Edit tour

Windows Analysis Report
09490699.exe

Overview

General Information

Sample Name:	09490699.exe
Analysis ID:	884770
MD5:	3aab057312f4f899b322f3f282eba2f3
SHA1:	53907d8c91acd85e53c058562a7f61e998bd9002
SHA256:	d69ab6b8780792026dc20e123afbb0e8eab342cbe19b705cb2e1e03d19551986
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

Sample is not signed and drops a device driver

Uses shutdown.exe to shutdown or reboot the system

Machine Learning detection for dropped file

Uses 32bit PE files

Creates files inside the driver directory

Yara signature match

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Creates driver files

Enables security privileges

Creates or modifies windows services

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

09490699.exe (PID: 7052 cmdline: C:\Users\user\Desktop\09490699.exe MD5: 3AAB057312F4F899B322F3F282EBA2F3)

conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7148 cmdline: C:\Windows\system32\cmd.exe /c net start "Hard-to-Destroy Reptile" MD5: F3BDBE3BB6F734E357235F4D5898582D)

net.exe (PID: 7132 cmdline: net start "Hard-to-Destroy Reptile" MD5: DD0561156F62BC1958CE0E370B23711B)

net1.exe (PID: 7124 cmdline: C:\Windows\system32\net1 start "Hard-to-Destroy Reptile" MD5: B5A26C2BF17222E86B91D26F1247AF3E)

09490699.exe (PID: 7108 cmdline: C:\Users\user\Desktop\09490699.exe MD5: 3AAB057312F4F899B322F3F282EBA2F3)

cmd.exe (PID: 5292 cmdline: C:\Windows\system32\cmd.exe /c 13.exe x -y 50 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

13.exe (PID: 6844 cmdline: 13.exe x -y 50 MD5: A42B35F975D88C1370A7AFF084EE57A7)

cmd.exe (PID: 5964 cmdline: C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0) MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dcinst.exe (PID: 5216 cmdline: dcinst.exe -setup MD5: FF5F598D99FD00F998FFA8DAC3BB620A)

shutdown.exe (PID: 3236 cmdline: shutdown -r -t 0 -f MD5: E2EB9CC0FE26E28406FB6F82F8E81B26)

conhost.exe (PID: 2740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Disgusting\dcrypt.sys	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$
C:\Disgusting\dccon.exe	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xb558:$s4: dc_get_mbr_config 0xb704:$s5: dc_encrypt_iso_image 0xb7bc:$s6: dc_start_re_encrypt 0xb5e6:$s7: dc_start_encrypt
C:\Disgusting\dcapi.dll	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt
C:\Windows\System32\drivers\dcrypt.sys	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x40358:$s4: dc_get_mbr_config 0x43114:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x40504:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x405bc:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt 0x403e6:$s7: dc_start_encrypt 0x6f5d8:$d1: \DosDevices\dcrypt 0x6f688:$d2: $dcsys$_fail_%x 0x6f668:$d3: %s\$DC_TRIM_%x$ 0x6f5b8:$d4: \Device\dcrypt 0x6f620:$d5: %s\$dcsys$

Unpacked PEs

Source	Rule	Description	Author	Strings
8.3.13.exe.1a50000.4.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x260ce:$s4: dc_get_mbr_config 0x25ff0:$s5: dc_encrypt_iso_image 0x26246:$s6: dc_start_re_encrypt 0x26225:$s7: dc_start_encrypt
8.3.13.exe.1d94200.2.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$
8.3.13.exe.1d94200.2.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2a1d8:$d1: \DosDevices\dcrypt 0x2a288:$d2: $dcsys$_fail_%x 0x2a268:$d3: %s\$DC_TRIM_%x$ 0x2a1b8:$d4: \Device\dcrypt 0x2a220:$d5: %s\$dcsys$
8.3.13.exe.1a94200.3.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$
8.3.13.exe.1a91c00.6.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x1514:$s4: dc_get_mbr_config 0x2d9d8:$d1: \DosDevices\dcrypt 0x2da88:$d2: $dcsys$_fail_%x 0x2da68:$d3: %s\$DC_TRIM_%x$ 0x2d9b8:$d4: \Device\dcrypt 0x2da20:$d5: %s\$dcsys$
8.3.13.exe.1a94200.3.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2a1d8:$d1: \DosDevices\dcrypt 0x2a288:$d2: $dcsys$_fail_%x 0x2a268:$d3: %s\$DC_TRIM_%x$ 0x2a1b8:$d4: \Device\dcrypt 0x2a220:$d5: %s\$dcsys$
8.3.13.exe.1d84e00.1.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xa158:$s4: dc_get_mbr_config 0xc114:$s4: dc_get_mbr_config 0xa304:$s5: dc_encrypt_iso_image 0xa3bc:$s6: dc_start_re_encrypt 0xa1e6:$s7: dc_start_encrypt
8.3.13.exe.1d91c00.0.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x1514:$s4: dc_get_mbr_config 0x2d9d8:$d1: \DosDevices\dcrypt 0x2da88:$d2: $dcsys$_fail_%x 0x2da68:$d3: %s\$DC_TRIM_%x$ 0x2d9b8:$d4: \Device\dcrypt 0x2da20:$d5: %s\$dcsys$
11.2.dcinst.exe.7ffd19af0000.1.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt
8.3.13.exe.1a84e00.5.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xa158:$s4: dc_get_mbr_config 0xc114:$s4: dc_get_mbr_config 0xa304:$s5: dc_encrypt_iso_image 0xa3bc:$s6: dc_start_re_encrypt 0xa1e6:$s7: dc_start_encrypt
8.3.13.exe.1a50000.4.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x40358:$s4: dc_get_mbr_config 0x43114:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x40504:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x405bc:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt 0x403e6:$s7: dc_start_encrypt 0x6f5d8:$d1: \DosDevices\dcrypt 0x6f688:$d2: $dcsys$_fail_%x 0x6f668:$d3: %s\$DC_TRIM_%x$ 0x6f5b8:$d4: \Device\dcrypt 0x6f620:$d5: %s\$dcsys$
8.3.13.exe.1a84e00.5.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xb558:$s4: dc_get_mbr_config 0xe314:$s4: dc_get_mbr_config 0xb704:$s5: dc_encrypt_iso_image 0xb7bc:$s6: dc_start_re_encrypt 0xb5e6:$s7: dc_start_encrypt 0x3a7d8:$d1: \DosDevices\dcrypt 0x3a888:$d2: $dcsys$_fail_%x 0x3a868:$d3: %s\$DC_TRIM_%x$ 0x3a7b8:$d4: \Device\dcrypt 0x3a820:$d5: %s\$dcsys$
8.3.13.exe.1d84e00.1.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xb558:$s4: dc_get_mbr_config 0xe314:$s4: dc_get_mbr_config 0xb704:$s5: dc_encrypt_iso_image 0xb7bc:$s6: dc_start_re_encrypt 0xb5e6:$s7: dc_start_encrypt 0x3a7d8:$d1: \DosDevices\dcrypt 0x3a888:$d2: $dcsys$_fail_%x 0x3a868:$d3: %s\$DC_TRIM_%x$ 0x3a7b8:$d4: \Device\dcrypt 0x3a820:$d5: %s\$dcsys$
Click to see the 8 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 09490699.exe	ReversingLabs: Detection: 54%
Source: 09490699.exe	Virustotal: Detection: 71%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: 09490699.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Disgusting\dcapi.dll

Virustotal: Detection: 8%

Perma Link

Machine Learning detection for dropped file

Source: C:\Disgusting\dcapi.dll

Joe Sandbox ML: detected

Source: 09490699.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source:

Binary string: dcrypt.pdb source: 13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr

Source: C:\Disgusting\13.exe	Code function: 8_2_010D58CD __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,		8_2_010D58CD
Source: C:\Disgusting\13.exe	Code function: 8_2_010D765C FindFirstFileW,		8_2_010D765C

Source: C:\Disgusting\13.exe

Code function: 8_2_010D6306 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,

8_2_010D6306

Source: 13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmp, dcinst.exe, 0000000B.00000002.480828119.00007FFD19B1C000.00000002.00000001.01000000.00000007.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr, dcapi.dll.8.dr, dccon.exe.8.dr, dcinst.exe.8.dr	String found in binary or memory: http://diskcryptor.net/
Source: 09490699.exe	String found in binary or memory: http://gcc.gnu.org/bugs.html):
Source: 13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07

Source: 09490699.exe, 00000000.00000002.482350262.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.3.13.exe.1a50000.4.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1d94200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1d94200.2.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1a94200.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1a91c00.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1a94200.3.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1d84e00.1.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1d91c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 11.2.dcinst.exe.7ffd19af0000.1.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1a84e00.5.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1a50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1a84e00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 8.3.13.exe.1d84e00.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Disgusting\dcrypt.sys, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Disgusting\dccon.exe, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Disgusting\dcapi.dll, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Windows\System32\drivers\dcrypt.sys, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Users\user\Desktop\09490699.exe

Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 0 -f

Source: 09490699.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Disgusting\dcinst.exe

File created: C:\Windows\system32\drivers\dcrypt.sys

Jump to behavior

Source: 8.3.13.exe.1a50000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1d94200.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1d94200.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1a94200.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1a91c00.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1a94200.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1d84e00.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1d91c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 11.2.dcinst.exe.7ffd19af0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1a84e00.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1a50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1a84e00.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 8.3.13.exe.1d84e00.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Disgusting\dcrypt.sys, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Disgusting\dccon.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Disgusting\dcapi.dll, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Windows\System32\drivers\dcrypt.sys, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions

Source: C:\Disgusting\dcinst.exe

File created: C:\Windows\system32\drivers\dcrypt.sys

Jump to behavior

Source: C:\Users\user\Desktop\09490699.exe	Code function: 0_2_0042CA80	0_2_0042CA80
Source: C:\Disgusting\13.exe	Code function: 8_2_010D826A	8_2_010D826A
Source: C:\Disgusting\13.exe	Code function: 8_2_010F4C61	8_2_010F4C61
Source: C:\Disgusting\13.exe	Code function: 8_2_010D1574	8_2_010D1574
Source: C:\Disgusting\13.exe	Code function: 8_2_010D176C	8_2_010D176C
Source: C:\Disgusting\13.exe	Code function: 8_2_010E384C	8_2_010E384C
Source: C:\Disgusting\13.exe	Code function: 8_2_010E5BB2	8_2_010E5BB2
Source: C:\Disgusting\13.exe	Code function: 8_2_01103F01	8_2_01103F01
Source: C:\Disgusting\13.exe	Code function: 8_2_01103FDB	8_2_01103FDB
Source: C:\Disgusting\dcinst.exe	Code function: 11_2_00007FFD19AF1110	11_2_00007FFD19AF1110
Source: C:\Disgusting\dcinst.exe	Code function: 11_2_00007FFD19AF1AE0	11_2_00007FFD19AF1AE0

Source: C:\Disgusting\13.exe	Code function: String function: 010D1ABD appears 92 times
Source: C:\Disgusting\13.exe	Code function: String function: 011039E0 appears 386 times
Source: C:\Users\user\Desktop\09490699.exe	Code function: String function: 0042CC10 appears 36 times
Source: C:\Users\user\Desktop\09490699.exe	Code function: String function: 0043BBA0 appears 118 times

Source: C:\Disgusting\13.exe

Code function: 8_2_010D66D0: DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,

8_2_010D66D0

Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: 7-zip archive data, version 0.4
Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: 7-zip archive data, version 0.4

Source: 09490699.exe, 00000000.00000000.473410496.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 09490699.exe
Source: 09490699.exe, 00000000.00000000.473410496.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe, 00000000.00000000.473410496.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe, 00000000.00000000.473410496.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe
Source: 09490699.exe, 00000005.00000003.481604552.0000000001452000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe, 00000005.00000003.481604552.0000000001452000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe, 00000005.00000003.481604552.0000000001452000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe
Source: 09490699.exe, 00000005.00000003.476696902.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 09490699.exe
Source: 09490699.exe, 00000005.00000002.482156691.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 09490699.exe
Source: 09490699.exe, 00000005.00000002.482156691.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe, 00000005.00000002.482156691.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe, 00000005.00000002.482156691.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe
Source: 09490699.exe, 00000005.00000003.476883450.0000000001335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe, 00000005.00000003.476883450.0000000001335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe, 00000005.00000003.476883450.0000000001335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe
Source: 09490699.exe	Binary or memory string: OriginalFilename7z.exe, vs 09490699.exe
Source: 09490699.exe	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe

Source: C:\Disgusting\13.exe

File created: C:\Disgusting\dcrypt.sys

Jump to behavior

Source: C:\Disgusting\13.exe

Process token adjusted: Security

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Disgusting\13.exe 56CC9E7E3767C0CFFAE8161BF0AD13457487C1B422E2879B897DBD4BAB115776

Source: 09490699.exe	ReversingLabs: Detection: 54%
Source: 09490699.exe	Virustotal: Detection: 71%

Source: 09490699.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\09490699.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\09490699.exe C:\Users\user\Desktop\09490699.exe
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net start "Hard-to-Destroy Reptile"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net start "Hard-to-Destroy Reptile"
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 start "Hard-to-Destroy Reptile"
Source: unknown	Process created: C:\Users\user\Desktop\09490699.exe C:\Users\user\Desktop\09490699.exe
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 13.exe x -y 50
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Disgusting\13.exe 13.exe x -y 50
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Disgusting\dcinst.exe dcinst.exe -setup
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 0 -f
Source: C:\Windows\SysWOW64\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net start "Hard-to-Destroy Reptile"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net start "Hard-to-Destroy Reptile"	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 start "Hard-to-Destroy Reptile"	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 13.exe x -y 50	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Disgusting\dcinst.exe dcinst.exe -setup	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 0 -f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Disgusting\13.exe 13.exe x -y 50	Jump to behavior

Source: C:\Disgusting\13.exe	Code function: 8_2_010DD4F9 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		8_2_010DD4F9
Source: C:\Disgusting\13.exe	Code function: 8_2_010D7EB5 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		8_2_010D7EB5

Source: dcrypt.sys.8.dr

Binary string: configFlags\Device\dcrypt\DosDevices\dcryptdump_hiber_%s\$dcsys$$dcsys$\Device\CdRom%s\$DC_TRIM_%x$$dcsys$_fail_%xNTFSFATFAT32exFATRSDS

Source: classification engine

Classification label: mal84.rans.winEXE@22/8@0/0

Source: C:\Users\user\Desktop\09490699.exe

Code function: StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

0_2_00401770

Source: C:\Disgusting\13.exe

Code function: 8_2_010D7DF4 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,

8_2_010D7DF4

Source: C:\Users\user\Desktop\09490699.exe

Code function: 0_2_00401770 StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

0_2_00401770

Source: C:\Users\user\Desktop\09490699.exe

Code function: 0_2_00401770 StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

0_2_00401770

Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-mtx_pthr_locked_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-mutex_global_shmem
Source: C:\Disgusting\dcinst.exe	Mutant created: \BaseNamedObjects\DISKCRYPTOR_MUTEX
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mtx_pthr_locked_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-mutex_global_static_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-pthr_root_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-fc_key
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_max_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-sjlj_once
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mxattr_recursive_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-_pthread_tls_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idListMax_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-rwl_global_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-idList_shmem
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7044:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idList_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-idListCnt_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-fc_key
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-pthr_last_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mutex_global_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-use_fc_key
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_dest_shmem
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3504:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-idListNextId_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_max_shmem
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2740:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_lock_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_tls_once_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_sch_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-pthr_root_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-global_lock_spinlock
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4536:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-idListMax_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-rwl_global_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-cond_locked_shmem_rwlock
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idListCnt_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_sch_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mutex_global_static_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-use_fc_key
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-once_global_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_lock_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-_pthread_tls_once_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-sjlj_once
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-once_obj_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-once_obj_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_tls_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idListNextId_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-global_lock_spinlock
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-mxattr_recursive_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_dest_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \Sessions\1\BaseNamedObjects\gcc-shmem-tdm2-cond_locked_shmem_rwlock
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-once_global_shmem

Source: 09490699.exe	String found in binary or memory: -help
Source: 09490699.exe	String found in binary or memory: Check charset encoding and -scs switch.Cannot find listfilebsobbbtbdba-helph?asut012sea0-pstlsdelsntsncsnrsnssnisnlsnhspfspespdsasscssesswsltsccscsslpsosiscrcsemlsfxstmrvuanaxaiiwstxtaoadybspbseUnsupported switch postfix for -slp-Unsupported switch postfix -stmSeLockMemoryPrivilegeUnsupported switch postfix -bbSeCreateSymbolicLinkPrivilegeSeRestorePrivilegeIncorrect Number of benmchmark iterationsOnly one archive can be created with rename commandstdout mode and email mode cannot be combined-ai switch is not supported for this commandCannot use absolute pathnames for this commandArchive name cannot by emptyCannot find archive nameUnsupported -spf:2Unsupported command:The command must be specifiedThere is no second file name for rename pair:Unsupported rename command:-r0-rThe file operation error for listfileIncorrect wildcard type markerToo short switchUnsupported Map data sizeMap data errorUnsupported Map dataMapViewOfFile errorCan not open mappingIncorrect volume size:incorrect update switch commandUnsupported charset:

Source: 09490699.exe

Static file information: File size 4408320 > 1048576

Source: 09490699.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x336c00

Source:

Source: C:\Disgusting\13.exe	Code function: 8_2_01103510 push ecx; mov dword ptr [esp], ecx	8_2_01103511
Source: C:\Disgusting\13.exe	Code function: 8_2_011039E0 push eax; ret	8_2_011039FE
Source: C:\Disgusting\13.exe	Code function: 8_2_01103D80 push eax; ret	8_2_01103DAE

Source: 09490699.exe	Static PE information: section name: .eh_fram
Source: 13.exe.5.dr	Static PE information: section name: .sxdata
Source: 7z.dll.5.dr	Static PE information: section name: .sxdata

Source: C:\Disgusting\13.exe

Code function: 8_2_01100A10 GetCurrentProcess,GetProcessTimes,fputs,memset,GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,fputs,__aulldiv,fputs,

8_2_01100A10

Source: 7z.dll.5.dr	Static PE information: real checksum: 0x0 should be: 0x120ccb
Source: 09490699.exe	Static PE information: real checksum: 0x2a89dd should be: 0x43467b
Source: dcapi.dll.8.dr	Static PE information: real checksum: 0x0 should be: 0x3c1d0
Source: 13.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x48a12

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcrypt.sys			Jump to behavior
Source: C:\Disgusting\dcinst.exe	File created: C:\Windows\system32\drivers\dcrypt.sys			Jump to behavior

Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcapi.dll	Jump to dropped file
Source: C:\Disgusting\dcinst.exe	File created: C:\Windows\System32\drivers\dcrypt.sys	Jump to dropped file
Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcinst.exe	Jump to dropped file
Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dccon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\09490699.exe	File created: C:\Disgusting\13.exe	Jump to dropped file
Source: C:\Users\user\Desktop\09490699.exe	File created: C:\Disgusting\7z.dll	Jump to dropped file
Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcrypt.sys	Jump to dropped file

Source: C:\Disgusting\dcinst.exe

File created: C:\Windows\System32\drivers\dcrypt.sys

Jump to dropped file

Source: C:\Disgusting\dcinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dcrypt\Instances

Jump to behavior

Source: C:\Users\user\Desktop\09490699.exe

Code function: 0_2_00401770 StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

0_2_00401770

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\net1.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Disgusting\dcinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\dcrypt.sys	Jump to dropped file
Source: C:\Disgusting\13.exe	Dropped PE file which has not been started: C:\Disgusting\dccon.exe	Jump to dropped file
Source: C:\Disgusting\13.exe	Dropped PE file which has not been started: C:\Disgusting\dcrypt.sys	Jump to dropped file

Source: C:\Disgusting\13.exe

Code function: 8_2_010D8623 GetSystemInfo,

8_2_010D8623

Source: C:\Disgusting\13.exe	Code function: 8_2_010D58CD __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,		8_2_010D58CD
Source: C:\Disgusting\13.exe	Code function: 8_2_010D765C FindFirstFileW,		8_2_010D765C

Source: C:\Disgusting\13.exe

Code function: 8_2_010D6306 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,

8_2_010D6306

Source: C:\Disgusting\13.exe

8_2_01100A10

Source: C:\Users\user\Desktop\09490699.exe	Code function: 0_2_00401000 SetUnhandledExceptionFilter,__getmainargs,_iob,_setmode,_setmode,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,	0_2_00401000
Source: C:\Disgusting\dcinst.exe	Code function: 11_2_00007FF7BB95178C SetUnhandledExceptionFilter,	11_2_00007FF7BB95178C
Source: C:\Disgusting\dcinst.exe	Code function: 11_2_00007FF7BB951290 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF7BB951290

Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net start "Hard-to-Destroy Reptile"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net start "Hard-to-Destroy Reptile"	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 start "Hard-to-Destroy Reptile"	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 13.exe x -y 50	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Disgusting\13.exe 13.exe x -y 50	Jump to behavior

Source: C:\Disgusting\dcinst.exe

Code function: 11_2_00007FFD19AF8260 cpuid

11_2_00007FFD19AF8260

Source: C:\Disgusting\13.exe

Code function: 8_2_010D877D GetSystemTimeAsFileTime,

8_2_010D877D

Source: C:\Disgusting\13.exe

Code function: 8_2_011015C3 GetVersionExW,

8_2_011015C3

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	23 Windows Service	1 Access Token Manipulation	3 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Service Execution	Boot or Logon Initialization Scripts	23 Windows Service	1 Access Token Manipulation	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Native API	Logon Script (Windows)	11 Process Injection	11 Process Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
09490699.exe	54%	ReversingLabs	Win32.Ransomware.Avaddon
09490699.exe	72%	Virustotal		Browse
09490699.exe	100%	Avira	TR/ATRAPS.Gen

Dropped Files

Source	Detection	Scanner	Link
C:\Disgusting\dcapi.dll	100%	Joe Sandbox ML
C:\Disgusting\13.exe	0%	ReversingLabs
C:\Disgusting\13.exe	0%	Virustotal	Browse
C:\Disgusting\7z.dll	0%	ReversingLabs
C:\Disgusting\7z.dll	0%	Virustotal	Browse
C:\Disgusting\dcapi.dll	0%	ReversingLabs
C:\Disgusting\dcapi.dll	9%	Virustotal	Browse
C:\Disgusting\dccon.exe	0%	ReversingLabs
C:\Disgusting\dccon.exe	7%	Virustotal	Browse
C:\Disgusting\dcinst.exe	0%	ReversingLabs
C:\Disgusting\dcinst.exe	1%	Virustotal	Browse
C:\Disgusting\dcrypt.sys	0%	ReversingLabs
C:\Windows\System32\drivers\dcrypt.sys	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://diskcryptor.net/	13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmp, dcinst.exe, 0000000B.00000002.480828119.00007FFD19B1C000.00000002.00000001.01000000.00000007.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr, dcapi.dll.8.dr, dccon.exe.8.dr, dcinst.exe.8.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr	false		high
http://gcc.gnu.org/bugs.html):	09490699.exe	false		high
http://ocsp.thawte.com0	13.exe, 00000008.00000003.478722448.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000B.00000003.480293414.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.11.dr, dcrypt.sys.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	884770
Start date and time:	2023-06-09 09:54:25 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	09490699.exe
Detection:	MAL
Classification:	mal84.rans.winEXE@22/8@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 96.1% (good quality ratio 76.7%) Quality average: 72.3% Quality standard deviation: 39.7%
HCA Information:	Successful, ratio: 75% Number of executed functions: 66 Number of non-executed functions: 119
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Disgusting\13.exe	bigcos.exe	Get hash	malicious	Unknown	Browse
	SyncroInstaller.msi	Get hash	malicious	Unknown	Browse
	update.exe	Get hash	malicious	Unknown	Browse
	https://chocolatey.org/install.ps1	Get hash	malicious		Browse

Created / dropped Files

C:\Disgusting\13.exe

Download File

Process:	C:\Users\user\Desktop\09490699.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	6.5071152934174465
Encrypted:	false
SSDEEP:	6144:bW+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1T:bW+Dfhg0cvd5JIDvTJw1
MD5:	A42B35F975D88C1370A7AFF084EE57A7
SHA1:	BEE1408FE0B15F6F719F003E46AEE5EC424CF608
SHA-256:	56CC9E7E3767C0CFFAE8161BF0AD13457487C1B422E2879B897DBD4BAB115776
SHA-512:	B92D05515E18277DB660118934E70678EE2A3BB66005BAD19BB417FFAEDB22A63727A5A697CA3AC0F6C48F6F5593BA45AB80F4EBDC0EAED10D80B7AF04D45B23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: bigcos.exe, Detection: malicious, Browse Filename: SyncroInstaller.msi, Detection: malicious, Browse Filename: update.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3...R..R..R...N..R...M..R...N..R...M..R...M..R...Z..R..R...R...Z..R..t...R...9.R.....R..VT..R..Rich.R..........................PE..L....l(\.................l...".......=............@.......................................@..................................-..x...............................L-...................................................................................text....k.......l.................. ..`.rdata..\|............p..............@..@.data...P'...@.......*..............@....sxdata......p.......0..............@....rsrc................2..............@..@.reloc...5.......6...:..............@..B................................................................................................................................................................................................................................................

C:\Disgusting\50

Download File

Process:	C:\Users\user\Desktop\09490699.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	130091
Entropy (8bit):	7.998606242544185
Encrypted:	true
SSDEEP:	3072:/feZayma19aVY/WRQVtEDPQQNleebsd4Qeg52RyTYHfgJ:/GJ9aafKDPpHtQe+W/4J
MD5:	17001C4B91CCFAE0D737F2D368566541
SHA1:	29609A5B3E73D86000093282B0EC8EC33F027393
SHA-256:	11E5B46BB38E0DBED53DE6BB67F777A5CB57F81F2011A14A55BD2BB25644F569
SHA-512:	CE16012ABD13BCA5610006676A41B7F090FD1DDA9E538D01B05FE82FEB0DD39D36F4309540B511F9EE52654AF5E1C5F358BC735C01E4E6320D95639C5C910671
Malicious:	false
Preview:	7z..'.....A[........$..........O..r..].&..p.........../D.N....LE .f...E..g]].. ..j5}.5...lX..^.c>1".B...;..8............g.c.f......h8F.z."......,...ik;.....T...o.`gq79h.H.8....Tf..V6:,.6%De..Qc\=.m.y.w=.....H...o..}u;5.......6$/.'.<.\~..H.89...S....F..L....x.eKb...._P9..sQ.{.S........A...nz.e;..J./....v.%7....ae.....\.\|S......J.1.U....+.48.D~..e.F...D.p.2%.....uz..fH.j..M@.U.........`.....Xb..2..D3c..'ddbt..Yl\i........A.!H]...}}..1'.a...\.....^pC...6"O.....<U.H...9/....2=VG..(7..]...C8.1...b..`S_...`..{.2w....A~{../!.....@...FS#+ZN.W..M-.....<.4..O\!.`.s..?..].@..k.3..:..R..t.....i.b..=....p.^.{.....%...E1l.+?..SK.[....M..+.......v.. ....`^v.{n...v..H.u..Y......!t..S....-..ic8.i..(=.F>..."L1...J.as...F..:~]O....?V.ki...g.*....0K.P..t.L.(#.........=..9..7..DJ.Z...rb.T.e........p+...O.\._..qJp.&H.....y..d.......HW..!N.T...c>.....[.2....=.3.4.!..=%A....I..X.B.~.c.tf%..i...~7..Ls"../......2.5&.q.b..QfY..ck...).b...W...n&M...?.Iyudv..L...g..4._.

C:\Disgusting\7z.dll

Download File

Process:	C:\Users\user\Desktop\09490699.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1140224
Entropy (8bit):	6.5968192524219535
Encrypted:	false
SSDEEP:	24576:0z+JvxNkWnteez2uuj6FKpCdouNOkiTONXrnl+A4wrvL4/kUjhB9:06JvbrnFz2uuj6FKpHuzXrn8A9zLIkUx
MD5:	8915C81B1DA3F8E9AC6D9CB7F9B7C105
SHA1:	4F9F117EAB2E75DF3C2CD85BBAD307D58990657D
SHA-256:	92F6E97C9177361EE5425826585E6E4470052A36BB4E0D0E8667E83B41652C2F
SHA-512:	8F4440FC3028A16F76DEEE8B14BAB3E973BC4E66E9CEFA0FB862D3C010465AE0D1D1A592B6F97D18F4FA123379D85D6C15081F67A8383EB19D96FB84771FDBB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.2Y.w\..w\..w\..hW..w\..kR..w\..hV..w\..hX..w\......w\..w].pw\......w\.&QW..w\.&QV..w\.....5w\......w\..qZ..w\..WX..w\.Rich.w\.................PE..L....l(\...........!.....~...f............................................... ............@..........................`..y....Y..d........{......................T{......................................................T............................text...E}.......~.................. ..`.rdata..y...........................@..@.data........p.......T..............@....sxdata..............Z..............@....rsrc....{.......\|...\..............@..@.reloc.............................@..B................................................................................................................................................................................................................................................

C:\Disgusting\dcapi.dll

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	216576
Entropy (8bit):	6.51676035376353
Encrypted:	false
SSDEEP:	6144:4JOXgVvT/irENNWTnNUFpn7qqDLKNVnnIl:Bs/uEZpn2qnknn8
MD5:	6299E7F901517D7167D3AFF5FA66A30B
SHA1:	69E4D05A36E2E925050A72D532CCE0DA3091BF8C
SHA-256:	8688EA09E4B59A50C983FF9A27AB4476AB0498C504B227C58A5AFC3713BFDAB2
SHA-512:	CF1F4AEA47B6B192F44849503C681787C24711FE1A8293B7D68150654A37CB9ADFE0D469CB5721251C080A9AC8C784541AAD53CEA5AAD25EFD8DAE7DCF97F862
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Disgusting\dcapi.dll, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 9%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.+.`.E.`.E.`.E.i..b.E.i..X.E.i...o.E.`.E.f.E.i..k.E.`.D..E.GZ;.a.E.{..q.E.{..a.E.{..a.E.{..a.E.Rich`.E.................PE..d...K^I\.........." .........j......8.....................................................@.........................................P........z..x.......p.......\............p..(.......................................................(............................text............................... ..`.rdata../...........................@..@.data...D+.......&...z..............@....pdata..\...........................@..@.rsrc...p...........................@..@.reloc.......p.......L..............@..B................................................................................................................................................................................................................................................

C:\Disgusting\dccon.exe

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	5.099019509484504
Encrypted:	false
SSDEEP:	768:PTwGmjUhT/a6JY4Xt0O9RJ6ChvYZFAURaIfCG7YGdDqxr0AT1QiQNkS2qg70H+XC:LwGra6J9SgJlhuHqxr0Rigg708I
MD5:	6739716D534E3867C5E5121FAAFD2F47
SHA1:	6C54A6F93F4DDBA093684E6EFB0368C5D8330DB1
SHA-256:	1EEAC62E1903C9E1F1F20837A89881F4386778F54752419AAD90F89A8CA49F64
SHA-512:	80973C8AA52A688813B937FF174DA9B5178564455FF8F723C691E404A924EF2B9854A397E77F99FCE3FD5063092DC059812697FA36400A4485A7BFFBCF623533
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Disgusting\dccon.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#..#..#..[f..#..[p..#..[w..#..[`..#..o..#..#.e#....#..]..#..i..#..n..#.Rich.#.................PE..d...[^I\.........."......H.....................@.............................@............@.................................................0...P.... ..0....................0.......................................................`..x............................text....G.......H.................. ..`.rdata..>p...`...r...L..............@..@.data...4/..........................@....pdata..............................@..@.rsrc...0.... ......................@..@.reloc..D....0......................@..B........................................................................................................................................................................................................................................................

C:\Disgusting\dcinst.exe

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.992172592669664
Encrypted:	false
SSDEEP:	192:85asM53R9ePzCJE+1jNH8Hmi/+bZMziIb/9JjlL:0i9NE+DQ+Q/RJ
MD5:	FF5F598D99FD00F998FFA8DAC3BB620A
SHA1:	4B2210A64025EC0E3EC74990A4433D28A22ABB37
SHA-256:	F2A45D08FE2B4CFF2D68C1AD2C204EC221428230F98D250B612EB0F27D92A636
SHA-512:	8D7DC9ECB18CDFDBD5DA947E25B781C96E1D9A65BCF423958D73AFFAFEBA09340B5A7F193269BA6ABF0D92875702AA0DFEA34636E9FB4C7349C52954BD5522C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.............Q......G.,....@......W......X.......v..4C.......n......^......Y....Rich...........PE..d...L^I\.........."............................@.............................p...... .....@................................................. #..P....P..H....@...............`....................................................... ..h............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...H....P......................@..@.reloc..h....`.......$..............@..B................................................................................................................................................................................................................................................................

C:\Disgusting\dcrypt.sys

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210632
Entropy (8bit):	6.677691827536191
Encrypted:	false
SSDEEP:	3072:zCBsPmcx7BTn/irEsrDUxo2vYsWwYEJOXKVviEWuwlVBgzUMqqDLW+z3AHW5:8sPnBT/irETNWiJOXKVvKBgz3qqDL1zt
MD5:	EDB72F4A46C39452D1A5414F7D26454A
SHA1:	08F94684E83A27F2414F439975B7F8A6D61FC056
SHA-256:	0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6
SHA-512:	D62A19436ABA8B2D181C065076B4AB54D7D8159D71237F83F1AFF8C3D132A80290AF39A8142708ACB468D78958C64F338BA6AD0CAB9FBAC001A6A0BDDC0E4FAA
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Disgusting\dcrypt.sys, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~...~..~.....w.~..x...~..x....~..#...~..#....~..#....~.Rich..~.................PE..d...9.S.........."......\...........0.......................................p............. .................................................0..P....P....... ...............`..t...0d...............................................`..(............................text...WI.......J.................. ..h.rdata...\|...`...~...N..............@..H.data....0......."..................@....pdata....... ......................@..HINIT.........0...................... ....rsrc........P......................@..B.reloc..L....`......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\drivers\dcrypt.sys

Download File

Process:	C:\Disgusting\dcinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210632
Entropy (8bit):	6.677691827536191
Encrypted:	false
SSDEEP:	3072:zCBsPmcx7BTn/irEsrDUxo2vYsWwYEJOXKVviEWuwlVBgzUMqqDLW+z3AHW5:8sPnBT/irETNWiJOXKVvKBgz3qqDL1zt
MD5:	EDB72F4A46C39452D1A5414F7D26454A
SHA1:	08F94684E83A27F2414F439975B7F8A6D61FC056
SHA-256:	0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6
SHA-512:	D62A19436ABA8B2D181C065076B4AB54D7D8159D71237F83F1AFF8C3D132A80290AF39A8142708ACB468D78958C64F338BA6AD0CAB9FBAC001A6A0BDDC0E4FAA
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Windows\System32\drivers\dcrypt.sys, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~...~..~.....w.~..x...~..x....~..#...~..#....~..#....~.Rich..~.................PE..d...9.S.........."......\...........0.......................................p............. .................................................0..P....P....... ...............`..t...0d...............................................`..(............................text...WI.......J.................. ..h.rdata...\|...`...~...N..............@..H.data....0......."..................@....pdata....... ......................@..HINIT.........0...................... ....rsrc........P......................@..B.reloc..L....`......................@..B........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.838942362048295
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	09490699.exe
File size:	4408320
MD5:	3aab057312f4f899b322f3f282eba2f3
SHA1:	53907d8c91acd85e53c058562a7f61e998bd9002
SHA256:	d69ab6b8780792026dc20e123afbb0e8eab342cbe19b705cb2e1e03d19551986
SHA512:	fc0a9d718e0d6a7e2f03add1ec9511d38c9d13a7ed10afa974f63d7db8ff09e1a6b79f0a6e025d15a1993451d93177932fa5b6868a9f886324d71af040b128d5
SSDEEP:	98304:l7uFXK3RGjr6hbrFjuj6gOzZPuGjr6hbrFjuj6gOzZP:lIK3Q36tpjuj6gYP736tpjuj6gYP
TLSH:	3516AF11F7B2C4B4C98705714A1AFBF650B4E72D88209CD7A7C4EE5DAF32CD2D129A1A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H........................@C..$................@...........................C.......*....... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401280
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x2A68A48 [Sun May 30 16:26:48 1971 UTC]
TLS Callbacks:	0x42b0f0, 0x42b0a0, 0x437240
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f0668a314ba5d4392ffaa4e2d7f980ef

Entrypoint Preview

Instruction
sub esp, 1Ch
mov dword ptr [esp], 00000001h
call dword ptr [00502438h]
call 00007FB0E476C820h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
sub esp, 1Ch
mov dword ptr [esp], 00000002h
call dword ptr [00502438h]
call 00007FB0E476C800h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
mov eax, dword ptr [0050247Ch]
jmp eax
mov esi, esi
lea edi, dword ptr [edi+00000000h]
mov eax, dword ptr [00502464h]
jmp eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [004EE5D0h]
test eax, eax
je 00007FB0E476CAECh
mov dword ptr [esp], 004EF000h
call 00007FB0E47A894Ah
sub esp, 04h
test eax, eax
mov edx, 00000000h
je 00007FB0E476CAC7h
mov dword ptr [esp+04h], 004EF00Eh
mov dword ptr [esp], eax
call 00007FB0E47A8936h
sub esp, 08h
mov edx, eax
test edx, edx
je 00007FB0E476CABBh
mov dword ptr [esp], 004EE5D0h
call edx
mov dword ptr [esp], 00401340h
call 00007FB0E476CA40h
leave
ret
mov esi, esi
lea edi, dword ptr [edi+00000000h]
push ebp
mov ebp, esp
pop ebp
ret
nop
nop

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x102000	0x1110	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x106000	0x336bb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x105004	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1022e0	0x27c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xec20c	0xec400	False	0.35927579365079365	data	6.187435097107904	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xee000	0x5d4	0x600	False	0.2688802083333333	DOS executable (block device driver)	2.660500415480139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xef000	0xda34	0xdc00	False	0.29380326704545456	data	5.577006554493379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0xfd000	0x1650	0x1800	False	0.3333333333333333	data	4.695360378922919	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xff000	0x2340	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x102000	0x1110	0x1200	False	0.3682725694444444	data	5.1934125537168745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x104000	0x1c	0x200	False	0.05078125	data	0.1755262916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x105000	0x20	0x200	False	0.05859375	data	0.21405875520435458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x106000	0x336bb0	0x336c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type
RT_RCDATA	0x106118	0x3b6	JSON data
RT_RCDATA	0x1064ce	0x47000	PE32 executable (console) Intel 80386, for MS Windows
RT_RCDATA	0x14d4ce	0x116600	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
RT_RCDATA	0x263ace	0x1ded9	7-zip archive data, version 0.4
RT_RCDATA	0x2819a7	0x1fc2b	7-zip archive data, version 0.4

Imports

DLL	Import
ADVAPI32.DLL	CloseServiceHandle, CreateServiceW, DeleteService, OpenSCManagerW, OpenServiceW, RegisterServiceCtrlHandlerW, SetServiceStatus, StartServiceCtrlDispatcherW
KERNEL32.dll	AddAtomA, CloseHandle, CreateDirectoryW, CreateEventA, CreateEventW, CreateMutexA, CreateProcessA, CreateProcessW, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FindResourceW, GetAtomNameA, GetCommandLineA, GetCurrentProcess, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetStartupInfoA, GetSystemDirectoryW, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, InitializeCriticalSection, InterlockedDecrement, InterlockedExchange, InterlockedExchangeAdd, InterlockedIncrement, IsDBCSLeadByteEx, LeaveCriticalSection, LoadResource, LockResource, MultiByteToWideChar, ReleaseMutex, ReleaseSemaphore, ResetEvent, ResumeThread, SetCriticalSectionSpinCount, SetCurrentDirectoryW, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	_fdopen, _pclose, _popen, _read, _write
msvcrt.dll	__getmainargs, __mb_cur_max, __p__environ, __p__fmode, __set_app_type, _assert, _beginthreadex, _cexit, _endthreadex, _errno, _filelengthi64, _fstati64, _iob, _isctype, _lseeki64, _onexit, _pctype, _setjmp, _setmode, _vsnwprintf, abort, atexit, atoi, calloc, exit, fclose, fflush, fgetpos, fgets, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getenv, getwc, iswctype, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, putc, putwc, realloc, setlocale, setvbuf, signal, sprintf, strchr, strcmp, strcoll, strerror, strftime, strlen, strtod, strtoul, strxfrm, system, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 09490699.exePID: 7052, Parent PID: 3452

General

Target ID:	0
Start time:	09:55:20
Start date:	09/06/2023
Path:	C:\Users\user\Desktop\09490699.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\09490699.exe
Imagebase:	0x400000
File size:	4408320 bytes
MD5 hash:	3AAB057312F4F899B322F3F282EBA2F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7044, Parent PID: 7052

General

Target ID:	1
Start time:	09:55:21
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7148, Parent PID: 7052

General

Target ID:	2
Start time:	09:55:21
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c net start "Hard-to-Destroy Reptile"
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: net.exePID: 7132, Parent PID: 7148

General

Target ID:	3
Start time:	09:55:21
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net start "Hard-to-Destroy Reptile"
Imagebase:	0x930000
File size:	46592 bytes
MD5 hash:	DD0561156F62BC1958CE0E370B23711B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: net1.exePID: 7124, Parent PID: 7132

General

Target ID:	4
Start time:	09:55:21
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 start "Hard-to-Destroy Reptile"
Imagebase:	0xd10000
File size:	141312 bytes
MD5 hash:	B5A26C2BF17222E86B91D26F1247AF3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: 09490699.exePID: 7108, Parent PID: 576

General

Target ID:	5
Start time:	09:55:21
Start date:	09/06/2023
Path:	C:\Users\user\Desktop\09490699.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\09490699.exe
Imagebase:	0x400000
File size:	4408320 bytes
MD5 hash:	3AAB057312F4F899B322F3F282EBA2F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5292, Parent PID: 7108

General

Target ID:	6
Start time:	09:55:22
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c 13.exe x -y 50
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4536, Parent PID: 5292

General

Target ID:	7
Start time:	09:55:22
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: 13.exePID: 6844, Parent PID: 5292

General

Target ID:	8
Start time:	09:55:23
Start date:	09/06/2023
Path:	C:\Disgusting\13.exe
Wow64 process (32bit):	true
Commandline:	13.exe x -y 50
Imagebase:	0x10d0000
File size:	290816 bytes
MD5 hash:	A42B35F975D88C1370A7AFF084EE57A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: 00000008.00000003.478810572.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5964, Parent PID: 7108

General

Target ID:	9
Start time:	09:55:23
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3504, Parent PID: 5964

General

Target ID:	10
Start time:	09:55:23
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: dcinst.exePID: 5216, Parent PID: 7108

General

Target ID:	11
Start time:	09:55:24
Start date:	09/06/2023
Path:	C:\Disgusting\dcinst.exe
Wow64 process (32bit):	false
Commandline:	dcinst.exe -setup
Imagebase:	0x7ff7bb950000
File size:	9728 bytes
MD5 hash:	FF5F598D99FD00F998FFA8DAC3BB620A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse

Show Windows behavior

Chronological Activities

Analysis Process: shutdown.exePID: 3236, Parent PID: 7108

General

Target ID:	12
Start time:	09:55:24
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	shutdown -r -t 0 -f
Imagebase:	0xd50000
File size:	23552 bytes
MD5 hash:	E2EB9CC0FE26E28406FB6F82F8E81B26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2740, Parent PID: 3236

General

Target ID:	13
Start time:	09:55:24
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 09490699.exePID: 7052, Parent PID: 3452COMMON

Executed Functions

Function 00401770 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 226
serviceCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E00401770(void* _a4) {
				void* _v8;
				char _v12;
				char _v534;
				signed int _v552;
				signed int _v556;
				char* _v560;
				char _v576;
				short* _v580;
				short* _v584;
				short* _v588;
				short* _v592;
				intOrPtr _v596;
				char _v600;
				signed int _v604;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				wchar_t* _v648;
				intOrPtr _v652;
				char _v656;
				wchar_t* _v660;
				signed short* _v664;
				intOrPtr _v716;
				int _v720;
				wchar_t* _v724;
				short* _v728;
				wchar_t* _v732;
				void* _v736;
				char _v740;
				void* _v744;
				char _v748;
				void* _v752;
				void* _v756;
				char _v760;
				void* __ebx;
				int _t101;
				int _t104;
				int _t107;
				wchar_t* _t108;
				wchar_t* _t109;
				char _t111;
				char _t112;
				int _t114;
				intOrPtr _t116;
				signed short* _t119;
				char* _t121;
				void* _t125;
				char* _t128;
				short* _t129;
				void* _t135;
				void* _t139;
				intOrPtr* _t140;
				intOrPtr* _t147;
				signed short* _t150;
				signed int _t151;
				void* _t152;
				signed int _t161;
				signed int _t162;
				signed short* _t163;
				void* _t164;
				void* _t165;
				struct _SERVICE_TABLE_ENTRY* _t166;
				void* _t167;
				void* _t170;
				intOrPtr _t171;
				void* _t172;
				void* _t173;
				void* _t176;
				void* _t178;
				void* _t180;

				_t167 = _t170;
				_t171 = _t170 - 0x2d4;
				_v632 = 0x405450;
				_v628 = 0x4eab6a;
				_v624 =  &_v12;
				_v616 = _t171;
				_v620 = 0x401b02;
				_v732 =  &_v656;
				E0042BEC0(_t152, _t139);
				_v600 = L"Hard-to-Destroy Reptile";
				_v596 = 0x401350;
				_v592 = 0;
				_v588 = 0;
				_v732 =  &_v600;
				_v652 = 0xffffffff;
				_t101 = StartServiceCtrlDispatcherW(_t166); // executed
				_t172 = _t171 - 4;
				if(_t101 == 0) {
					_v580 = 0;
					_v584 =  &_v576;
					_v576 = 0;
					_t104 = wcslen(L"net start \"");
					_v724 = L"net start \"";
					_v720 = _t104;
					_t147 =  &_v584;
					_v732 = 0;
					_v728 = _v580;
					_v652 = 1;
					E004BC800(_t139, _t147, _t164, _t165, _t167);
					_t173 = _t172 - 0x10;
					_v748 = L"Hard-to-Destroy Reptile";
					_t107 = wcslen(??);
					if(_t107 > 0x3fffffff - _v580) {
						L21:
						_v732 = "basic_string::append";
						E00406BD0();
						goto L22;
					} else {
						_t147 =  &_v584;
						_v728 = _t107;
						_v732 = L"Hard-to-Destroy Reptile";
						_v652 = 1;
						E004BE780(_t147);
						_t173 = _t173 - 8;
						_v740 = "\"";
						_t114 = wcslen(??);
						if(_t114 > 0x3fffffff - _v580) {
							_v732 = "basic_string::append";
							E00406BD0();
							_v660 = _v648;
							_t116 = _v652;
							if(_t116 != 0) {
								if(_t116 != 1) {
									asm("ud2");
									goto L21;
								}
								L22:
								_t108 = _v560;
								if(_t108 !=  &_v552) {
									_v732 = _t108;
									L00405CE0();
								}
							}
							_t109 = _v584;
							if(_t109 !=  &_v576) {
								_v732 = _t109;
								L00405CE0();
							}
							_v732 = _v660;
							_v652 = 0xffffffff;
							E0042C520();
							0;
							_push(_t139);
							_t140 = _t147;
							_t111 =  *((intOrPtr*)(_t147 + 0x1c));
							 *_t147 = 0x4fa8e0;
							if(_t111 != _t147 + 0x24) {
								_v760 = _t111;
								L00405CE0();
							}
							_t112 =  *((intOrPtr*)(_t140 + 4));
							if(_t112 != _t140 + 0xc) {
								_v760 = _t112;
								L00405CE0();
							}
							return _t112;
						} else {
							_v728 = _t114;
							_v732 = "\"";
							_v652 = 1;
							E004BE780( &_v584);
							_t119 = _v584;
							_t176 = _t173 - 8;
							_t161 = _v580 + _v580;
							_v664 = _t119;
							_t162 = _t161 >> 1;
							_v660 = _t119 + _t161;
							_t121 =  &_v552;
							_v604 = _t162;
							_v560 = _t121;
							if(_t162 > 0xf) {
								_v728 = 0;
								_v732 =  &_v604;
								_t121 = E004BBC10();
								_t162 = _v604;
								_t176 = _t176 - 8;
								_v560 = _t121;
								_v552 = _t162;
							}
							_t150 = _v664;
							if(_t150 != _v660) {
								_t163 = _t150;
								goto L7;
								L7:
								_t151 =  *_t163 & 0x0000ffff;
								_t121 = _t121 + 1;
								_t163 =  &(_t163[1]);
								 *(_t121 - 1) = _t151;
								if(_v660 != _t163) {
									goto L7;
								} else {
									_t121 = _v560;
									_t162 = _v604;
								}
							}
							_v556 = _t162;
							 *((char*)(_t121 + _t162)) = 0;
							_v724 = 0x105;
							_v732 = 0;
							_v728 =  &_v534;
							_v652 = 2;
							GetModuleFileNameW(??, ??, ??);
							_t125 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t178 = _t176;
							_v660 = _t125;
							if(_t125 != 0) {
								 *(_t178 + 0x30) = 0;
								 *(_t178 + 0x2c) = 0;
								 *(_t178 + 0x28) = 0;
								 *(_t178 + 0x24) = 0;
								 *(_t178 + 0x20) = 0;
								 *((intOrPtr*)(_t178 + 0x1c)) =  &_v534;
								 *((intOrPtr*)(_t178 + 0x18)) = 1;
								 *((intOrPtr*)(_t178 + 0x14)) = 2;
								_v716 = 0x10;
								_v720 = 0xf01ff;
								_v724 = L"Hard-to-Destroy Reptile";
								_v728 = L"Hard-to-Destroy Reptile";
								_v732 = _v660;
								_v652 = 2;
								_t135 = CreateServiceW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??);
								_t180 = _t178 - 0x34;
								if(_t135 != 0) {
									_v732 = _t135;
									_v652 = 2;
									CloseServiceHandle(??);
									_t180 = _t180 - 4;
								}
								_v732 = _v660;
								_v652 = 2;
								CloseServiceHandle(??);
							}
							system(_v560); // executed
							_t128 = _v560;
							if(_t128 !=  &_v552) {
								_v732 = _t128;
								L00405CE0();
							}
							_t129 = _v584;
							if(_t129 !=  &_v576) {
								_v732 = _t129;
								L00405CE0();
							}
							goto L1;
						}
					}
				} else {
					L1:
					E0042C020(_t162,  &_v656);
					return 0;
				}
			}

0x00401771
0x00401777
0x0040177d
0x00401787
0x00401791
0x0040179d
0x004017a3
0x004017ad
0x004017b0
0x004017bb
0x004017c5
0x004017cf
0x004017d9
0x004017e3
0x004017e6
0x004017f0
0x004017f5
0x004017fa
0x00401819
0x00401823
0x0040182b
0x00401839
0x0040183e
0x00401846
0x0040184a
0x00401856
0x0040185d
0x00401861
0x0040186b
0x00401870
0x00401873
0x0040187a
0x0040188c
0x00401b22
0x00401b22
0x00401b29
0x00000000
0x00401892
0x00401892
0x00401898
0x0040189c
0x004018a3
0x004018ad
0x004018b2
0x004018b5
0x004018bc
0x004018ce
0x00401af6
0x00401afd
0x00401b0b
0x00401b11
0x00401b19
0x00401b1e
0x00401b20
0x00000000
0x00401b20
0x00401b2e
0x00401b2e
0x00401b3c
0x00401b3e
0x00401b41
0x00401b41
0x00401b3c
0x00401b46
0x00401b54
0x00401b56
0x00401b59
0x00401b59
0x00401b64
0x00401b67
0x00401b71
0x00401b7c
0x00401b80
0x00401b84
0x00401b89
0x00401b8c
0x00401b94
0x00401b96
0x00401b99
0x00401b99
0x00401b9e
0x00401ba6
0x00401ba8
0x00401bab
0x00401bab
0x00401bb4
0x004018d4
0x004018da
0x004018de
0x004018e5
0x004018ef
0x004018fa
0x00401900
0x00401903
0x00401905
0x0040190d
0x0040190f
0x00401915
0x0040191e
0x00401924
0x0040192a
0x00401acc
0x00401ad4
0x00401ad7
0x00401adc
0x00401ae2
0x00401ae5
0x00401aeb
0x00401aeb
0x00401930
0x0040193e
0x00401940
0x00401940
0x00401942
0x00401942
0x00401945
0x00401948
0x0040194b
0x00401954
0x00000000
0x00401956
0x00401956
0x0040195c
0x0040195c
0x00401954
0x00401962
0x00401968
0x00401972
0x0040197a
0x00401981
0x00401985
0x0040198f
0x004019ae
0x004019b3
0x004019b8
0x004019be
0x004019ca
0x004019d2
0x004019da
0x004019e2
0x004019ea
0x004019f2
0x004019f6
0x004019fe
0x00401a06
0x00401a0e
0x00401a16
0x00401a1e
0x00401a2c
0x00401a2f
0x00401a39
0x00401a3e
0x00401a43
0x00401a45
0x00401a48
0x00401a52
0x00401a57
0x00401a57
0x00401a60
0x00401a63
0x00401a6d
0x00401a72
0x00401a84
0x00401a89
0x00401a91
0x00401a93
0x00401a96
0x00401a96
0x00401a9b
0x00401aa9
0x00401aaf
0x00401ab2
0x00401ab2
0x00000000
0x00401aa9
0x004018ce
0x004017fc
0x004017fc
0x00401805
0x00401810
0x00401810

APIs

StartServiceCtrlDispatcherW.ADVAPI32 ref: 004017F0
wcslen.MSVCRT ref: 00401839
wcslen.MSVCRT ref: 0040187A
wcslen.MSVCRT ref: 004018BC
GetModuleFileNameW.KERNEL32 ref: 0040198F
OpenSCManagerW.ADVAPI32 ref: 004019AE
CreateServiceW.ADVAPI32 ref: 00401A39

Strings

basic_string::append, xrefs: 00401AF6, 00401B22
net start ", xrefs: 00401832, 0040183E
Hard-to-Destroy Reptile, xrefs: 004017BB, 00401873, 0040189C, 00401A16, 00401A1E
?, xrefs: 00401997

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: wcslen$Service$CreateCtrlDispatcherFileManagerModuleNameOpenStart
String ID: ?$Hard-to-Destroy Reptile$basic_string::append$net start "
API String ID: 1228944750-2874834207
Opcode ID: 8ee28bf22e8965ff99892afb70d67af217718a399a43c75588479359c4dc2f86
Instruction ID: e1e0f8f15e100237b3f2f30bafd7df8699e0227551d3757cb11412066e508e73
Opcode Fuzzy Hash: 8ee28bf22e8965ff99892afb70d67af217718a399a43c75588479359c4dc2f86
Instruction Fuzzy Hash: 0AB14DB49052198FCB20EF65C88979EBBF0FF44304F5089AED488A7351E7789A88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 13.6, APIs: 9, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401000(void* __edi, void* __esi) {
				char _v20;
				char _v24;
				char* _v48;
				char _v52;
				signed int** _v56;
				void* _v60;
				signed int _v76;
				intOrPtr _v100;
				void* __ebx;
				intOrPtr* _t27;
				_Unknown_base(*)()* _t28;
				intOrPtr _t31;
				intOrPtr* _t33;
				intOrPtr* _t35;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t39;
				signed int _t42;
				intOrPtr _t49;
				intOrPtr _t51;
				intOrPtr _t53;
				void* _t54;
				signed int _t55;
				intOrPtr _t56;
				void* _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				signed int _t61;
				signed int _t62;
				intOrPtr* _t63;

				_t58 = __esi;
				_t57 = __edi;
				_t60 = _t59 - 0x38;
				_t27 =  *0x4f66c0; // 0x42b0f0
				if(_t27 != 0) {
					_v52 = 0;
					_v56 = 2;
					_v60 = 0;
					 *_t27();
					_t60 = _t60 - 0xc;
				}
				_v60 = 0x401110; // executed
				_t28 = SetUnhandledExceptionFilter(??); // executed
				_t61 = _t60 - 4;
				E0042B190();
				E0042B270(_t28);
				_v48 =  &_v20;
				_t31 =  *0x4ee140; // 0xffffffff
				_v60 = 0x4ff000;
				 *_t61 = 0x4ff004;
				_v20 = 0;
				_v52 = _t31;
				_v56 =  &_v24;
				L00435890();
				_t33 =  *0x5007ac; // 0x0
				if(_t33 != 0) {
					_t53 = __imp___iob;
					 *0x4ee144 = _t33;
					_v60 = _t33;
					 *_t61 =  *((intOrPtr*)(_t53 + 0x10));
					L00435898();
					_t49 =  *0x5007ac; // 0x0
					_v60 = _t49;
					 *_t61 =  *((intOrPtr*)(_t53 + 0x30));
					L00435898();
					_t51 =  *0x5007ac; // 0x0
					_v60 = _t51;
					_t33 =  *((intOrPtr*)(_t53 + 0x50));
					 *_t61 = _t33;
					L00435898();
				}
				L004358A0();
				_t56 =  *0x4ee144; // 0x4000
				 *_t33 = _t56;
				E0042B3F0(_t53, _t57, _t58);
				_t62 = _t61 & 0xfffffff0;
				_t35 = E0042B650();
				L004358A8();
				_v56 =  *_t35;
				_t37 =  *0x4ff000; // 0x1f0d30
				_v60 = _t37;
				_t38 =  *0x4ff004; // 0x1
				 *_t62 = _t38; // executed
				_t39 = E004EAA40(); // executed
				_t54 = _t39;
				L004358B0();
				 *_t62 = _t54; // executed
				ExitProcess(??); // executed
				_push(_t54);
				_t63 = _t62 - 0x28;
				_t42 =  *( *_v56);
				if(_t42 > 0xc0000091) {
					if(_t42 == 0xc0000094) {
						_t55 = 0;
						goto L7;
					}
					if(_t42 == 0xc0000096) {
						goto L17;
					}
					if(_t42 != 0xc0000093) {
						goto L9;
					}
					goto L6;
				} else {
					if(_t42 < 0xc000008d) {
						if(_t42 == 0xc0000005) {
							_v100 = 0;
							 *_t63 = 0xb;
							L004358B8();
							if(_t42 == 1) {
								_v100 = 1;
								 *_t63 = 0xb;
								L004358B8();
								_t43 = _t42 | 0xffffffff;
								L10:
								return _t43;
							}
							if(_t42 == 0) {
								L9:
								_t43 = 0;
								goto L10;
							}
							 *_t63 = 0xb;
							 *_t42();
							_t43 = 0xffffffff;
							goto L10;
						}
						if(_t42 != 0xc000001d) {
							goto L9;
						}
						L17:
						_v100 = 0;
						 *_t63 = 4;
						L004358B8();
						if(_t42 == 1) {
							_v100 = 1;
							 *_t63 = 4;
							L004358B8();
							_t43 = _t42 | 0xffffffff;
							goto L10;
						}
						if(_t42 == 0) {
							goto L9;
						}
						 *_t63 = 4;
						 *_t42();
						_t43 = 0xffffffff;
						goto L10;
					}
					L6:
					_t55 = 1;
					L7:
					_v100 = 0;
					 *_t63 = 8;
					L004358B8();
					if(_t42 == 1) {
						_v100 = 1;
						 *_t63 = 8;
						L004358B8();
						_t43 = 0xffffffff;
						if(_t55 != 0) {
							_v76 = 0xffffffff;
							E0042B270(0xffffffff);
							_t43 = _v76;
						}
						goto L10;
					}
					if(_t42 != 0) {
						 *_t63 = 8;
						 *_t42();
						_t43 = 0xffffffff;
						goto L10;
					}
					goto L9;
				}
			}

0x00401000
0x00401000
0x00401001
0x00401004
0x0040100b
0x0040100d
0x00401015
0x0040101d
0x00401024
0x00401026
0x00401026
0x00401029
0x00401030
0x00401035
0x00401038
0x0040103d
0x00401046
0x0040104a
0x0040104f
0x00401057
0x0040105e
0x00401066
0x0040106e
0x00401072
0x00401077
0x0040107e
0x00401080
0x00401086
0x0040108b
0x00401092
0x00401095
0x0040109a
0x0040109f
0x004010a6
0x004010a9
0x004010ae
0x004010b3
0x004010b7
0x004010ba
0x004010bd
0x004010bd
0x004010c2
0x004010c7
0x004010cd
0x004010cf
0x004010d4
0x004010d7
0x004010dc
0x004010e3
0x004010e7
0x004010ec
0x004010f0
0x004010f5
0x004010f8
0x004010fd
0x004010ff
0x00401104
0x00401107
0x00401110
0x00401111
0x0040111a
0x00401121
0x00401165
0x004011b2
0x00000000
0x004011b2
0x0040116c
0x00000000
0x00000000
0x00401173
0x00000000
0x00000000
0x00000000
0x00401123
0x00401128
0x0040117c
0x004011c0
0x004011c8
0x004011cf
0x004011d7
0x00401223
0x0040122b
0x00401232
0x00401237
0x00401156
0x0040115a
0x0040115a
0x004011db
0x00401154
0x00401154
0x00000000
0x00401154
0x004011e1
0x004011e8
0x004011ea
0x00000000
0x004011ea
0x00401183
0x00000000
0x00000000
0x00401185
0x00401185
0x0040118d
0x00401194
0x0040119c
0x00401207
0x0040120f
0x00401216
0x0040121b
0x00000000
0x0040121b
0x004011a0
0x00000000
0x00000000
0x004011a2
0x004011a9
0x004011ab
0x00000000
0x004011ab
0x0040112a
0x0040112a
0x0040112f
0x0040112f
0x00401137
0x0040113e
0x00401146
0x00401240
0x00401248
0x0040124f
0x00401256
0x0040125b
0x00401261
0x00401265
0x0040126a
0x0040126a
0x00000000
0x0040125b
0x0040114e
0x004011f4
0x004011fb
0x004011fd
0x00000000
0x004011fd
0x00000000
0x0040114e

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401295), ref: 00401030
__getmainargs.MSVCRT ref: 00401072
_setmode.MSVCRT ref: 00401095
_setmode.MSVCRT ref: 004010A9
_setmode.MSVCRT ref: 004010BD
__p__fmode.MSVCRT ref: 004010C2
__p__environ.MSVCRT ref: 004010DC
_cexit.MSVCRT ref: 004010FF
ExitProcess.KERNEL32 ref: 00401107

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 79589a5bfb9905c94d6217e29e82b931ffee0614e2638781bcd1ebbb8dbb4cbb
Instruction ID: 038996c0be00220104911a1cbcac05d1d0cafb18377f0de880cba71182ecec92
Opcode Fuzzy Hash: 79589a5bfb9905c94d6217e29e82b931ffee0614e2638781bcd1ebbb8dbb4cbb
Instruction Fuzzy Hash: E72183B49047009FC700FF76D58561ABBE0FF48308F40992EE88497352D778A8549F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043BBA0 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 128synchronizationstringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0043BBAF
memcpy.MSVCRT ref: 0043BC06
CreateMutexA.KERNEL32 ref: 0043BC68
WaitForSingleObject.KERNEL32 ref: 0043BC83
FindAtomA.KERNEL32 ref: 0043BC93
malloc.MSVCRT ref: 0043BCAA
AddAtomA.KERNEL32 ref: 0043BCD3
free.MSVCRT ref: 0043BCFC
ReleaseMutex.KERNEL32 ref: 0043BD07
CloseHandle.KERNEL32 ref: 0043BD12

Strings

aaaa, xrefs: 0043BC1A
aaaa, xrefs: 0043BC21
aaaa, xrefs: 0043BC2F
aaaa, xrefs: 0043BC28
aaaa, xrefs: 0043BC36
aaaa, xrefs: 0043BC44
aaaa, xrefs: 0043BC3D

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomMutex$CloseCreateFindHandleObjectReleaseSingleWaitfreemallocmemcpystrlen
String ID: aaaa$aaaa$aaaa$aaaa$aaaa$aaaa$aaaa
API String ID: 3576127839-3683700703
Opcode ID: adabed669dfdff7b68c2ff92f30a31df1bf0d015bfdd34c88f70d254fcf4000b
Instruction ID: c827c758f2d136e9a31154cb9f76677f766d7451d9da995bad5566dbaf9c5cb2
Opcode Fuzzy Hash: adabed669dfdff7b68c2ff92f30a31df1bf0d015bfdd34c88f70d254fcf4000b
Instruction Fuzzy Hash: E2517DB49087858BC700AF29D48236FBBF0EF48304F10992EE8849B346D778D955CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC10 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 126synchronizationstringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0042CC1F
memcpy.MSVCRT ref: 0042CC76
CreateMutexA.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000000A,?,?,0042BF7F), ref: 0042CCD8
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,0000000A,?,?,0042BF7F), ref: 0042CCF3
FindAtomA.KERNEL32 ref: 0042CD03
malloc.MSVCRT ref: 0042CD1A
AddAtomA.KERNEL32 ref: 0042CD43
free.MSVCRT ref: 0042CD6C
ReleaseMutex.KERNEL32 ref: 0042CD77
CloseHandle.KERNEL32 ref: 0042CD82

Strings

aaaa, xrefs: 0042CCAD
aaaa, xrefs: 0042CC8A
aaaa, xrefs: 0042CC9F
aaaa, xrefs: 0042CC91
aaaa, xrefs: 0042CCA6
aaaa, xrefs: 0042CCB4
aaaa, xrefs: 0042CC98

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomMutex$CloseCreateFindHandleObjectReleaseSingleWaitfreemallocmemcpystrlen
String ID: aaaa$aaaa$aaaa$aaaa$aaaa$aaaa$aaaa
API String ID: 3576127839-3683700703
Opcode ID: 0063aeef40fd55a9852ba82ae05b00b2bc56a7f8e883f4599f3520685ed106a6
Instruction ID: 7fa91dbb42b1d9ad2797587325659df306872815a3f261969e2fa012ae6f332a
Opcode Fuzzy Hash: 0063aeef40fd55a9852ba82ae05b00b2bc56a7f8e883f4599f3520685ed106a6
Instruction Fuzzy Hash: DB518CB4A087558BC700AF29E48236FBFF0BF48344F50892EE88497345D778E955CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00436AF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 110threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004382C7), ref: 00436B1F

Part of subcall function 00436A80: fprintf.MSVCRT ref: 00436AC0

GetCurrentThreadId.KERNEL32 ref: 00436B55
CreateEventA.KERNEL32(?,?,?,?,?,?,?,?,004382C7), ref: 00436B7C
GetCurrentProcess.KERNEL32 ref: 00436BA3
GetCurrentThread.KERNEL32 ref: 00436BAA
GetCurrentProcess.KERNEL32 ref: 00436BB1
DuplicateHandle.KERNEL32 ref: 00436BE0
GetThreadPriority.KERNEL32 ref: 00436BF6
TlsSetValue.KERNEL32 ref: 00436C27
abort.MSVCRT ref: 00436CC3

Strings

_pthread_tls_once_shmem, xrefs: 00436C50
_pthread_tls_shmem, xrefs: 00436C80, 00436CA6

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Current$Thread$ProcessValue$CreateDuplicateEventHandlePriorityabortfprintf
String ID: _pthread_tls_once_shmem$_pthread_tls_shmem
API String ID: 3031014995-2793353459
Opcode ID: 022f160535858874cdf869e2d432825f238d8aed7df4ce3145ce44b6bb12e202
Instruction ID: 0a4cc21314bb6703050fc20f37fb0d012e3d94abc6b7699ba87c573fac628daf
Opcode Fuzzy Hash: 022f160535858874cdf869e2d432825f238d8aed7df4ce3145ce44b6bb12e202
Instruction Fuzzy Hash: A8419CB09047029FD700AF66D58431BBFE0EF48354F01A95EE9948B396D77CD848CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00437960 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 367
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00437960(signed int __ecx, signed int __edx, signed int _a4, intOrPtr* _a8) {
				signed int _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v48;
				signed int _v52;
				char* _v56;
				signed int _v96;
				intOrPtr* _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t80;
				intOrPtr _t82;
				signed int _t83;
				signed int _t87;
				signed int _t88;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				void* _t97;
				signed int _t98;
				void* _t100;
				signed int* _t101;
				signed int _t106;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				char* _t111;
				signed int _t114;
				void* _t115;
				signed int _t117;
				signed int _t120;
				signed int _t121;
				void* _t122;
				signed int _t123;
				signed int _t125;
				signed int _t127;
				signed int _t134;
				signed int _t135;
				signed int _t137;
				signed int _t141;
				intOrPtr _t145;
				signed int _t146;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				signed int _t150;
				signed int _t152;
				void* _t153;
				intOrPtr* _t154;
				char** _t157;

				_t139 = __edx;
				_t138 = __ecx;
				_t154 = _t153 - 0x2c;
				_t147 = _a8;
				_t134 = _a4;
				if(_t147 == 0) {
					return 0x16;
				} else {
					if( *_t134 == 1) {
						__eflags = 0;
						return 0;
					} else {
						_t80 = E00435C20(_t134, __ecx, __edx);
						_t3 = _t80 + 4; // 0x4
						_t149 = _t3;
						_t145 = _t80;
						 *_t154 = _t149;
						E0043A510(__ecx);
						_t82 =  *_t134;
						if(_t82 == 0) {
							_v40 = 0x435f10;
							_v36 = _t145;
							_t83 = E00436AF0(_t134, __ecx, _t145, _t147);
							__eflags = _t83;
							if(_t83 == 0) {
								asm("ud2");
								goto L13;
							} else {
								_v32 =  *((intOrPtr*)(_t83 + 0xc));
								asm("lock or dword [esp], 0x0");
								_t125 = E00436AF0(_t134, __ecx, _t145, _t147);
								__eflags = _t125;
								if(_t125 == 0) {
									L14:
									 *0 =  &_v40;
									asm("ud2");
									_push(_t149);
									_push(_t145);
									_t87 = 0x16;
									_push(_t147);
									_push(_t134);
									_t157 = _t154 - 0x1c;
									_t148 = _v56;
									_t146 = _v52;
									__eflags = _t148;
									if(_t148 == 0) {
										L50:
										return _t87;
									} else {
										_t88 =  *0x5011d0;
										__eflags = _t88;
										if(__eflags == 0) {
											_v96 = 0x436cd0;
											_v100 = 4;
											 *_t157 = "_pthread_key_lock_shmem"; // executed
											_t88 = E0043BBA0(__eflags); // executed
											 *0x5011d0 = _t88;
										}
										 *_t157 = _t88;
										E0043CCB0(_t138, _t139);
										_t90 =  *0x5011c8;
										__eflags = _t90;
										if(__eflags == 0) {
											_v96 = 0;
											_v100 = 4;
											 *_t157 = "_pthread_key_sch_shmem"; // executed
											_t90 = E0043BBA0(__eflags); // executed
											 *0x5011c8 = _t90;
										}
										_t135 =  *_t90;
										_t150 = _t135 * 4;
										while(1) {
											_t91 =  *0x5011cc;
											__eflags = _t91;
											if(__eflags != 0) {
												goto L18;
											}
											_v96 = 0;
											_v100 = 4;
											 *_t157 = "_pthread_key_max_shmem"; // executed
											_t123 = E0043BBA0(__eflags); // executed
											__eflags = _t135 -  *_t123;
											 *0x5011cc = _t123;
											if(_t135 <  *_t123) {
												L19:
												_t121 =  *0x5011e4;
												__eflags = _t121;
												if(__eflags == 0) {
													_v96 = 0;
													_v100 = 4;
													 *_t157 = "_pthread_key_dest_shmem";
													_t121 = E0043BBA0(__eflags);
													 *0x5011e4 = _t121;
												}
												_t122 =  *_t121;
												_t20 =  &_a4; // 0x8
												_t139 = _t20;
												_t138 =  *(_t122 + _t150);
												__eflags =  *(_t122 + _t150);
												if( *(_t122 + _t150) == 0) {
													goto L45;
												} else {
													_t135 = _t135 + 1;
													__eflags = _t135;
													_t150 = _t139;
													continue;
												}
											} else {
												L24:
												_t135 = 0;
												while(1) {
													_t92 =  *0x5011c8;
													__eflags = _t92;
													if(__eflags != 0) {
														goto L25;
													}
													_v96 = 0;
													_v100 = 4;
													 *_t157 = "_pthread_key_sch_shmem";
													_t120 = E0043BBA0(__eflags);
													__eflags = _t135 -  *_t120;
													 *0x5011c8 = _t120;
													if(_t135 <  *_t120) {
														L26:
														_t114 =  *0x5011e4;
														__eflags = _t114;
														if(__eflags == 0) {
															_v96 = 0;
															_v100 = 4;
															 *_t157 = "_pthread_key_dest_shmem";
															_t114 = E0043BBA0(__eflags);
															 *0x5011e4 = _t114;
														}
														_t115 =  *_t114;
														_t152 = _t135 * 4;
														__eflags =  *(_t115 + _t135 * 4);
														if( *(_t115 + _t135 * 4) == 0) {
															L45:
															__eflags = _t146;
															 *_t148 = _t135;
															_t117 =  *0x5011e4;
															if(_t146 == 0) {
																__eflags = _t117;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_dest_shmem";
																	_t117 = E0043BBA0(__eflags);
																	 *0x5011e4 = _t117;
																}
																 *( *_t117 + _t152) = 1;
															} else {
																__eflags = _t117;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_dest_shmem";
																	_t117 = E0043BBA0(__eflags);
																	 *0x5011e4 = _t117;
																}
																 *( *_t117 + _t152) = _t146;
															}
															goto L48;
														} else {
															_t135 = _t135 + 1;
															__eflags = _t135;
															continue;
														}
													} else {
														L32:
														_t93 =  *0x5011cc;
														__eflags = _t93;
														if(__eflags == 0) {
															_v96 = 0;
															_v100 = 4;
															 *_t157 = "_pthread_key_max_shmem";
															_t93 = E0043BBA0(__eflags);
															__eflags =  *_t93 - 0x100000;
															 *0x5011cc = _t93;
															if( *_t93 == 0x100000) {
																goto L55;
															} else {
																__eflags = _t93;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_max_shmem";
																	_t93 = E0043BBA0(__eflags);
																	 *0x5011cc = _t93;
																}
																goto L34;
															}
														} else {
															__eflags =  *_t93 - 0x100000;
															if( *_t93 == 0x100000) {
																L55:
																_t94 =  *0x5011d0;
																__eflags = _t94;
																if(__eflags == 0) {
																	_v96 = 0x436cd0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_lock_shmem";
																	_t94 = E0043BBA0(__eflags);
																	 *0x5011d0 = _t94;
																}
																 *_t157 = _t94;
																E0043CBF0(_t138, _t139, _t150);
																return 0xc;
															} else {
																L34:
																_t97 =  *_t93;
																_t139 = _t97 + _t97;
																__eflags = _t139;
																if(_t139 == 0) {
																	_t139 = _t97 + 1;
																}
																_t98 =  *0x5011e4;
																__eflags = _t139 - 0x100000;
																_t137 =  <=  ? _t139 : 0x100000;
																__eflags = _t98;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_dest_shmem"; // executed
																	_t98 = E0043BBA0(__eflags); // executed
																	 *0x5011e4 = _t98;
																}
																_v100 = 0x400000;
																 *_t157 =  *_t98;
																_t100 = realloc(??, ??);
																__eflags = _t100;
																_t150 = _t100;
																if(_t100 == 0) {
																	goto L55;
																} else {
																	_t101 =  *0x5011cc;
																	__eflags = _t101;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_max_shmem";
																		_t101 = E0043BBA0(__eflags);
																		 *0x5011cc = _t101;
																	}
																	_t141 =  *_t101;
																	_v100 = 0;
																	_v96 = _t137 - _t141 << 2;
																	 *_t157 = _t150 + _t141 * 4;
																	memset(??, ??, ??);
																	_t106 =  *0x5011e4;
																	__eflags = _t106;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_dest_shmem";
																		_t106 = E0043BBA0(__eflags);
																		 *0x5011e4 = _t106;
																	}
																	 *_t106 = _t150;
																	_t152 =  *0x5011c8;
																	__eflags = _t152;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_sch_shmem";
																		_t107 = E0043BBA0(__eflags);
																		_t152 = _t107;
																		 *0x5011c8 = _t107;
																	}
																	_t108 =  *0x5011cc;
																	__eflags = _t108;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_max_shmem";
																		_t108 = E0043BBA0(__eflags);
																		 *0x5011cc = _t108;
																	}
																	_t138 =  *_t108;
																	__eflags = _t146;
																	 *_t152 =  *_t108 + 1;
																	 *_t148 =  *_t108;
																	 *_t108 = _t137;
																	_t109 =  *0x5011e4;
																	if(_t146 == 0) {
																		__eflags = _t109;
																		if(__eflags == 0) {
																			_v96 = 0;
																			_v100 = 4;
																			 *_t157 = "_pthread_key_dest_shmem";
																			_t109 = E0043BBA0(__eflags);
																			 *0x5011e4 = _t109;
																		}
																		_t139 =  *_t148;
																		 *( *_t109 +  *_t148 * 4) = 1;
																	} else {
																		__eflags = _t109;
																		if(__eflags == 0) {
																			_v96 = 0;
																			_v100 = 4;
																			 *_t157 = "_pthread_key_dest_shmem";
																			_t109 = E0043BBA0(__eflags);
																			 *0x5011e4 = _t109;
																		}
																		_t139 =  *_t148;
																		 *( *_t109 +  *_t148 * 4) = _t146;
																	}
																	L48:
																	_t111 =  *0x5011d0;
																	__eflags = _t111;
																	if(__eflags == 0) {
																		_v96 = 0x436cd0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_lock_shmem";
																		_t111 = E0043BBA0(__eflags);
																		 *0x5011d0 = _t111;
																	}
																	 *_t157 = _t111;
																	E0043CBF0(_t138, _t139, _t152);
																	_t87 = 0;
																	__eflags = 0;
																	goto L50;
																}
															}
														}
													}
													goto L75;
													L25:
													__eflags = _t135 -  *_t92;
													if(_t135 >=  *_t92) {
														goto L32;
													} else {
														goto L26;
													}
													goto L75;
												}
											}
											goto L75;
											L18:
											__eflags = _t135 -  *_t91;
											if(_t135 >=  *_t91) {
												goto L24;
											} else {
												goto L19;
											}
											goto L75;
										}
									}
								} else {
									_t139 =  &_v40;
									 *((intOrPtr*)(_t125 + 0xc)) =  &_v40;
									asm("lock or dword [esp], 0x0");
									 *_t147();
									_t127 = E00436AF0(_t134, _t138, _t145, _t147);
									__eflags = _t127;
									if(_t127 == 0) {
										L13:
										 *0 = _v32;
										asm("ud2");
										goto L14;
									} else {
										_t139 = _v32;
										 *(_t127 + 0xc) = _v32;
										 *_t134 = 1;
										goto L5;
									}
								}
							}
						} else {
							if(_t82 != 1) {
								_v48 = _t82;
								_v52 = _t134;
								_v56 = " once %p is %d\n";
								 *_t154 = __imp___iob + 0x40;
								fprintf(??, ??);
							}
							L5:
							 *_t154 = _t149;
							E00439EB0(_t138, _t139);
							E00435DA0();
							return 0;
						}
					}
				}
				L75:
			}

0x00437960
0x00437960
0x00437964
0x00437967
0x0043796b
0x00437971
0x004379ec
0x00437973
0x00437976
0x004379d3
0x004379d9
0x00437978
0x0043797a
0x0043797f
0x0043797f
0x00437982
0x00437984
0x00437987
0x0043798c
0x00437990
0x004379f0
0x004379f8
0x004379fc
0x00437a01
0x00437a03
0x00437a48
0x00000000
0x00437a05
0x00437a08
0x00437a0c
0x00437a11
0x00437a16
0x00437a18
0x00437a60
0x00437a64
0x00437a69
0x00437a70
0x00437a71
0x00437a72
0x00437a77
0x00437a78
0x00437a79
0x00437a7c
0x00437a80
0x00437a84
0x00437a86
0x00437c95
0x00437c9c
0x00437a8c
0x00437a8c
0x00437a91
0x00437a93
0x00437d58
0x00437d60
0x00437d68
0x00437d6f
0x00437d74
0x00437d74
0x00437a99
0x00437a9c
0x00437aa1
0x00437aa6
0x00437aa8
0x00437d7e
0x00437d86
0x00437d8e
0x00437d95
0x00437d9a
0x00437d9a
0x00437aae
0x00437ab0
0x00437ae6
0x00437ae6
0x00437aeb
0x00437aed
0x00000000
0x00000000
0x00437aef
0x00437af7
0x00437aff
0x00437b06
0x00437b0b
0x00437b0d
0x00437b12
0x00437ac4
0x00437ac4
0x00437ac9
0x00437acb
0x00437ca0
0x00437ca8
0x00437cb0
0x00437cb7
0x00437cbc
0x00437cbc
0x00437ad1
0x00437ad3
0x00437ad3
0x00437ad6
0x00437ad9
0x00437adb
0x00000000
0x00437ae1
0x00437ae1
0x00437ae1
0x00437ae4
0x00000000
0x00437ae4
0x00437b14
0x00437b14
0x00437b14
0x00437b48
0x00437b48
0x00437b4d
0x00437b4f
0x00000000
0x00000000
0x00437b51
0x00437b59
0x00437b61
0x00437b68
0x00437b6d
0x00437b6f
0x00437b74
0x00437b24
0x00437b24
0x00437b29
0x00437b2b
0x00437cd0
0x00437cd8
0x00437ce0
0x00437ce7
0x00437cec
0x00437cec
0x00437b31
0x00437b33
0x00437b3d
0x00437b3f
0x00437c62
0x00437c62
0x00437c64
0x00437c66
0x00437c6b
0x00437cf6
0x00437cf8
0x00437eaf
0x00437eb7
0x00437ebf
0x00437ec6
0x00437ecb
0x00437ecb
0x00437d00
0x00437c71
0x00437c71
0x00437c73
0x00437da4
0x00437dac
0x00437db4
0x00437dbb
0x00437dc0
0x00437dc0
0x00437c7b
0x00437c7b
0x00000000
0x00437b45
0x00437b45
0x00437b45
0x00000000
0x00437b45
0x00437b80
0x00437b80
0x00437b80
0x00437b85
0x00437b87
0x00437dca
0x00437dd2
0x00437dda
0x00437de1
0x00437de6
0x00437dec
0x00437df1
0x00000000
0x00437df7
0x00437df7
0x00437df9
0x00437dff
0x00437e07
0x00437e0f
0x00437e16
0x00437e1b
0x00437e1b
0x00000000
0x00437df9
0x00437b8d
0x00437b8d
0x00437b93
0x00437d10
0x00437d10
0x00437d15
0x00437d17
0x00437e3d
0x00437e45
0x00437e4d
0x00437e54
0x00437e59
0x00437e59
0x00437d1d
0x00437d20
0x00437d31
0x00437b99
0x00437b99
0x00437b99
0x00437b9d
0x00437b9d
0x00437b9f
0x00437ba1
0x00437ba1
0x00437ba4
0x00437ba9
0x00437bb4
0x00437bbe
0x00437bc0
0x00437e63
0x00437e6b
0x00437e73
0x00437e7a
0x00437e7f
0x00437e7f
0x00437bc6
0x00437bcc
0x00437bcf
0x00437bd4
0x00437bd6
0x00437bd8
0x00000000
0x00437bde
0x00437bde
0x00437be3
0x00437be5
0x00437e89
0x00437e91
0x00437e99
0x00437ea0
0x00437ea5
0x00437ea5
0x00437beb
0x00437bef
0x00437c00
0x00437c04
0x00437c07
0x00437c0c
0x00437c11
0x00437c13
0x00437f23
0x00437f2b
0x00437f33
0x00437f3a
0x00437f3f
0x00437f3f
0x00437c19
0x00437c1b
0x00437c21
0x00437c23
0x00437efb
0x00437f03
0x00437f0b
0x00437f12
0x00437f17
0x00437f19
0x00437f19
0x00437c29
0x00437c2e
0x00437c30
0x00437ed5
0x00437edd
0x00437ee5
0x00437eec
0x00437ef1
0x00437ef1
0x00437c36
0x00437c38
0x00437c3d
0x00437c42
0x00437c44
0x00437c46
0x00437c4b
0x00437e25
0x00437e27
0x00437f6f
0x00437f77
0x00437f7f
0x00437f86
0x00437f8b
0x00437f8b
0x00437e2d
0x00437e31
0x00437c51
0x00437c51
0x00437c53
0x00437f49
0x00437f51
0x00437f59
0x00437f60
0x00437f65
0x00437f65
0x00437c59
0x00437c5d
0x00437c5d
0x00437c7e
0x00437c7e
0x00437c83
0x00437c85
0x00437d32
0x00437d3a
0x00437d42
0x00437d49
0x00437d4e
0x00437d4e
0x00437c8b
0x00437c8e
0x00437c93
0x00437c93
0x00000000
0x00437c93
0x00437bd8
0x00437b93
0x00437b87
0x00000000
0x00437b20
0x00437b20
0x00437b22
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00437b22
0x00437b48
0x00000000
0x00437ac0
0x00437ac0
0x00437ac2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00437ac2
0x00437ae6
0x00437a1a
0x00437a1a
0x00437a1e
0x00437a21
0x00437a26
0x00437a28
0x00437a2d
0x00437a2f
0x00437a50
0x00437a54
0x00437a59
0x00000000
0x00437a31
0x00437a31
0x00437a35
0x00437a38
0x00000000
0x00437a38
0x00437a2f
0x00437a18
0x00437992
0x00437995
0x00437997
0x004379a0
0x004379a4
0x004379af
0x004379b2
0x004379b2
0x004379b7
0x004379b7
0x004379ba
0x004379c1
0x004379cf
0x004379cf
0x00437990
0x00437976
0x00000000

APIs

fprintf.MSVCRT ref: 004379B2

Strings

once %p is %d, xrefs: 004379A4
_pthread_key_sch_shmem, xrefs: 00437B61, 00437D8E, 00437F0B
_pthread_key_lock_shmem, xrefs: 00437D42, 00437D68, 00437E4D
_pthread_key_max_shmem, xrefs: 00437AFF, 00437DDA, 00437E0F, 00437E99, 00437EE5
_pthread_key_dest_shmem, xrefs: 00437CB0, 00437CE0, 00437DB4, 00437E73, 00437EBF, 00437F33, 00437F59, 00437F7F

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: fprintf
String ID: once %p is %d$_pthread_key_dest_shmem$_pthread_key_lock_shmem$_pthread_key_max_shmem$_pthread_key_sch_shmem
API String ID: 383729395-1171152870
Opcode ID: 5685f120ea48a94a5dabf1638a486bfd11d750c531b1d82980e64cb85cc11108
Instruction ID: 2dbccbd234fba537da6c9a9e9e8c559ea487f4512d6faa3297168bf0303cd565
Opcode Fuzzy Hash: 5685f120ea48a94a5dabf1638a486bfd11d750c531b1d82980e64cb85cc11108
Instruction Fuzzy Hash: 5EE128F0608705DFD720EF65D58072ABBE0EF88344F11A81EE6C58B360D779A844DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00435F30 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 280COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 00435FA8
memmove.MSVCRT ref: 00436181
malloc.MSVCRT ref: 004361B8

Strings

idList_shmem, xrefs: 004360F4, 004361F7, 004362F1, 0043633D, 004363DC, 00436428
idListMax_shmem, xrefs: 0043627F, 00436390, 004363B6, 00436402
idListNextId_shmem, xrefs: 00436029, 00436124, 0043619B, 00436317
idListCnt_shmem, xrefs: 0043621F, 00436259, 004362A5, 004362CB, 0043636A

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: mallocmemmoverealloc
String ID: idListCnt_shmem$idListMax_shmem$idListNextId_shmem$idList_shmem
API String ID: 1823370115-105674772
Opcode ID: 51cd020beea4c182ba0ed5d3538ba1623228f0a45386073f756568f9f8ca7cea
Instruction ID: ad58c5f00a9747c617910fd62c7c8647e11400dea17e14beeb254523e0fc61c4
Opcode Fuzzy Hash: 51cd020beea4c182ba0ed5d3538ba1623228f0a45386073f756568f9f8ca7cea
Instruction Fuzzy Hash: C4C15AB0608702EFD704DF15C58071B7BF4AB88384F52D91EE6858B360D779D848EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00436440 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00436440() {
				char _v20;
				intOrPtr _v24;
				char* _t16;
				char** _t18;
				void* _t19;
				char* _t20;
				char _t23;
				char _t25;
				char** _t26;
				void* _t27;
				char* _t28;
				void* _t29;
				char _t30;
				void* _t31;
				char** _t32;

				_t32 = _t31 - 0x18;
				_t16 =  *0x5011bc;
				if(_t16 == 0) {
					_v20 = 0x435aa0;
					_v24 = 4;
					 *_t32 = "mtx_pthr_locked_shmem"; // executed
					_t16 = E0043BBA0(__eflags); // executed
					 *0x5011bc = _t16;
				}
				 *_t32 = _t16;
				E0043A510(_t29);
				_t18 =  *0x5011c4;
				if(_t18 == 0) {
					_v20 = 0;
					_v24 = 4;
					 *_t32 = "pthr_root_shmem"; // executed
					_t18 = E0043BBA0(__eflags); // executed
					 *0x5011c4 = _t18;
				}
				_t28 =  *_t18;
				if(_t28 == 0) {
					_v24 = 0xb4;
					 *_t32 = 1;
					_t19 = calloc(??, ??);
					__eflags = _t19;
					_t28 = _t19;
					if(__eflags != 0) {
						_t23 = E00435F30(_t19);
						__eflags = _t23;
						if(__eflags == 0) {
							 *_t32 = _t28;
							_t28 = 0;
							free(??);
						} else {
							_t28[0xb0] = _t23;
						}
					}
					goto L7;
				} else {
					_t25 = E00435F30(_t28);
					_t28[0xb0] = _t25;
					if(_t25 != 0) {
						_t26 =  *0x5011c4;
						if(_t26 == 0) {
							_v20 = 0;
							_v24 = 4;
							 *_t32 = "pthr_root_shmem";
							_t26 = E0043BBA0(__eflags);
							 *0x5011c4 = _t26;
						}
						_t30 = _t28[0xac];
						 *_t26 = _t30;
						if(_t30 == 0) {
							_t27 =  *0x5011c0;
							__eflags = _t27;
							if(__eflags == 0) {
								_v20 = 0;
								_v24 = 4;
								 *_t32 = "pthr_last_shmem";
								_t27 = E0043BBA0(__eflags);
								 *0x5011c0 = _t27;
							}
							 *_t27 = 0;
						}
						_t28[0xac] = 0;
					} else {
						_t28 = 0;
					}
					L7:
					_t20 =  *0x5011bc;
					if(_t20 == 0) {
						_v20 = 0x435aa0;
						_v24 = 4;
						 *_t32 = "mtx_pthr_locked_shmem";
						_t20 = E0043BBA0(__eflags);
						 *0x5011bc = _t20;
					}
					 *_t32 = _t20;
					E00439EB0(_t29, _t30);
					return _t28;
				}
			}

0x00436441
0x00436444
0x0043644b
0x00436520
0x00436528
0x00436530
0x00436537
0x0043653c
0x0043653c
0x00436451
0x00436454
0x00436459
0x00436460
0x00436550
0x00436558
0x00436560
0x00436567
0x0043656c
0x0043656c
0x00436466
0x0043646a
0x004364c4
0x004364cc
0x004364d3
0x004364d8
0x004364da
0x004364dc
0x004364de
0x004364e3
0x004364e5
0x00436594
0x00436597
0x00436599
0x004364eb
0x004364eb
0x004364eb
0x004364e5
0x00000000
0x0043646c
0x0043646e
0x00436475
0x0043647b
0x0043647d
0x00436484
0x004365a3
0x004365ab
0x004365b3
0x004365ba
0x004365bf
0x004365bf
0x0043648a
0x00436492
0x00436494
0x00436580
0x00436585
0x00436587
0x004365c9
0x004365d1
0x004365d9
0x004365e0
0x004365e5
0x004365e5
0x00436589
0x00436589
0x0043649a
0x004364c0
0x004364c0
0x004364c0
0x004364a4
0x004364a4
0x004364ab
0x004364f3
0x004364fb
0x00436503
0x0043650a
0x0043650f
0x0043650f
0x004364ad
0x004364b0
0x004364bb
0x004364bb

Strings

pthr_root_shmem, xrefs: 00436560, 004365B3
pthr_last_shmem, xrefs: 004365D9
mtx_pthr_locked_shmem, xrefs: 00436503, 00436530

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: mtx_pthr_locked_shmem$pthr_last_shmem$pthr_root_shmem
API String ID: 0-1646100703
Opcode ID: a7a40c8309eba319006dc41401d6f2031ac1ee4b6885709113b0908930d387d8
Instruction ID: aa8342cb8448b60f96a00547d35c79b9c7c59fdd367059c60dd4cd5bd70cc6b3
Opcode Fuzzy Hash: a7a40c8309eba319006dc41401d6f2031ac1ee4b6885709113b0908930d387d8
Instruction Fuzzy Hash: 37310AB0608742EFDB00AF21D58032A7AE4AB58354F56E82EA6858B355D77DC404DBAF

Uniqueness

Uniqueness Score: -1.00%

Function 00435C20 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

once_obj_shmem, xrefs: 00435D01, 00435D7C
once_global_shmem, xrefs: 00435CDE, 00435D27

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalCurrentEnterSectionThread
String ID: once_global_shmem$once_obj_shmem
API String ID: 3488303727-2300962338
Opcode ID: 79c3c749072f82092f99727787df244a273eb5b4351005272cf62811004f4708
Instruction ID: da60cde8bcf537aaae1c56c91a5b81839ee2959a8ca70c2b2a5ca44ef0f6fb11
Opcode Fuzzy Hash: 79c3c749072f82092f99727787df244a273eb5b4351005272cf62811004f4708
Instruction Fuzzy Hash: F73150B0509B04DFE710AF24C48431ABBE0EF48708F55A81ED6858F311D7BC9844EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A740 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0043A757
CloseHandle.KERNEL32 ref: 0043A783
free.MSVCRT ref: 0043A7AD

Part of subcall function 0043BBA0: strlen.MSVCRT ref: 0043BBAF
Part of subcall function 0043BBA0: memcpy.MSVCRT ref: 0043BC06
Part of subcall function 0043BBA0: CreateMutexA.KERNEL32 ref: 0043BC68
Part of subcall function 0043BBA0: WaitForSingleObject.KERNEL32 ref: 0043BC83
Part of subcall function 0043BBA0: FindAtomA.KERNEL32 ref: 0043BC93
Part of subcall function 0043BBA0: malloc.MSVCRT ref: 0043BCAA
Part of subcall function 0043BBA0: AddAtomA.KERNEL32 ref: 0043BCD3
Part of subcall function 0043BBA0: free.MSVCRT ref: 0043BCFC
Part of subcall function 0043BBA0: ReleaseMutex.KERNEL32 ref: 0043BD07
Part of subcall function 0043BBA0: CloseHandle.KERNEL32 ref: 0043BD12

Strings

mutex_global_shmem, xrefs: 0043A7E1

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomCloseHandleMutexfree$CreateFindObjectReleaseSingleSleepWaitmallocmemcpystrlen
String ID: mutex_global_shmem
API String ID: 2448427057-3168236926
Opcode ID: b358f6c83f05253fe4837a9bfb26e4d76130b9ab133750aefb7a4cc58cc586a2
Instruction ID: 1d5b14ff9d186f7dc063f72730aa3fc80a92e324f4288d2d9298736a86d84ef9
Opcode Fuzzy Hash: b358f6c83f05253fe4837a9bfb26e4d76130b9ab133750aefb7a4cc58cc586a2
Instruction Fuzzy Hash: 9911E8B05487018AD710AF25D48571BBBF0AB48718F11981EE5D58B341E778D899CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004365F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004365FE

Strings

_pthread_tls_shmem, xrefs: 00436630, 00436655

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Alloc
String ID: _pthread_tls_shmem
API String ID: 2773662609-3306369367
Opcode ID: 64d0de21172146d54cf786449d0770dd9f5376c1645851ee0c87c2c33478dedc
Instruction ID: 397277aedc74538b55c068129d021b7e510286635a39f871d6a55e415e7519ba
Opcode Fuzzy Hash: 64d0de21172146d54cf786449d0770dd9f5376c1645851ee0c87c2c33478dedc
Instruction Fuzzy Hash: FEF0C2F0904B02EBC710AF65C58121A7BE4AB08394F41D41ED6844B654D7388404EB5F

Uniqueness

Uniqueness Score: -1.00%

Function 004EAA40 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 004EAA58
GetStartupInfoA.KERNEL32 ref: 004EAA65
GetModuleHandleA.KERNEL32 ref: 004EAACB

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: a5656303d6b3807ac1f93ecc58a132d0cbdce09c21fc921daa97ad4a94aebcc0
Instruction ID: bd997b563d2d56ab41927357340ecae69e0db04128df52edc0cec6b4cefe812f
Opcode Fuzzy Hash: a5656303d6b3807ac1f93ecc58a132d0cbdce09c21fc921daa97ad4a94aebcc0
Instruction Fuzzy Hash: FA216DB2C043944DCF306B6B86853B77BE19F16306F84016BECD146245E23C7866C65F

Uniqueness

Uniqueness Score: -1.00%

Function 0043BD70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32 ref: 0043BD91

Strings

global_lock_spinlock, xrefs: 0043BDB8

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ExchangeInterlocked
String ID: global_lock_spinlock
API String ID: 367298776-4279298018
Opcode ID: 64ed229d09a556f6869bdeef32bbf37196e271bd7f7d7b5664fb385cb78e9ad4
Instruction ID: e2fc91aa2dae9bbd09f6307f58c1a26c95e6fb51d8a7f304a5d1f2538d915a1c
Opcode Fuzzy Hash: 64ed229d09a556f6869bdeef32bbf37196e271bd7f7d7b5664fb385cb78e9ad4
Instruction Fuzzy Hash: 23F01C749046058AD740AF26D54031B7AE0EBA4309F54966ED6818B326E77894489B9A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CA80 Relevance: .1, Instructions: 118
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0042CA80(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v32;
				unsigned int _v36;
				signed int _t36;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t55;
				signed int _t57;
				signed int _t60;
				signed int _t62;
				signed int _t71;
				signed int _t78;
				signed int _t87;
				signed int _t89;
				signed int _t92;
				signed int _t94;
				signed int _t101;
				signed int _t102;

				_t92 = _a16;
				_t55 = _a4;
				_t62 = _a8;
				_t87 = _a12;
				_v36 = _t55;
				_t71 = _t62;
				_t36 = _t87;
				if(_t92 != 0) {
					if(_t92 > _t62) {
						return 0;
					} else {
						asm("bsr edi, esi");
						_t89 = _t87 ^ 0x0000001f;
						if(_t89 == 0) {
							if(_t92 < _t62) {
								L17:
								_t57 = 1;
							} else {
								_t57 = 0;
								if(_t36 <= _v36) {
									goto L17;
								}
							}
							goto L5;
						} else {
							_t94 = _t92 << _t89 | _t36 >> 0x00000020;
							_v32 = _t36 << _t89;
							_t42 = _t71 << _t89 | _v36 >> 0x00000020 - _t89;
							_t43 = _t42 / _t94;
							_t101 = _t42 % _t94;
							_t60 = _t43;
							_t78 = _t43 * _v32 >> 0x20;
							_t44 = _t43 * _v32;
							if(_t101 < _t78 || _v36 << _t89 < _t44 && _t101 == _t78) {
								_t60 = _t60 - 1;
							}
							return _t60;
						}
					}
				} else {
					if(_t87 > _t62) {
						return _t55 / _t87;
					} else {
						_t102 = _t87;
						if(_t87 == 0) {
							_t102 = 1 / _t87;
						}
						_t89 = _t62 / _t102;
						_t57 = _t55 / _t102;
						L5:
						return _t57;
					}
				}
			}

0x0042ca87
0x0042ca8b
0x0042ca8f
0x0042ca93
0x0042ca99
0x0042ca9d
0x0042ca9f
0x0042caa1
0x0042cae2
0x0042cb61
0x0042cae4
0x0042cae4
0x0042cae7
0x0042caea
0x0042cb82
0x0042cb90
0x0042cb90
0x0042cb84
0x0042cb84
0x0042cb8a
0x00000000
0x00000000
0x0042cb8a
0x00000000
0x0042caf0
0x0042cb05
0x0042cb09
0x0042cb1f
0x0042cb23
0x0042cb25
0x0042cb27
0x0042cb29
0x0042cb29
0x0042cb2f
0x0042cb41
0x0042cb41
0x0042cb51
0x0042cb51
0x0042caea
0x0042caa3
0x0042caa5
0x0042cb75
0x0042caab
0x0042caad
0x0042caaf
0x0042caba
0x0042caba
0x0042cac6
0x0042caca
0x0042cacc
0x0042cad7
0x0042cad7
0x0042caa5

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afadc2eab2ff3b3027cca3738c1ff8411963936b93912ee887a9f088a56aa3e1
Instruction ID: ed5b5f1a63cc8107f1472cf0426e328277d1879bf9135a97fccd9baca80acf98
Opcode Fuzzy Hash: afadc2eab2ff3b3027cca3738c1ff8411963936b93912ee887a9f088a56aa3e1
Instruction Fuzzy Hash: 2021B437B093250B9714AC6FB8D515EF6C7A7D8264F99813FEA0CC3341ECB19C1A8699

Uniqueness

Uniqueness Score: -1.00%

Function 0042B280 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 83memoryfileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0042B2B0
vfprintf.MSVCRT ref: 0042B2C8
abort.MSVCRT(?,?,?,?,?,?,?,?,?,00400000,0042B3EE), ref: 0042B2CD
VirtualQuery.KERNEL32 ref: 0042B30C
memcpy.MSVCRT ref: 0042B330
VirtualProtect.KERNEL32 ref: 0042B374
memcpy.MSVCRT ref: 0042B39B
VirtualProtect.KERNEL32 ref: 0042B3C9

Strings

Mingw runtime failure:, xrefs: 0042B2A5
@, xrefs: 0042B361

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Virtual$Protectmemcpy$Queryabortfwritevfprintf
String ID: @$Mingw runtime failure:
API String ID: 978211760-2549925133
Opcode ID: 481118a8c24774bead5277e15e978baae0a2603b9b5df006a6ad611e5a89c511
Instruction ID: 528d92e29a79508f64584de84d4091f41f3d494de88997af7300f87b26bdbad7
Opcode Fuzzy Hash: 481118a8c24774bead5277e15e978baae0a2603b9b5df006a6ad611e5a89c511
Instruction Fuzzy Hash: 1D319EB59083459BD700EF29C18461EFBE0BF88748F959C1EF8D897351D778D9488B86

Uniqueness

Uniqueness Score: -1.00%

Function 0043AA80 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0043AA96
CreateSemaphoreA.KERNEL32 ref: 0043AAE6
CreateSemaphoreA.KERNEL32 ref: 0043AB10
InitializeCriticalSection.KERNEL32 ref: 0043AB2C
InitializeCriticalSection.KERNEL32 ref: 0043AB3A
InitializeCriticalSection.KERNEL32 ref: 0043AB48
CloseHandle.KERNEL32 ref: 0043AB73
CloseHandle.KERNEL32 ref: 0043AB85
free.MSVCRT ref: 0043AB90

Strings

l, xrefs: 0043AA87

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalInitializeSection$CloseCreateHandleSemaphore$callocfree
String ID: l
API String ID: 3701386200-2517025534
Opcode ID: 87313f87f4e5caeea46800d84f3a9730e52f3b3d48ec46b35b5d865762cec62f
Instruction ID: dbe5e94c8664ecda7efe431951d5c7c6cd7f96218d30a0d7d2e6a2ba6a86a44c
Opcode Fuzzy Hash: 87313f87f4e5caeea46800d84f3a9730e52f3b3d48ec46b35b5d865762cec62f
Instruction Fuzzy Hash: F7310CF14083008EEB10BF39E58535BBBE4AF44318F158AAED8944F286E779D458CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043AF80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 183synchronizationCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32 ref: 0043AFCA
WaitForSingleObject.KERNEL32 ref: 0043B00B
WaitForSingleObject.KERNEL32 ref: 0043B056
WaitForSingleObject.KERNEL32 ref: 0043B177
ResetEvent.KERNEL32 ref: 0043B1D4

Strings

(, xrefs: 0043B0B9

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Wait$ObjectSingle$EventMultipleObjectsReset
String ID: (
API String ID: 654736092-3887548279
Opcode ID: 0e3b8552fb09de9f006bf554c7f1a4cdfca246f95dac43cfbcd0b928e19659af
Instruction ID: 0e8ce6b69b44642137844e13484c84cc189cccd81effe6800983d4255a9c6ff4
Opcode Fuzzy Hash: 0e3b8552fb09de9f006bf554c7f1a4cdfca246f95dac43cfbcd0b928e19659af
Instruction Fuzzy Hash: BF51D87270430046DB246A6A954A32F76A5EBCC394F24693FFA98C7341DB3DC84987DB

Uniqueness

Uniqueness Score: -1.00%

Function 00436670 Relevance: 15.2, APIs: 4, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 004366A6
free.MSVCRT ref: 004366B5
free.MSVCRT ref: 004367D6

Strings

idList_shmem, xrefs: 00436780, 00436A36, 00436A5C
pthr_root_shmem, xrefs: 004369C0
idListMax_shmem, xrefs: 004369E8
pthr_last_shmem, xrefs: 00436920, 00436962
mtx_pthr_locked_shmem, xrefs: 004368C3, 004368F0
idListCnt_shmem, xrefs: 00436837, 0043689D, 00436988, 00436A0E

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: free
String ID: idListCnt_shmem$idListMax_shmem$idList_shmem$mtx_pthr_locked_shmem$pthr_last_shmem$pthr_root_shmem
API String ID: 1294909896-1441618966
Opcode ID: 47d7f0151eb60fe39a86d1aea4374055fdf84bd26276adef733f6528ccbb3d01
Instruction ID: 1ed47ff944916ae5163d6bfc6342058b48959d9ed6bd14901f8c8651a5b647e6
Opcode Fuzzy Hash: 47d7f0151eb60fe39a86d1aea4374055fdf84bd26276adef733f6528ccbb3d01
Instruction Fuzzy Hash: B2A16CB0608706EFD704EF25C58432ABBF4EF98748F52D91ED6848B360D7799804DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F850 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 210COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F9A2

Strings

basic_string::append, xrefs: 0040F9D7
/dev/random, xrefs: 0040FA67
random_device::random_device(const std::string&), xrefs: 0040FA7C
default, xrefs: 0040F9FC
Genu, xrefs: 0040FA92
/dev/urandom, xrefs: 0040FA2B, 0040FA54, 0040FAA3

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: memset
String ID: /dev/random$/dev/urandom$Genu$basic_string::append$default$random_device::random_device(const std::string&)
API String ID: 2221118986-705455346
Opcode ID: 5ce0955d9d14aa41da8507fe68be5aee5d5edde17b2dd59d561a50e4264a68a3
Instruction ID: 4954fe131f1188abe9475f078a50e68e6bf230f20d0affb11fca21cde60aab22
Opcode Fuzzy Hash: 5ce0955d9d14aa41da8507fe68be5aee5d5edde17b2dd59d561a50e4264a68a3
Instruction Fuzzy Hash: 346117B2B087015FD720AF29C480B6BBBE1AF95304F14887FE4C5A7791D378D8498B5A

Uniqueness

Uniqueness Score: -1.00%

Function 004385A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E004385A0(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v20;
				char* _v24;
				char* _v48;
				intOrPtr _v52;
				void* _t39;
				signed int _t42;
				signed int _t43;
				char* _t44;
				signed int _t46;
				void* _t48;
				signed int _t50;
				signed int _t51;
				char* _t57;
				void* _t63;
				signed int _t64;
				void* _t65;
				void* _t68;
				signed int _t72;
				intOrPtr _t76;
				intOrPtr _t78;
				void* _t80;
				char** _t81;
				char** _t82;
				char** _t84;

				_t74 = __edi;
				_push(__esi);
				_push(__ebx);
				_t81 = _t80 - 0x14;
				_t76 = _a4;
				_t39 = E00436AF0(__ebx, _t68, __edi, _t76);
				_t63 = _t39;
				 *((intOrPtr*)(_t39 + 4)) = _t76;
				_t40 =  *((intOrPtr*)(_t39 + 0xb0));
				if( *((intOrPtr*)(_t39 + 0xb0)) != 0) {
					E00437050(_t40, _t68, __eflags);
				}
				if(( *(_t63 + 0x20) & 0x00000030) != 0) {
					_t46 =  *0x5011d4;
					if(_t46 == 0) {
						_v20 = 0x435a90;
						_v24 = 4;
						 *_t81 = "_pthread_tls_shmem";
						_t46 = E0043BBA0(__eflags);
						 *0x5011d4 = _t46;
					}
					 *_t81 =  *_t46;
					_t48 = TlsGetValue(??);
					_t84 = _t81 - 4;
					_t65 = _t48;
					if(_t48 == 0) {
						L8:
						_a4 = _t76;
						goto L30;
					} else {
						if( *((intOrPtr*)(_t48 + 0x14)) == 0) {
							 *_t48 = 0xdeadbeef;
							_t50 =  *(_t48 + 0x18);
							__eflags = _t50;
							if(_t50 != 0) {
								 *_t84 = _t50;
								CloseHandle(??);
								_t84 = _t84 - 4;
							}
							 *(_t65 + 0x18) = 0;
							_t78 =  *((intOrPtr*)(_t65 + 4));
							__eflags =  *(_t65 + 0xac);
							if( *(_t65 + 0xac) != 0) {
								L11:
								_t51 =  *0x5011d4;
								__eflags = _t51;
								if(__eflags == 0) {
									_v20 = 0x435a90;
									_v24 = 4;
									 *_t84 = "_pthread_tls_shmem";
									_t51 = E0043BBA0(__eflags);
									 *0x5011d4 = _t51;
								}
								_v24 = 0;
								 *_t84 =  *_t51;
								TlsSetValue(??, ??);
								_a4 = _t78;
								L30:
								return __imp___endthreadex();
							} else {
								L16:
								E00436670(_t65);
								goto L11;
							}
						}
						_t78 =  *((intOrPtr*)(_t48 + 4));
						 *(_t48 + 0x64) = 1;
						_t57 =  *(_t48 + 0x18);
						if(_t57 != 0) {
							 *_t84 = _t57;
							CloseHandle(??);
							_t84 = _t84 - 4;
						}
						 *(_t65 + 0x18) = 0;
						if(( *(_t65 + 0x24) & 0x00000004) != 0) {
							 *_t65 = 0xdeadbeef;
							 *_t84 =  *(_t65 + 0x14);
							CloseHandle(??);
							_t84 = _t84 - 4;
							 *(_t65 + 0x14) = 0;
							__eflags =  *(_t65 + 0xac);
							if( *(_t65 + 0xac) == 0) {
								goto L16;
							}
							goto L11;
						} else {
							goto L8;
						}
					}
				}
				_t64 = _t63 + 0x6c;
				__eflags = _t64;
				_v24 = 1;
				 *_t81 = _t64;
				L0043D4F0();
				_t82 = _t81 - 0x1c;
				_t42 =  *0x5011e0;
				__eflags = _t42;
				if(__eflags == 0) {
					_v48 = 0;
					_v52 = 4;
					 *_t82 = "_pthread_cancelling_shmem";
					_t42 = E0043BBA0(__eflags);
					 *0x5011e0 = _t42;
				}
				__eflags =  *_t42;
				if( *_t42 != 0) {
					_t43 = E00436AF0(_t64, _t68, _t74, _t76);
					__eflags = _t43;
					_t72 = _t43;
					if(_t43 == 0) {
						goto L22;
					} else {
						__eflags =  *(_t43 + 0x10);
						if( *(_t43 + 0x10) > 0) {
							goto L22;
						} else {
							__eflags =  *(_t72 + 0x20) & 0x00000003;
							if(( *(_t72 + 0x20) & 0x00000003) == 0) {
								goto L22;
							} else {
								__eflags =  *(_t72 + 0x24) & 0x00000001;
								_t44 = 1;
								if(( *(_t72 + 0x24) & 0x00000001) == 0) {
									goto L22;
								} else {
								}
							}
						}
					}
				} else {
					L22:
					_t44 = 0;
					__eflags = 0;
				}
				return _t44;
			}

0x004385a0
0x004385a0
0x004385a1
0x004385a2
0x004385a5
0x004385a9
0x004385ae
0x004385b0
0x004385b3
0x004385bb
0x00438630
0x00438630
0x004385c1
0x004385c7
0x004385ce
0x004386d0
0x004386d8
0x004386e0
0x004386e7
0x004386ec
0x004386ec
0x004385d6
0x004385d9
0x004385de
0x004385e3
0x004385e5
0x0043861b
0x0043861b
0x00000000
0x004385e7
0x004385ec
0x00438695
0x0043869b
0x0043869e
0x004386a0
0x004386a2
0x004386a5
0x004386aa
0x004386aa
0x004386b3
0x004386ba
0x004386bd
0x004386bf
0x00438665
0x00438665
0x0043866a
0x0043866c
0x00438700
0x00438708
0x00438710
0x00438717
0x0043871c
0x0043871c
0x00438672
0x0043867c
0x0043867f
0x00438687
0x0043d4e0
0x0043d4e0
0x004386c1
0x004386c1
0x004386c3
0x00000000
0x004386c3
0x004386bf
0x004385f2
0x004385f5
0x004385fc
0x00438601
0x00438603
0x00438606
0x0043860b
0x0043860b
0x00438612
0x00438619
0x00438643
0x00438649
0x0043864c
0x00438657
0x0043865a
0x00438661
0x00438663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00438619
0x004385e5
0x00438726
0x00438726
0x00438729
0x00438731
0x00438734
0x00438740
0x00438743
0x00438748
0x0043874a
0x00438785
0x0043878d
0x00438795
0x0043879c
0x004387a1
0x004387a1
0x0043874e
0x00438750
0x00438760
0x00438765
0x00438767
0x00438769
0x00000000
0x0043876b
0x0043876e
0x00438770
0x00000000
0x00438772
0x00438772
0x00438776
0x00000000
0x00438778
0x00438778
0x0043877c
0x00438781
0x00000000
0x00000000
0x00438783
0x00438781
0x00438776
0x00438770
0x00438752
0x00438752
0x00438752
0x00438752
0x00438752
0x00438757

APIs

Part of subcall function 00436AF0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004382C7), ref: 00436B1F

TlsGetValue.KERNEL32 ref: 004385D9
CloseHandle.KERNEL32 ref: 00438606

Strings

_pthread_tls_shmem, xrefs: 004386E0, 00438710

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Value$CloseHandle
String ID: _pthread_tls_shmem
API String ID: 152943319-3306369367
Opcode ID: 0ab1959d0feb96cedbcbc06bd059713b59e07e307bad38f8eeff3e61f80de730
Instruction ID: 2dd2a8fc5ab4f0645c25caa009d1227e8052ba6b46ce59b4dc46c9181b30d69b
Opcode Fuzzy Hash: 0ab1959d0feb96cedbcbc06bd059713b59e07e307bad38f8eeff3e61f80de730
Instruction Fuzzy Hash: 08415FB0A04700CFEB14EF25D68571BBBE4AF08348F05556EE9858F356EB78D804DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00439C00 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 64COMMON

Download Yara Rule

Strings

7, xrefs: 00439CBC
(m_->valid == LIFE_MUTEX) && (m_->busy > 0), xrefs: 00439CCC
Assertion failed: (%s), file %s, line %d, xrefs: 00439CD4
C:/crossdev/src/winpthreads-git20150508/src/mutex.c, xrefs: 00439CC4
mutex_global_shmem, xrefs: 00439C70, 00439CA1

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: (m_->valid == LIFE_MUTEX) && (m_->busy > 0)$7$Assertion failed: (%s), file %s, line %d$C:/crossdev/src/winpthreads-git20150508/src/mutex.c$mutex_global_shmem
API String ID: 0-2294020286
Opcode ID: ea14f078db4baa2907177413255d535b830cc1ba507d23d7c7cf80a13b9fa81c
Instruction ID: 18b7ac79861a80f11e88f793c57b6e36eb2c5a0de9640029c39ff26f7e6c6871
Opcode Fuzzy Hash: ea14f078db4baa2907177413255d535b830cc1ba507d23d7c7cf80a13b9fa81c
Instruction Fuzzy Hash: CF2141B0608301DFDB10EF29E48571ABBE4FB58358F05941EE5988B305D7B8D884DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C320 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E0043C320(int __eax, int __edx) {
				intOrPtr _v28;
				char* _v32;
				char* _v36;
				char* _v40;
				void* _v76;
				intOrPtr _v100;
				char* _t26;
				char* _t30;
				int _t31;
				void* _t32;
				void* _t34;
				void* _t36;
				void* _t40;
				char* _t46;
				char* _t47;
				int _t53;
				void* _t55;
				void* _t61;
				void* _t66;
				int _t71;
				int _t72;
				void* _t81;
				void* _t83;
				void* _t86;
				char** _t87;
				void** _t88;

				_t62 = __edx;
				_t53 = __eax;
				_t71 = __edx;
				_t87 = _t86 - 0x24;
				_t26 =  *0x501210;
				if(_t26 == 0) {
					_v36 = 0x43c6a0;
					_v40 = 4;
					 *_t87 = "rwl_global_shmem";
					_t26 = E0043BBA0(__eflags);
					 *0x501210 = _t26;
				}
				 *_t87 = _t26;
				E0043BFB0();
				if( *((intOrPtr*)( *_t53)) != 0xbab1f0ed ||  *((intOrPtr*)( *_t53 + 4)) <= 0) {
					_v28 = 0x2e;
					_v32 = "C:/crossdev/src/winpthreads-git20150508/src/rwlock.c";
					_v36 = "(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)";
					_v40 = "Assertion failed: (%s), file %s, line %d\n";
					_t30 = __imp___iob + 0x40;
					__eflags = _t30;
					 *_t87 = _t30;
					_t31 = fprintf(??, ??);
					 *_t87 = 1;
					exit(??);
					_t72 = _t31;
					_t88 = _t87 - 0x2c;
					 *_t31 = 0;
					_v100 = 0x20;
					 *_t88 = 1;
					_t32 = calloc(_t53, _t71);
					__eflags = _t32;
					if(_t32 == 0) {
						return 0xc;
					} else {
						_t13 = _t32 + 0x14; // 0x14
						_t66 = _t13;
						 *_t32 = 0xdeadb0ef;
						 *((intOrPtr*)(_t32 + 0x10)) = 0;
						 *((intOrPtr*)(_t32 + 0xc)) = 0;
						 *((intOrPtr*)(_t32 + 8)) = 0;
						_t55 = _t32;
						_v100 = 0;
						 *_t88 = _t66;
						_t34 = E00439FA0(_t61, _t62);
						__eflags = _t34;
						_t81 = _t34;
						if(_t34 != 0) {
							 *_t88 = _t55;
							free(??);
							return _t81;
						} else {
							_t18 = _t55 + 0x18; // 0x18
							_t83 = _t18;
							_v100 = 0;
							 *_t88 = _t83;
							_t36 = E00439FA0(_t61, _t62);
							__eflags = _t36;
							if(__eflags != 0) {
								_v76 = _t36;
								 *_t88 = _t66;
								goto L16;
							} else {
								_t20 = _t55 + 0x1c; // 0x1c
								_v100 = 0;
								 *_t88 = _t20;
								_t40 = E0043AF40();
								__eflags = _t40;
								if(__eflags != 0) {
									 *_t88 = _t66;
									_v76 = _t40;
									E0043A740(_t61, __eflags);
									 *_t88 = _t83;
									L16:
									E0043A740(_t61, __eflags);
									 *_t88 = _t55;
									free(??);
									return _v76;
								} else {
									 *_t55 = 0xbab1f0ed;
									 *_t72 = _t55;
									__eflags = 0;
									return 0;
								}
							}
						}
					}
				} else {
					 *((intOrPtr*)( *_t53 + 4)) =  *((intOrPtr*)( *_t53 + 4)) - 1;
					_t46 =  *0x501210;
					if(_t46 == 0) {
						_v36 = 0x43c6a0;
						_v40 = 4;
						 *_t87 = "rwl_global_shmem";
						_t47 = E0043BBA0(__eflags);
						 *_t87 = _t47;
						 *0x501210 = _t47;
						E0043C060();
						return _t71;
					} else {
						 *_t87 = _t46;
						E0043C060();
						return _t71;
					}
				}
			}

0x0043c320
0x0043c322
0x0043c324
0x0043c326
0x0043c329
0x0043c330
0x0043c3a1
0x0043c3a9
0x0043c3b1
0x0043c3b8
0x0043c3bd
0x0043c3bd
0x0043c332
0x0043c335
0x0043c342
0x0043c3cc
0x0043c3d4
0x0043c3dc
0x0043c3e4
0x0043c3ec
0x0043c3ec
0x0043c3ef
0x0043c3f2
0x0043c3f7
0x0043c3fe
0x0043c414
0x0043c416
0x0043c419
0x0043c41f
0x0043c427
0x0043c42e
0x0043c433
0x0043c435
0x0043c4cf
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43e
0x0043c444
0x0043c44b
0x0043c452
0x0043c459
0x0043c45b
0x0043c463
0x0043c466
0x0043c46b
0x0043c46d
0x0043c46f
0x0043c4b1
0x0043c4b4
0x0043c4c2
0x0043c471
0x0043c471
0x0043c471
0x0043c474
0x0043c47c
0x0043c47f
0x0043c484
0x0043c486
0x0043c4d0
0x0043c4d4
0x00000000
0x0043c488
0x0043c488
0x0043c48b
0x0043c493
0x0043c496
0x0043c49b
0x0043c49d
0x0043c4f2
0x0043c4f5
0x0043c4f9
0x0043c4fe
0x0043c4d7
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4f1
0x0043c49f
0x0043c49f
0x0043c4a5
0x0043c4ab
0x0043c4b0
0x0043c4b0
0x0043c49d
0x0043c486
0x0043c46f
0x0043c351
0x0043c353
0x0043c357
0x0043c35e
0x0043c370
0x0043c378
0x0043c380
0x0043c387
0x0043c38c
0x0043c38f
0x0043c394
0x0043c3a0
0x0043c360
0x0043c360
0x0043c363
0x0043c36f
0x0043c36f
0x0043c35e

Strings

Assertion failed: (%s), file %s, line %d, xrefs: 0043C3E4
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 0043C3DC
C:/crossdev/src/winpthreads-git20150508/src/rwlock.c, xrefs: 0043C3D4
., xrefs: 0043C3CC
rwl_global_shmem, xrefs: 0043C380, 0043C3B1

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectReleaseSingleThreadWaitfreemallocmemcpystrlen
String ID: (((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$.$Assertion failed: (%s), file %s, line %d$C:/crossdev/src/winpthreads-git20150508/src/rwlock.c$rwl_global_shmem
API String ID: 3812948584-3571693141
Opcode ID: 114bc64a01216010a10afb5dc246f535fd9dd7fd073271ab0629c94d2a25e01e
Instruction ID: 69e968675bc76213cd08b4be24315c88aee4d539c034ac2414849845ba73a2ed
Opcode Fuzzy Hash: 114bc64a01216010a10afb5dc246f535fd9dd7fd073271ab0629c94d2a25e01e
Instruction Fuzzy Hash: 802118B16082418FDB00EF29E48571EBBE0FF58358F05E81EE5849B311D778D898CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A9A0 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0043A9B2
LeaveCriticalSection.KERNEL32 ref: 0043A9D6
InterlockedExchangeAdd.KERNEL32 ref: 0043AA06
ReleaseSemaphore.KERNEL32 ref: 0043AA2C
LeaveCriticalSection.KERNEL32 ref: 0043AA3B

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlockedReleaseSemaphore
String ID:
API String ID: 3008583290-0
Opcode ID: 39eefa2fd8e995d4b7236330f8826f620e55f1a5a8ce1d083daafbbe7c0515ee
Instruction ID: 6652bda1ed7cfa67283dd1c3665bfb4811379c9af3ee29a79c613414e57f84b7
Opcode Fuzzy Hash: 39eefa2fd8e995d4b7236330f8826f620e55f1a5a8ce1d083daafbbe7c0515ee
Instruction Fuzzy Hash: A9214FB2A083044BD7047E7AA98521FBBE5EBC8319F051A3FE989C7341D579D858C787

Uniqueness

Uniqueness Score: -1.00%

Function 00438310 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0043831B

Part of subcall function 00436AF0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004382C7), ref: 00436B1F

Part of subcall function 0043BFB0: EnterCriticalSection.KERNEL32 ref: 0043BFD3
Part of subcall function 0043BFB0: GetCurrentThreadId.KERNEL32 ref: 0043BFDB

SetLastError.KERNEL32(?,?,?,?,?,?,0000000A,?,?,0042BF13), ref: 0043835B
realloc.MSVCRT ref: 00438384
realloc.MSVCRT ref: 0043839F
memset.MSVCRT ref: 004383D0
memset.MSVCRT ref: 004383EF

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ErrorLastmemsetrealloc$CriticalCurrentEnterSectionThreadValue
String ID:
API String ID: 2483718828-0
Opcode ID: 2b991ac583324c5d4f2076b08c83c9a28005ced037b12d733ed84bba57b13fdb
Instruction ID: 2d828eab537e5c03b2d72faf244a94f4981ab9897d08ff59a01e12934438311d
Opcode Fuzzy Hash: 2b991ac583324c5d4f2076b08c83c9a28005ced037b12d733ed84bba57b13fdb
Instruction Fuzzy Hash: 543106B0A083058FC704EF2AD48069EBBE4EF88358F05592EF88897311D739D845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B230 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0043B246
InterlockedDecrement.KERNEL32 ref: 0043B255
LeaveCriticalSection.KERNEL32 ref: 0043B266
EnterCriticalSection.KERNEL32 ref: 0043B299
LeaveCriticalSection.KERNEL32 ref: 0043B2A8

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$EnterLeave$DecrementInterlocked
String ID:
API String ID: 1781445796-0
Opcode ID: 3f64820c9508d35d7959de1756f98c0a43e87d843261d461c26acf3746c752a2
Instruction ID: 26b56c1294838656c658971b065320bf546af459f1bf5dd776ae346c46426df6
Opcode Fuzzy Hash: 3f64820c9508d35d7959de1756f98c0a43e87d843261d461c26acf3746c752a2
Instruction Fuzzy Hash: 2B012EB69083104BC700BF7AA58541FFBF4EE88318F011A7EED8587301E239D854CA87

Uniqueness

Uniqueness Score: -1.00%

Function 00439FA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00439FCF
CreateSemaphoreA.KERNEL32 ref: 0043A02C

Strings

mutex_global_shmem, xrefs: 0043A0C0, 0043A0F0, 0043A113

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CreateSemaphorecalloc
String ID: mutex_global_shmem
API String ID: 194818478-3168236926
Opcode ID: e8a91ee6741951d95c4b24459ae75f4536334de3b8cbc5e7dcaf1479026d262a
Instruction ID: 7dd052dc4d3c0f70d6b14379b13e535935c83e5abfa1dab09bfb2fa559f70b45
Opcode Fuzzy Hash: e8a91ee6741951d95c4b24459ae75f4536334de3b8cbc5e7dcaf1479026d262a
Instruction Fuzzy Hash: 12317AB06083019FE700AF25E58572BBBE0EB48358F15981EE5D88B351D77DC894DB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00435DA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

Strings

once_obj_shmem, xrefs: 00435EA2, 00435EFC
once_global_shmem, xrefs: 00435E59, 00435E7C
%p not found?!?!, xrefs: 00435EC1

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: %p not found?!?!$once_global_shmem$once_obj_shmem
API String ID: 0-1814957349
Opcode ID: 47815b744350093856f76170f4194fa3b534b1d9fccf2f1c7ae24bd6eeee1e5b
Instruction ID: 2e78075db2c5618674d934cff079e95f62e0c7551df30ba1ca0c06472ab188f8
Opcode Fuzzy Hash: 47815b744350093856f76170f4194fa3b534b1d9fccf2f1c7ae24bd6eeee1e5b
Instruction Fuzzy Hash: 20316EB0A08B01DFD714AF25D48532BBBE4AF48308F59E81FD6858B301D77C9945DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E0042C640(void* __ebp, char* _a4) {
				char _v16;
				intOrPtr _v36;
				char* _v40;
				intOrPtr* _t15;
				intOrPtr* _t16;
				intOrPtr _t17;
				intOrPtr* _t18;
				intOrPtr* _t19;
				char _t20;
				char** _t24;
				char* _t27;
				void* _t31;
				char** _t32;

				_t31 = __ebp;
				_t32 =  &_v40;
				_t27 = _a4;
				_t28 = _t27[0xc];
				if(_t27[0xc] == 0) {
					L8:
					 *_t32 = _t27;
					return E0042C230(_t31);
				}
				_t15 =  *0x5007e8; // 0x1f0da0
				if(_t15 == 0) {
					L12:
					_v36 = 0x42b890;
					_v40 = 4;
					 *_t32 = "use_fc_key";
					_t16 = E0042CC10(__eflags);
					 *0x5007e8 = _t16;
					__eflags =  *_t16;
					if(__eflags >= 0) {
						L15:
						_t17 =  *_t16;
						L3:
						if(_t17 == 0) {
							_t18 =  *0x5007f0; // 0x0
							__eflags = _t18;
							if(__eflags == 0) {
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_static";
								_t19 = E0042CC10(__eflags);
								 *0x5007f0 = _t19;
								_t20 =  *_t19;
							} else {
								_t20 =  *_t18;
							}
						} else {
							_t24 =  *0x5007ec; // 0x1f04a0
							if(_t24 == 0) {
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_key";
								_t24 = E0042CC10(__eflags);
								 *0x5007ec = _t24;
							}
							 *_t32 =  *_t24;
							_t20 = E004382B0(_t28);
						}
						_v16 = _t20;
						if(E0042BBC0(_t27,  &_v16) == 7) {
							E0042BAB0();
							goto L12;
						} else {
							abort();
							goto L8;
						}
					}
					L13:
					E0042B9E0();
					_t16 =  *0x5007e8; // 0x1f0da0
					__eflags = _t16;
					if(__eflags == 0) {
						_v36 = 0x42b890;
						_v40 = 4;
						 *_t32 = "use_fc_key";
						_t16 = E0042CC10(__eflags);
						 *0x5007e8 = _t16;
					}
					goto L15;
				}
				_t17 =  *_t15;
				if(_t17 < 0) {
					goto L13;
				}
				goto L3;
			}

0x0042c640
0x0042c641
0x0042c644
0x0042c648
0x0042c64d
0x0042c6a0
0x0042c6a0
0x0042c6ac
0x0042c6ac
0x0042c64f
0x0042c656
0x0042c6d0
0x0042c6d0
0x0042c6d8
0x0042c6e0
0x0042c6e7
0x0042c6ee
0x0042c6f3
0x0042c6f5
0x0042c726
0x0042c726
0x0042c662
0x0042c664
0x0042c6b0
0x0042c6b5
0x0042c6b7
0x0042c730
0x0042c738
0x0042c740
0x0042c747
0x0042c74c
0x0042c751
0x0042c6b9
0x0042c6b9
0x0042c6b9
0x0042c666
0x0042c666
0x0042c66d
0x0042c760
0x0042c768
0x0042c770
0x0042c777
0x0042c77c
0x0042c77c
0x0042c675
0x0042c678
0x0042c678
0x0042c681
0x0042c68f
0x0042c6c4
0x00000000
0x0042c691
0x0042c691
0x00000000
0x0042c691
0x0042c68f
0x0042c6f7
0x0042c6f7
0x0042c6fc
0x0042c701
0x0042c703
0x0042c705
0x0042c70d
0x0042c715
0x0042c71c
0x0042c721
0x0042c721
0x00000000
0x0042c703
0x0042c658
0x0042c65c
0x00000000
0x00000000
0x00000000

APIs

abort.MSVCRT ref: 0042C691

Strings

fc_key, xrefs: 0042C770
use_fc_key, xrefs: 0042C6E0, 0042C715
fc_static, xrefs: 0042C740

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: abort
String ID: fc_key$fc_static$use_fc_key
API String ID: 4206212132-2840716747
Opcode ID: 8ca43725764354c695c29e147c11743c239105381c80cf3161235c3d87259257
Instruction ID: 16e5463ec3e7e04ba0a092706142a41f234b6fb4dd2a67069b1c0f506fb26b11
Opcode Fuzzy Hash: 8ca43725764354c695c29e147c11743c239105381c80cf3161235c3d87259257
Instruction Fuzzy Hash: 6231D4B07053118FD700EF26E48171E77E4EF44348F90A81EE5898B351D778A8499FDA

Uniqueness

Uniqueness Score: -1.00%

Function 0042C520 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0042C520(intOrPtr _a4) {
				char _v16;
				char* _v36;
				intOrPtr _v40;
				intOrPtr* _t13;
				intOrPtr* _t14;
				intOrPtr* _t15;
				intOrPtr _t16;
				intOrPtr* _t17;
				intOrPtr* _t18;
				char _t19;
				intOrPtr _t20;
				void* _t21;
				char** _t23;
				intOrPtr _t26;
				void* _t29;
				void* _t31;
				char** _t32;

				_t32 =  &_v36;
				_t13 =  *0x5007e8; // 0x1f0da0
				_t26 = _a4;
				if(_t13 == 0) {
					_v36 = 0x42b890;
					_v40 = 4;
					 *_t32 = "use_fc_key";
					_t14 = E0042CC10(__eflags);
					__eflags =  *_t14;
					 *0x5007e8 = _t14;
					if( *_t14 >= 0) {
						L16:
						_t15 =  *0x5007e8; // 0x1f0da0
						__eflags = _t15;
						if(__eflags == 0) {
							_v36 = 0x42b890;
							_v40 = 4;
							 *_t32 = "use_fc_key";
							_t15 = E0042CC10(__eflags);
							 *0x5007e8 = _t15;
						}
						_t16 =  *_t15;
						L2:
						if(_t16 == 0) {
							L9:
							_t17 =  *0x5007f0; // 0x0
							if(_t17 == 0) {
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_static";
								_t18 = E0042CC10(__eflags);
								 *0x5007f0 = _t18;
								_t19 =  *_t18;
							} else {
								_t19 =  *_t17;
							}
							L5:
							_t27 =  *((intOrPtr*)(_t26 + 0xc));
							_v16 = _t19;
							_t20 = _t26;
							if( *((intOrPtr*)(_t26 + 0xc)) != 0) {
								_t21 = E0042BBC0(_t20,  &_v16);
							} else {
								_t21 = E0042B940(_t20, _t26,  &_v16, _t29,  &_v16, _t31);
							}
							if(_t21 == 7) {
								E0042BAB0();
								L13:
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_key";
								_t23 = E0042CC10(__eflags);
								 *0x5007ec = _t23;
								L4:
								 *_t32 =  *_t23;
								_t19 = E004382B0(_t27);
								goto L5;
							} else {
								abort();
								goto L9;
							}
						}
						_t23 =  *0x5007ec; // 0x1f04a0
						if(_t23 == 0) {
							goto L13;
						}
						goto L4;
					}
					L15:
					E0042B9E0();
					goto L16;
				}
				_t16 =  *_t13;
				if(_t16 < 0) {
					goto L15;
				}
				goto L2;
			}

0x0042c522
0x0042c525
0x0042c52a
0x0042c530
0x0042c5bb
0x0042c5c3
0x0042c5cb
0x0042c5d2
0x0042c5d7
0x0042c5da
0x0042c5df
0x0042c5e6
0x0042c5e6
0x0042c5eb
0x0042c5ed
0x0042c5ef
0x0042c5f7
0x0042c5ff
0x0042c606
0x0042c60b
0x0042c60b
0x0042c610
0x0042c540
0x0042c542
0x0042c579
0x0042c579
0x0042c580
0x0042c617
0x0042c61f
0x0042c627
0x0042c62e
0x0042c633
0x0042c638
0x0042c586
0x0042c586
0x0042c586
0x0042c557
0x0042c557
0x0042c55e
0x0042c562
0x0042c568
0x0042c58a
0x0042c56a
0x0042c56a
0x0042c56a
0x0042c572
0x0042c593
0x0042c598
0x0042c598
0x0042c5a0
0x0042c5a8
0x0042c5af
0x0042c5b4
0x0042c54d
0x0042c54f
0x0042c552
0x00000000
0x0042c574
0x0042c574
0x00000000
0x0042c574
0x0042c572
0x0042c544
0x0042c54b
0x00000000
0x00000000
0x00000000
0x0042c54b
0x0042c5e1
0x0042c5e1
0x00000000
0x0042c5e1
0x0042c536
0x0042c53a
0x00000000
0x00000000
0x00000000

APIs

abort.MSVCRT ref: 0042C574

Strings

fc_key, xrefs: 0042C5A8
use_fc_key, xrefs: 0042C5CB, 0042C5FF
fc_static, xrefs: 0042C627

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: abort
String ID: fc_key$fc_static$use_fc_key
API String ID: 4206212132-2840716747
Opcode ID: a56f7af088029c1503d585d243efb1daf242a629d6f05d423dadd1f229dcafa0
Instruction ID: c3e54ca8eb8ef5b2fb2e58862e58249095b8c7d23d31e16215ad9e942f9b3b8b
Opcode Fuzzy Hash: a56f7af088029c1503d585d243efb1daf242a629d6f05d423dadd1f229dcafa0
Instruction Fuzzy Hash: E821D4B03052219ADB10EF26E48172E7BE4EB44788F90981EE5848B351D77CE885DBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043BE30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0043BE47
InitializeCriticalSection.KERNEL32 ref: 0043BE58
SetCriticalSectionSpinCount.KERNEL32 ref: 0043BE6B

Strings

, xrefs: 0043BE38

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$CountInitializeSpincalloc
String ID:
API String ID: 1612259017-3916222277
Opcode ID: 61f0ea035d7994c11323c9b2c2d24568a1ea55af336413b7695b1c851f3f1624
Instruction ID: 3a341486998524d459d197d44c8350c218554f47d216dca70cf6ba02041b939f
Opcode Fuzzy Hash: 61f0ea035d7994c11323c9b2c2d24568a1ea55af336413b7695b1c851f3f1624
Instruction Fuzzy Hash: 0BF0A0B26083004AE3007F3CB9466ABBBE4EB84354F454A7EE8C487246D3788895C7D7

Uniqueness

Uniqueness Score: -1.00%

Function 0043C410 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0043C410(void** __eax) {
				intOrPtr _v32;
				intOrPtr _v56;
				void* _t15;
				void* _t17;
				intOrPtr _t19;
				intOrPtr _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				void* _t30;
				void** _t31;
				void* _t32;
				void* _t33;
				void* _t34;
				void** _t35;

				_t31 = __eax;
				_t35 = _t34 - 0x2c;
				 *((intOrPtr*)(__eax)) = 0;
				_v56 = 0x20;
				 *_t35 = 1;
				_t15 = calloc(??, ??);
				if(_t15 == 0) {
					return 0xc;
				} else {
					_t2 = _t15 + 0x14; // 0x14
					_t30 = _t2;
					 *_t15 = 0xdeadb0ef;
					 *((intOrPtr*)(_t15 + 0x10)) = 0;
					 *((intOrPtr*)(_t15 + 0xc)) = 0;
					 *((intOrPtr*)(_t15 + 8)) = 0;
					_t26 = _t15;
					_v56 = 0;
					 *_t35 = _t30;
					_t17 = E00439FA0(_t27, _t28);
					_t32 = _t17;
					if(_t17 != 0) {
						 *_t35 = _t26;
						free(??);
						return _t32;
					} else {
						_t7 = _t26 + 0x18; // 0x18
						_t33 = _t7;
						_v56 = 0;
						 *_t35 = _t33;
						_t19 = E00439FA0(_t27, _t28);
						if(_t19 != 0) {
							_v32 = _t19;
							 *_t35 = _t30;
							goto L8;
						} else {
							_t9 = _t26 + 0x1c; // 0x1c
							_v56 = 0;
							 *_t35 = _t9;
							_t23 = E0043AF40();
							if(_t23 != 0) {
								 *_t35 = _t30;
								_v32 = _t23;
								E0043A740(_t27, __eflags);
								 *_t35 = _t33;
								L8:
								E0043A740(_t27, __eflags);
								 *_t35 = _t26;
								free(??);
								return _v32;
							} else {
								 *_t26 = 0xbab1f0ed;
								 *_t31 = _t26;
								return 0;
							}
						}
					}
				}
			}

0x0043c414
0x0043c416
0x0043c419
0x0043c41f
0x0043c427
0x0043c42e
0x0043c435
0x0043c4cf
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43e
0x0043c444
0x0043c44b
0x0043c452
0x0043c459
0x0043c45b
0x0043c463
0x0043c466
0x0043c46d
0x0043c46f
0x0043c4b1
0x0043c4b4
0x0043c4c2
0x0043c471
0x0043c471
0x0043c471
0x0043c474
0x0043c47c
0x0043c47f
0x0043c486
0x0043c4d0
0x0043c4d4
0x00000000
0x0043c488
0x0043c488
0x0043c48b
0x0043c493
0x0043c496
0x0043c49d
0x0043c4f2
0x0043c4f5
0x0043c4f9
0x0043c4fe
0x0043c4d7
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4f1
0x0043c49f
0x0043c49f
0x0043c4a5
0x0043c4b0
0x0043c4b0
0x0043c49d
0x0043c486
0x0043c46f

APIs

calloc.MSVCRT ref: 0043C42E
free.MSVCRT ref: 0043C4B4
free.MSVCRT ref: 0043C4DF

Strings

, xrefs: 0043C41F

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: free$calloc
String ID:
API String ID: 3095843317-3916222277
Opcode ID: 9d49e0e25256c0cdf1d0b7f0e359b083908d7e673c75fd90129bdb1a3645acd5
Instruction ID: 6ed584d97483dc5471c8ebf37d34033bd514768df12a83c7c172324f7564abe3
Opcode Fuzzy Hash: 9d49e0e25256c0cdf1d0b7f0e359b083908d7e673c75fd90129bdb1a3645acd5
Instruction Fuzzy Hash: E52112B11043048FD710AF66E4D576BBBE4EF88328F05586EE5888B342E37E8855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00439EB0 Relevance: 6.1, APIs: 4, Instructions: 71
threadCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00439EB0(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				char* _v32;
				char* _v36;
				char* _v40;
				void* __ebx;
				void* __edi;
				void** __esi;
				intOrPtr* _t26;
				char* _t27;
				char* _t30;
				intOrPtr* _t32;
				char* _t35;
				char* _t36;
				intOrPtr* _t45;
				void* _t49;
				intOrPtr _t53;
				void* _t55;
				void* _t58;
				void* _t59;
				char** _t61;

				_t49 = __edx;
				_t59 = _t58 - 0x10;
				_t53 = _a4;
				_t26 = E00439A10(_t53, __ecx, __edx);
				if(_t26 != 0) {
					return _t26;
				} else {
					__ebx =  *__esi;
					__edx =  *(__ebx + 8);
					__eflags =  *(__ebx + 8);
					if( *(__ebx + 8) != 0) {
						__edi =  *(__ebx + 0x14);
						__eflags = __edi;
						if(__eflags == 0) {
							__eax = __ebx;
							goto L21;
						} else {
							__eflags = __edi - GetCurrentThreadId();
							if(__eflags == 0) {
								__eflags =  *(__ebx + 8) - 2;
								if( *(__ebx + 8) != 2) {
									goto L13;
								} else {
									_t24 = __ebx + 0xc; // 0xc
									__eax = _t24;
									__eax = InterlockedDecrement(_t24);
									__esp = __esp - 4;
									__eflags = __eax;
									if(__eflags == 0) {
										goto L13;
									} else {
										__edx = 0;
									}
								}
								goto L16;
							} else {
								__eax =  *__esi;
								L21:
								__esp = __esp + 0x10;
								__edx = 1;
								_pop(__ebx);
								_pop(__esi);
								_pop(__edi);
							}
						}
					} else {
						__eax =  *(__ebx + 0x14);
						__eflags =  *(__ebx + 0x14);
						if(__eflags == 0) {
							__edx = 1;
							__eax = __ebx;
						} else {
							L13:
							__eax =  *(__ebx + 0x18);
							 *(__ebx + 0x14) = 0;
							__eflags = __eax;
							if(__eax == 0) {
								L15:
								__edx = 0;
								__eflags = 0;
							} else {
								__eax = ReleaseSemaphore(__eax, 1, 0);
								__esp = __esp - 0xc;
								__eflags = __eax;
								if(__eflags == 0) {
									__eax = GetCurrentThreadId();
									__edx = 1;
									 *(__ebx + 0x14) = __eax;
								} else {
									goto L15;
								}
							}
							L16:
							__eax =  *__esi;
						}
						__esp = __esp + 0x10;
						_pop(__ebx);
						_pop(__esi);
						_pop(__edi);
					}
					_push(_t53);
					_push(_t43);
					_t45 = _t26;
					_t55 = _t49;
					_t61 = _t59 - 0x24;
					_t27 =  *0x5011f8;
					if(_t27 == 0) {
						_v36 = 0x439d00;
						_v40 = 4;
						 *_t61 = "mutex_global_shmem";
						_t27 = E0043BBA0(__eflags);
						 *0x5011f8 = _t27;
					}
					 *_t61 = _t27;
					E0043BFB0();
					if( *_t45 != 0xbab1f00d ||  *((intOrPtr*)(_t45 + 4)) <= 0) {
						_v28 = 0x37;
						_v32 = "C:/crossdev/src/winpthreads-git20150508/src/mutex.c";
						_v36 = "(m_->valid == LIFE_MUTEX) && (m_->busy > 0)";
						_v40 = "Assertion failed: (%s), file %s, line %d\n";
						_t30 = __imp___iob + 0x40;
						__eflags = _t30;
						 *_t61 = _t30;
						fprintf(??, ??);
						 *_t61 = 1;
						exit(??);
						_t32 = _v40;
						 *_t32 = 0xffffffff;
						return _t32;
					} else {
						if( *((intOrPtr*)(_t45 + 4)) > 0) {
							 *((intOrPtr*)(_t45 + 4)) =  *((intOrPtr*)(_t45 + 4)) - 1;
						}
						_t35 =  *0x5011f8;
						if(_t35 == 0) {
							_v36 = 0x439d00;
							_v40 = 4;
							 *_t61 = "mutex_global_shmem";
							_t36 = E0043BBA0(__eflags);
							 *_t61 = _t36;
							 *0x5011f8 = _t36;
							E0043C060();
							return _t55;
						} else {
							 *_t61 = _t35;
							E0043C060();
							return _t55;
						}
					}
				}
			}

0x00439eb0
0x00439eb3
0x00439eb6
0x00439ebc
0x00439ec3
0x00439f46
0x00439ec5
0x00439ec5
0x00439ec7
0x00439eca
0x00439ecc
0x00439f15
0x00439f18
0x00439f1a
0x00439f50
0x00000000
0x00439f1c
0x00439f21
0x00439f23
0x00439f63
0x00439f67
0x00000000
0x00439f6d
0x00439f6d
0x00439f6d
0x00439f73
0x00439f78
0x00439f7b
0x00439f7d
0x00000000
0x00439f83
0x00439f83
0x00439f83
0x00439f7d
0x00000000
0x00439f25
0x00439f25
0x00439f27
0x00439f27
0x00439f2a
0x00439f2f
0x00439f30
0x00439f31
0x00439f31
0x00439f23
0x00439ece
0x00439ece
0x00439ed1
0x00439ed3
0x00439f90
0x00439f95
0x00439ed9
0x00439ed9
0x00439ed9
0x00439edc
0x00439ee3
0x00439ee5
0x00439f06
0x00439f06
0x00439f06
0x00439ee7
0x00439efa
0x00439eff
0x00439f02
0x00439f04
0x00439f54
0x00439f59
0x00439f5e
0x00000000
0x00000000
0x00000000
0x00439f04
0x00439f08
0x00439f08
0x00439f08
0x00439f0a
0x00439f0d
0x00439f0e
0x00439f0f
0x00439f0f
0x00439c00
0x00439c01
0x00439c02
0x00439c04
0x00439c06
0x00439c09
0x00439c10
0x00439c91
0x00439c99
0x00439ca1
0x00439ca8
0x00439cad
0x00439cad
0x00439c12
0x00439c15
0x00439c20
0x00439cbc
0x00439cc4
0x00439ccc
0x00439cd4
0x00439cdc
0x00439cdc
0x00439cdf
0x00439ce2
0x00439ce7
0x00439cee
0x00439d00
0x00439d04
0x00439d0a
0x00439c31
0x00439c36
0x00439c3e
0x00439c3e
0x00439c41
0x00439c48
0x00439c60
0x00439c68
0x00439c70
0x00439c77
0x00439c7c
0x00439c7f
0x00439c84
0x00439c90
0x00439c4a
0x00439c4a
0x00439c4d
0x00439c59
0x00439c59
0x00439c48
0x00439c20

APIs

ReleaseSemaphore.KERNEL32 ref: 00439EFA
GetCurrentThreadId.KERNEL32 ref: 00439F1C
GetCurrentThreadId.KERNEL32 ref: 00439F54

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CurrentThread$ReleaseSemaphore
String ID:
API String ID: 1483290962-0
Opcode ID: 39c59e246521a09a5736d3619143fa4c464643fb08811b0f8d16e075040d056c
Instruction ID: 5c3f1898a17541d2d3271e4883119fc6851a5dfae6492a7babe4c092ce19fd7f
Opcode Fuzzy Hash: 39c59e246521a09a5736d3619143fa4c464643fb08811b0f8d16e075040d056c
Instruction Fuzzy Hash: 9611E431B042018BEB10EE29E4C0357B7E4EF88348F28556BEC44CB34AE6B9DC55C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0042B2E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0042B2E0(char* __eax, intOrPtr __ebx, char* __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr __ebp) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v36;
				intOrPtr _v44;
				char* _v56;
				void* _v60;
				char _v61;
				char _v62;
				intOrPtr _v80;
				char* _v84;
				char** _v88;
				char* _v96;
				intOrPtr _v100;
				char* _v104;
				char _v108;
				char _v112;
				signed int _v132;
				long _t72;
				signed int _t74;
				signed int* _t78;
				signed int _t79;
				signed int* _t81;
				signed char* _t82;
				intOrPtr _t83;
				void* _t84;
				intOrPtr _t88;
				char* _t93;
				intOrPtr* _t94;
				signed int _t96;
				intOrPtr _t98;
				char* _t102;
				intOrPtr _t108;
				char _t110;
				signed int _t114;
				signed int _t115;
				signed char _t121;
				char* _t128;
				intOrPtr _t134;
				signed short _t136;
				signed int _t137;
				char* _t141;
				void* _t142;
				intOrPtr* _t143;
				char** _t144;
				char** _t145;
				intOrPtr* _t147;
				void* _t149;

				_t139 = __ebp;
				_t107 = __edx;
				_t100 = __ecx;
				_t143 = _t142 - 0x5c;
				_v16 = __ebx;
				_t93 = __eax;
				_v84 = 0x1c;
				_v88 =  &_v56;
				 *_t143 = __eax;
				_v12 = __esi;
				_t134 = __edx;
				_v8 = __edi;
				_t128 = __ecx;
				_v4 = __ebp;
				_t72 = VirtualQuery(??, ??, ??);
				_t144 = _t143 - 0xc;
				if(_t72 == 0) {
					_v84 = _t93;
					_v88 = 0x1c;
					 *_t144 = "  VirtualQuery failed for %d bytes at address %p";
					E0042B280(_t100, _t107, _t128, _t134, __ebp);
					_t74 =  *0x5007b4; // 0x1
					if(_t74 == 0) {
						_t74 = 0;
						 *0x5007b4 = 1;
						if(0x4fca34 <= 7) {
							goto L10;
						} else {
							_t145 = _t144 - 0x2c;
							_v104 = _t93;
							_v100 = _t134;
							_v96 = _t128;
							if(0x4fca34 <= 0xb) {
								_t94 = 0x4fca34;
								goto L28;
							} else {
								_t134 =  *0x4fca34; // 0x0
								if(_t134 != 0) {
									L23:
									_t94 = 0x4fca34;
									goto L24;
								} else {
									_t98 =  *0x4fca38; // 0x0
									if(_t98 != 0) {
										goto L23;
									} else {
										_t100 =  *0x4fca3c; // 0x0
										_t94 = 0x4fca40;
										if(_t100 == 0) {
											L28:
											_t107 =  *_t94;
											if( *_t94 != 0) {
												L24:
												while(_t94 < 0x4fca34) {
													_t46 = _t94 + 4; // 0x0
													_t108 =  *_t46;
													_t47 = _t108 + 0x400000; // 0x400000
													_t48 = _t108 + 0x400000; // 0x905a4d
													_t110 =  *_t48 +  *_t94;
													_t94 = _t94 + 8;
													_v108 = _t110;
													_t74 = E0042B2E0(_t47, _t94, 4,  &_v108, _t128, _t134, _t139);
												}
												goto L26;
											} else {
												_t54 = _t94 + 4; // 0x0
												_t74 =  *_t54;
												if(_t74 == 0) {
													goto L17;
												} else {
													goto L24;
												}
											}
										} else {
											_t94 = 0x4fca34;
											L17:
											_t39 = _t94 + 8; // 0x0
											_t74 =  *_t39;
											if(_t74 != 1) {
												_v132 = _t74;
												 *_t145 = "  Unknown pseudo relocation protocol version %d.\n";
												E0042B280(_t100, _t107, _t128, _t134, _t139);
												0;
												0;
												_t78 =  *0x4ee148; // 0x4eab60
												_t79 =  *_t78;
												if(_t79 != 0) {
													_t149 = _t145 - 0xc;
													do {
														 *_t79();
														_t81 =  *0x4ee148; // 0x4eab60
														_t63 =  &(_t81[1]); // 0x4eab64
														_t64 =  &(_t81[1]); // 0x201ffff
														_t79 =  *_t64;
														 *0x4ee148 = _t63;
													} while (_t79 != 0);
													_t145 = _t149 + 0xc;
												}
												asm("repe ret");
												_push(_t94);
												_t147 = _t145 - 0x18;
												_t96 =  *0x4eab30; // 0xffffffff
												if(_t96 == 0xffffffff) {
													_t96 = 0;
													while(1) {
														_t67 = _t96 + 1; // 0x2
														_t79 = _t67;
														if(0x4eab30[_t79] == 0) {
															break;
														}
														_t96 = _t79;
													}
												}
												if(_t96 != 0) {
													do {
														_t79 = 0x4eab30[_t96]();
														_t96 = _t96 - 1;
													} while (_t96 != 0);
												}
												 *_t147 = 0x42b5d0;
												E004012C0();
												return _t79;
											} else {
												while(1) {
													_t94 = _t94 + 0xc;
													if(_t94 >= 0x4fca34) {
														break;
													}
													_t40 = _t94 + 8; // 0x64742820
													_t114 =  *_t40 & 0x000000ff;
													_t41 = _t94 + 4; // 0x3a434347
													_t134 =  *_t41;
													_t102 =  *_t94;
													_t42 = _t134 + 0x400000; // 0x3a834347
													_t82 = _t42;
													_t128 =  *(_t102 + 0x400000);
													if(_t114 == 0x10) {
														_t136 =  *(_t134 + 0x400000) & 0x0000ffff;
														_t115 = _t136 & 0x0000ffff;
														if(_t136 < 0) {
															_t115 = _t115 | 0xffff0000;
														}
														_v112 = _t115 - _t102 - 0x400000 + _t128;
														_t74 = E0042B2E0(_t82, _t94, 2,  &_v112, _t128, _t136, _t139);
														continue;
													} else {
														if(_t114 == 0x20) {
															_v112 = _t128 - _t102 + 0x400000 +  *_t82;
															_t74 = E0042B2E0(_t82, _t94, 4,  &_v112, _t128 - _t102 + 0x400000 +  *_t82, _t134, _t139);
															continue;
														} else {
															if(_t114 == 8) {
																_t121 =  *_t82 & 0x000000ff;
																_t137 = _t121 & 0x000000ff;
																if(_t121 < 0) {
																	_t137 = _t137 | 0xffffff00;
																}
																_v112 = _t137 - 0x400000 - _t102 + _t128;
																_t74 = E0042B2E0(_t82, _t94, 1,  &_v112, _t128, _t137, _t139);
																continue;
															} else {
																_v132 = _t114;
																 *_t145 = "  Unknown pseudo relocation bit size %d.\n";
																_v112 = 0;
																_t74 = E0042B280(_t102, _t114, _t128, _t134, _t139);
																goto L23;
															}
														}
													}
													break;
												}
												L26:
												return _t74;
											}
										}
									}
								}
							}
						}
					} else {
						L10:
						return _t74;
					}
				} else {
					_t83 = _v36;
					if(_t83 != 4) {
						if(_t83 == 0x40) {
							goto L2;
						} else {
							_t141 =  &_v60;
							_v80 = _t141;
							_v84 = 0x40;
							_v88 = _v44;
							 *_t144 = _v56;
							VirtualProtect(??, ??, ??, ??);
							_t144 = _t144 - 0x10;
							_t88 = _v36;
							_v84 = _t128;
							_v88 = _t134;
							 *_t144 = _t93;
							_v62 = _t88 != 0x40;
							_v61 = _t88 != 4;
							_t84 = memcpy(??, ??, ??);
							if(_v61 != 0 && _v62 != 0) {
								_v80 = _t141;
								_v84 = _v60;
								_v88 = _v44;
								 *_t144 = _v56;
								_t84 = VirtualProtect(??, ??, ??, ??);
								_t144 = _t144 - 0x10;
							}
						}
					} else {
						L2:
						_v84 = _t128;
						_v88 = _t134;
						 *_t144 = _t93;
						_t84 = memcpy(??, ??, ??);
					}
					return _t84;
				}
			}

0x0042b2e0
0x0042b2e0
0x0042b2e0
0x0042b2e0
0x0042b2e3
0x0042b2e7
0x0042b2ed
0x0042b2f5
0x0042b2f9
0x0042b2fc
0x0042b300
0x0042b302
0x0042b306
0x0042b308
0x0042b30c
0x0042b311
0x0042b316
0x0042b3d6
0x0042b3da
0x0042b3e2
0x0042b3e9
0x0042b3f0
0x0042b3f7
0x0042b405
0x0042b40d
0x0042b417
0x00000000
0x0042b419
0x0042b419
0x0042b41f
0x0042b423
0x0042b427
0x0042b42b
0x0042b510
0x00000000
0x0042b431
0x0042b431
0x0042b439
0x0042b4c4
0x0042b4c4
0x00000000
0x0042b43f
0x0042b43f
0x0042b447
0x00000000
0x0042b449
0x0042b449
0x0042b44f
0x0042b456
0x0042b515
0x0042b515
0x0042b519
0x0042b4c9
0x0042b4cf
0x0042b4d1
0x0042b4d1
0x0042b4d9
0x0042b4df
0x0042b4e5
0x0042b4e7
0x0042b4ea
0x0042b4f2
0x0042b4f7
0x00000000
0x0042b51b
0x0042b51b
0x0042b51b
0x0042b520
0x00000000
0x0042b526
0x00000000
0x0042b526
0x0042b520
0x0042b45c
0x0042b45c
0x0042b461
0x0042b461
0x0042b461
0x0042b467
0x0042b5b4
0x0042b5b8
0x0042b5bf
0x0042b5ca
0x0042b5ce
0x0042b5d0
0x0042b5d5
0x0042b5d9
0x0042b5db
0x0042b5e0
0x0042b5e0
0x0042b5e2
0x0042b5e7
0x0042b5ea
0x0042b5ea
0x0042b5ed
0x0042b5f3
0x0042b5f7
0x0042b5f7
0x0042b5fa
0x0042b600
0x0042b601
0x0042b604
0x0042b60d
0x0042b633
0x0042b639
0x0042b639
0x0042b639
0x0042b645
0x00000000
0x00000000
0x0042b637
0x0042b637
0x0042b647
0x0042b611
0x0042b613
0x0042b613
0x0042b61a
0x0042b61a
0x0042b613
0x0042b622
0x0042b629
0x0042b632
0x0042b46d
0x0042b46d
0x0042b46d
0x0042b476
0x00000000
0x00000000
0x0042b47c
0x0042b47c
0x0042b480
0x0042b480
0x0042b483
0x0042b488
0x0042b488
0x0042b48e
0x0042b494
0x0042b528
0x0042b532
0x0042b535
0x0042b537
0x0042b537
0x0042b54c
0x0042b554
0x00000000
0x0042b49a
0x0042b49d
0x0042b5a6
0x0042b5aa
0x00000000
0x0042b4a3
0x0042b4a6
0x0042b560
0x0042b565
0x0042b568
0x0042b56a
0x0042b56a
0x0042b581
0x0042b589
0x00000000
0x0042b4ac
0x0042b4ac
0x0042b4b0
0x0042b4b7
0x0042b4bf
0x00000000
0x0042b4bf
0x0042b4a6
0x0042b49d
0x00000000
0x0042b494
0x0042b4ff
0x0042b50e
0x0042b50e
0x0042b467
0x0042b456
0x0042b447
0x0042b439
0x0042b42b
0x0042b3f9
0x0042b3f9
0x0042b3f9
0x0042b3f9
0x0042b31c
0x0042b31c
0x0042b323
0x0042b353
0x00000000
0x0042b355
0x0042b359
0x0042b35d
0x0042b361
0x0042b369
0x0042b371
0x0042b374
0x0042b379
0x0042b37c
0x0042b380
0x0042b384
0x0042b388
0x0042b38e
0x0042b396
0x0042b39b
0x0042b3a5
0x0042b3b2
0x0042b3b6
0x0042b3be
0x0042b3c6
0x0042b3c9
0x0042b3ce
0x0042b3ce
0x0042b3a5
0x0042b325
0x0042b325
0x0042b325
0x0042b329
0x0042b32d
0x0042b330
0x0042b330
0x0042b348
0x0042b348

APIs

VirtualQuery.KERNEL32 ref: 0042B30C
memcpy.MSVCRT ref: 0042B330
VirtualProtect.KERNEL32 ref: 0042B374
memcpy.MSVCRT ref: 0042B39B
VirtualProtect.KERNEL32 ref: 0042B3C9

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0042B3E2

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Virtual$Protectmemcpy$Query
String ID: VirtualQuery failed for %d bytes at address %p
API String ID: 228986436-2206166143
Opcode ID: 91a4c394fedae3fb419980858da680f69efd7319b981b8349d268330f5019ab5
Instruction ID: 00a6030aa549dd86dd144b5cd7b2cb66d90ec2d1356356b3509aef34224861d9
Opcode Fuzzy Hash: 91a4c394fedae3fb419980858da680f69efd7319b981b8349d268330f5019ab5
Instruction Fuzzy Hash: FA01A2B0A083549BD300EF59D18021FFBE4FF88744F95892EF99893312D7B9D8448B86

Uniqueness

Uniqueness Score: -1.00%

Function 0043B4E0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0043B52A
LeaveCriticalSection.KERNEL32 ref: 0043B553

Memory Dump Source

Source File: 00000000.00000002.481444449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.481435287.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481679793.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481689477.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481704757.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.481719447.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8d6d91e716bd15d31d584d24bce01ac45827ac927d59d9b6ca6f9c1b067ab63a
Instruction ID: fb7b6b1053817834b69614e2367650d44185121494f8c65083edc678544ef21b
Opcode Fuzzy Hash: 8d6d91e716bd15d31d584d24bce01ac45827ac927d59d9b6ca6f9c1b067ab63a
Instruction Fuzzy Hash: 9C316DB16042009BDB14EF29D4C075BB7E0EF48318F18966AED558F34AE739D885CBD6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 13.exePID: 6844, Parent PID: 5292COMMON

Executed Functions

Function 010D7EB5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E010D7EB5(WCHAR* __ecx, signed char __edx) {
				signed int _v5;
				void* _v12;
				signed int _v16;
				struct _TOKEN_PRIVILEGES _v28;
				int _t17;
				int _t20;
				signed int _t21;
				signed char _t22;
				signed char _t23;
				WCHAR* _t30;

				_v5 = _v5 & 0x00000000;
				_t22 = __edx;
				_t30 = __ecx;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v12) == 0) {
					_t23 = _v5;
				} else {
					_t17 = LookupPrivilegeValueW(0, _t30,  &(_v28.Privileges)); // executed
					if(_t17 == 0) {
						L4:
						_t23 = _v5;
					} else {
						_v28.PrivilegeCount = 1;
						asm("sbb ebx, ebx");
						_v16 =  ~_t22 & 0x00000002;
						_t20 = AdjustTokenPrivileges(_v12, 0,  &_v28, 0, 0, 0); // executed
						if(_t20 == 0) {
							goto L4;
						} else {
							_t21 = GetLastError();
							asm("sbb bl, bl");
							_t23 =  ~_t21 + 1;
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				return _t23;
			}

0x010d7ebb
0x010d7ec5
0x010d7ec7
0x010d7eda
0x010d7f32
0x010d7edc
0x010d7ee4
0x010d7eec
0x010d7f24
0x010d7f24
0x010d7eee
0x010d7efb
0x010d7f02
0x010d7f07
0x010d7f0a
0x010d7f12
0x00000000
0x010d7f14
0x010d7f14
0x010d7f1e
0x010d7f20
0x010d7f20
0x010d7f12
0x010d7f2a
0x010d7f2a
0x010d7f3a

APIs

GetCurrentProcess.KERNEL32(00000020,010DB936,?,00000000,?,?,?,?,010DB936,010DB801), ref: 010D7ECB
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,010DB936,010DB801), ref: 010D7ED2
LookupPrivilegeValueW.ADVAPI32(00000000,SeRestorePrivilege,?), ref: 010D7EE4
AdjustTokenPrivileges.ADVAPI32(010DB936,00000000,?,00000000,00000000,00000000), ref: 010D7F0A
GetLastError.KERNEL32 ref: 010D7F14
FindCloseChangeNotification.KERNELBASE(010DB936,?,?,?,?,010DB936,010DB801), ref: 010D7F2A

Strings

SeRestorePrivilege, xrefs: 010D7EE0

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ProcessToken$AdjustChangeCloseCurrentErrorFindLastLookupNotificationOpenPrivilegePrivilegesValue
String ID: SeRestorePrivilege
API String ID: 2838110999-1684392131
Opcode ID: 1a2b1d8b5cdabdf1c51448494ae5437485c1e235e99b56f6d3343635c1f1ad8c
Instruction ID: 32abc272e65aba8d71c398032c30b9e16f189659004f52981450e89b1177fe7f
Opcode Fuzzy Hash: 1a2b1d8b5cdabdf1c51448494ae5437485c1e235e99b56f6d3343635c1f1ad8c
Instruction Fuzzy Hash: F6016D75D49218ABDB319BF59C49AEE7FBCAF06204F0400A4E682E2145D6B59645CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010DD4F9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E010DD4F9(void* __eflags) {
				void* _t16;
				int _t25;
				signed int _t26;
				int _t28;
				void* _t38;

				E011039E0(E01104C14, _t38);
				_t28 = 0;
				 *(_t38 - 0x10) = 0;
				 *(_t38 - 4) = 0;
				_t16 = GetCurrentProcess();
				E010DD597(_t38 - 0x10);
				if(OpenProcessToken(_t16, 0x28, _t38 - 0x10) != 0) {
					 *(_t38 - 0x20) = 1;
					 *((intOrPtr*)(_t38 - 0x14)) = 2;
					if(LookupPrivilegeValueW(0, L"SeSecurityPrivilege", _t38 - 0x1c) != 0) {
						_t25 = AdjustTokenPrivileges( *(_t38 - 0x10), 0, _t38 - 0x20, 0, 0, 0); // executed
						if(_t25 != 0) {
							_t26 = GetLastError();
							asm("sbb bl, bl");
							_t28 =  ~_t26 + 1;
						}
					}
				}
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				E010DD597(_t38 - 0x10);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t28;
			}

0x010dd4fe
0x010dd507
0x010dd50a
0x010dd50d
0x010dd510
0x010dd51b
0x010dd52f
0x010dd534
0x010dd542
0x010dd551
0x010dd55e
0x010dd566
0x010dd568
0x010dd572
0x010dd574
0x010dd574
0x010dd566
0x010dd551
0x010dd576
0x010dd57d
0x010dd589
0x010dd591

APIs

__EH_prolog.LIBCMT ref: 010DD4FE
GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD510
OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD527
LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 010DD549
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD55E
GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD568

Strings

SeSecurityPrivilege, xrefs: 010DD53C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ProcessToken$AdjustCurrentErrorH_prologLastLookupOpenPrivilegePrivilegesValue
String ID: SeSecurityPrivilege
API String ID: 3475889169-2333288578
Opcode ID: f17830f91fa6347b13d98bf9cb7d673ae4c0a844a9a5181d19bcf3213f7be65f
Instruction ID: 9c8f50a22ea96afe6b85a40322534c8f50c4d04d1d2dcb2054a41d4c66bbf0bc
Opcode Fuzzy Hash: f17830f91fa6347b13d98bf9cb7d673ae4c0a844a9a5181d19bcf3213f7be65f
Instruction Fuzzy Hash: 7B115EB1D4021AAFEB25DFE4CC84AEEBBBCFB04244F404529E561E21C8D7B08904CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010D58CD Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D58CD(void* __ebx, void** __ecx, void* __edi, void* __eflags) {
				void* _t22;
				signed int _t25;
				void* _t31;
				void* _t33;
				void** _t48;
				void* _t50;

				E011039E0(E01104584, _t50);
				_t48 = __ecx;
				if(E010D58AD(__ecx) == 0) {
					L9:
					_t22 = 0;
				} else {
					_t33 = E010D7553( *(_t50 + 8));
					if(_t33 != 1) {
						_t31 = FindFirstFileW( *(_t50 + 8), _t50 - 0x268); // executed
						 *_t48 = _t31;
					}
					if( *_t48 == 0xffffffff && _t33 != 0) {
						_t25 = E010D28E9(_t50 - 0x18);
						 *(_t50 - 4) =  *(_t50 - 4) & 0x00000000;
						if(E010D765C( *(_t50 + 8), _t50 - 0x18, _t50, _t25 & 0xffffff00 | _t33 != 0x00000001) != 0) {
							_t27 = FindFirstFileW( *(_t50 - 0x18), _t50 - 0x268); // executed
							 *_t48 = _t27;
						}
						 *(_t50 - 4) =  *(_t50 - 4) | 0xffffffff;
						E010D1ABD(_t27,  *(_t50 - 0x18));
					}
					if( *_t48 != 0xffffffff) {
						E010D597E(_t50 - 0x268,  *((intOrPtr*)(_t50 + 0xc)), __eflags);
						_t22 = 1;
					} else {
						goto L9;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t22;
			}

0x010d58d2
0x010d58de
0x010d58e7
0x010d595b
0x010d595b
0x010d58e9
0x010d58f9
0x010d58fe
0x010d590a
0x010d590c
0x010d590c
0x010d5911
0x010d591a
0x010d591f
0x010d5937
0x010d5943
0x010d5945
0x010d5945
0x010d594a
0x010d594e
0x010d5953
0x010d5959
0x010d5968
0x010d596d
0x00000000
0x00000000
0x00000000
0x010d5959
0x010d5973
0x010d597b

APIs

__EH_prolog.LIBCMT ref: 010D58D2

Part of subcall function 010D58AD: FindClose.KERNEL32(00000000,?,010D58E5), ref: 010D58B8

FindFirstFileW.KERNELBASE(?,?,00000001,00000000), ref: 010D590A
FindFirstFileW.KERNELBASE(?,?,00000000,00000001,00000000), ref: 010D5943

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Find$FileFirst$CloseH_prolog
String ID:
API String ID: 3371352514-0
Opcode ID: a4053055c178f324616ba613066183b4f59467fd808100372453aafb7314a3a0
Instruction ID: 416677f9376224361b7ed17b2fc98c30fbace4b60aaa8c025c97226d973efb73
Opcode Fuzzy Hash: a4053055c178f324616ba613066183b4f59467fd808100372453aafb7314a3a0
Instruction Fuzzy Hash: 5911907180030A9FCB65EF68CC809EDB7B9EF52234F104259DDE197290DB718A85DB40

Uniqueness

Uniqueness Score: -1.00%

Function 010FEEE3 Relevance: 56.7, APIs: 15, Strings: 17, Instructions: 681
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E010FEEE3(struct _IO_FILE** __ebx, intOrPtr __esi) {
				struct _IO_FILE** _t377;
				void* _t379;
				signed int _t380;
				intOrPtr _t392;
				signed int _t397;
				signed int _t401;
				signed int _t410;
				signed int _t414;
				signed int _t422;
				signed int _t434;
				void* _t450;
				void* _t455;
				signed int _t456;
				void* _t489;
				signed int _t516;
				signed int _t530;
				signed int _t557;
				signed int _t566;
				struct _IO_FILE** _t568;
				signed int _t569;
				signed int _t590;
				void* _t596;
				struct _IO_FILE** _t603;
				signed int _t759;
				signed int _t772;
				void* _t790;
				struct _IO_FILE** _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				intOrPtr _t805;
				signed int _t808;
				struct _IO_FILE** _t810;
				void* _t811;

				_t805 = __esi;
				_t603 = __ebx;
				if( *((intOrPtr*)(_t811 - 0x318)) == 6) {
					 *((intOrPtr*)(_t811 - 0x48)) = 0;
					 *((intOrPtr*)(_t811 - 0x44)) = 0;
					 *((intOrPtr*)(_t811 - 0x40)) = 0;
					 *((intOrPtr*)(_t811 - 0x54)) = 0;
					 *((intOrPtr*)(_t811 - 0x50)) = 0;
					 *((intOrPtr*)(_t811 - 0x4c)) = 0;
					__eflags =  *((char*)(_t811 - 0x336));
					_t603 = fputs;
					 *(_t811 - 4) = 0xd;
					if(__eflags == 0) {
						_push(0xc8);
						 *((intOrPtr*)(_t811 - 0x3fc)) = 0x110c6a0;
						E010FE094(_t811 - 0x3ec, __eflags);
						 *((intOrPtr*)(_t811 - 0x3fc)) = 0x110c698;
						_t377 =  *0x11146fc;
						asm("sbb ecx, ecx");
						 *(_t811 - 4) = 0xe;
						 *(_t811 - 0x3f8) =  ~( *(_t811 - 0x334)) & _t377;
						 *(_t811 - 0x3f4) =  *0x1114700;
						 *(_t811 - 0x348) =  *(_t811 - 0x18);
						__eflags = _t377;
						 *((intOrPtr*)(_t811 - 0x340)) =  *(_t811 - 0x14) - 1;
						if(_t377 != 0) {
							__eflags =  *(_t811 - 0x334);
							if( *(_t811 - 0x334) != 0) {
								fputs("Scanning the drive for archives:",  *_t377);
								E010D1CAE(_t377);
							}
						}
						 *((intOrPtr*)(_t811 - 0xac)) = 0;
						 *((intOrPtr*)(_t811 - 0xa8)) = 0;
						 *((intOrPtr*)(_t811 - 0xa4)) = 0;
						 *((intOrPtr*)(_t811 - 0xa0)) = 0;
						 *((intOrPtr*)(_t811 - 0x9c)) = 0;
						 *((intOrPtr*)(_t811 - 0x98)) = 0;
						 *(_t811 - 0x94) = 0;
						 *(_t811 - 0x90) = 0;
						 *((intOrPtr*)(_t811 - 0x8c)) = 0;
						 *(_t811 - 0x88) = 0;
						 *(_t811 - 0x84) = 0;
						 *(_t811 - 0x80) = 0;
						E010FA34A(_t811 - 0x3fc);
						_t379 = E010D28E9(_t811 - 0x60);
						_push(_t811 - 0x3fc);
						_push(_t811 - 0xac);
						_push(_t811 - 0x54);
						_push(_t811 - 0x48);
						_push(_t379);
						 *(_t811 - 4) = 0xf;
						_t380 = E010E8549(_t603, _t811 - 0x2e4, 0, 0, __eflags); // executed
						 *(_t811 - 0x20) = _t380;
						 *(_t811 - 4) = 0xe;
						E010D1ABD(_t380,  *((intOrPtr*)(_t811 - 0x60)));
						__eflags =  *(_t811 - 0x348);
						if( *(_t811 - 0x348) != 0) {
							E0110183F(_t811 - 0x3ec, 0, 1);
						}
						__eflags =  *(_t811 - 0x20);
						if( *(_t811 - 0x20) == 0) {
							__eflags =  *(_t811 - 0x334);
							if( *(_t811 - 0x334) != 0) {
								_push(_t811 - 0xac);
								E010FA6F7(_t811 - 0x3fc);
							}
						}
						 *(_t811 - 4) = 0xd;
						E011017A6(_t811 - 0x3ec);
						__eflags =  *(_t811 - 0x20);
						if( *(_t811 - 0x20) != 0) {
							L105:
							 *(_t811 - 4) = 0xc;
							E010E8B2E(_t603, _t811 - 0x54);
							 *(_t811 - 4) = 9;
							E010E8B2E(_t603, _t811 - 0x48);
							L106:
							if( *((char*)(_t811 - 0x2f7)) != 0 &&  *0x11146fc != 0) {
								E01100A10();
							}
							E010D1ABD(E011009F5( *(_t811 - 0x20)),  *((intOrPtr*)(_t811 - 0xd0)));
							 *(_t811 - 4) = 6;
							E010E9E21(_t811 - 0xc4);
							_t627 =  *((intOrPtr*)(_t811 - 0x1c));
							 *(_t811 - 4) = 5;
							_t828 =  *((intOrPtr*)(_t811 - 0x1c));
							if( *((intOrPtr*)(_t811 - 0x1c)) != 0) {
								E010EBD18(_t627);
							}
							 *(_t811 - 4) = 3;
							E010FFCF6(_t811 - 0xf0);
							 *(_t811 - 4) = 2;
							E010D11BB(_t811 - 0x448);
							 *(_t811 - 4) =  *(_t811 - 4) & 0x00000000;
							E01100E30(_t603, _t811 - 0x33c, _t828);
							 *(_t811 - 4) =  *(_t811 - 4) | 0xffffffff;
							E010E8B2E(_t603, _t811 - 0x7c);
							_t392 =  *((intOrPtr*)(_t811 - 0x3c));
							 *[fs:0x0] =  *((intOrPtr*)(_t811 - 0xc));
							return _t392;
						} else {
							L38:
							__eflags =  *(_t811 - 0xd);
							if( *(_t811 - 0xd) == 0) {
								_push(_t811 - 0x38);
								_push(_t811 - 0x2c);
								_push(_t811 - 0x2c0);
								_push(_t811 - 0x304);
								_push(_t811 - 0x308);
								 *(_t811 - 0x2c) = 0;
								_push( *((intOrPtr*)(_t811 - 0x2f8)));
								 *(_t811 - 0x28) = 0;
								 *(_t811 - 0x38) = 0;
								 *(_t811 - 0x34) = 0;
								_push( *(_t811 - 0x334));
								_t397 =  *((intOrPtr*)( *((intOrPtr*)(_t811 - 0x330)))) + 0xc;
								__eflags = _t397;
								_push(_t397);
								_push( *((intOrPtr*)(_t811 - 0x28e)));
								_push( *((intOrPtr*)(_t811 - 0x296)));
								_push(_t811 - 0x54);
								_push(_t811 - 0x48);
								_push( *((intOrPtr*)(_t811 - 0x336)));
								_push(_t811 - 0xd0);
								_t401 = L010FD42A( *((intOrPtr*)(_t811 - 0x1c)), _t811 - 0xc4, _t397);
								__eflags =  *(_t811 - 0x334);
								 *(_t811 - 0x20) = _t401;
								if( *(_t811 - 0x334) == 0) {
									L100:
									__eflags =  *(_t811 - 0x28);
									if( *(_t811 - 0x28) > 0) {
										L102:
										__eflags =  *(_t811 - 0x334);
										if( *(_t811 - 0x334) != 0) {
											E010D1CAE(0x1114440);
											 *_t603("Errors: ",  *0x1114440);
											E010D1CAE(E010D1F47(0x1114440,  *(_t811 - 0x2c),  *(_t811 - 0x28)));
										}
										 *((intOrPtr*)(_t811 - 0x3c)) = 2;
										goto L105;
									}
									__eflags =  *(_t811 - 0x2c);
									if( *(_t811 - 0x2c) <= 0) {
										goto L105;
									}
									goto L102;
								} else {
									__eflags =  *(_t811 - 0x34);
									if( *(_t811 - 0x34) > 0) {
										L99:
										E010D1CAE(0x1114440);
										 *_t603("Warnings: ",  *0x1114440);
										E010D1CAE(E010D1F47(0x1114440,  *(_t811 - 0x38),  *(_t811 - 0x34)));
										goto L100;
									}
									__eflags =  *(_t811 - 0x38);
									if( *(_t811 - 0x38) <= 0) {
										goto L100;
									}
									goto L99;
								}
							}
							_push(0x178);
							_t410 = E010D1A96();
							 *(_t811 - 0x34) = _t410;
							__eflags = _t410;
							 *(_t811 - 4) = 0x10;
							if(__eflags == 0) {
								_t808 = 0;
								__eflags = 0;
							} else {
								_t808 = E01100157(_t410, __eflags);
							}
							__eflags = _t808;
							 *(_t811 - 4) = 0xd;
							 *(_t811 - 0x34) = _t808;
							if(_t808 != 0) {
								 *((intOrPtr*)( *_t808 + 4))(_t808);
							}
							_t173 = _t808 + 0xe4; // 0xe4
							 *((char*)(_t808 + 0xe1)) =  *((intOrPtr*)(_t811 - 0x308));
							 *(_t811 - 4) = 0x11;
							E010D2A8C(_t173, _t811 - 0x304);
							_t414 = E011002D6(_t808,  *0x11146fc,  *0x1114700,  *(_t811 - 0x18));
							__eflags =  *((intOrPtr*)(_t811 - 0x44)) - 1;
							__eflags =  *(_t811 - 0x18);
							 *((char*)(_t808 + 0xe0)) = _t414 & 0xffffff00 |  *((intOrPtr*)(_t811 - 0x44)) - 0x00000001 > 0x00000000;
							 *((intOrPtr*)(_t808 + 0x170)) =  *((intOrPtr*)(_t811 - 0x134));
							 *(_t808 + 0x16c) =  *(_t811 - 0x24);
							if(__eflags != 0) {
								_t530 =  *(_t811 - 0x14) - 1;
								__eflags = _t530;
								 *(_t808 + 0xc4) = _t530;
							}
							E010FFD74(_t811 - 0x12c, __eflags);
							 *(_t811 - 4) = 0x12;
							E01100F65(_t811 - 0x12c, _t811 - 0x2b4);
							__eflags =  *((intOrPtr*)(_t811 - 0x318)) - 3;
							 *((char*)(_t811 - 0x108)) =  *((intOrPtr*)(_t811 - 0x336));
							_t422 =  *((intOrPtr*)(_t811 - 0x333));
							 *(_t811 - 0x106) = _t422;
							 *(_t811 - 0x107) = _t422;
							 *((char*)(_t811 - 0x105)) = _t422 & 0xffffff00 |  *((intOrPtr*)(_t811 - 0x318)) == 0x00000003;
							_push(_t811 - 0x2c0);
							E010DD18C(_t811 - 0x104);
							E010D28E9(_t811 - 0x60);
							 *(_t811 - 4) = 0x13;
							E010EADD3(_t811 - 0x39c);
							__eflags =  *(_t811 - 0x2f0);
							 *(_t811 - 4) = 0x14;
							 *(_t811 - 0x14) = 0;
							if( *(_t811 - 0x2f0) != 0) {
								 *(_t811 - 0x14) = _t811 - 0x39c;
								_push(_t811 - 0x2f4);
								_push(_t811 - 0xf0);
								E011009F5(E010EA2E2(_t811 - 0x39c));
							}
							_push(_t811 - 0xb4);
							_push(_t811 - 0x60);
							_push( *(_t811 - 0x14));
							_t219 = _t808 + 0x10; // 0x10
							_push(_t808);
							asm("sbb edx, edx");
							_push( ~_t808 & _t219);
							_push(_t811 - 0x12c);
							_push( *((intOrPtr*)( *((intOrPtr*)(_t811 - 0x330)))) + 0xc);
							_push(_t811 - 0x54);
							_push(_t811 - 0x48);
							_push(_t811 - 0xd0); // executed
							_t434 = E010E8D6E( *((intOrPtr*)(_t811 - 0x1c)), _t811 - 0xc4); // executed
							__eflags =  *(_t808 + 0xbc);
							 *(_t811 - 0x20) = _t434;
							if( *(_t808 + 0xbc) != 0) {
								_t228 = _t808 + 0x18; // 0x18
								E0110183F(_t228, 0, 1);
							}
							__eflags =  *(_t811 - 0x5c);
							if( *(_t811 - 0x5c) != 0) {
								_t516 =  *0x1114700; // 0x1114438
								__eflags = _t516;
								if(_t516 != 0) {
									 *(_t811 - 0x24) = _t516;
									E010D1CAE(_t516);
									fputs("ERROR:",  *( *(_t811 - 0x24)));
									E010D1CAE( *(_t811 - 0x24));
									_push( *((intOrPtr*)(_t811 - 0x60)));
									E010D1CAE(E010D1CC1( *(_t811 - 0x24)));
								}
								__eflags =  *(_t811 - 0x20);
								if( *(_t811 - 0x20) == 0) {
									 *(_t811 - 0x20) = 0x80004005;
								}
							}
							_t801 =  *0x11146fc; // 0x1114440
							 *(_t811 - 0xd) =  *(_t811 - 0xd) & 0x00000000;
							__eflags = _t801;
							if(_t801 == 0) {
								L59:
								__eflags =  *(_t808 + 0x130) |  *(_t808 + 0x134);
								if(( *(_t808 + 0x130) |  *(_t808 + 0x134)) != 0) {
									__eflags = _t801;
									 *(_t811 - 0xd) = 1;
									if(_t801 != 0) {
										fputs("Can\'t open as archive: ",  *_t801);
										E010D1CAE(E010D1F47(_t801,  *(_t808 + 0x130),  *(_t808 + 0x134)));
									}
								}
								__eflags =  *(_t808 + 0x138) |  *(_t808 + 0x13c);
								if(( *(_t808 + 0x138) |  *(_t808 + 0x13c)) == 0) {
									L65:
									__eflags = _t801;
									if(_t801 != 0) {
										_t256 = _t808 + 0x140; // 0x140
										_t489 = _t256;
										__eflags =  *(_t808 + 0x140) |  *(_t489 + 4);
										if(( *(_t808 + 0x140) |  *(_t489 + 4)) != 0) {
											fputs("Archives with Warnings: ",  *_t801);
											_t258 = _t808 + 0x140; // 0x140
											E010D1CAE(E010D1F47(_t801,  *_t258,  *((intOrPtr*)(_t258 + 4))));
										}
										__eflags =  *(_t808 + 0x150) |  *(_t808 + 0x154);
										if(( *(_t808 + 0x150) |  *(_t808 + 0x154)) != 0) {
											E010D1CAE(_t801);
											__eflags =  *(_t808 + 0x150) |  *(_t808 + 0x154);
											if(( *(_t808 + 0x150) |  *(_t808 + 0x154)) != 0) {
												fputs("Warnings: ",  *_t801);
												E010D1CAE(E010D1F47(_t801,  *(_t808 + 0x150),  *(_t808 + 0x154)));
											}
										}
									}
									goto L71;
								} else {
									__eflags = _t801;
									 *(_t811 - 0xd) = 1;
									if(_t801 == 0) {
										L71:
										__eflags =  *(_t808 + 0x148) |  *(_t808 + 0x14c);
										if(( *(_t808 + 0x148) |  *(_t808 + 0x14c)) == 0) {
											L75:
											__eflags =  *(_t811 - 0xd);
											if( *(_t811 - 0xd) == 0) {
												L77:
												__eflags = _t801;
												if(_t801 == 0) {
													L93:
													 *(_t811 - 4) = 0x13;
													E010D1ABD(E010EAE4E(_t811 - 0x39c),  *((intOrPtr*)(_t811 - 0x60)));
													 *(_t811 - 4) = 0x15;
													E010D1ABD(E01101159(_t811 - 0x104),  *((intOrPtr*)(_t811 - 0x120)));
													__eflags = _t808;
													 *(_t811 - 4) = 0xd;
													if(_t808 != 0) {
														 *((intOrPtr*)( *_t808 + 8))(_t808);
													}
													goto L105;
												}
												__eflags =  *(_t808 + 0x138) |  *(_t808 + 0x13c);
												if(( *(_t808 + 0x138) |  *(_t808 + 0x13c)) != 0) {
													L91:
													E010D1CAE(_t801);
													_t309 = _t808 + 0x158; // 0x158
													_t450 = _t309;
													__eflags =  *(_t808 + 0x158) |  *(_t450 + 4);
													if(( *(_t808 + 0x158) |  *(_t450 + 4)) != 0) {
														fputs("Sub items Errors: ",  *_t801);
														_t311 = _t808 + 0x158; // 0x158
														E010D1CAE(E010D1F47(_t801,  *_t311,  *((intOrPtr*)(_t311 + 4))));
													}
													goto L93;
												}
												_t278 = _t808 + 0x158; // 0x158
												_t455 = _t278;
												__eflags =  *(_t808 + 0x158) |  *(_t455 + 4);
												if(( *(_t808 + 0x158) |  *(_t455 + 4)) != 0) {
													goto L91;
												}
												__eflags =  *(_t811 - 0x20);
												if( *(_t811 - 0x20) != 0) {
													goto L93;
												}
												_t456 =  *(_t811 - 0x94);
												__eflags = _t456 |  *(_t811 - 0x90);
												if((_t456 |  *(_t811 - 0x90)) != 0) {
													fputs("Folders: ",  *_t801);
													E010D1CAE(E010D1F47(_t801,  *(_t811 - 0x94),  *(_t811 - 0x90)));
													_t456 =  *(_t811 - 0x94);
												}
												__eflags =  *((intOrPtr*)(_t811 - 0x8c)) - 1;
												if( *((intOrPtr*)(_t811 - 0x8c)) != 1) {
													L87:
													fputs("Files: ",  *_t801);
													E010D1CAE(E010D1F47(_t801,  *((intOrPtr*)(_t811 - 0x8c)),  *(_t811 - 0x88)));
													__eflags =  *(_t811 - 0x84) |  *(_t811 - 0x80);
													if(( *(_t811 - 0x84) |  *(_t811 - 0x80)) != 0) {
														fputs("Alternate Streams: ",  *_t801);
														E010D1CAE(E010D1F47(_t801,  *(_t811 - 0x84),  *(_t811 - 0x80)));
														fputs("Alternate Streams Size: ",  *_t801);
														E010D1CAE(E010D1F47(_t801,  *((intOrPtr*)(_t811 - 0xa4)),  *((intOrPtr*)(_t811 - 0xa0))));
													}
													goto L89;
												} else {
													__eflags =  *(_t811 - 0x88);
													if( *(_t811 - 0x88) != 0) {
														goto L87;
													}
													__eflags = _t456 |  *(_t811 - 0x90);
													if((_t456 |  *(_t811 - 0x90)) != 0) {
														goto L87;
													}
													__eflags =  *(_t811 - 0x84) |  *(_t811 - 0x80);
													if(( *(_t811 - 0x84) |  *(_t811 - 0x80)) == 0) {
														L89:
														fputs("Size:       ",  *_t801);
														 *(_t811 - 0x28) = E010D1F47(_t801,  *((intOrPtr*)(_t811 - 0xac)),  *((intOrPtr*)(_t811 - 0xa8)));
														E010D1CAE(_t463);
														fputs("Compressed: ",  *( *(_t811 - 0x28)));
														E010D1CAE(E010D1F47( *(_t811 - 0x28),  *((intOrPtr*)(_t811 - 0x9c)),  *((intOrPtr*)(_t811 - 0x98))));
														__eflags =  *(_t811 - 0x14);
														if( *(_t811 - 0x14) != 0) {
															E010D1CAE(_t801);
															E010FBF06(_t801, _t811 - 0x39c);
														}
														goto L93;
													}
													goto L87;
												}
											}
											L76:
											 *((intOrPtr*)(_t811 - 0x3c)) = 2;
											goto L77;
										}
										__eflags = _t801;
										 *(_t811 - 0xd) = 1;
										if(_t801 == 0) {
											goto L76;
										}
										E010D1CAE(_t801);
										__eflags =  *(_t808 + 0x148) |  *(_t808 + 0x14c);
										if(( *(_t808 + 0x148) |  *(_t808 + 0x14c)) == 0) {
											goto L76;
										}
										fputs("Open Errors: ",  *_t801);
										E010D1CAE(E010D1F47(_t801,  *(_t808 + 0x148),  *(_t808 + 0x14c)));
										goto L75;
									}
									fputs("Archives with Errors: ",  *_t801);
									E010D1CAE(E010D1F47(_t801,  *(_t808 + 0x138),  *(_t808 + 0x13c)));
									goto L65;
								}
							} else {
								E010D1CAE(_t801);
								__eflags =  *(_t808 + 0x11c);
								if( *(_t808 + 0x11c) > 0) {
									L58:
									fputs("Archives: ",  *_t801);
									_t241 = _t808 + 0x118; // 0x118
									E010D1CAE(E010D1F47(_t801,  *_t241,  *((intOrPtr*)(_t241 + 4))));
									fputs("OK archives: ",  *_t801);
									E010D1CAE(E010D1F47(_t801,  *((intOrPtr*)(_t808 + 0x128)),  *((intOrPtr*)(_t808 + 0x12c))));
									goto L59;
								}
								__eflags =  *((intOrPtr*)(_t808 + 0x118)) - 1;
								if( *((intOrPtr*)(_t808 + 0x118)) <= 1) {
									goto L59;
								}
								goto L58;
							}
						}
					}
					_push(_t811 - 0x2cc);
					E010D150C(_t811 - 0x48);
					_push(_t811 - 0x2cc);
					E010D150C(_t811 - 0x54);
					goto L38;
				}
				if(E010DB621(_t811 - 0x318) == 0) {
					__eflags =  *((intOrPtr*)(_t811 - 0x318)) - 9;
					if(__eflags != 0) {
						_t790 = 7;
						E011005EE(_t790);
					} else {
						E0110054D(_t811 - 0x580, __eflags);
						__eflags =  *(_t811 - 0x18) - __esi;
						 *(_t811 - 4) = 0x1a;
						if( *(_t811 - 0x18) != __esi) {
							_t566 =  *(_t811 - 0x14) - 1;
							__eflags = _t566;
							 *(_t811 - 0x4cc) = _t566;
						}
						_t802 =  *0x1114700; // 0x1114438
						_t603 =  *0x11146fc; // 0x1114440
						E010EC900(_t811 - 0x49c);
						 *(_t811 - 0x4d4) =  *(_t811 - 0x18);
						 *((intOrPtr*)(_t811 - 0x48c)) = _t805;
						 *(_t811 - 0x4c8) = _t603;
						 *(_t811 - 0x4c4) = _t802;
						 *((char*)(_t811 - 0x44f)) =  *(_t811 - 0x334);
						E010D232F(_t811 - 0x60);
						_push(_t811 - 0x580);
						_push(_t811 - 0x60);
						_push(_t811 - 0x16c);
						 *(_t811 - 4) = 0x1b;
						 *(_t811 - 0x20) = E010EA895(_t811 - 0xf0, _t811 - 0x330, __eflags);
						E010FFDE9(_t811 - 0x98, __eflags);
						 *(_t811 - 4) = 0x1c;
						E010D240D(_t811 - 0x94, _t811 - 0x60);
						_t557 =  *0x11146fc; // 0x1114440
						_t759 = _t557;
						__eflags = _t759 - _t805;
						if(_t759 == _t805) {
							_t759 =  *0x1114700; // 0x1114438
						}
						_push( *(_t811 - 0x334));
						_push(_t759);
						_push(_t557);
						_push(_t811 - 0x98);
						asm("sbb edx, edx");
						 *((intOrPtr*)(_t811 - 0x3c)) = E01100733( *(_t811 - 0x20),  ~(_t811 - 0x580) & _t811 - 0x00000578);
						 *(_t811 - 4) = 0x1d;
						E010D1ABD(E010D1ABD(E010E8B2E(_t603, _t811 - 0x88),  *(_t811 - 0x94)),  *((intOrPtr*)(_t811 - 0x60)));
						 *(_t811 - 4) = 9;
						E011005BB(_t603, _t811 - 0x580);
					}
					goto L106;
				} else {
					if( *((char*)(_t811 - 0x1e0)) != 0) {
						_t817 =  *((intOrPtr*)(_t811 - 0x1d8)) - __esi;
						if( *((intOrPtr*)(_t811 - 0x1d8)) == __esi) {
							E010D2B8A(_t811 - 0x1dc, "7zCon.sfx");
						}
					}
					E010FE02D(_t811 - 0x41c, _t817);
					_t568 =  *0x11146fc; // 0x1114440
					_t803 =  *(_t811 - 0x18);
					 *(_t811 - 0x364) = _t568;
					_t569 =  *0x1114700; // 0x1114438
					 *(_t811 - 4) = 0x16;
					 *(_t811 - 0x360) = _t569;
					 *(_t811 - 0x370) = _t803;
					if( *((char*)(_t811 - 0x308)) == 0) {
						L8:
						_t15 = _t811 - 0xd;
						 *_t15 =  *(_t811 - 0xd) & 0x00000000;
						__eflags =  *_t15;
						L9:
						 *((char*)(_t811 - 0x34b)) =  *(_t811 - 0xd);
						E010D2A8C(_t811 - 0x348, _t811 - 0x304);
						E011003B6(_t811 - 0x578, _t819);
						 *((intOrPtr*)(_t811 - 0x4b0)) =  *((intOrPtr*)(_t811 - 0x134));
						 *(_t811 - 4) = 0x17;
						 *(_t811 - 0x4b4) =  *(_t811 - 0x24);
						if(_t803 != _t805) {
							 *(_t811 - 0x4c4) =  *(_t811 - 0x14) - 1;
						}
						 *((char*)(_t811 - 0x460)) =  *(_t811 - 0xd);
						if( *((char*)(_t811 - 0x308)) == 0) {
							L14:
							_t34 = _t811 - 0x450;
							 *_t34 =  *(_t811 - 0x450) & 0x00000000;
							__eflags =  *_t34;
							L15:
							E010D2A8C(_t811 - 0x45c, _t811 - 0x304);
							_t804 =  *0x1114700; // 0x1114438
							_t810 =  *0x11146fc; // 0x1114440
							 *((char*)(_t811 - 0x4b8)) =  *((intOrPtr*)(_t811 - 0x1c0));
							E010EC900(_t811 - 0x494);
							 *(_t811 - 0x484) =  *(_t811 - 0x484) & 0x00000000;
							 *(_t811 - 0x4c0) = _t810;
							 *(_t811 - 0x4bc) = _t804;
							 *(_t811 - 0x4cc) =  *(_t811 - 0x18);
							E010FFDE9(_t811 - 0x70, _t823);
							_push(1);
							_push(_t811 - 0x578);
							_push(_t811 - 0x41c);
							_push(_t811 - 0x70);
							_push(_t811 - 0x284);
							_push(_t811 - 0x330);
							_push(_t811 - 0x314);
							 *(_t811 - 4) = 0x18;
							 *(_t811 - 0x20) = E010F4C61(_t603, _t811 - 0xc4);
							if( *(_t811 - 0x4cc) != 0) {
								E0110183F(_t811 - 0x570, _t804, 1);
							}
							_t590 =  *0x11146fc; // 0x1114440
							_t772 = _t590;
							if(_t772 == 0) {
								_t772 =  *0x1114700; // 0x1114438
							}
							_push(1);
							_push(_t772);
							_push(_t590);
							_push(_t811 - 0x70);
							asm("sbb edx, edx");
							 *((intOrPtr*)(_t811 - 0x3c)) = E01100733( *(_t811 - 0x20),  ~(_t811 - 0x578) & _t811 - 0x00000570);
							 *(_t811 - 4) = 0x19;
							E010D1ABD(E010E8B2E(_t603, _t811 - 0x60),  *((intOrPtr*)(_t811 - 0x6c)));
							 *(_t811 - 4) = 0x16;
							_t596 = E01100FAB(_t603, _t811 - 0x578);
							 *(_t811 - 4) = 9;
							E010D1ABD(_t596,  *(_t811 - 0x348));
							E011017A6(_t811 - 0x414);
							goto L106;
						}
						_t823 =  *((intOrPtr*)(_t811 - 0x300)) - _t805;
						if( *((intOrPtr*)(_t811 - 0x300)) != _t805) {
							goto L14;
						} else {
							 *(_t811 - 0x450) = 1;
							goto L15;
						}
					}
					_t819 =  *((intOrPtr*)(_t811 - 0x300)) - _t805;
					if( *((intOrPtr*)(_t811 - 0x300)) == _t805) {
						goto L8;
					} else {
						 *(_t811 - 0xd) = 1;
						goto L9;
					}
				}
			}

0x010feee3
0x010feee3
0x010feeea
0x010ff24d
0x010ff250
0x010ff253
0x010ff256
0x010ff259
0x010ff25c
0x010ff25f
0x010ff266
0x010ff26c
0x010ff270
0x010ff295
0x010ff2a0
0x010ff2aa
0x010ff2af
0x010ff2bf
0x010ff2c6
0x010ff2c8
0x010ff2ce
0x010ff2da
0x010ff2e3
0x010ff2ed
0x010ff2ef
0x010ff2f5
0x010ff2f7
0x010ff2fe
0x010ff309
0x010ff30f
0x010ff30f
0x010ff2fe
0x010ff31a
0x010ff320
0x010ff326
0x010ff32c
0x010ff332
0x010ff338
0x010ff33e
0x010ff344
0x010ff34a
0x010ff350
0x010ff356
0x010ff35c
0x010ff35f
0x010ff367
0x010ff374
0x010ff37b
0x010ff37f
0x010ff383
0x010ff384
0x010ff38b
0x010ff38f
0x010ff394
0x010ff397
0x010ff39e
0x010ff3a3
0x010ff3aa
0x010ff3b4
0x010ff3b4
0x010ff3b9
0x010ff3bc
0x010ff3be
0x010ff3c5
0x010ff3d3
0x010ff3d4
0x010ff3d4
0x010ff3c5
0x010ff3df
0x010ff3e3
0x010ff3e8
0x010ff3eb
0x010ffab8
0x010ffabb
0x010ffabf
0x010ffac7
0x010ffacb
0x010ffad0
0x010ffad7
0x010ffae2
0x010ffae2
0x010ffaf5
0x010ffafb
0x010ffb05
0x010ffb0a
0x010ffb0d
0x010ffb11
0x010ffb13
0x010ffb15
0x010ffb15
0x010ffb20
0x010ffb24
0x010ffb2f
0x010ffb33
0x010ffb38
0x010ffb42
0x010ffb47
0x010ffb4e
0x010ffb53
0x010ffb5c
0x010ffb64
0x010ff3f1
0x010ff3f1
0x010ff3f1
0x010ff3f5
0x010ff9c8
0x010ff9cc
0x010ff9d3
0x010ff9da
0x010ff9e1
0x010ff9e2
0x010ff9e5
0x010ff9eb
0x010ff9ee
0x010ff9f1
0x010ff9f6
0x010ff9fc
0x010ff9fc
0x010ffa02
0x010ffa06
0x010ffa12
0x010ffa18
0x010ffa1c
0x010ffa23
0x010ffa29
0x010ffa2a
0x010ffa2f
0x010ffa36
0x010ffa3e
0x010ffa74
0x010ffa74
0x010ffa77
0x010ffa7e
0x010ffa7e
0x010ffa85
0x010ffa89
0x010ffa99
0x010ffaac
0x010ffaac
0x010ffab1
0x00000000
0x010ffab1
0x010ffa79
0x010ffa7c
0x00000000
0x00000000
0x00000000
0x010ffa40
0x010ffa40
0x010ffa43
0x010ffa4a
0x010ffa4c
0x010ffa5c
0x010ffa6f
0x00000000
0x010ffa6f
0x010ffa45
0x010ffa48
0x00000000
0x00000000
0x00000000
0x010ffa48
0x010ffa3e
0x010ff3fb
0x010ff400
0x010ff406
0x010ff409
0x010ff40b
0x010ff40f
0x010ff41c
0x010ff41c
0x010ff411
0x010ff418
0x010ff418
0x010ff41e
0x010ff420
0x010ff424
0x010ff427
0x010ff42c
0x010ff42c
0x010ff435
0x010ff43b
0x010ff448
0x010ff44c
0x010ff462
0x010ff467
0x010ff46e
0x010ff471
0x010ff47d
0x010ff486
0x010ff48c
0x010ff491
0x010ff491
0x010ff492
0x010ff492
0x010ff49e
0x010ff4b0
0x010ff4b4
0x010ff4bf
0x010ff4c6
0x010ff4cc
0x010ff4d2
0x010ff4d8
0x010ff4e1
0x010ff4ed
0x010ff4f4
0x010ff4fc
0x010ff507
0x010ff50b
0x010ff510
0x010ff516
0x010ff51a
0x010ff51d
0x010ff52b
0x010ff534
0x010ff53b
0x010ff543
0x010ff543
0x010ff554
0x010ff55a
0x010ff55b
0x010ff562
0x010ff565
0x010ff566
0x010ff573
0x010ff574
0x010ff575
0x010ff57c
0x010ff586
0x010ff58d
0x010ff58e
0x010ff593
0x010ff599
0x010ff59c
0x010ff5a0
0x010ff5a3
0x010ff5a3
0x010ff5a8
0x010ff5ab
0x010ff5ad
0x010ff5b2
0x010ff5b4
0x010ff5b8
0x010ff5bb
0x010ff5ca
0x010ff5d1
0x010ff5d9
0x010ff5e3
0x010ff5e3
0x010ff5e8
0x010ff5eb
0x010ff5ed
0x010ff5ed
0x010ff5eb
0x010ff5f4
0x010ff5fa
0x010ff5fe
0x010ff600
0x010ff664
0x010ff66a
0x010ff670
0x010ff672
0x010ff674
0x010ff678
0x010ff681
0x010ff69a
0x010ff69a
0x010ff678
0x010ff6a5
0x010ff6ab
0x010ff6de
0x010ff6de
0x010ff6e0
0x010ff6e8
0x010ff6e8
0x010ff6ee
0x010ff6f1
0x010ff6fa
0x010ff6fd
0x010ff712
0x010ff712
0x010ff71d
0x010ff723
0x010ff727
0x010ff732
0x010ff738
0x010ff741
0x010ff75a
0x010ff75a
0x010ff738
0x010ff723
0x00000000
0x010ff6ad
0x010ff6ad
0x010ff6af
0x010ff6b3
0x010ff75f
0x010ff765
0x010ff76b
0x010ff7af
0x010ff7af
0x010ff7b3
0x010ff7bc
0x010ff7bc
0x010ff7be
0x010ff975
0x010ff97b
0x010ff987
0x010ff993
0x010ff9a2
0x010ff9a7
0x010ff9aa
0x010ff9ae
0x010ff9b7
0x010ff9b7
0x00000000
0x010ff9ae
0x010ff7ca
0x010ff7d0
0x010ff939
0x010ff93b
0x010ff946
0x010ff946
0x010ff94c
0x010ff94f
0x010ff958
0x010ff95b
0x010ff970
0x010ff970
0x00000000
0x010ff94f
0x010ff7dc
0x010ff7dc
0x010ff7e2
0x010ff7e5
0x00000000
0x00000000
0x010ff7eb
0x010ff7ef
0x00000000
0x00000000
0x010ff7f5
0x010ff7fd
0x010ff803
0x010ff80c
0x010ff825
0x010ff82a
0x010ff82a
0x010ff830
0x010ff837
0x010ff855
0x010ff85c
0x010ff875
0x010ff880
0x010ff883
0x010ff88c
0x010ff8a2
0x010ff8ae
0x010ff8c7
0x010ff8c7
0x00000000
0x010ff839
0x010ff839
0x010ff840
0x00000000
0x00000000
0x010ff842
0x010ff848
0x00000000
0x00000000
0x010ff850
0x010ff853
0x010ff8cc
0x010ff8d3
0x010ff8ec
0x010ff8ef
0x010ff8fe
0x010ff918
0x010ff91d
0x010ff921
0x010ff925
0x010ff932
0x010ff932
0x00000000
0x010ff921
0x00000000
0x010ff853
0x010ff837
0x010ff7b5
0x010ff7b5
0x00000000
0x010ff7b5
0x010ff76d
0x010ff76f
0x010ff773
0x00000000
0x00000000
0x010ff777
0x010ff782
0x010ff788
0x00000000
0x00000000
0x010ff791
0x010ff7aa
0x00000000
0x010ff7aa
0x010ff6c0
0x010ff6d9
0x00000000
0x010ff6d9
0x010ff602
0x010ff604
0x010ff609
0x010ff610
0x010ff61b
0x010ff622
0x010ff625
0x010ff63a
0x010ff646
0x010ff65f
0x00000000
0x010ff65f
0x010ff612
0x010ff619
0x00000000
0x00000000
0x00000000
0x010ff619
0x010ff600
0x010ff3eb
0x010ff27b
0x010ff27c
0x010ff28a
0x010ff28b
0x00000000
0x010ff28b
0x010feefd
0x010ff10a
0x010ff111
0x010ff240
0x010ff241
0x010ff117
0x010ff11d
0x010ff122
0x010ff125
0x010ff129
0x010ff12e
0x010ff12e
0x010ff12f
0x010ff12f
0x010ff135
0x010ff13b
0x010ff147
0x010ff152
0x010ff15e
0x010ff164
0x010ff16a
0x010ff170
0x010ff176
0x010ff187
0x010ff18b
0x010ff192
0x010ff199
0x010ff1a8
0x010ff1ab
0x010ff1ba
0x010ff1be
0x010ff1c3
0x010ff1c8
0x010ff1ca
0x010ff1cc
0x010ff1ce
0x010ff1ce
0x010ff1d4
0x010ff1e2
0x010ff1e6
0x010ff1ed
0x010ff1f4
0x010ff1fd
0x010ff206
0x010ff21d
0x010ff223
0x010ff22e
0x010ff22e
0x00000000
0x010fef03
0x010fef0a
0x010fef0c
0x010fef12
0x010fef1f
0x010fef1f
0x010fef12
0x010fef2a
0x010fef2f
0x010fef34
0x010fef3e
0x010fef44
0x010fef49
0x010fef4d
0x010fef53
0x010fef59
0x010fef69
0x010fef69
0x010fef69
0x010fef69
0x010fef6d
0x010fef76
0x010fef83
0x010fef8e
0x010fef9b
0x010fefa4
0x010fefa8
0x010fefae
0x010fefb4
0x010fefb4
0x010fefc4
0x010fefca
0x010fefdd
0x010fefdd
0x010fefdd
0x010fefdd
0x010fefe4
0x010feff1
0x010feffc
0x010ff002
0x010ff00e
0x010ff014
0x010ff01c
0x010ff026
0x010ff02c
0x010ff032
0x010ff038
0x010ff043
0x010ff045
0x010ff04c
0x010ff050
0x010ff057
0x010ff05e
0x010ff065
0x010ff06e
0x010ff07e
0x010ff081
0x010ff08b
0x010ff08b
0x010ff090
0x010ff095
0x010ff099
0x010ff09b
0x010ff09b
0x010ff0a1
0x010ff0a3
0x010ff0a7
0x010ff0b3
0x010ff0ba
0x010ff0c3
0x010ff0c9
0x010ff0d5
0x010ff0db
0x010ff0e5
0x010ff0ea
0x010ff0f4
0x010ff100
0x00000000
0x010ff100
0x010fefcc
0x010fefd2
0x00000000
0x010fefd4
0x010fefd4
0x00000000
0x010fefd4
0x010fefd2
0x010fef5b
0x010fef61
0x00000000
0x010fef63
0x010fef63
0x00000000
0x010fef63
0x010fef61

Strings

Open Errors: , xrefs: 010FF78C
Archives with Errors: , xrefs: 010FF6BB
Alternate Streams: , xrefs: 010FF887
Archives with Warnings: , xrefs: 010FF6F5
Warnings: , xrefs: 010FF73C
Compressed: , xrefs: 010FF8F9
Can't open as archive: , xrefs: 010FF67C
Sub items Errors: , xrefs: 010FF953
ERROR:, xrefs: 010FF5C5
Alternate Streams Size: , xrefs: 010FF8A9
Files: , xrefs: 010FF857
OK archives: , xrefs: 010FF641
Folders: , xrefs: 010FF807
F}w, xrefs: 010FF0A3, 010FF0A7, 010FF1E2, 010FF1E6, 010FF61B, 010FF63F, 010FF67A, 010FF6B9, 010FF6F3, 010FF73A, 010FF78A, 010FF805, 010FF855, 010FF885, 010FF8A7, 010FF8CC, 010FF951
7zCon.sfx, xrefs: 010FEF14
Size: , xrefs: 010FF8CE
Archives: , xrefs: 010FF61D

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$ExceptionThrow
String ID: F}w$7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 3665150552-3072540131
Opcode ID: 9428fac3b69ded49fb7c58cd14dd97eaaa492e4cf924fb8975ff73eb31ef03b9
Instruction ID: 801773c841ee0cd987d59b5c08048f219888d454ec02b8b06601072a8fe500df
Opcode Fuzzy Hash: 9428fac3b69ded49fb7c58cd14dd97eaaa492e4cf924fb8975ff73eb31ef03b9
Instruction Fuzzy Hash: 9752673190425A9FDF2ADBA8C895BEDBBF5AF54304F0440DED289A7290DF706A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010FE64B Relevance: 53.2, APIs: 19, Strings: 11, Instructions: 728
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E010FE64B(void* __ebx, void* __edi, struct _IO_FILE** __esi) {
				char* _t629;
				void* _t636;
				signed char _t638;
				struct _IO_FILE** _t644;
				void* _t646;
				struct _IO_FILE** _t647;
				struct _IO_FILE** _t659;
				signed char _t664;
				struct _IO_FILE** _t668;
				signed char _t677;
				signed int _t681;
				signed int _t689;
				struct _IO_FILE** _t701;
				void* _t717;
				void* _t722;
				signed int _t723;
				void* _t756;
				signed char _t783;
				signed char _t797;
				signed char _t810;
				struct _IO_FILE** _t824;
				signed char _t833;
				struct _IO_FILE** _t835;
				struct _IO_FILE** _t836;
				struct _IO_FILE** _t856;
				signed char _t857;
				void* _t863;
				signed char _t868;
				struct _IO_FILE** _t870;
				struct _IO_FILE** _t871;
				struct _IO_FILE** _t872;
				struct _IO_FILE** _t874;
				int _t882;
				signed int _t886;
				intOrPtr* _t892;
				void* _t893;
				char** _t902;
				signed char _t921;
				signed char _t927;
				char** _t938;
				signed int _t948;
				signed int _t954;
				void* _t982;
				signed int _t986;
				signed char _t990;
				unsigned int _t991;
				unsigned int _t992;
				signed char _t993;
				signed int _t997;
				signed int _t1015;
				signed char _t1017;
				signed int _t1032;
				void* _t1035;
				signed int _t1037;
				signed int _t1039;
				signed int _t1054;
				void* _t1056;
				void* _t1058;
				intOrPtr* _t1059;
				struct _IO_FILE** _t1061;
				struct _IO_FILE** _t1230;
				signed char _t1243;
				signed char _t1350;
				signed int _t1369;
				void* _t1379;
				void* _t1395;
				signed char _t1396;
				signed int _t1397;
				struct _IO_FILE** _t1400;
				struct _IO_FILE** _t1401;
				signed int _t1402;
				struct _IO_FILE** _t1403;
				struct _IO_FILE** _t1404;
				signed char _t1407;
				struct _IO_FILE** _t1409;
				void* _t1410;
				void* _t1412;
				void* _t1414;
				void* _t1437;
				void* _t1466;
				signed int _t1471;
				void* _t1474;

				_t1404 = __esi;
				_t1395 = __edi;
				_t1061 =  *0x11146fc; // 0x1114440
				E01100640(_t1061, 0);
				_push(_t1410 - 0x33c);
				E010DB97D(__ebx, _t1410 - 0x448, __edi, __esi);
				 *(_t1410 - 0x24) = __ebx;
				if( *((intOrPtr*)(_t1410 - 0x134)) == __esi ||  *((intOrPtr*)(_t1410 - 0x138)) !=  *((intOrPtr*)(_t1410 - 0x140))) {
					 *(_t1410 - 0x24) = _t1395;
				}
				_t1396 = 0x50;
				 *(_t1410 - 0x14) = _t1396;
				if( *(_t1410 - 0x18) != _t1404 && GetConsoleScreenBufferInfo(GetStdHandle(0xfffffff5), _t1410 - 0x6c) != 0) {
					 *(_t1410 - 0x14) =  *(_t1410 - 0x6c);
				}
				_push(_t1396);
				_t629 = E010D1A96();
				 *(_t1410 - 0x34) = _t629;
				_t1421 = _t629 - _t1404;
				 *(_t1410 - 4) = 4;
				if(_t629 == _t1404) {
					_t1054 = 0;
					__eflags = 0;
				} else {
					_t1054 = E010FFB71(_t629);
				}
				 *(_t1410 - 0x1c) = _t1054;
				 *(_t1410 - 4) = 3;
				E01100F0E(_t1410 - 0xf0);
				 *(_t1410 - 4) = 5;
				E010E0E48(_t1410 - 0xf0, _t1054);
				_t20 = _t1054 + 4; // 0x4
				asm("sbb ecx, ecx");
				E010E0E48(_t1410 - 0xec,  ~_t1054 & _t20);
				 *((char*)(_t1054 + 0x4c)) =  *((intOrPtr*)(_t1410 - 0x33b));
				 *(_t1410 - 4) = 6;
				 *(_t1410 - 0xf4) = _t1054;
				 *((char*)(_t1054 + 0x4d)) =  *((intOrPtr*)(_t1410 - 0x33a));
				_t636 = E010EBD45(_t1054, _t1421); // executed
				E011009F5(_t636);
				_t638 = E010DB5FD(_t1410 - 0x318);
				 *(_t1410 - 0xd) = _t638;
				if( *((intOrPtr*)(_t1054 + 0x2c)) == _t1404 && (_t638 != 0 ||  *((intOrPtr*)(_t1410 - 0x318)) == 6 || E010DB621(_t1410 - 0x318) != 0)) {
					if( *((intOrPtr*)(_t1054 + 0x1c)) != _t1404) {
						E010D296F(_t1410 - 0x60, "Can\'t load module: ");
						_t1054 = _t1054 + 0x18;
						_t1427 = _t1054;
						 *(_t1410 - 4) = 7;
						E010D2C71(_t1410 - 0x60, _t1054, _t1054);
						E010D29BC(_t1410 - 0x54, _t1054, _t1410 - 0x60);
						_push(0x1110e80);
						_push(_t1410 - 0x54);
						L01103CAC();
					}
					_t1039 =  *0x110b790; // 0x110b7b4
					_push(0x110da90);
					 *(_t1410 - 0x28) = _t1039;
					_push(_t1410 - 0x28);
					L01103CAC();
				}
				 *(_t1410 - 0xc4) = _t1404;
				 *(_t1410 - 0xc0) = _t1404;
				 *(_t1410 - 0xbc) = _t1404;
				_t1369 = _t1410 - 0x158;
				_push(_t1410 - 0xc4);
				 *(_t1410 - 4) = 8;
				if(E010F2E8E(_t1054, _t1369, _t1427) == 0) {
					_t1037 =  *0x110b794; // 0x110b798
					_push(0x110da90);
					 *(_t1410 - 0x28) = _t1037;
					_push(_t1410 - 0x28);
					L01103CAC();
				}
				 *(_t1410 - 0xd0) = _t1404;
				 *(_t1410 - 0xcc) = _t1404;
				 *(_t1410 - 0xc8) = _t1404;
				_t1397 = 0;
				 *(_t1410 - 4) = 9;
				if( *((intOrPtr*)(_t1410 - 0x148)) <= _t1404) {
					L23:
					if( *(_t1410 - 0xd) != 0 ||  *((intOrPtr*)(_t1410 - 0x318)) == 9) {
						L26:
						E011009F5(E010D8785(_t1410 - 0xf0, _t1435));
						goto L27;
					} else {
						_t1435 =  *((intOrPtr*)(_t1410 - 0x318)) - 7;
						if( *((intOrPtr*)(_t1410 - 0x318)) != 7) {
							L27:
							 *(_t1410 - 0x3c) = _t1404;
							 *(_t1410 - 0x20) = _t1404;
							if( *((intOrPtr*)(_t1410 - 0x318)) != 8) {
								__eflags =  *((intOrPtr*)(_t1410 - 0x318)) - 7;
								if( *((intOrPtr*)(_t1410 - 0x318)) != 7) {
									__eflags =  *(_t1410 - 0xd);
									if( *(_t1410 - 0xd) != 0) {
										L119:
										 *(_t1410 - 0x48) = 0;
										 *((intOrPtr*)(_t1410 - 0x44)) = 0;
										 *((intOrPtr*)(_t1410 - 0x40)) = 0;
										 *(_t1410 - 0x54) = 0;
										 *(_t1410 - 0x50) = 0;
										 *(_t1410 - 0x4c) = 0;
										__eflags =  *((char*)(_t1410 - 0x336));
										_t1054 = fputs;
										 *(_t1410 - 4) = 0xd;
										if(__eflags == 0) {
											_push(0xc8);
											 *((intOrPtr*)(_t1410 - 0x3fc)) = 0x110c6a0;
											E010FE094(_t1410 - 0x3ec, __eflags);
											 *((intOrPtr*)(_t1410 - 0x3fc)) = 0x110c698;
											_t644 =  *0x11146fc;
											asm("sbb ecx, ecx");
											 *(_t1410 - 4) = 0xe;
											 *(_t1410 - 0x3f8) =  ~( *(_t1410 - 0x334)) & _t644;
											 *(_t1410 - 0x3f4) =  *0x1114700;
											 *(_t1410 - 0x348) =  *(_t1410 - 0x18);
											__eflags = _t644;
											 *((intOrPtr*)(_t1410 - 0x340)) =  *(_t1410 - 0x14) - 1;
											if(_t644 != 0) {
												__eflags =  *(_t1410 - 0x334);
												if( *(_t1410 - 0x334) != 0) {
													fputs("Scanning the drive for archives:",  *_t644);
													E010D1CAE(_t644);
												}
											}
											 *((intOrPtr*)(_t1410 - 0xac)) = 0;
											 *((intOrPtr*)(_t1410 - 0xa8)) = 0;
											 *((intOrPtr*)(_t1410 - 0xa4)) = 0;
											 *((intOrPtr*)(_t1410 - 0xa0)) = 0;
											 *((intOrPtr*)(_t1410 - 0x9c)) = 0;
											 *((intOrPtr*)(_t1410 - 0x98)) = 0;
											 *(_t1410 - 0x94) = 0;
											 *(_t1410 - 0x90) = 0;
											 *((intOrPtr*)(_t1410 - 0x8c)) = 0;
											 *(_t1410 - 0x88) = 0;
											 *(_t1410 - 0x84) = 0;
											 *(_t1410 - 0x80) = 0;
											E010FA34A(_t1410 - 0x3fc);
											_t646 = E010D28E9(_t1410 - 0x60);
											_push(_t1410 - 0x3fc);
											_push(_t1410 - 0xac);
											_push(_t1410 - 0x54);
											_push(_t1410 - 0x48);
											_push(_t646);
											 *(_t1410 - 4) = 0xf;
											_t647 = E010E8549(_t1054, _t1410 - 0x2e4, 0, 0, __eflags); // executed
											 *(_t1410 - 0x20) = _t647;
											 *(_t1410 - 4) = 0xe;
											E010D1ABD(_t647,  *((intOrPtr*)(_t1410 - 0x60)));
											__eflags =  *(_t1410 - 0x348);
											if( *(_t1410 - 0x348) != 0) {
												E0110183F(_t1410 - 0x3ec, 0, 1);
											}
											__eflags =  *(_t1410 - 0x20);
											if( *(_t1410 - 0x20) == 0) {
												__eflags =  *(_t1410 - 0x334);
												if( *(_t1410 - 0x334) != 0) {
													_push(_t1410 - 0xac);
													E010FA6F7(_t1410 - 0x3fc);
												}
											}
											 *(_t1410 - 4) = 0xd;
											E011017A6(_t1410 - 0x3ec);
											__eflags =  *(_t1410 - 0x20);
											if( *(_t1410 - 0x20) != 0) {
												L197:
												 *(_t1410 - 4) = 0xc;
												E010E8B2E(_t1054, _t1410 - 0x54);
												 *(_t1410 - 4) = 9;
												E010E8B2E(_t1054, _t1410 - 0x48);
												goto L198;
											} else {
												L130:
												__eflags =  *(_t1410 - 0xd);
												if( *(_t1410 - 0xd) == 0) {
													_push(_t1410 - 0x38);
													_push(_t1410 - 0x2c);
													_push(_t1410 - 0x2c0);
													_push(_t1410 - 0x304);
													_push(_t1410 - 0x308);
													 *(_t1410 - 0x2c) = 0;
													_push( *((intOrPtr*)(_t1410 - 0x2f8)));
													 *(_t1410 - 0x28) = 0;
													 *(_t1410 - 0x38) = 0;
													 *(_t1410 - 0x34) = 0;
													_push( *(_t1410 - 0x334));
													_t664 =  *((intOrPtr*)( *((intOrPtr*)(_t1410 - 0x330)))) + 0xc;
													__eflags = _t664;
													_push(_t664);
													_push( *((intOrPtr*)(_t1410 - 0x28e)));
													_push( *((intOrPtr*)(_t1410 - 0x296)));
													_push(_t1410 - 0x54);
													_push(_t1410 - 0x48);
													_push( *((intOrPtr*)(_t1410 - 0x336)));
													_push(_t1410 - 0xd0);
													_t668 = L010FD42A( *(_t1410 - 0x1c), _t1410 - 0xc4, _t664);
													__eflags =  *(_t1410 - 0x334);
													 *(_t1410 - 0x20) = _t668;
													if( *(_t1410 - 0x334) == 0) {
														L192:
														__eflags =  *(_t1410 - 0x28);
														if( *(_t1410 - 0x28) > 0) {
															L194:
															__eflags =  *(_t1410 - 0x334);
															if( *(_t1410 - 0x334) != 0) {
																E010D1CAE(0x1114440);
																 *_t1054("Errors: ",  *0x1114440);
																E010D1CAE(E010D1F47(0x1114440,  *(_t1410 - 0x2c),  *(_t1410 - 0x28)));
															}
															 *(_t1410 - 0x3c) = 2;
															goto L197;
														}
														__eflags =  *(_t1410 - 0x2c);
														if( *(_t1410 - 0x2c) <= 0) {
															goto L197;
														}
														goto L194;
													} else {
														__eflags =  *(_t1410 - 0x34);
														if( *(_t1410 - 0x34) > 0) {
															L191:
															E010D1CAE(0x1114440);
															 *_t1054("Warnings: ",  *0x1114440);
															E010D1CAE(E010D1F47(0x1114440,  *(_t1410 - 0x38),  *(_t1410 - 0x34)));
															goto L192;
														}
														__eflags =  *(_t1410 - 0x38);
														if( *(_t1410 - 0x38) <= 0) {
															goto L192;
														}
														goto L191;
													}
												}
												_push(0x178);
												_t677 = E010D1A96();
												 *(_t1410 - 0x34) = _t677;
												__eflags = _t677;
												 *(_t1410 - 4) = 0x10;
												if(__eflags == 0) {
													_t1407 = 0;
													__eflags = 0;
												} else {
													_t1407 = E01100157(_t677, __eflags);
												}
												__eflags = _t1407;
												 *(_t1410 - 4) = 0xd;
												 *(_t1410 - 0x34) = _t1407;
												if(_t1407 != 0) {
													 *((intOrPtr*)( *_t1407 + 4))(_t1407);
												}
												_t423 = _t1407 + 0xe4; // 0xe4
												 *((char*)(_t1407 + 0xe1)) =  *((intOrPtr*)(_t1410 - 0x308));
												 *(_t1410 - 4) = 0x11;
												E010D2A8C(_t423, _t1410 - 0x304);
												_t681 = E011002D6(_t1407,  *0x11146fc,  *0x1114700,  *(_t1410 - 0x18));
												__eflags =  *((intOrPtr*)(_t1410 - 0x44)) - 1;
												__eflags =  *(_t1410 - 0x18);
												 *((char*)(_t1407 + 0xe0)) = _t681 & 0xffffff00 |  *((intOrPtr*)(_t1410 - 0x44)) - 0x00000001 > 0x00000000;
												 *((intOrPtr*)(_t1407 + 0x170)) =  *((intOrPtr*)(_t1410 - 0x134));
												 *((intOrPtr*)(_t1407 + 0x16c)) =  *(_t1410 - 0x24);
												if(__eflags != 0) {
													_t797 =  *(_t1410 - 0x14) - 1;
													__eflags = _t797;
													 *(_t1407 + 0xc4) = _t797;
												}
												E010FFD74(_t1410 - 0x12c, __eflags);
												 *(_t1410 - 4) = 0x12;
												E01100F65(_t1410 - 0x12c, _t1410 - 0x2b4);
												__eflags =  *((intOrPtr*)(_t1410 - 0x318)) - 3;
												 *((char*)(_t1410 - 0x108)) =  *((intOrPtr*)(_t1410 - 0x336));
												_t689 =  *((intOrPtr*)(_t1410 - 0x333));
												 *(_t1410 - 0x106) = _t689;
												 *(_t1410 - 0x107) = _t689;
												 *((char*)(_t1410 - 0x105)) = _t689 & 0xffffff00 |  *((intOrPtr*)(_t1410 - 0x318)) == 0x00000003;
												_push(_t1410 - 0x2c0);
												E010DD18C(_t1410 - 0x104);
												E010D28E9(_t1410 - 0x60);
												 *(_t1410 - 4) = 0x13;
												E010EADD3(_t1410 - 0x39c);
												__eflags =  *(_t1410 - 0x2f0);
												 *(_t1410 - 4) = 0x14;
												 *(_t1410 - 0x14) = 0;
												if( *(_t1410 - 0x2f0) != 0) {
													 *(_t1410 - 0x14) = _t1410 - 0x39c;
													_push(_t1410 - 0x2f4);
													_push(_t1410 - 0xf0);
													E011009F5(E010EA2E2(_t1410 - 0x39c));
												}
												_push(_t1410 - 0xb4);
												_push(_t1410 - 0x60);
												_push( *(_t1410 - 0x14));
												_t469 = _t1407 + 0x10; // 0x10
												_push(_t1407);
												asm("sbb edx, edx");
												_push( ~_t1407 & _t469);
												_push(_t1410 - 0x12c);
												_push( *((intOrPtr*)( *((intOrPtr*)(_t1410 - 0x330)))) + 0xc);
												_push(_t1410 - 0x54);
												_push(_t1410 - 0x48);
												_push(_t1410 - 0xd0); // executed
												_t701 = E010E8D6E( *(_t1410 - 0x1c), _t1410 - 0xc4); // executed
												__eflags =  *(_t1407 + 0xbc);
												 *(_t1410 - 0x20) = _t701;
												if( *(_t1407 + 0xbc) != 0) {
													_t478 = _t1407 + 0x18; // 0x18
													E0110183F(_t478, 0, 1);
												}
												__eflags =  *(_t1410 - 0x5c);
												if( *(_t1410 - 0x5c) != 0) {
													_t783 =  *0x1114700; // 0x1114438
													__eflags = _t783;
													if(_t783 != 0) {
														 *(_t1410 - 0x24) = _t783;
														E010D1CAE(_t783);
														fputs("ERROR:",  *( *(_t1410 - 0x24)));
														E010D1CAE( *(_t1410 - 0x24));
														_push( *((intOrPtr*)(_t1410 - 0x60)));
														E010D1CAE(E010D1CC1( *(_t1410 - 0x24)));
													}
													__eflags =  *(_t1410 - 0x20);
													if( *(_t1410 - 0x20) == 0) {
														 *(_t1410 - 0x20) = 0x80004005;
													}
												}
												_t1400 =  *0x11146fc; // 0x1114440
												 *(_t1410 - 0xd) =  *(_t1410 - 0xd) & 0x00000000;
												__eflags = _t1400;
												if(_t1400 == 0) {
													L151:
													__eflags =  *(_t1407 + 0x130) |  *(_t1407 + 0x134);
													if(( *(_t1407 + 0x130) |  *(_t1407 + 0x134)) != 0) {
														__eflags = _t1400;
														 *(_t1410 - 0xd) = 1;
														if(_t1400 != 0) {
															fputs("Can\'t open as archive: ",  *_t1400);
															E010D1CAE(E010D1F47(_t1400,  *(_t1407 + 0x130),  *(_t1407 + 0x134)));
														}
													}
													__eflags =  *(_t1407 + 0x138) |  *(_t1407 + 0x13c);
													if(( *(_t1407 + 0x138) |  *(_t1407 + 0x13c)) == 0) {
														L157:
														__eflags = _t1400;
														if(_t1400 != 0) {
															_t506 = _t1407 + 0x140; // 0x140
															_t756 = _t506;
															__eflags =  *(_t1407 + 0x140) |  *(_t756 + 4);
															if(( *(_t1407 + 0x140) |  *(_t756 + 4)) != 0) {
																fputs("Archives with Warnings: ",  *_t1400);
																_t508 = _t1407 + 0x140; // 0x140
																E010D1CAE(E010D1F47(_t1400,  *_t508,  *((intOrPtr*)(_t508 + 4))));
															}
															__eflags =  *(_t1407 + 0x150) |  *(_t1407 + 0x154);
															if(( *(_t1407 + 0x150) |  *(_t1407 + 0x154)) != 0) {
																E010D1CAE(_t1400);
																__eflags =  *(_t1407 + 0x150) |  *(_t1407 + 0x154);
																if(( *(_t1407 + 0x150) |  *(_t1407 + 0x154)) != 0) {
																	fputs("Warnings: ",  *_t1400);
																	E010D1CAE(E010D1F47(_t1400,  *(_t1407 + 0x150),  *(_t1407 + 0x154)));
																}
															}
														}
														goto L163;
													} else {
														__eflags = _t1400;
														 *(_t1410 - 0xd) = 1;
														if(_t1400 == 0) {
															L163:
															__eflags =  *(_t1407 + 0x148) |  *(_t1407 + 0x14c);
															if(( *(_t1407 + 0x148) |  *(_t1407 + 0x14c)) == 0) {
																L167:
																__eflags =  *(_t1410 - 0xd);
																if( *(_t1410 - 0xd) == 0) {
																	L169:
																	__eflags = _t1400;
																	if(_t1400 == 0) {
																		L185:
																		 *(_t1410 - 4) = 0x13;
																		E010D1ABD(E010EAE4E(_t1410 - 0x39c),  *((intOrPtr*)(_t1410 - 0x60)));
																		 *(_t1410 - 4) = 0x15;
																		E010D1ABD(E01101159(_t1410 - 0x104),  *((intOrPtr*)(_t1410 - 0x120)));
																		__eflags = _t1407;
																		 *(_t1410 - 4) = 0xd;
																		if(_t1407 != 0) {
																			 *((intOrPtr*)( *_t1407 + 8))(_t1407);
																		}
																		goto L197;
																	}
																	__eflags =  *(_t1407 + 0x138) |  *(_t1407 + 0x13c);
																	if(( *(_t1407 + 0x138) |  *(_t1407 + 0x13c)) != 0) {
																		L183:
																		E010D1CAE(_t1400);
																		_t559 = _t1407 + 0x158; // 0x158
																		_t717 = _t559;
																		__eflags =  *(_t1407 + 0x158) |  *(_t717 + 4);
																		if(( *(_t1407 + 0x158) |  *(_t717 + 4)) != 0) {
																			fputs("Sub items Errors: ",  *_t1400);
																			_t561 = _t1407 + 0x158; // 0x158
																			E010D1CAE(E010D1F47(_t1400,  *_t561,  *((intOrPtr*)(_t561 + 4))));
																		}
																		goto L185;
																	}
																	_t528 = _t1407 + 0x158; // 0x158
																	_t722 = _t528;
																	__eflags =  *(_t1407 + 0x158) |  *(_t722 + 4);
																	if(( *(_t1407 + 0x158) |  *(_t722 + 4)) != 0) {
																		goto L183;
																	}
																	__eflags =  *(_t1410 - 0x20);
																	if( *(_t1410 - 0x20) != 0) {
																		goto L185;
																	}
																	_t723 =  *(_t1410 - 0x94);
																	__eflags = _t723 |  *(_t1410 - 0x90);
																	if((_t723 |  *(_t1410 - 0x90)) != 0) {
																		fputs("Folders: ",  *_t1400);
																		E010D1CAE(E010D1F47(_t1400,  *(_t1410 - 0x94),  *(_t1410 - 0x90)));
																		_t723 =  *(_t1410 - 0x94);
																	}
																	__eflags =  *((intOrPtr*)(_t1410 - 0x8c)) - 1;
																	if( *((intOrPtr*)(_t1410 - 0x8c)) != 1) {
																		L179:
																		fputs("Files: ",  *_t1400);
																		E010D1CAE(E010D1F47(_t1400,  *((intOrPtr*)(_t1410 - 0x8c)),  *(_t1410 - 0x88)));
																		__eflags =  *(_t1410 - 0x84) |  *(_t1410 - 0x80);
																		if(( *(_t1410 - 0x84) |  *(_t1410 - 0x80)) != 0) {
																			fputs("Alternate Streams: ",  *_t1400);
																			E010D1CAE(E010D1F47(_t1400,  *(_t1410 - 0x84),  *(_t1410 - 0x80)));
																			fputs("Alternate Streams Size: ",  *_t1400);
																			E010D1CAE(E010D1F47(_t1400,  *((intOrPtr*)(_t1410 - 0xa4)),  *((intOrPtr*)(_t1410 - 0xa0))));
																		}
																		goto L181;
																	} else {
																		__eflags =  *(_t1410 - 0x88);
																		if( *(_t1410 - 0x88) != 0) {
																			goto L179;
																		}
																		__eflags = _t723 |  *(_t1410 - 0x90);
																		if((_t723 |  *(_t1410 - 0x90)) != 0) {
																			goto L179;
																		}
																		__eflags =  *(_t1410 - 0x84) |  *(_t1410 - 0x80);
																		if(( *(_t1410 - 0x84) |  *(_t1410 - 0x80)) == 0) {
																			L181:
																			fputs("Size:       ",  *_t1400);
																			 *(_t1410 - 0x28) = E010D1F47(_t1400,  *((intOrPtr*)(_t1410 - 0xac)),  *((intOrPtr*)(_t1410 - 0xa8)));
																			E010D1CAE(_t730);
																			fputs("Compressed: ",  *( *(_t1410 - 0x28)));
																			E010D1CAE(E010D1F47( *(_t1410 - 0x28),  *((intOrPtr*)(_t1410 - 0x9c)),  *((intOrPtr*)(_t1410 - 0x98))));
																			__eflags =  *(_t1410 - 0x14);
																			if( *(_t1410 - 0x14) != 0) {
																				E010D1CAE(_t1400);
																				E010FBF06(_t1400, _t1410 - 0x39c);
																			}
																			goto L185;
																		}
																		goto L179;
																	}
																}
																L168:
																 *(_t1410 - 0x3c) = 2;
																goto L169;
															}
															__eflags = _t1400;
															 *(_t1410 - 0xd) = 1;
															if(_t1400 == 0) {
																goto L168;
															}
															E010D1CAE(_t1400);
															__eflags =  *(_t1407 + 0x148) |  *(_t1407 + 0x14c);
															if(( *(_t1407 + 0x148) |  *(_t1407 + 0x14c)) == 0) {
																goto L168;
															}
															fputs("Open Errors: ",  *_t1400);
															E010D1CAE(E010D1F47(_t1400,  *(_t1407 + 0x148),  *(_t1407 + 0x14c)));
															goto L167;
														}
														fputs("Archives with Errors: ",  *_t1400);
														E010D1CAE(E010D1F47(_t1400,  *(_t1407 + 0x138),  *(_t1407 + 0x13c)));
														goto L157;
													}
												} else {
													E010D1CAE(_t1400);
													__eflags =  *(_t1407 + 0x11c);
													if( *(_t1407 + 0x11c) > 0) {
														L150:
														fputs("Archives: ",  *_t1400);
														_t491 = _t1407 + 0x118; // 0x118
														E010D1CAE(E010D1F47(_t1400,  *_t491,  *((intOrPtr*)(_t491 + 4))));
														fputs("OK archives: ",  *_t1400);
														E010D1CAE(E010D1F47(_t1400,  *((intOrPtr*)(_t1407 + 0x128)),  *((intOrPtr*)(_t1407 + 0x12c))));
														goto L151;
													}
													__eflags =  *((intOrPtr*)(_t1407 + 0x118)) - 1;
													if( *((intOrPtr*)(_t1407 + 0x118)) <= 1) {
														goto L151;
													}
													goto L150;
												}
											}
										}
										_push(_t1410 - 0x2cc);
										E010D150C(_t1410 - 0x48);
										_push(_t1410 - 0x2cc);
										E010D150C(_t1410 - 0x54);
										goto L130;
									}
									__eflags =  *((intOrPtr*)(_t1410 - 0x318)) - 6;
									if( *((intOrPtr*)(_t1410 - 0x318)) == 6) {
										goto L119;
									}
									_t810 = E010DB621(_t1410 - 0x318);
									__eflags = _t810;
									if(_t810 == 0) {
										__eflags =  *((intOrPtr*)(_t1410 - 0x318)) - 9;
										if(__eflags != 0) {
											_t1379 = 7;
											E011005EE(_t1379);
										} else {
											E0110054D(_t1410 - 0x580, __eflags);
											__eflags =  *(_t1410 - 0x18) - _t1404;
											 *(_t1410 - 4) = 0x1a;
											if( *(_t1410 - 0x18) != _t1404) {
												_t833 =  *(_t1410 - 0x14) - 1;
												__eflags = _t833;
												 *(_t1410 - 0x4cc) = _t833;
											}
											_t1401 =  *0x1114700; // 0x1114438
											_t1054 =  *0x11146fc; // 0x1114440
											E010EC900(_t1410 - 0x49c);
											 *(_t1410 - 0x4d4) =  *(_t1410 - 0x18);
											 *(_t1410 - 0x48c) = _t1404;
											 *(_t1410 - 0x4c8) = _t1054;
											 *(_t1410 - 0x4c4) = _t1401;
											 *((char*)(_t1410 - 0x44f)) =  *(_t1410 - 0x334);
											E010D232F(_t1410 - 0x60);
											_push(_t1410 - 0x580);
											_push(_t1410 - 0x60);
											_push(_t1410 - 0x16c);
											 *(_t1410 - 4) = 0x1b;
											 *(_t1410 - 0x20) = E010EA895(_t1410 - 0xf0, _t1410 - 0x330, __eflags);
											E010FFDE9(_t1410 - 0x98, __eflags);
											 *(_t1410 - 4) = 0x1c;
											E010D240D(_t1410 - 0x94, _t1410 - 0x60);
											_t824 =  *0x11146fc; // 0x1114440
											_t1230 = _t824;
											__eflags = _t1230 - _t1404;
											if(_t1230 == _t1404) {
												_t1230 =  *0x1114700; // 0x1114438
											}
											_push( *(_t1410 - 0x334));
											_push(_t1230);
											_push(_t824);
											_push(_t1410 - 0x98);
											asm("sbb edx, edx");
											 *(_t1410 - 0x3c) = E01100733( *(_t1410 - 0x20),  ~(_t1410 - 0x580) & _t1410 - 0x00000578);
											 *(_t1410 - 4) = 0x1d;
											E010D1ABD(E010D1ABD(E010E8B2E(_t1054, _t1410 - 0x88),  *(_t1410 - 0x94)),  *((intOrPtr*)(_t1410 - 0x60)));
											 *(_t1410 - 4) = 9;
											E011005BB(_t1054, _t1410 - 0x580);
										}
										goto L198;
									}
									__eflags =  *((char*)(_t1410 - 0x1e0));
									if(__eflags != 0) {
										__eflags =  *((intOrPtr*)(_t1410 - 0x1d8)) - _t1404;
										if(__eflags == 0) {
											E010D2B8A(_t1410 - 0x1dc, "7zCon.sfx");
										}
									}
									E010FE02D(_t1410 - 0x41c, __eflags);
									_t835 =  *0x11146fc; // 0x1114440
									_t1402 =  *(_t1410 - 0x18);
									__eflags =  *((char*)(_t1410 - 0x308));
									 *(_t1410 - 0x364) = _t835;
									_t836 =  *0x1114700; // 0x1114438
									 *(_t1410 - 4) = 0x16;
									 *(_t1410 - 0x360) = _t836;
									 *(_t1410 - 0x370) = _t1402;
									if( *((char*)(_t1410 - 0x308)) == 0) {
										L100:
										_t265 = _t1410 - 0xd;
										 *_t265 =  *(_t1410 - 0xd) & 0x00000000;
										__eflags =  *_t265;
										goto L101;
									} else {
										__eflags =  *((intOrPtr*)(_t1410 - 0x300)) - _t1404;
										if( *((intOrPtr*)(_t1410 - 0x300)) == _t1404) {
											goto L100;
										}
										 *(_t1410 - 0xd) = 1;
										L101:
										 *((char*)(_t1410 - 0x34b)) =  *(_t1410 - 0xd);
										E010D2A8C(_t1410 - 0x348, _t1410 - 0x304);
										E011003B6(_t1410 - 0x578, __eflags);
										__eflags = _t1402 - _t1404;
										 *((intOrPtr*)(_t1410 - 0x4b0)) =  *((intOrPtr*)(_t1410 - 0x134));
										 *(_t1410 - 4) = 0x17;
										 *((intOrPtr*)(_t1410 - 0x4b4)) =  *(_t1410 - 0x24);
										if(_t1402 != _t1404) {
											_t868 =  *(_t1410 - 0x14) - 1;
											__eflags = _t868;
											 *(_t1410 - 0x4c4) = _t868;
										}
										__eflags =  *((char*)(_t1410 - 0x308));
										 *((char*)(_t1410 - 0x460)) =  *(_t1410 - 0xd);
										if( *((char*)(_t1410 - 0x308)) == 0) {
											L106:
											_t284 = _t1410 - 0x450;
											 *_t284 =  *(_t1410 - 0x450) & 0x00000000;
											__eflags =  *_t284;
											goto L107;
										} else {
											__eflags =  *((intOrPtr*)(_t1410 - 0x300)) - _t1404;
											if( *((intOrPtr*)(_t1410 - 0x300)) != _t1404) {
												goto L106;
											}
											 *(_t1410 - 0x450) = 1;
											L107:
											E010D2A8C(_t1410 - 0x45c, _t1410 - 0x304);
											_t1403 =  *0x1114700; // 0x1114438
											_t1409 =  *0x11146fc; // 0x1114440
											 *((char*)(_t1410 - 0x4b8)) =  *((intOrPtr*)(_t1410 - 0x1c0));
											E010EC900(_t1410 - 0x494);
											 *(_t1410 - 0x484) =  *(_t1410 - 0x484) & 0x00000000;
											 *(_t1410 - 0x4c0) = _t1409;
											 *(_t1410 - 0x4bc) = _t1403;
											 *(_t1410 - 0x4cc) =  *(_t1410 - 0x18);
											E010FFDE9(_t1410 - 0x70, __eflags);
											 *(_t1410 - 4) = 0x18;
											_t856 = E010F4C61(_t1054, _t1410 - 0xc4, _t1410 - 0x314, _t1410 - 0x330, _t1410 - 0x284, _t1410 - 0x70, _t1410 - 0x41c, _t1410 - 0x578, 1);
											__eflags =  *(_t1410 - 0x4cc);
											 *(_t1410 - 0x20) = _t856;
											if( *(_t1410 - 0x4cc) != 0) {
												E0110183F(_t1410 - 0x570, _t1403, 1);
											}
											_t857 =  *0x11146fc; // 0x1114440
											_t1243 = _t857;
											__eflags = _t1243;
											if(_t1243 == 0) {
												_t1243 =  *0x1114700; // 0x1114438
											}
											_push(1);
											_push(_t1243);
											_push(_t857);
											_push(_t1410 - 0x70);
											asm("sbb edx, edx");
											 *(_t1410 - 0x3c) = E01100733( *(_t1410 - 0x20),  ~(_t1410 - 0x578) & _t1410 - 0x00000570);
											 *(_t1410 - 4) = 0x19;
											E010D1ABD(E010E8B2E(_t1054, _t1410 - 0x60),  *(_t1410 - 0x6c));
											 *(_t1410 - 4) = 0x16;
											_t863 = E01100FAB(_t1054, _t1410 - 0x578);
											 *(_t1410 - 4) = 9;
											E010D1ABD(_t863,  *(_t1410 - 0x348));
											E011017A6(_t1410 - 0x414);
											goto L198;
										}
									}
								}
								_t870 =  *0x11146fc; // 0x1114440
								__eflags = _t870 - _t1404;
								if(_t870 == _t1404) {
									_t870 = 0x1114440;
								}
								_t871 = E010FA29C(_t1410 - 0xf0, _t1410 - 0x2c0,  *((intOrPtr*)(_t1410 - 0x130)),  *_t870);
								__eflags = _t871 - 1;
								 *(_t1410 - 0x20) = _t871;
								if(_t871 == 1) {
									_t872 =  *0x1114700; // 0x1114438
									__eflags = _t872 - _t1404;
									if(_t872 != _t1404) {
										fputs("\nDecoding ERROR\n",  *_t872);
									}
									 *(_t1410 - 0x3c) = 2;
									 *(_t1410 - 0x20) = _t1404;
								}
								goto L198;
							} else {
								_t874 =  *0x11146fc; // 0x1114440
								_t1437 = _t874 - _t1404;
								_t1404 = _t874;
								if(_t1437 == 0) {
									_t1404 = 0x1114440;
								}
								E010D1CAE(_t1404);
								fputs("Libs:",  *_t1404);
								E010D1CAE(_t1404);
								 *(_t1410 - 0x18) =  *(_t1410 - 0x18) & 0x00000000;
								_t1397 = fputc;
								if( *((intOrPtr*)(_t1054 + 0x10)) <= 0) {
									L32:
									E010D1CAE(_t1404);
									fputs("Formats:",  *_t1404);
									E010D1CAE(_t1404);
									_t882 = strlen("KSNFMGOPBELH");
									 *(_t1410 - 0x18) =  *(_t1410 - 0x18) & 0x00000000;
									 *(_t1410 - 0xb8) = _t882;
									if( *((intOrPtr*)(_t1054 + 0x2c)) <= 0) {
										L64:
										E010D1CAE(_t1404);
										fputs("Codecs:",  *_t1404);
										E010D1CAE(_t1404);
										 *(_t1410 - 0x18) =  *(_t1410 - 0x18) & 0x00000000;
										if( *0x1114598 <= 0) {
											L70:
											_t886 =  *(_t1410 - 0x1c);
											_t1389 = _t1410 - 0x24;
											_push(_t1410 - 0x24);
											_push(_t886);
											if( *((intOrPtr*)( *_t886 + 0xc))() != 0) {
												L78:
												E010D1CAE(_t1404);
												fputs("Hashers:",  *_t1404);
												E010D1CAE(_t1404);
												 *(_t1410 - 0x18) =  *(_t1410 - 0x18) & 0x00000000;
												if( *0x111459c <= 0) {
													L81:
													_t892 =  *(_t1410 - 0x1c) + 4;
													_t893 =  *((intOrPtr*)( *_t892 + 0xc))(_t892);
													_t1054 = 0;
													 *(_t1410 - 0x24) = _t893;
													_t1475 = _t893;
													if(_t893 <= 0) {
														L198:
														if( *((char*)(_t1410 - 0x2f7)) != 0 &&  *0x11146fc != 0) {
															E01100A10();
														}
														E010D1ABD(E011009F5( *(_t1410 - 0x20)),  *(_t1410 - 0xd0));
														 *(_t1410 - 4) = 6;
														E010E9E21(_t1410 - 0xc4);
														_t1098 =  *(_t1410 - 0x1c);
														 *(_t1410 - 4) = 5;
														_t1479 =  *(_t1410 - 0x1c);
														if( *(_t1410 - 0x1c) != 0) {
															E010EBD18(_t1098);
														}
														 *(_t1410 - 4) = 3;
														E010FFCF6(_t1410 - 0xf0);
														 *(_t1410 - 4) = 2;
														E010D11BB(_t1410 - 0x448);
														 *(_t1410 - 4) =  *(_t1410 - 4) & 0x00000000;
														E01100E30(_t1054, _t1410 - 0x33c, _t1479);
														 *(_t1410 - 4) =  *(_t1410 - 4) | 0xffffffff;
														E010E8B2E(_t1054, _t1410 - 0x7c);
														_t659 =  *(_t1410 - 0x3c);
														 *[fs:0x0] =  *((intOrPtr*)(_t1410 - 0xc));
														return _t659;
													} else {
														goto L82;
													}
													do {
														L82:
														E011006D8(_t1404, E010EC549( *(_t1410 - 0x1c), _t1054));
														E01100671(_t1404, E010EC7B7( *(_t1410 - 0x1c)), _t1054);
														 *_t1397(0x20,  *_t1404, 4);
														E01100E08(_t1404, E010EC6C9( *(_t1410 - 0x1c)), _t896);
														_t902 = E010EC72E( *(_t1410 - 0x1c), _t1397, _t1404, _t1475);
														 *(_t1410 - 0x34) =  *_t902;
														 *_t1397(0x20,  *_t1404, _t1410 - 0x60, _t1054, _t1054);
														fputs( *(_t1410 - 0x34),  *_t1404);
														_t1412 = _t1412 + 0x10;
														E010D1ABD(E010D1CAE(_t1404),  *((intOrPtr*)(_t1410 - 0x60)));
														_t1054 = _t1054 + 1;
													} while (_t1054 <  *(_t1410 - 0x24));
													goto L198;
												}
												 *(_t1410 - 0x14) = 0x1114458;
												do {
													_t1056 =  *( *(_t1410 - 0x14));
													E011006D8(_t1404, _t1389 | 0xffffffff);
													_t1389 =  *(_t1056 + 0x14);
													E01100671(_t1404,  *(_t1056 + 0x14), 4);
													 *_t1397(0x20,  *_t1404);
													E01100E08(_t1404,  *((intOrPtr*)(_t1056 + 8)),  *((intOrPtr*)(_t1056 + 0xc)));
													 *_t1397(0x20,  *_t1404);
													fputs( *(_t1056 + 0x10),  *_t1404);
													_t1412 = _t1412 + 0x10;
													E010D1CAE(_t1404);
													 *(_t1410 - 0x18) =  *(_t1410 - 0x18) + 1;
													 *(_t1410 - 0x14) =  *(_t1410 - 0x14) + 4;
													_t1474 =  *(_t1410 - 0x18) -  *0x111459c; // 0x0
												} while (_t1474 < 0);
												goto L81;
											}
											_t1058 = 0;
											if( *(_t1410 - 0x24) <= 0) {
												goto L78;
											} else {
												goto L72;
											}
											do {
												L72:
												_t1389 = E010EC539( *(_t1410 - 0x1c), _t1058);
												E011006D8(_t1404, _t917);
												_push(_t1058);
												if(E010EC578( *(_t1410 - 0x1c)) != 1) {
													E010D1F1E(_t1404, _t919);
												} else {
													 *_t1397(0x20,  *_t1404);
												}
												_t921 = E010EC567( *(_t1410 - 0x1c), _t1058);
												asm("sbb al, al");
												 *_t1397(( ~_t921 & 0x00000025) + 0x00000020 & 0x000000ff,  *_t1404);
												_t927 = E010EC556( *(_t1410 - 0x1c), _t1058);
												asm("sbb al, al");
												 *_t1397(( ~_t927 & 0x00000024) + 0x00000020 & 0x000000ff,  *_t1404);
												 *_t1397(0x20,  *_t1404);
												_t1414 = _t1412 + 0x10;
												_push(_t1410 - 0x2c);
												_push(_t1058);
												if(E010EC5DB( *(_t1410 - 0x1c)) != 0) {
													 *(_t1410 - 0x2c) =  *(_t1410 - 0x2c) | 0xffffffff;
													_t208 = _t1410 - 0x28;
													 *_t208 =  *(_t1410 - 0x28) | 0xffffffff;
													_t1471 =  *_t208;
												}
												E01100E08(_t1404,  *(_t1410 - 0x2c),  *(_t1410 - 0x28));
												_t938 = E010EC644( *(_t1410 - 0x1c), _t1397, _t1404, _t1471);
												 *(_t1410 - 0x34) =  *_t938;
												 *_t1397(0x20,  *_t1404, _t1410 - 0x60, _t1058);
												fputs( *(_t1410 - 0x34),  *_t1404);
												_t1412 = _t1414 + 0x10;
												E010D1ABD(E010D1CAE(_t1404),  *((intOrPtr*)(_t1410 - 0x60)));
												_t1058 = _t1058 + 1;
											} while (_t1058 <  *(_t1410 - 0x24));
											goto L78;
										}
										 *(_t1410 - 0x14) = 0x1114498;
										do {
											_t1369 = _t1369 | 0xffffffff;
											_t1059 =  *( *(_t1410 - 0x14));
											E011006D8(_t1404, _t1369);
											_t947 =  *((intOrPtr*)(_t1059 + 0x14));
											if( *((intOrPtr*)(_t1059 + 0x14)) != 1) {
												_t948 = E010D1F1E(_t1404, _t947);
											} else {
												_t948 =  *_t1397(0x20,  *_t1404);
											}
											_t954 =  *_t1397(((_t948 & 0xffffff00 |  *((intOrPtr*)(_t1059 + 4)) == 0x00000000) - 0x00000001 & 0x00000025) + 0x00000020 & 0x000000ff,  *_t1404);
											 *_t1397(((_t954 & 0xffffff00 |  *_t1059 == 0x00000000) - 0x00000001 & 0x00000024) + 0x00000020 & 0x000000ff,  *_t1404);
											 *_t1397(0x20,  *_t1404);
											E01100E08(_t1404,  *((intOrPtr*)(_t1059 + 8)),  *((intOrPtr*)(_t1059 + 0xc)));
											 *_t1397(0x20,  *_t1404);
											fputs( *(_t1059 + 0x10),  *_t1404);
											_t1412 = _t1412 + 0x28;
											E010D1CAE(_t1404);
											 *(_t1410 - 0x18) =  *(_t1410 - 0x18) + 1;
											 *(_t1410 - 0x14) =  *(_t1410 - 0x14) + 4;
											_t1466 =  *(_t1410 - 0x18) -  *0x1114598; // 0x0
										} while (_t1466 < 0);
										goto L70;
									}
									L33:
									_t1054 =  *( *((intOrPtr*)( *(_t1410 - 0x1c) + 0x28)) +  *(_t1410 - 0x18) * 4);
									fputc(((E011006D8(_t1404,  *((intOrPtr*)(_t1054 + 0x3c))) & 0xffffff00 |  *((char*)(_t1054 + 0x28)) == 0x00000000) - 0x00000001 & 0x00000023) + 0x00000020 & 0x000000ff,  *_t1404);
									 *(_t1410 - 0x14) =  *(_t1410 - 0x14) & 0x00000000;
									if( *(_t1410 - 0xb8) <= 0) {
										L39:
										 *_t1397(0x20,  *_t1404);
										_t117 = _t1054 + 0xc; // 0xc
										E01100705(_t1404, _t117, 8);
										 *_t1397(0x20,  *_t1404);
										E010D28E9(_t1410 - 0x48);
										 *(_t1410 - 0x30) =  *(_t1410 - 0x30) & 0x00000000;
										 *(_t1410 - 4) = 0xb;
										if( *((intOrPtr*)(_t1054 + 0x1c)) <= 0) {
											L45:
											_t1369 = _t1410 - 0x48;
											E01100705(_t1404, _t1369, 0xd);
											 *_t1397(0x20,  *_t1404);
											if( *((intOrPtr*)(_t1054 + 0x2c)) != 0) {
												fputs("offset=",  *_t1404);
												 *_t1397(0x20,  *((intOrPtr*)(E010D1F1E(_t1404,  *((intOrPtr*)(_t1054 + 0x2c))))));
											}
											 *(_t1410 - 0x14) =  *(_t1410 - 0x14) & 0x00000000;
											if( *((intOrPtr*)(_t1054 + 0x34)) <= 0) {
												L63:
												_t982 = E010D1CAE(_t1404);
												 *(_t1410 - 4) = 9;
												E010D1ABD(_t982,  *(_t1410 - 0x48));
												 *(_t1410 - 0x18) =  *(_t1410 - 0x18) + 1;
												if( *(_t1410 - 0x18) <  *((intOrPtr*)( *(_t1410 - 0x1c) + 0x2c))) {
													goto L33;
												}
												goto L64;
											} else {
												do {
													if( *(_t1410 - 0x14) != 0) {
														fputs("  ||  ",  *_t1404);
													}
													 *(_t1410 - 0x30) =  *(_t1410 - 0x30) & 0x00000000;
													_t986 =  *( *((intOrPtr*)(_t1054 + 0x30)) +  *(_t1410 - 0x14) * 4);
													 *(_t1410 - 0x28) = _t986;
													if( *((intOrPtr*)(_t986 + 4)) > 0) {
														do {
															if( *(_t1410 - 0x30) != 0) {
																 *_t1397(0x20,  *_t1404);
																_t986 =  *(_t1410 - 0x28);
															}
															_t990 =  *((intOrPtr*)( *_t986 +  *(_t1410 - 0x30)));
															if(_t990 <= 0x20 || _t990 >= 0x80) {
																_t991 = _t990 & 0x000000ff;
																 *(_t1410 - 0x34) = _t991;
																_t992 = _t991 >> 4;
																if(_t992 >= 0xa) {
																	_t993 = _t992 + 0x37;
																	__eflags = _t993;
																} else {
																	_t993 = _t992 + 0x30;
																}
																 *_t1397(_t993 & 0x000000ff,  *_t1404);
																_t997 =  *(_t1410 - 0x34) & 0x0000000f;
																if(_t997 >= 0xa) {
																	_t990 = _t997 + 0x37;
																	__eflags = _t990;
																} else {
																	_t990 = _t997 + 0x30;
																}
															}
															 *_t1397(_t990 & 0x000000ff,  *_t1404);
															 *(_t1410 - 0x30) =  *(_t1410 - 0x30) + 1;
															_t986 =  *(_t1410 - 0x28);
														} while ( *(_t1410 - 0x30) <  *((intOrPtr*)(_t986 + 4)));
													}
													 *(_t1410 - 0x14) =  *(_t1410 - 0x14) + 1;
												} while ( *(_t1410 - 0x14) <  *((intOrPtr*)(_t1054 + 0x34)));
												goto L63;
											}
										} else {
											goto L40;
										}
										do {
											L40:
											_t1446 =  *(_t1410 - 0x30);
											if( *(_t1410 - 0x30) != 0) {
												E010D2BF6();
											}
											 *(_t1410 - 0x14) =  *( *(_t1054 + 0x18) +  *(_t1410 - 0x30) * 4);
											E010D2C71(_t1410 - 0x48, _t1446,  *( *(_t1054 + 0x18) +  *(_t1410 - 0x30) * 4));
											if( *((intOrPtr*)( *(_t1410 - 0x14) + 0x10)) != 0) {
												E010D2CAD(_t1410 - 0x48, " (");
												E010D2C71(_t1410 - 0x48,  *(_t1410 - 0x14) + 0xc,  *(_t1410 - 0x14) + 0xc);
												E010D1089(_t1410 - 0x48, 0x29);
											}
											 *(_t1410 - 0x30) =  *(_t1410 - 0x30) + 1;
										} while ( *(_t1410 - 0x30) <  *((intOrPtr*)(_t1054 + 0x1c)));
										goto L45;
									}
									L34:
									_t1350 =  *(_t1410 - 0x14);
									_t1015 = 1;
									if(( *_t1054 & _t1015 << _t1350) == 0) {
										L37:
										_t1017 = 0x20;
										goto L38;
									} else {
										_t110 =  &(("KSNFMGOPBELH")[_t1350]); // 0x464e534b
										_t1017 =  *_t110;
										L38:
										 *_t1397(_t1017 & 0x000000ff,  *_t1404);
										 *(_t1410 - 0x14) =  *(_t1410 - 0x14) + 1;
										if( *(_t1410 - 0x14) <  *(_t1410 - 0xb8)) {
											goto L34;
										}
										goto L39;
									}
								} else {
									goto L31;
								}
								do {
									L31:
									_t1369 =  *(_t1410 - 0x18);
									E011006D8(_t1404, _t1369);
									 *(_t1410 - 0x28) =  *( *((intOrPtr*)( *((intOrPtr*)(_t1054 + 0xc)) +  *(_t1410 - 0x18) * 4)) + 4);
									fputc(0x20,  *_t1404);
									_push( *(_t1410 - 0x28));
									E010D1CAE(E010D1CC1(_t1404));
									 *(_t1410 - 0x18) =  *(_t1410 - 0x18) + 1;
								} while ( *(_t1410 - 0x18) <  *((intOrPtr*)(_t1054 + 0x10)));
								goto L32;
							}
						}
						goto L26;
					}
				} else {
					goto L20;
				}
				while(1) {
					L20:
					 *(_t1410 - 0x54) = _t1404;
					 *(_t1410 - 0x50) = _t1404;
					 *(_t1410 - 0x4c) = _t1404;
					_push(_t1410 - 0x54);
					 *(_t1410 - 4) = 0xa;
					_push( *((intOrPtr*)( *((intOrPtr*)(_t1410 - 0x14c)) + _t1397 * 4)));
					if(E010EC2F0(_t1054) == 0 ||  *(_t1410 - 0x50) != 1) {
						_t1032 =  *0x110b794; // 0x110b798
						_push(0x110da90);
						 *(_t1410 - 0x28) = _t1032;
						_push(_t1410 - 0x28);
						L01103CAC();
						goto L37;
					}
					_t1035 = E01101045(_t1410 - 0xd0,  *( *(_t1410 - 0x54)));
					 *(_t1410 - 4) = 9;
					E010D1ABD(_t1035,  *(_t1410 - 0x54));
					_t1397 = _t1397 + 1;
					if(_t1397 <  *((intOrPtr*)(_t1410 - 0x148))) {
						continue;
					}
					goto L23;
				}
				goto L37;
			}

0x010fe64b
0x010fe64b
0x010fe64b
0x010fe653
0x010fe664
0x010fe665
0x010fe670
0x010fe673
0x010fe683
0x010fe683
0x010fe68b
0x010fe68c
0x010fe68f
0x010fe6ac
0x010fe6ac
0x010fe6af
0x010fe6b0
0x010fe6b6
0x010fe6b9
0x010fe6bb
0x010fe6bf
0x010fe6cc
0x010fe6cc
0x010fe6c1
0x010fe6c8
0x010fe6c8
0x010fe6d4
0x010fe6d7
0x010fe6db
0x010fe6e7
0x010fe6eb
0x010fe6f2
0x010fe6f7
0x010fe702
0x010fe70f
0x010fe718
0x010fe71c
0x010fe722
0x010fe725
0x010fe72c
0x010fe737
0x010fe73f
0x010fe742
0x010fe763
0x010fe76d
0x010fe772
0x010fe772
0x010fe779
0x010fe77d
0x010fe789
0x010fe791
0x010fe796
0x010fe797
0x010fe797
0x010fe79c
0x010fe7a1
0x010fe7a6
0x010fe7ac
0x010fe7ad
0x010fe7ad
0x010fe7b2
0x010fe7b8
0x010fe7be
0x010fe7ca
0x010fe7d0
0x010fe7d3
0x010fe7de
0x010fe7e0
0x010fe7e5
0x010fe7ea
0x010fe7f0
0x010fe7f1
0x010fe7f1
0x010fe7f6
0x010fe7fc
0x010fe802
0x010fe808
0x010fe810
0x010fe814
0x010fe870
0x010fe874
0x010fe888
0x010fe895
0x00000000
0x010fe87f
0x010fe87f
0x010fe886
0x010fe89a
0x010fe8a1
0x010fe8a4
0x010fe8a7
0x010fee76
0x010fee7d
0x010feed9
0x010feedd
0x010ff24b
0x010ff24d
0x010ff250
0x010ff253
0x010ff256
0x010ff259
0x010ff25c
0x010ff25f
0x010ff266
0x010ff26c
0x010ff270
0x010ff295
0x010ff2a0
0x010ff2aa
0x010ff2af
0x010ff2bf
0x010ff2c6
0x010ff2c8
0x010ff2ce
0x010ff2da
0x010ff2e3
0x010ff2ed
0x010ff2ef
0x010ff2f5
0x010ff2f7
0x010ff2fe
0x010ff309
0x010ff30f
0x010ff30f
0x010ff2fe
0x010ff31a
0x010ff320
0x010ff326
0x010ff32c
0x010ff332
0x010ff338
0x010ff33e
0x010ff344
0x010ff34a
0x010ff350
0x010ff356
0x010ff35c
0x010ff35f
0x010ff367
0x010ff374
0x010ff37b
0x010ff37f
0x010ff383
0x010ff384
0x010ff38b
0x010ff38f
0x010ff394
0x010ff397
0x010ff39e
0x010ff3a3
0x010ff3aa
0x010ff3b4
0x010ff3b4
0x010ff3b9
0x010ff3bc
0x010ff3be
0x010ff3c5
0x010ff3d3
0x010ff3d4
0x010ff3d4
0x010ff3c5
0x010ff3df
0x010ff3e3
0x010ff3e8
0x010ff3eb
0x010ffab8
0x010ffabb
0x010ffabf
0x010ffac7
0x010ffacb
0x00000000
0x010ff3f1
0x010ff3f1
0x010ff3f1
0x010ff3f5
0x010ff9c8
0x010ff9cc
0x010ff9d3
0x010ff9da
0x010ff9e1
0x010ff9e2
0x010ff9e5
0x010ff9eb
0x010ff9ee
0x010ff9f1
0x010ff9f6
0x010ff9fc
0x010ff9fc
0x010ffa02
0x010ffa06
0x010ffa12
0x010ffa18
0x010ffa1c
0x010ffa23
0x010ffa29
0x010ffa2a
0x010ffa2f
0x010ffa36
0x010ffa3e
0x010ffa74
0x010ffa74
0x010ffa77
0x010ffa7e
0x010ffa7e
0x010ffa85
0x010ffa89
0x010ffa99
0x010ffaac
0x010ffaac
0x010ffab1
0x00000000
0x010ffab1
0x010ffa79
0x010ffa7c
0x00000000
0x00000000
0x00000000
0x010ffa40
0x010ffa40
0x010ffa43
0x010ffa4a
0x010ffa4c
0x010ffa5c
0x010ffa6f
0x00000000
0x010ffa6f
0x010ffa45
0x010ffa48
0x00000000
0x00000000
0x00000000
0x010ffa48
0x010ffa3e
0x010ff3fb
0x010ff400
0x010ff406
0x010ff409
0x010ff40b
0x010ff40f
0x010ff41c
0x010ff41c
0x010ff411
0x010ff418
0x010ff418
0x010ff41e
0x010ff420
0x010ff424
0x010ff427
0x010ff42c
0x010ff42c
0x010ff435
0x010ff43b
0x010ff448
0x010ff44c
0x010ff462
0x010ff467
0x010ff46e
0x010ff471
0x010ff47d
0x010ff486
0x010ff48c
0x010ff491
0x010ff491
0x010ff492
0x010ff492
0x010ff49e
0x010ff4b0
0x010ff4b4
0x010ff4bf
0x010ff4c6
0x010ff4cc
0x010ff4d2
0x010ff4d8
0x010ff4e1
0x010ff4ed
0x010ff4f4
0x010ff4fc
0x010ff507
0x010ff50b
0x010ff510
0x010ff516
0x010ff51a
0x010ff51d
0x010ff52b
0x010ff534
0x010ff53b
0x010ff543
0x010ff543
0x010ff554
0x010ff55a
0x010ff55b
0x010ff562
0x010ff565
0x010ff566
0x010ff573
0x010ff574
0x010ff575
0x010ff57c
0x010ff586
0x010ff58d
0x010ff58e
0x010ff593
0x010ff599
0x010ff59c
0x010ff5a0
0x010ff5a3
0x010ff5a3
0x010ff5a8
0x010ff5ab
0x010ff5ad
0x010ff5b2
0x010ff5b4
0x010ff5b8
0x010ff5bb
0x010ff5ca
0x010ff5d1
0x010ff5d9
0x010ff5e3
0x010ff5e3
0x010ff5e8
0x010ff5eb
0x010ff5ed
0x010ff5ed
0x010ff5eb
0x010ff5f4
0x010ff5fa
0x010ff5fe
0x010ff600
0x010ff664
0x010ff66a
0x010ff670
0x010ff672
0x010ff674
0x010ff678
0x010ff681
0x010ff69a
0x010ff69a
0x010ff678
0x010ff6a5
0x010ff6ab
0x010ff6de
0x010ff6de
0x010ff6e0
0x010ff6e8
0x010ff6e8
0x010ff6ee
0x010ff6f1
0x010ff6fa
0x010ff6fd
0x010ff712
0x010ff712
0x010ff71d
0x010ff723
0x010ff727
0x010ff732
0x010ff738
0x010ff741
0x010ff75a
0x010ff75a
0x010ff738
0x010ff723
0x00000000
0x010ff6ad
0x010ff6ad
0x010ff6af
0x010ff6b3
0x010ff75f
0x010ff765
0x010ff76b
0x010ff7af
0x010ff7af
0x010ff7b3
0x010ff7bc
0x010ff7bc
0x010ff7be
0x010ff975
0x010ff97b
0x010ff987
0x010ff993
0x010ff9a2
0x010ff9a7
0x010ff9aa
0x010ff9ae
0x010ff9b7
0x010ff9b7
0x00000000
0x010ff9ae
0x010ff7ca
0x010ff7d0
0x010ff939
0x010ff93b
0x010ff946
0x010ff946
0x010ff94c
0x010ff94f
0x010ff958
0x010ff95b
0x010ff970
0x010ff970
0x00000000
0x010ff94f
0x010ff7dc
0x010ff7dc
0x010ff7e2
0x010ff7e5
0x00000000
0x00000000
0x010ff7eb
0x010ff7ef
0x00000000
0x00000000
0x010ff7f5
0x010ff7fd
0x010ff803
0x010ff80c
0x010ff825
0x010ff82a
0x010ff82a
0x010ff830
0x010ff837
0x010ff855
0x010ff85c
0x010ff875
0x010ff880
0x010ff883
0x010ff88c
0x010ff8a2
0x010ff8ae
0x010ff8c7
0x010ff8c7
0x00000000
0x010ff839
0x010ff839
0x010ff840
0x00000000
0x00000000
0x010ff842
0x010ff848
0x00000000
0x00000000
0x010ff850
0x010ff853
0x010ff8cc
0x010ff8d3
0x010ff8ec
0x010ff8ef
0x010ff8fe
0x010ff918
0x010ff91d
0x010ff921
0x010ff925
0x010ff932
0x010ff932
0x00000000
0x010ff921
0x00000000
0x010ff853
0x010ff837
0x010ff7b5
0x010ff7b5
0x00000000
0x010ff7b5
0x010ff76d
0x010ff76f
0x010ff773
0x00000000
0x00000000
0x010ff777
0x010ff782
0x010ff788
0x00000000
0x00000000
0x010ff791
0x010ff7aa
0x00000000
0x010ff7aa
0x010ff6c0
0x010ff6d9
0x00000000
0x010ff6d9
0x010ff602
0x010ff604
0x010ff609
0x010ff610
0x010ff61b
0x010ff622
0x010ff625
0x010ff63a
0x010ff646
0x010ff65f
0x00000000
0x010ff65f
0x010ff612
0x010ff619
0x00000000
0x00000000
0x00000000
0x010ff619
0x010ff600
0x010ff3eb
0x010ff27b
0x010ff27c
0x010ff28a
0x010ff28b
0x00000000
0x010ff28b
0x010feee3
0x010feeea
0x00000000
0x00000000
0x010feef6
0x010feefb
0x010feefd
0x010ff10a
0x010ff111
0x010ff240
0x010ff241
0x010ff117
0x010ff11d
0x010ff122
0x010ff125
0x010ff129
0x010ff12e
0x010ff12e
0x010ff12f
0x010ff12f
0x010ff135
0x010ff13b
0x010ff147
0x010ff152
0x010ff15e
0x010ff164
0x010ff16a
0x010ff170
0x010ff176
0x010ff187
0x010ff18b
0x010ff192
0x010ff199
0x010ff1a8
0x010ff1ab
0x010ff1ba
0x010ff1be
0x010ff1c3
0x010ff1c8
0x010ff1ca
0x010ff1cc
0x010ff1ce
0x010ff1ce
0x010ff1d4
0x010ff1e2
0x010ff1e6
0x010ff1ed
0x010ff1f4
0x010ff1fd
0x010ff206
0x010ff21d
0x010ff223
0x010ff22e
0x010ff22e
0x00000000
0x010ff111
0x010fef03
0x010fef0a
0x010fef0c
0x010fef12
0x010fef1f
0x010fef1f
0x010fef12
0x010fef2a
0x010fef2f
0x010fef34
0x010fef37
0x010fef3e
0x010fef44
0x010fef49
0x010fef4d
0x010fef53
0x010fef59
0x010fef69
0x010fef69
0x010fef69
0x010fef69
0x00000000
0x010fef5b
0x010fef5b
0x010fef61
0x00000000
0x00000000
0x010fef63
0x010fef6d
0x010fef76
0x010fef83
0x010fef8e
0x010fef99
0x010fef9b
0x010fefa4
0x010fefa8
0x010fefae
0x010fefb3
0x010fefb3
0x010fefb4
0x010fefb4
0x010fefbd
0x010fefc4
0x010fefca
0x010fefdd
0x010fefdd
0x010fefdd
0x010fefdd
0x00000000
0x010fefcc
0x010fefcc
0x010fefd2
0x00000000
0x00000000
0x010fefd4
0x010fefe4
0x010feff1
0x010feffc
0x010ff002
0x010ff00e
0x010ff014
0x010ff01c
0x010ff026
0x010ff02c
0x010ff032
0x010ff038
0x010ff06e
0x010ff072
0x010ff077
0x010ff07e
0x010ff081
0x010ff08b
0x010ff08b
0x010ff090
0x010ff095
0x010ff097
0x010ff099
0x010ff09b
0x010ff09b
0x010ff0a1
0x010ff0a3
0x010ff0a7
0x010ff0b3
0x010ff0ba
0x010ff0c3
0x010ff0c9
0x010ff0d5
0x010ff0db
0x010ff0e5
0x010ff0ea
0x010ff0f4
0x010ff100
0x00000000
0x010ff100
0x010fefca
0x010fef59
0x010fee7f
0x010fee84
0x010fee86
0x010fee88
0x010fee88
0x010feea1
0x010feea6
0x010feea9
0x010feeac
0x010feeb2
0x010feeb7
0x010feeb9
0x010feec2
0x010feec9
0x010feeca
0x010feed1
0x010feed1
0x00000000
0x010fe8ad
0x010fe8ad
0x010fe8b2
0x010fe8b4
0x010fe8b6
0x010fe8b8
0x010fe8b8
0x010fe8bf
0x010fe8cb
0x010fe8d5
0x010fe8dd
0x010fe8e1
0x010fe8e9
0x010fe928
0x010fe92a
0x010fe936
0x010fe940
0x010fe94a
0x010fe94f
0x010fe958
0x010fe95e
0x010feb87
0x010feb89
0x010feb95
0x010feb9f
0x010feba4
0x010febaf
0x010fec58
0x010fec58
0x010fec5b
0x010fec5e
0x010fec5f
0x010fec67
0x010fed4d
0x010fed4f
0x010fed5b
0x010fed65
0x010fed6a
0x010fed75
0x010feddc
0x010feddf
0x010fede5
0x010fede8
0x010fedea
0x010feded
0x010fedef
0x010ffad0
0x010ffad7
0x010ffae2
0x010ffae2
0x010ffaf5
0x010ffafb
0x010ffb05
0x010ffb0a
0x010ffb0d
0x010ffb11
0x010ffb13
0x010ffb15
0x010ffb15
0x010ffb20
0x010ffb24
0x010ffb2f
0x010ffb33
0x010ffb38
0x010ffb42
0x010ffb47
0x010ffb4e
0x010ffb53
0x010ffb5c
0x010ffb64
0x00000000
0x00000000
0x00000000
0x010fedf5
0x010fedf5
0x010fee02
0x010fee16
0x010fee1f
0x010fee30
0x010fee3d
0x010fee46
0x010fee4b
0x010fee52
0x010fee58
0x010fee65
0x010fee6a
0x010fee6c
0x00000000
0x010fee71
0x010fed77
0x010fed7e
0x010fed86
0x010fed88
0x010fed8d
0x010fed94
0x010fed9d
0x010feda9
0x010fedb2
0x010fedba
0x010fedc0
0x010fedc5
0x010fedca
0x010fedcd
0x010fedd4
0x010fedd4
0x00000000
0x010fed7e
0x010fec6d
0x010fec72
0x00000000
0x00000000
0x00000000
0x00000000
0x010fec78
0x010fec78
0x010fec81
0x010fec85
0x010fec8d
0x010fec96
0x010feca5
0x010fec98
0x010fec9c
0x010fec9f
0x010fecae
0x010fecb7
0x010fecc1
0x010fecc9
0x010fecd2
0x010fecdc
0x010fece2
0x010fece7
0x010feced
0x010fecee
0x010fecf6
0x010fecf8
0x010fecfc
0x010fecfc
0x010fecfc
0x010fecfc
0x010fed08
0x010fed15
0x010fed1e
0x010fed23
0x010fed2a
0x010fed30
0x010fed3d
0x010fed42
0x010fed44
0x00000000
0x010fec78
0x010febb5
0x010febbc
0x010febbf
0x010febc4
0x010febc6
0x010febcb
0x010febd1
0x010febe0
0x010febd3
0x010febd7
0x010febda
0x010febf9
0x010fec0e
0x010fec14
0x010fec21
0x010fec2a
0x010fec32
0x010fec38
0x010fec3d
0x010fec42
0x010fec45
0x010fec4c
0x010fec4c
0x00000000
0x010febbc
0x010fe964
0x010fe96d
0x010fe98e
0x010fe990
0x010fe99d
0x010fe9e3
0x010fe9e7
0x010fe9ea
0x010fe9f2
0x010fe9fb
0x010fea02
0x010fea07
0x010fea0f
0x010fea13
0x010fea72
0x010fea74
0x010fea79
0x010fea82
0x010fea8a
0x010fea93
0x010feaa9
0x010feaac
0x010feaad
0x010feab5
0x010feb61
0x010feb63
0x010feb68
0x010feb6f
0x010feb74
0x010feb81
0x00000000
0x00000000
0x00000000
0x010feabb
0x010feabb
0x010feabf
0x010feac8
0x010feacf
0x010fead6
0x010feada
0x010feadd
0x010feae4
0x010feae6
0x010feaea
0x010feaf0
0x010feaf2
0x010feaf6
0x010feafc
0x010feb01
0x010feb07
0x010feb0a
0x010feb0d
0x010feb13
0x010feb1a
0x010feb1a
0x010feb15
0x010feb15
0x010feb15
0x010feb23
0x010feb29
0x010feb30
0x010feb37
0x010feb37
0x010feb32
0x010feb32
0x010feb32
0x010feb30
0x010feb40
0x010feb42
0x010feb45
0x010feb4d
0x010feae6
0x010feb52
0x010feb58
0x00000000
0x010feabb
0x00000000
0x00000000
0x00000000
0x010fea15
0x010fea15
0x010fea15
0x010fea19
0x010fea1e
0x010fea1e
0x010fea30
0x010fea33
0x010fea3f
0x010fea49
0x010fea58
0x010fea62
0x010fea62
0x010fea67
0x010fea6d
0x00000000
0x010fea15
0x010fe99f
0x010fe99f
0x010fe9a4
0x010fe9a9
0x010fe9c9
0x010fe9c9
0x00000000
0x010fe9ab
0x010fe9ab
0x010fe9ab
0x010fe9cb
0x010fe9d1
0x010fe9d3
0x010fe9e1
0x00000000
0x00000000
0x00000000
0x010fe9e1
0x00000000
0x00000000
0x00000000
0x010fe8eb
0x010fe8eb
0x010fe8eb
0x010fe8f0
0x010fe905
0x010fe908
0x010fe90c
0x010fe918
0x010fe91d
0x010fe923
0x00000000
0x010fe8eb
0x010fe8a7
0x00000000
0x010fe886
0x00000000
0x00000000
0x00000000
0x010fe816
0x010fe816
0x010fe816
0x010fe819
0x010fe81c
0x010fe828
0x010fe82e
0x010fe832
0x010fe83a
0x010fe9b3
0x010fe9b8
0x010fe9bd
0x010fe9c3
0x010fe9c4
0x010fe9c4
0x010fe9c4
0x010fe855
0x010fe85a
0x010fe861
0x010fe866
0x010fe86e
0x00000000
0x00000000
0x00000000
0x010fe86e
0x00000000

APIs

Part of subcall function 01100640: fputs.MSVCRT ref: 01100659
Part of subcall function 01100640: fputs.MSVCRT ref: 01100669

Part of subcall function 010DB97D: _CxxThrowException.MSVCRT(?,0110DED0), ref: 010DB9B1
Part of subcall function 010DB97D: _CxxThrowException.MSVCRT(?,0110DED0), ref: 010DB9E8
Part of subcall function 010DB97D: wcscmp.MSVCRT ref: 010DBA56

GetStdHandle.KERNEL32(000000F5,?,?), ref: 010FE697
GetConsoleScreenBufferInfo.KERNEL32(00000000), ref: 010FE69E
_CxxThrowException.MSVCRT(?,01110E80), ref: 010FE797
_CxxThrowException.MSVCRT(?,0110DA90), ref: 010FE7AD

Strings

|| , xrefs: 010FEAC3
Libs:, xrefs: 010FE8C6
KSNFMGOPBELH, xrefs: 010FE945
Can't load module: , xrefs: 010FE765
Codecs:, xrefs: 010FEB90
F}w, xrefs: 010FE8B8, 010FE8C4, 010FE8FB, 010FE92F, 010FE97E
.(, xrefs: 010FE6DB
offset=, xrefs: 010FEA8E
Formats:, xrefs: 010FE931
[!, xrefs: 010FE895
Hashers:, xrefs: 010FED56

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$fputs$BufferConsoleHandleInfoScreenwcscmp
String ID: || $ F}w$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$offset=$.($[!
API String ID: 3991676522-2948176350
Opcode ID: 2a46555a59ed7a065585498323d05f3e5de00d7dbb24b9fe1a49bbf8171929e3
Instruction ID: 72a1d55a4f710dc9a8f4a294589ba2225f1d3e8cc339fee7687bebd5f177c6c5
Opcode Fuzzy Hash: 2a46555a59ed7a065585498323d05f3e5de00d7dbb24b9fe1a49bbf8171929e3
Instruction Fuzzy Hash: 6E427C31E002199FDF29EFA8C885BEDBBB5BF58310F10009EE585A7291DB745A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010FF2F7 Relevance: 53.0, APIs: 14, Strings: 16, Instructions: 497
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E010FF2F7(intOrPtr* __eax, intOrPtr* __ebx, signed int __edi) {
				void* _t246;
				intOrPtr _t247;
				intOrPtr _t259;
				signed int _t264;
				intOrPtr _t268;
				signed int _t277;
				signed int _t289;
				intOrPtr _t301;
				void* _t317;
				signed int _t323;
				struct _IO_FILE** _t383;
				intOrPtr _t397;
				intOrPtr* _t406;
				signed int _t553;
				struct _IO_FILE** _t555;
				signed int _t558;
				void* _t560;
				intOrPtr _t573;

				_t553 = __edi;
				_t406 = __ebx;
				_t563 =  *((char*)(_t560 - 0x334));
				if( *((char*)(_t560 - 0x334)) != 0) {
					_push( *__eax);
					_push("Scanning the drive for archives:");
					 *__ebx();
					E010D1CAE(__eax);
				}
				 *(_t560 - 0xac) = _t553;
				 *(_t560 - 0xa8) = _t553;
				 *(_t560 - 0xa4) = _t553;
				 *(_t560 - 0xa0) = _t553;
				 *(_t560 - 0x9c) = _t553;
				 *(_t560 - 0x98) = _t553;
				 *(_t560 - 0x94) = _t553;
				 *(_t560 - 0x90) = _t553;
				 *(_t560 - 0x8c) = _t553;
				 *(_t560 - 0x88) = _t553;
				 *(_t560 - 0x84) = _t553;
				 *(_t560 - 0x80) = _t553;
				E010FA34A(_t560 - 0x3fc);
				_t246 = E010D28E9(_t560 - 0x60);
				_push(_t560 - 0x3fc);
				_push(_t560 - 0xac);
				_push(_t560 - 0x54);
				_push(_t560 - 0x48);
				_push(_t246);
				 *(_t560 - 4) = 0xf;
				_t247 = E010E8549(_t406, _t560 - 0x2e4, 0, _t553, _t563); // executed
				 *((intOrPtr*)(_t560 - 0x20)) = _t247;
				 *(_t560 - 4) = 0xe;
				E010D1ABD(_t247,  *((intOrPtr*)(_t560 - 0x60)));
				if( *((intOrPtr*)(_t560 - 0x348)) != _t553) {
					E0110183F(_t560 - 0x3ec, _t553, 1);
				}
				if( *((intOrPtr*)(_t560 - 0x20)) == _t553 &&  *((char*)(_t560 - 0x334)) != 0) {
					_push(_t560 - 0xac);
					E010FA6F7(_t560 - 0x3fc);
				}
				 *(_t560 - 4) = 0xd;
				E011017A6(_t560 - 0x3ec);
				if( *((intOrPtr*)(_t560 - 0x20)) != _t553) {
					L75:
					 *(_t560 - 4) = 0xc;
					E010E8B2E(_t406, _t560 - 0x54);
					 *(_t560 - 4) = 9;
					E010E8B2E(_t406, _t560 - 0x48);
					if( *((char*)(_t560 - 0x2f7)) != 0 &&  *0x11146fc != 0) {
						E01100A10();
					}
					E010D1ABD(E011009F5( *((intOrPtr*)(_t560 - 0x20))),  *((intOrPtr*)(_t560 - 0xd0)));
					 *(_t560 - 4) = 6;
					E010E9E21(_t560 - 0xc4);
					_t422 =  *((intOrPtr*)(_t560 - 0x1c));
					 *(_t560 - 4) = 5;
					_t609 =  *((intOrPtr*)(_t560 - 0x1c));
					if( *((intOrPtr*)(_t560 - 0x1c)) != 0) {
						E010EBD18(_t422);
					}
					 *(_t560 - 4) = 3;
					E010FFCF6(_t560 - 0xf0);
					 *(_t560 - 4) = 2;
					E010D11BB(_t560 - 0x448);
					 *(_t560 - 4) =  *(_t560 - 4) & 0x00000000;
					E01100E30(_t406, _t560 - 0x33c, _t609);
					 *(_t560 - 4) =  *(_t560 - 4) | 0xffffffff;
					E010E8B2E(_t406, _t560 - 0x7c);
					_t259 =  *((intOrPtr*)(_t560 - 0x3c));
					 *[fs:0x0] =  *((intOrPtr*)(_t560 - 0xc));
					return _t259;
				}
				if( *(_t560 - 0xd) == 0) {
					_push(_t560 - 0x38);
					_push(_t560 - 0x2c);
					_push(_t560 - 0x2c0);
					_push(_t560 - 0x304);
					_push(_t560 - 0x308);
					 *(_t560 - 0x2c) = _t553;
					_push( *((intOrPtr*)(_t560 - 0x2f8)));
					 *(_t560 - 0x28) = _t553;
					 *(_t560 - 0x38) = _t553;
					 *(_t560 - 0x34) = _t553;
					_push( *((intOrPtr*)(_t560 - 0x334)));
					_t264 =  *((intOrPtr*)( *((intOrPtr*)(_t560 - 0x330)))) + 0xc;
					__eflags = _t264;
					_push(_t264);
					_push( *((intOrPtr*)(_t560 - 0x28e)));
					_push( *((intOrPtr*)(_t560 - 0x296)));
					_push(_t560 - 0x54);
					_push(_t560 - 0x48);
					_push( *((intOrPtr*)(_t560 - 0x336)));
					_push(_t560 - 0xd0);
					_t268 = L010FD42A( *((intOrPtr*)(_t560 - 0x1c)), _t560 - 0xc4, _t264);
					__eflags =  *((char*)(_t560 - 0x334));
					 *((intOrPtr*)(_t560 - 0x20)) = _t268;
					if( *((char*)(_t560 - 0x334)) == 0) {
						L70:
						__eflags =  *(_t560 - 0x28) - _t553;
						if( *(_t560 - 0x28) > _t553) {
							L72:
							__eflags =  *((char*)(_t560 - 0x334));
							if( *((char*)(_t560 - 0x334)) != 0) {
								E010D1CAE(0x1114440);
								 *_t406("Errors: ",  *0x1114440);
								E010D1CAE(E010D1F47(0x1114440,  *(_t560 - 0x2c),  *(_t560 - 0x28)));
							}
							 *((intOrPtr*)(_t560 - 0x3c)) = 2;
							goto L75;
						}
						__eflags =  *(_t560 - 0x2c) - _t553;
						if( *(_t560 - 0x2c) <= _t553) {
							goto L75;
						}
						goto L72;
					} else {
						__eflags =  *(_t560 - 0x34) - _t553;
						if( *(_t560 - 0x34) > _t553) {
							L69:
							E010D1CAE(0x1114440);
							 *_t406("Warnings: ",  *0x1114440);
							E010D1CAE(E010D1F47(0x1114440,  *(_t560 - 0x38),  *(_t560 - 0x34)));
							goto L70;
						}
						__eflags =  *(_t560 - 0x38) - _t553;
						if( *(_t560 - 0x38) <= _t553) {
							goto L70;
						}
						goto L69;
					}
				} else {
					_push(0x178);
					_t277 = E010D1A96();
					 *(_t560 - 0x34) = _t277;
					_t569 = _t277 - _t553;
					 *(_t560 - 4) = 0x10;
					if(_t277 == _t553) {
						_t558 = 0;
						__eflags = 0;
					} else {
						_t558 = E01100157(_t277, _t569);
					}
					 *(_t560 - 4) = 0xd;
					 *(_t560 - 0x34) = _t558;
					if(_t558 != _t553) {
						 *((intOrPtr*)( *_t558 + 4))(_t558);
					}
					_t41 = _t558 + 0xe4; // 0xe4
					 *((char*)(_t558 + 0xe1)) =  *((intOrPtr*)(_t560 - 0x308));
					 *(_t560 - 4) = 0x11;
					E010D2A8C(_t41, _t560 - 0x304);
					 *((char*)(_t558 + 0xe0)) = E011002D6(_t558,  *0x11146fc,  *0x1114700,  *((intOrPtr*)(_t560 - 0x18))) & 0xffffff00 |  *((intOrPtr*)(_t560 - 0x44)) - 0x00000001 > 0x00000000;
					 *((intOrPtr*)(_t558 + 0x170)) =  *((intOrPtr*)(_t560 - 0x134));
					 *(_t558 + 0x16c) =  *(_t560 - 0x24);
					if( *((intOrPtr*)(_t560 - 0x18)) != _t553) {
						_t397 =  *(_t560 - 0x14) - 1;
						_t573 = _t397;
						 *((intOrPtr*)(_t558 + 0xc4)) = _t397;
					}
					E010FFD74(_t560 - 0x12c, _t573);
					 *(_t560 - 4) = 0x12;
					E01100F65(_t560 - 0x12c, _t560 - 0x2b4);
					 *((char*)(_t560 - 0x108)) =  *((intOrPtr*)(_t560 - 0x336));
					_t289 =  *((intOrPtr*)(_t560 - 0x333));
					 *(_t560 - 0x106) = _t289;
					 *(_t560 - 0x107) = _t289;
					 *((char*)(_t560 - 0x105)) = _t289 & 0xffffff00 |  *((intOrPtr*)(_t560 - 0x318)) == 0x00000003;
					_push(_t560 - 0x2c0);
					E010DD18C(_t560 - 0x104);
					E010D28E9(_t560 - 0x60);
					 *(_t560 - 4) = 0x13;
					E010EADD3(_t560 - 0x39c);
					 *(_t560 - 4) = 0x14;
					 *(_t560 - 0x14) = _t553;
					if( *((intOrPtr*)(_t560 - 0x2f0)) != _t553) {
						 *(_t560 - 0x14) = _t560 - 0x39c;
						_push(_t560 - 0x2f4);
						_push(_t560 - 0xf0);
						E011009F5(E010EA2E2(_t560 - 0x39c));
					}
					_push(_t560 - 0xb4);
					_push(_t560 - 0x60);
					_push( *(_t560 - 0x14));
					_t87 = _t558 + 0x10; // 0x10
					_push(_t558);
					asm("sbb edx, edx");
					_push( ~_t558 & _t87);
					_push(_t560 - 0x12c);
					_push( *((intOrPtr*)( *((intOrPtr*)(_t560 - 0x330)))) + 0xc);
					_push(_t560 - 0x54);
					_push(_t560 - 0x48);
					_push(_t560 - 0xd0); // executed
					_t301 = E010E8D6E( *((intOrPtr*)(_t560 - 0x1c)), _t560 - 0xc4); // executed
					 *((intOrPtr*)(_t560 - 0x20)) = _t301;
					if( *((intOrPtr*)(_t558 + 0xbc)) != _t553) {
						_t96 = _t558 + 0x18; // 0x18
						E0110183F(_t96, _t553, 1);
					}
					if( *((intOrPtr*)(_t560 - 0x5c)) != _t553) {
						_t383 =  *0x1114700; // 0x1114438
						if(_t383 != _t553) {
							 *(_t560 - 0x24) = _t383;
							E010D1CAE(_t383);
							fputs("ERROR:",  *( *(_t560 - 0x24)));
							E010D1CAE( *(_t560 - 0x24));
							_push( *((intOrPtr*)(_t560 - 0x60)));
							E010D1CAE(E010D1CC1( *(_t560 - 0x24)));
						}
						if( *((intOrPtr*)(_t560 - 0x20)) == _t553) {
							 *((intOrPtr*)(_t560 - 0x20)) = 0x80004005;
						}
					}
					_t555 =  *0x11146fc; // 0x1114440
					 *(_t560 - 0xd) =  *(_t560 - 0xd) & 0x00000000;
					if(_t555 != 0) {
						E010D1CAE(_t555);
						if( *((intOrPtr*)(_t558 + 0x11c)) > 0 ||  *((intOrPtr*)(_t558 + 0x118)) > 1) {
							fputs("Archives: ",  *_t555);
							_t109 = _t558 + 0x118; // 0x118
							E010D1CAE(E010D1F47(_t555,  *_t109,  *((intOrPtr*)(_t109 + 4))));
							fputs("OK archives: ",  *_t555);
							E010D1CAE(E010D1F47(_t555,  *((intOrPtr*)(_t558 + 0x128)),  *((intOrPtr*)(_t558 + 0x12c))));
						}
					}
					if(( *(_t558 + 0x130) |  *(_t558 + 0x134)) != 0) {
						 *(_t560 - 0xd) = 1;
						if(_t555 != 0) {
							fputs("Can\'t open as archive: ",  *_t555);
							E010D1CAE(E010D1F47(_t555,  *(_t558 + 0x130),  *(_t558 + 0x134)));
						}
					}
					if(( *(_t558 + 0x138) |  *(_t558 + 0x13c)) == 0) {
						L35:
						if(_t555 != 0) {
							_t124 = _t558 + 0x140; // 0x140
							if(( *(_t558 + 0x140) |  *(_t124 + 4)) != 0) {
								fputs("Archives with Warnings: ",  *_t555);
								_t126 = _t558 + 0x140; // 0x140
								E010D1CAE(E010D1F47(_t555,  *_t126,  *((intOrPtr*)(_t126 + 4))));
							}
							if(( *(_t558 + 0x150) |  *(_t558 + 0x154)) != 0) {
								E010D1CAE(_t555);
								if(( *(_t558 + 0x150) |  *(_t558 + 0x154)) != 0) {
									fputs("Warnings: ",  *_t555);
									E010D1CAE(E010D1F47(_t555,  *(_t558 + 0x150),  *(_t558 + 0x154)));
								}
							}
						}
						goto L41;
					} else {
						 *(_t560 - 0xd) = 1;
						if(_t555 == 0) {
							L41:
							if(( *(_t558 + 0x148) |  *(_t558 + 0x14c)) == 0) {
								L45:
								if( *(_t560 - 0xd) == 0) {
									L47:
									if(_t555 == 0) {
										L63:
										 *(_t560 - 4) = 0x13;
										E010D1ABD(E010EAE4E(_t560 - 0x39c),  *((intOrPtr*)(_t560 - 0x60)));
										 *(_t560 - 4) = 0x15;
										E010D1ABD(E01101159(_t560 - 0x104),  *((intOrPtr*)(_t560 - 0x120)));
										 *(_t560 - 4) = 0xd;
										if(_t558 != 0) {
											 *((intOrPtr*)( *_t558 + 8))(_t558);
										}
										goto L75;
									}
									if(( *(_t558 + 0x138) |  *(_t558 + 0x13c)) != 0) {
										L61:
										E010D1CAE(_t555);
										_t177 = _t558 + 0x158; // 0x158
										_t317 = _t177;
										__eflags =  *(_t558 + 0x158) |  *(_t317 + 4);
										if(( *(_t558 + 0x158) |  *(_t317 + 4)) != 0) {
											fputs("Sub items Errors: ",  *_t555);
											_t179 = _t558 + 0x158; // 0x158
											E010D1CAE(E010D1F47(_t555,  *_t179,  *((intOrPtr*)(_t179 + 4))));
										}
										goto L63;
									}
									_t146 = _t558 + 0x158; // 0x158
									if(( *(_t558 + 0x158) |  *(_t146 + 4)) != 0) {
										goto L61;
									}
									if( *((intOrPtr*)(_t560 - 0x20)) == 0) {
										_t323 =  *(_t560 - 0x94);
										if((_t323 |  *(_t560 - 0x90)) != 0) {
											fputs("Folders: ",  *_t555);
											E010D1CAE(E010D1F47(_t555,  *(_t560 - 0x94),  *(_t560 - 0x90)));
											_t323 =  *(_t560 - 0x94);
										}
										if( *(_t560 - 0x8c) != 1 ||  *(_t560 - 0x88) != 0 || (_t323 |  *(_t560 - 0x90)) != 0 || ( *(_t560 - 0x84) |  *(_t560 - 0x80)) != 0) {
											fputs("Files: ",  *_t555);
											E010D1CAE(E010D1F47(_t555,  *(_t560 - 0x8c),  *(_t560 - 0x88)));
											if(( *(_t560 - 0x84) |  *(_t560 - 0x80)) != 0) {
												fputs("Alternate Streams: ",  *_t555);
												E010D1CAE(E010D1F47(_t555,  *(_t560 - 0x84),  *(_t560 - 0x80)));
												fputs("Alternate Streams Size: ",  *_t555);
												E010D1CAE(E010D1F47(_t555,  *(_t560 - 0xa4),  *(_t560 - 0xa0)));
											}
										}
										fputs("Size:       ",  *_t555);
										 *(_t560 - 0x28) = E010D1F47(_t555,  *(_t560 - 0xac),  *(_t560 - 0xa8));
										E010D1CAE(_t330);
										fputs("Compressed: ",  *( *(_t560 - 0x28)));
										E010D1CAE(E010D1F47( *(_t560 - 0x28),  *(_t560 - 0x9c),  *(_t560 - 0x98)));
										if( *(_t560 - 0x14) != 0) {
											E010D1CAE(_t555);
											E010FBF06(_t555, _t560 - 0x39c);
										}
									}
									goto L63;
								}
								L46:
								 *((intOrPtr*)(_t560 - 0x3c)) = 2;
								goto L47;
							}
							 *(_t560 - 0xd) = 1;
							if(_t555 == 0) {
								goto L46;
							}
							E010D1CAE(_t555);
							if(( *(_t558 + 0x148) |  *(_t558 + 0x14c)) == 0) {
								goto L46;
							}
							fputs("Open Errors: ",  *_t555);
							E010D1CAE(E010D1F47(_t555,  *(_t558 + 0x148),  *(_t558 + 0x14c)));
							goto L45;
						}
						fputs("Archives with Errors: ",  *_t555);
						E010D1CAE(E010D1F47(_t555,  *(_t558 + 0x138),  *(_t558 + 0x13c)));
						goto L35;
					}
				}
			}

0x010ff2f7
0x010ff2f7
0x010ff2f7
0x010ff2fe
0x010ff302
0x010ff304
0x010ff309
0x010ff30f
0x010ff30f
0x010ff31a
0x010ff320
0x010ff326
0x010ff32c
0x010ff332
0x010ff338
0x010ff33e
0x010ff344
0x010ff34a
0x010ff350
0x010ff356
0x010ff35c
0x010ff35f
0x010ff367
0x010ff374
0x010ff37b
0x010ff37f
0x010ff383
0x010ff384
0x010ff38b
0x010ff38f
0x010ff394
0x010ff397
0x010ff39e
0x010ff3aa
0x010ff3b4
0x010ff3b4
0x010ff3bc
0x010ff3d3
0x010ff3d4
0x010ff3d4
0x010ff3df
0x010ff3e3
0x010ff3eb
0x010ffab8
0x010ffabb
0x010ffabf
0x010ffac7
0x010ffacb
0x010ffad7
0x010ffae2
0x010ffae2
0x010ffaf5
0x010ffafb
0x010ffb05
0x010ffb0a
0x010ffb0d
0x010ffb11
0x010ffb13
0x010ffb15
0x010ffb15
0x010ffb20
0x010ffb24
0x010ffb2f
0x010ffb33
0x010ffb38
0x010ffb42
0x010ffb47
0x010ffb4e
0x010ffb53
0x010ffb5c
0x010ffb64
0x010ffb64
0x010ff3f5
0x010ff9c8
0x010ff9cc
0x010ff9d3
0x010ff9da
0x010ff9e1
0x010ff9e2
0x010ff9e5
0x010ff9eb
0x010ff9ee
0x010ff9f1
0x010ff9f6
0x010ff9fc
0x010ff9fc
0x010ffa02
0x010ffa06
0x010ffa12
0x010ffa18
0x010ffa1c
0x010ffa23
0x010ffa29
0x010ffa2a
0x010ffa2f
0x010ffa36
0x010ffa3e
0x010ffa74
0x010ffa74
0x010ffa77
0x010ffa7e
0x010ffa7e
0x010ffa85
0x010ffa89
0x010ffa99
0x010ffaac
0x010ffaac
0x010ffab1
0x00000000
0x010ffab1
0x010ffa79
0x010ffa7c
0x00000000
0x00000000
0x00000000
0x010ffa40
0x010ffa40
0x010ffa43
0x010ffa4a
0x010ffa4c
0x010ffa5c
0x010ffa6f
0x00000000
0x010ffa6f
0x010ffa45
0x010ffa48
0x00000000
0x00000000
0x00000000
0x010ffa48
0x010ff3fb
0x010ff3fb
0x010ff400
0x010ff406
0x010ff409
0x010ff40b
0x010ff40f
0x010ff41c
0x010ff41c
0x010ff411
0x010ff418
0x010ff418
0x010ff420
0x010ff424
0x010ff427
0x010ff42c
0x010ff42c
0x010ff435
0x010ff43b
0x010ff448
0x010ff44c
0x010ff471
0x010ff47d
0x010ff486
0x010ff48c
0x010ff491
0x010ff491
0x010ff492
0x010ff492
0x010ff49e
0x010ff4b0
0x010ff4b4
0x010ff4c6
0x010ff4cc
0x010ff4d2
0x010ff4d8
0x010ff4e1
0x010ff4ed
0x010ff4f4
0x010ff4fc
0x010ff507
0x010ff50b
0x010ff516
0x010ff51a
0x010ff51d
0x010ff52b
0x010ff534
0x010ff53b
0x010ff543
0x010ff543
0x010ff554
0x010ff55a
0x010ff55b
0x010ff562
0x010ff565
0x010ff566
0x010ff573
0x010ff574
0x010ff575
0x010ff57c
0x010ff586
0x010ff58d
0x010ff58e
0x010ff599
0x010ff59c
0x010ff5a0
0x010ff5a3
0x010ff5a3
0x010ff5ab
0x010ff5ad
0x010ff5b4
0x010ff5b8
0x010ff5bb
0x010ff5ca
0x010ff5d1
0x010ff5d9
0x010ff5e3
0x010ff5e3
0x010ff5eb
0x010ff5ed
0x010ff5ed
0x010ff5eb
0x010ff5f4
0x010ff5fa
0x010ff600
0x010ff604
0x010ff610
0x010ff622
0x010ff625
0x010ff63a
0x010ff646
0x010ff65f
0x010ff65f
0x010ff610
0x010ff670
0x010ff674
0x010ff678
0x010ff681
0x010ff69a
0x010ff69a
0x010ff678
0x010ff6ab
0x010ff6de
0x010ff6e0
0x010ff6e8
0x010ff6f1
0x010ff6fa
0x010ff6fd
0x010ff712
0x010ff712
0x010ff723
0x010ff727
0x010ff738
0x010ff741
0x010ff75a
0x010ff75a
0x010ff738
0x010ff723
0x00000000
0x010ff6ad
0x010ff6af
0x010ff6b3
0x010ff75f
0x010ff76b
0x010ff7af
0x010ff7b3
0x010ff7bc
0x010ff7be
0x010ff975
0x010ff97b
0x010ff987
0x010ff993
0x010ff9a2
0x010ff9aa
0x010ff9ae
0x010ff9b7
0x010ff9b7
0x00000000
0x010ff9ae
0x010ff7d0
0x010ff939
0x010ff93b
0x010ff946
0x010ff946
0x010ff94c
0x010ff94f
0x010ff958
0x010ff95b
0x010ff970
0x010ff970
0x00000000
0x010ff94f
0x010ff7dc
0x010ff7e5
0x00000000
0x00000000
0x010ff7ef
0x010ff7f5
0x010ff803
0x010ff80c
0x010ff825
0x010ff82a
0x010ff82a
0x010ff837
0x010ff85c
0x010ff875
0x010ff883
0x010ff88c
0x010ff8a2
0x010ff8ae
0x010ff8c7
0x010ff8c7
0x010ff883
0x010ff8d3
0x010ff8ec
0x010ff8ef
0x010ff8fe
0x010ff918
0x010ff921
0x010ff925
0x010ff932
0x010ff932
0x010ff921
0x00000000
0x010ff7ef
0x010ff7b5
0x010ff7b5
0x00000000
0x010ff7b5
0x010ff76f
0x010ff773
0x00000000
0x00000000
0x010ff777
0x010ff788
0x00000000
0x00000000
0x010ff791
0x010ff7aa
0x00000000
0x010ff7aa
0x010ff6c0
0x010ff6d9
0x00000000
0x010ff6d9
0x010ff6ab

Strings

Open Errors: , xrefs: 010FF78C
Archives with Errors: , xrefs: 010FF6BB
Alternate Streams: , xrefs: 010FF887
Archives with Warnings: , xrefs: 010FF6F5
Scanning the drive for archives:, xrefs: 010FF304
Warnings: , xrefs: 010FF73C
Compressed: , xrefs: 010FF8F9
Can't open as archive: , xrefs: 010FF67C
ERROR:, xrefs: 010FF5C5
Alternate Streams Size: , xrefs: 010FF8A9
Files: , xrefs: 010FF857
OK archives: , xrefs: 010FF641
Folders: , xrefs: 010FF807
F}w, xrefs: 010FF61B, 010FF63F, 010FF67A, 010FF6B9, 010FF6F3, 010FF73A, 010FF78A, 010FF805, 010FF855, 010FF885, 010FF8A7, 010FF8CC
Size: , xrefs: 010FF8CE
Archives: , xrefs: 010FF61D

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputc
String ID: F}w$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 1992160199-3936530970
Opcode ID: 8e9dfbccc36fd7f0a0fdb3242117dcbdd37cdad99d44277178791ae7f53746d7
Instruction ID: e21e7291b38b1490588a0f2d487d0ce81b5f6bf2c5b0baae25c1eac6e168b271
Opcode Fuzzy Hash: 8e9dfbccc36fd7f0a0fdb3242117dcbdd37cdad99d44277178791ae7f53746d7
Instruction Fuzzy Hash: 83224931A0425A9FDF2AEBA4C855BEDBBF1AF64304F1441DED189A6290DF706A84CF11

Uniqueness

Uniqueness Score: -1.00%

Function 010DB637 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E010DB637(signed int* __ecx, void* __edx, void* __eflags) {
				void* _t87;
				signed int _t88;
				signed int _t92;
				signed int _t96;
				signed int _t98;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				signed int _t117;
				signed int _t118;
				wchar_t*** _t120;
				void* _t128;
				long _t130;
				char _t135;
				intOrPtr* _t137;
				intOrPtr* _t150;
				signed int* _t176;
				char* _t179;
				wchar_t** _t181;
				void* _t182;

				E011039E0(E011049CC, _t182);
				_t176 = __ecx;
				_push( *((intOrPtr*)(_t182 + 8)));
				_push(0x35);
				_push(0x11140a0);
				_t87 = E010D13E5(__ecx, __eflags);
				_t189 = _t87;
				if(_t87 == 0) {
					_push( *((intOrPtr*)(__ecx + 0x20)));
					_push( *((intOrPtr*)(__ecx + 0x14)));
					E010E8A22(_t182 - 0x24, _t189);
					_push(0x110ded0);
					_push(_t182 - 0x24);
					L01103CAC();
				}
				_t150 = __imp___fileno; // 0x77793130
				_t88 =  *_t150(__imp___iob);
				__imp___isatty(_t88);
				_t179 =  *((intOrPtr*)(_t182 + 0xc));
				 *((char*)(_t179 + 3)) = _t88 & 0xffffff00 | _t88 != 0x00000000;
				_t92 =  *_t150(__imp___iob + 0x20);
				__imp___isatty(_t92);
				 *((char*)(_t179 + 4)) = _t92 & 0xffffff00 | _t92 != 0x00000000;
				_t96 =  *_t150(__imp___iob + 0x40);
				__imp___isatty(_t96);
				 *((char*)(_t179 + 5)) = _t96 & 0xffffff00 | _t96 != 0x00000000;
				_t98 =  *_t176;
				if( *_t98 != 0 ||  *((intOrPtr*)(_t98 + 0x14)) != 0 ||  *((intOrPtr*)(_t98 + 0x28)) != 0) {
					_push(1);
					_pop(0);
				}
				 *_t179 = 0;
				 *((char*)(_t179 + 6)) =  *((intOrPtr*)( *_t176 + 0x258));
				 *((char*)(_t179 + 7)) =  *((intOrPtr*)( *_t176 + 0x26c));
				 *((char*)(_t179 + 8)) =  *_t176 & 0xffffff00 |  *((intOrPtr*)( *_t176 + 0x3c)) == 0x00000000;
				 *((char*)(_t179 + 0x44)) =  *((intOrPtr*)( *_t176 + 0x2bc));
				 *((char*)(_t179 + 0x45)) =  *((intOrPtr*)( *_t176 + 0x64));
				if( *((intOrPtr*)( *_t176 + 0x50)) != 0 ||  *((intOrPtr*)(_t179 + 7)) != 0 ||  *((intOrPtr*)(_t179 + 4)) == 0) {
					 *((intOrPtr*)(_t179 + 0x204)) = 0;
				}
				if( *((intOrPtr*)(_t179 + 7)) != 0) {
					 *((intOrPtr*)(_t179 + 0x1fc)) = 0;
				}
				_t112 =  *_t176 + 0x8c;
				if( *_t112 != 0) {
					 *((intOrPtr*)(_t179 + 0x1fc)) =  *((intOrPtr*)(_t112 + 4));
				}
				_t114 =  *_t176 + 0xa0;
				if( *_t114 != 0) {
					 *((intOrPtr*)(_t179 + 0x200)) =  *((intOrPtr*)(_t114 + 4));
				}
				_t116 =  *_t176 + 0xb4;
				if( *_t116 != 0) {
					 *((intOrPtr*)(_t179 + 0x204)) =  *((intOrPtr*)(_t116 + 4));
				}
				_t117 =  *_t176;
				if( *((intOrPtr*)(_t117 + 0x78)) != 0) {
					_t137 =  *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x80))));
					 *((intOrPtr*)(_t182 + 8)) = _t137;
					if( *((intOrPtr*)(_t137 + 4)) != 0) {
						__eflags = E010DB942( *_t137, _t182 + 0xc);
						if(__eflags == 0) {
							_push( *((intOrPtr*)( *((intOrPtr*)(_t182 + 8)))));
							_push("Unsupported switch postfix -bb");
							E010E8A22(_t182 - 0x24, __eflags);
							_push(0x110ded0);
							_push(_t182 - 0x24);
							L01103CAC();
						}
						 *((intOrPtr*)(_t179 + 0x208)) =  *((intOrPtr*)(_t182 + 0xc));
					} else {
						 *((intOrPtr*)(_t179 + 0x208)) = 1;
					}
				}
				_t118 =  *_t176;
				if( *((intOrPtr*)(_t118 + 0x2f8)) != 0) {
					 *0x1114448 = _t118 & 0xffffff00 |  *((intOrPtr*)(_t118 + 0x2f9)) == 0x00000000;
					 *((char*)(_t179 + 1)) = 1;
					_t135 =  *0x1114448; // 0x0
					 *((char*)(_t179 + 2)) = _t135;
				}
				E010DB92A(); // executed
				_t120 =  *_t176;
				if(_t120[0xa0] == 0) {
					L32:
					_t176 =  *_t176;
					if(_t176[0x82] == 0) {
						goto L43;
					}
					_t120 = _t176[0x84];
					_t181 =  *_t120;
					if(_t181[1] == 0) {
						goto L43;
					}
					E010D232F(_t182 - 0x18);
					 *((intOrPtr*)(_t182 - 4)) = 0;
					E010D245E(_t182 - 0x18,  *_t181);
					if( *((intOrPtr*)(_t182 - 0x14)) == 0) {
						L38:
						_push( *_t181);
						_push("Unsupported switch postfix -stm");
						E010E8A22(_t182 - 0x30, _t216);
						_push(0x110ded0);
						_push(_t182 - 0x30);
						L01103CAC();
						goto L39;
					}
					_t130 = E010D336B( *((intOrPtr*)(_t182 - 0x18)), _t182 + 8);
					if( *((intOrPtr*)( *((intOrPtr*)(_t182 + 8)))) != 0) {
						 *((intOrPtr*)(_t182 - 0x14)) = 0;
						 *((char*)( *((intOrPtr*)(_t182 - 0x18)))) = 0;
					}
					_t216 =  *((intOrPtr*)(_t182 - 0x14));
					if( *((intOrPtr*)(_t182 - 0x14)) != 0) {
						goto L42;
					} else {
						goto L38;
					}
				} else {
					 *((intOrPtr*)(_t182 + 8)) = 0;
					_t181 =  *(_t120[0xa2]);
					if(_t181[1] != 0) {
						L39:
						if(wcscmp( *_t181, "-") == 0) {
							L30:
							_t120 = E010D7F3B();
							if( *((intOrPtr*)(_t182 + 8)) > _t120) {
								E011033D0();
								_t120 = E010D7EB5(L"SeLockMemoryPrivilege", 1);
								 *0x11145a0 = _t120;
							}
							goto L32;
						}
						_t128 = E010DB942( *_t181, _t182 + 8);
						_t218 = _t128;
						if(_t128 != 0) {
							goto L30;
						}
						_push( *_t181);
						_push("Unsupported switch postfix for -slp");
						E010E8A22(_t182 - 0x24, _t218);
						_t130 = _t182 - 0x24;
						_push(0x110ded0);
						_push(_t130);
						L01103CAC();
						L42:
						_t120 = E010D1ABD(SetProcessAffinityMask(GetCurrentProcess(), _t130),  *((intOrPtr*)(_t182 - 0x18)));
						L43:
						 *[fs:0x0] =  *((intOrPtr*)(_t182 - 0xc));
						return _t120;
					}
					 *((intOrPtr*)(_t182 + 8)) = 1;
					goto L30;
				}
			}

0x010db63c
0x010db647
0x010db649
0x010db64c
0x010db64e
0x010db653
0x010db658
0x010db65a
0x010db65c
0x010db662
0x010db665
0x010db66d
0x010db672
0x010db673
0x010db673
0x010db67e
0x010db684
0x010db687
0x010db68d
0x010db695
0x010db6a1
0x010db6a4
0x010db6af
0x010db6bb
0x010db6be
0x010db6cc
0x010db6cf
0x010db6d5
0x010db6e5
0x010db6e7
0x010db6e7
0x010db6e8
0x010db6f2
0x010db6fd
0x010db708
0x010db713
0x010db71b
0x010db723
0x010db72f
0x010db72f
0x010db738
0x010db73a
0x010db73a
0x010db742
0x010db749
0x010db74e
0x010db74e
0x010db756
0x010db75d
0x010db762
0x010db762
0x010db76a
0x010db771
0x010db776
0x010db776
0x010db77c
0x010db781
0x010db789
0x010db78b
0x010db791
0x010db7ab
0x010db7ad
0x010db7b5
0x010db7b7
0x010db7bc
0x010db7c4
0x010db7c9
0x010db7ca
0x010db7ca
0x010db7d2
0x010db793
0x010db793
0x010db793
0x010db791
0x010db7d8
0x010db7e0
0x010db7eb
0x010db7f0
0x010db7f4
0x010db7f9
0x010db7f9
0x010db7fc
0x010db801
0x010db809
0x010db846
0x010db846
0x010db84e
0x00000000
0x00000000
0x010db854
0x010db85a
0x010db85f
0x00000000
0x00000000
0x010db868
0x010db872
0x010db875
0x010db87d
0x010db89e
0x010db89e
0x010db8a3
0x010db8a8
0x010db8b0
0x010db8b5
0x010db8b6
0x00000000
0x010db8b6
0x010db885
0x010db88f
0x010db894
0x010db897
0x010db897
0x010db899
0x010db89c
0x00000000
0x00000000
0x00000000
0x00000000
0x010db80b
0x010db80b
0x010db814
0x010db819
0x010db8bb
0x010db8cd
0x010db826
0x010db826
0x010db82e
0x010db830
0x010db83c
0x010db841
0x010db841
0x00000000
0x010db82e
0x010db8d8
0x010db8dd
0x010db8df
0x00000000
0x00000000
0x010db8e5
0x010db8ea
0x010db8ef
0x010db8f4
0x010db8f7
0x010db8fc
0x010db8fd
0x010db902
0x010db913
0x010db919
0x010db91f
0x010db927
0x010db927
0x010db81f
0x00000000
0x010db81f

APIs

__EH_prolog.LIBCMT ref: 010DB63C

Part of subcall function 010D13E5: __EH_prolog.LIBCMT ref: 010D13EA

_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DB673
_fileno.MSVCRT ref: 010DB684
_isatty.MSVCRT ref: 010DB687
_fileno.MSVCRT ref: 010DB6A1
_isatty.MSVCRT ref: 010DB6A4
_fileno.MSVCRT ref: 010DB6BB
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DB7CA
_isatty.MSVCRT ref: 010DB6BE

Part of subcall function 010E8A22: __EH_prolog.LIBCMT ref: 010E8A27

_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DB8B6
wcscmp.MSVCRT ref: 010DB8C3
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DB8FD
GetCurrentProcess.KERNEL32(00000000,?), ref: 010DB903
SetProcessAffinityMask.KERNEL32(00000000), ref: 010DB90A

Strings

Unsupported switch postfix -stm, xrefs: 010DB8A3
01yw, xrefs: 010DB67E
Unsupported switch postfix for -slp, xrefs: 010DB8EA
Unsupported switch postfix -bb, xrefs: 010DB7B7
SeLockMemoryPrivilege, xrefs: 010DB837

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog_fileno_isatty$Process$AffinityCurrentMaskwcscmp
String ID: 01yw$SeLockMemoryPrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 3459974080-9442193
Opcode ID: f826226d55322081b6df00dfc25cc136229ced8caddd6f8968f551670efede8a
Instruction ID: b47058778ca1c6f78d08b1308d6e99253c78f28446d180b59ba26b4b3b310597
Opcode Fuzzy Hash: f826226d55322081b6df00dfc25cc136229ced8caddd6f8968f551670efede8a
Instruction Fuzzy Hash: D991D371D053869FDB26EFB8C584A99BFF0BF16204F0984A9E5D59B312DB70E944CB10

Uniqueness

Uniqueness Score: -1.00%

Function 010EB4D3 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 271
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E010EB4D3(intOrPtr __ecx) {
				void* __ebx;
				_Unknown_base(*)()* _t117;
				signed int _t118;
				signed int _t124;
				signed int _t127;
				signed int _t137;
				char _t148;
				signed int _t150;
				void* _t158;
				_Unknown_base(*)()* _t171;
				signed int _t173;
				struct HINSTANCE__** _t224;
				signed int _t226;
				signed int _t227;
				void* _t230;
				void* _t232;
				void* _t233;

				E011039E0(E01105DCF, _t230);
				_t233 = _t232 - 0xa4;
				 *((intOrPtr*)(_t230 - 0x30)) = __ecx;
				_t224 =  *( *((intOrPtr*)(__ecx + 0xc)) +  *(__ecx + 0x10) * 4 - 4);
				_t173 = 0;
				 *(_t230 - 0x18) = 0;
				 *((intOrPtr*)(_t230 - 0x1c)) = GetProcAddress( *_t224, "GetHandlerProperty2");
				 *((intOrPtr*)(_t230 - 0x44)) = GetProcAddress( *_t224, "GetIsArc");
				 *(_t230 - 0x28) = 1;
				if( *((intOrPtr*)(_t230 - 0x1c)) == 0) {
					_t117 = GetProcAddress( *_t224, "GetHandlerProperty");
					__eflags = _t117;
					 *(_t230 - 0x18) = _t117;
					if(_t117 == 0) {
						goto L29;
					} else {
						goto L5;
					}
				} else {
					_t171 = GetProcAddress( *_t224, "GetNumberOfFormats");
					if(_t171 == 0) {
						L5:
						_t226 = 0;
						__eflags =  *(_t230 - 0x28);
						if(__eflags <= 0) {
							L29:
							_t118 = 0;
							__eflags = 0;
						} else {
							while(1) {
								E010EB825(_t230 - 0xb0, __eflags);
								 *(_t230 - 4) = _t226;
								 *((intOrPtr*)(_t230 - 0x70)) = _t173;
								 *((intOrPtr*)(_t230 - 0x74)) =  *((intOrPtr*)( *((intOrPtr*)(_t230 - 0x30)) + 0x10)) - 1;
								_push(_t230 - 0xa4);
								_push(_t226);
								_push(_t173);
								_t124 = E010EB9C2( *(_t230 - 0x18),  *((intOrPtr*)(_t230 - 0x1c)));
								__eflags = _t124 - _t226;
								if(_t124 != _t226) {
									break;
								}
								 *(_t230 - 0x40) = _t226;
								 *(_t230 - 0x3e) = _t226;
								 *(_t230 - 0x38) = _t226;
								 *(_t230 - 4) = 1;
								_t127 = E010EB8BE( *(_t230 - 0x18),  *((intOrPtr*)(_t230 - 0x1c)), _t173, 1, _t230 - 0x40);
								__eflags = _t127;
								if(_t127 != 0) {
									L9:
									E010D8173(_t230 - 0x40);
									 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
									E010EBAEB(_t173, _t230 - 0xb0);
									goto L28;
								} else {
									__eflags =  *(_t230 - 0x40) - 8;
									if( *(_t230 - 0x40) == 8) {
										__imp__#149( *(_t230 - 0x38));
										__eflags = _t127 - 0x10;
										if(_t127 != 0x10) {
											E010D8173(_t230 - 0x40);
											 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
											E010EBAEB(_t173, _t230 - 0xb0);
											_t118 = 0x80004005;
										} else {
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											E010D8173(_t230 - 0x40);
											 *(_t230 - 4) =  *(_t230 - 4) & 0x00000000;
											E010D8173(_t230 - 0x40);
											E010D28E9(_t230 - 0x5c);
											 *(_t230 - 4) = 2;
											E010D28E9(_t230 - 0x50);
											_t222 =  *((intOrPtr*)(_t230 - 0x1c));
											_t229 =  *(_t230 - 0x18);
											_push(_t230 - 0x5c);
											_push(2);
											_push(_t173);
											 *(_t230 - 4) = 3;
											_t137 = E010EB9C2( *(_t230 - 0x18),  *((intOrPtr*)(_t230 - 0x1c)));
											__eflags = _t137;
											if(_t137 != 0) {
												L33:
												_t227 = _t137;
												goto L35;
											} else {
												_push(_t230 - 0x50);
												_push(3);
												_push(_t173);
												_t137 = E010EB9C2(_t229, _t222);
												__eflags = _t137;
												if(__eflags != 0) {
													goto L33;
												} else {
													_push(_t230 - 0x50);
													_push(_t230 - 0x5c); // executed
													E010EB152(_t230 - 0xb0, __eflags); // executed
													_push(_t230 - 0x88);
													_push(4);
													_push(_t173);
													E010EB8D8(_t229, _t222);
													 *(_t230 - 0xd) =  *(_t230 - 0xd) & 0x00000000;
													_push(_t230 - 0xd);
													_push(_t230 - 0xb0);
													_push(0xb);
													_push(_t173);
													_t137 = E010EB94A(_t229, _t222);
													__eflags = _t137;
													if(_t137 != 0) {
														goto L33;
													} else {
														_t148 =  *(_t230 - 0xd);
														__eflags = _t148;
														 *((char*)(_t230 - 0x87)) = _t148;
														if(_t148 == 0) {
															 *(_t230 - 0x14) = 0x11098a0;
															do {
																 *(_t230 - 0xe) =  *(_t230 - 0xe) & 0x00000000;
																_push(_t230 - 0xe);
																_t66 =  *(_t230 - 0x14) - 4; // 0x5
																_push( *_t66);
																_push(_t173);
																E010EB8D8(_t229, _t222);
																__eflags =  *(_t230 - 0xe);
																if( *(_t230 - 0xe) != 0) {
																	_t69 = _t230 - 0xb0;
																	 *_t69 =  *(_t230 - 0xb0) |  *( *(_t230 - 0x14));
																	__eflags =  *_t69;
																}
																 *(_t230 - 0x14) =  &(( *(_t230 - 0x14))[2]);
																__eflags =  *(_t230 - 0x14) - L"th32";
															} while ( *(_t230 - 0x14) < L"th32");
														}
														 *(_t230 - 0x24) =  *(_t230 - 0x24) & 0x00000000;
														 *(_t230 - 0x20) =  *(_t230 - 0x20) & 0x00000000;
														_push(_t230 - 0x24);
														_push(6);
														_push(_t173);
														 *(_t230 - 4) = 4;
														_t150 = E010EBA3B(_t229, _t222);
														__eflags = _t150;
														if(_t150 != 0) {
															L34:
															_t227 = _t150;
															_t137 = E010D1ABD(_t150,  *(_t230 - 0x24));
															L35:
															E010D1ABD(E010D1ABD(_t137,  *((intOrPtr*)(_t230 - 0x50))),  *((intOrPtr*)(_t230 - 0x5c)));
															L36:
															 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
															E010EBAEB(_t173, _t230 - 0xb0);
															_t118 = _t227;
														} else {
															__eflags =  *(_t230 - 0x20) - _t150;
															_push(_t230 - 0x24);
															if( *(_t230 - 0x20) == _t150) {
																_push(7);
																_push(_t173);
																_t150 = E010EBA3B(_t229, _t222);
																__eflags = _t150;
																if(__eflags != 0) {
																	goto L34;
																} else {
																	E010EB862( *(_t230 - 0x24),  *(_t230 - 0x20), __eflags, _t230 - 0x80);
																	goto L24;
																}
															} else {
																E010EC8B9(_t230 - 0x80);
																L24:
																_push(_t230 - 0x29);
																_push(_t230 - 0x84);
																_push(8);
																_push(_t173);
																_t150 = E010EB94A(_t229, _t222);
																__eflags = _t150;
																if(_t150 != 0) {
																	goto L34;
																} else {
																	__eflags =  *((intOrPtr*)(_t230 - 0x44)) - _t150;
																	if( *((intOrPtr*)(_t230 - 0x44)) != _t150) {
																		 *((intOrPtr*)(_t230 - 0x44))(_t173, _t230 - 0xa8);
																	}
																	_push(_t230 - 0xb0);
																	_t158 = E010ECA16( *((intOrPtr*)(_t230 - 0x30)) + 0x28); // executed
																	E010D1ABD(E010D1ABD(E010D1ABD(_t158,  *(_t230 - 0x24)),  *((intOrPtr*)(_t230 - 0x50))),  *((intOrPtr*)(_t230 - 0x5c)));
																	 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
																	_t233 = _t233 + 0xc;
																	E010EBAEB(_t173, _t230 - 0xb0);
																	_t226 = 0;
																	__eflags = 0;
																	L28:
																	_t173 = _t173 + 1;
																	__eflags = _t173 -  *(_t230 - 0x28);
																	if(__eflags < 0) {
																		continue;
																	} else {
																		goto L29;
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										goto L9;
									}
								}
								goto L30;
							}
							_t227 = _t124;
							goto L36;
						}
					} else {
						_t118 =  *_t171(_t230 - 0x28);
						if(_t118 == 0) {
							goto L5;
						} else {
						}
					}
				}
				L30:
				 *[fs:0x0] =  *((intOrPtr*)(_t230 - 0xc));
				return _t118;
			}

0x010eb4d8
0x010eb4dd
0x010eb4e6
0x010eb4ef
0x010eb4fe
0x010eb502
0x010eb50c
0x010eb516
0x010eb519
0x010eb520
0x010eb545
0x010eb547
0x010eb549
0x010eb54c
0x00000000
0x00000000
0x00000000
0x00000000
0x010eb522
0x010eb529
0x010eb52d
0x010eb552
0x010eb552
0x010eb554
0x010eb557
0x010eb7be
0x010eb7be
0x010eb7be
0x010eb55d
0x010eb55d
0x010eb563
0x010eb571
0x010eb577
0x010eb57b
0x010eb584
0x010eb585
0x010eb586
0x010eb587
0x010eb58c
0x010eb58e
0x00000000
0x00000000
0x010eb594
0x010eb598
0x010eb59c
0x010eb5a8
0x010eb5b0
0x010eb5b5
0x010eb5b7
0x010eb5c0
0x010eb5c3
0x010eb5c8
0x010eb5d2
0x00000000
0x010eb5b9
0x010eb5b9
0x010eb5be
0x010eb5df
0x010eb5e5
0x010eb5e8
0x010eb7d6
0x010eb7db
0x010eb7e5
0x010eb7ea
0x010eb5ee
0x010eb5f4
0x010eb5f5
0x010eb5f6
0x010eb5fa
0x010eb5fb
0x010eb600
0x010eb607
0x010eb60f
0x010eb617
0x010eb61b
0x010eb620
0x010eb623
0x010eb62b
0x010eb62c
0x010eb62e
0x010eb631
0x010eb635
0x010eb63a
0x010eb63c
0x010eb7f1
0x010eb7f1
0x00000000
0x010eb642
0x010eb647
0x010eb648
0x010eb64a
0x010eb64d
0x010eb652
0x010eb654
0x00000000
0x010eb65a
0x010eb663
0x010eb667
0x010eb668
0x010eb675
0x010eb676
0x010eb678
0x010eb67b
0x010eb680
0x010eb687
0x010eb68e
0x010eb68f
0x010eb691
0x010eb696
0x010eb69b
0x010eb69d
0x00000000
0x010eb6a3
0x010eb6a3
0x010eb6a6
0x010eb6a8
0x010eb6ae
0x010eb6b0
0x010eb6b7
0x010eb6ba
0x010eb6be
0x010eb6c6
0x010eb6c6
0x010eb6c9
0x010eb6ca
0x010eb6cf
0x010eb6d3
0x010eb6da
0x010eb6da
0x010eb6da
0x010eb6da
0x010eb6e0
0x010eb6e4
0x010eb6e4
0x010eb6b7
0x010eb6ed
0x010eb6f1
0x010eb6fa
0x010eb6fb
0x010eb6fd
0x010eb700
0x010eb704
0x010eb709
0x010eb70b
0x010eb7f5
0x010eb7f8
0x010eb7fa
0x010eb800
0x010eb80b
0x010eb812
0x010eb812
0x010eb81c
0x010eb821
0x010eb711
0x010eb711
0x010eb717
0x010eb718
0x010eb724
0x010eb726
0x010eb72b
0x010eb730
0x010eb732
0x00000000
0x010eb738
0x010eb742
0x00000000
0x010eb742
0x010eb71a
0x010eb71d
0x010eb747
0x010eb74c
0x010eb753
0x010eb754
0x010eb756
0x010eb759
0x010eb75e
0x010eb760
0x00000000
0x010eb766
0x010eb766
0x010eb769
0x010eb773
0x010eb773
0x010eb77c
0x010eb783
0x010eb79b
0x010eb7a0
0x010eb7a4
0x010eb7ad
0x010eb7b2
0x010eb7b2
0x010eb7b4
0x010eb7b4
0x010eb7b5
0x010eb7b8
0x00000000
0x00000000
0x00000000
0x00000000
0x010eb7b8
0x010eb760
0x010eb718
0x010eb70b
0x010eb69d
0x010eb654
0x010eb63c
0x00000000
0x00000000
0x00000000
0x010eb5be
0x00000000
0x010eb5b7
0x010eb7cf
0x00000000
0x010eb7cf
0x010eb52f
0x010eb533
0x010eb537
0x00000000
0x00000000
0x010eb539
0x010eb537
0x010eb52d
0x010eb7c0
0x010eb7c6
0x010eb7ce

APIs

__EH_prolog.LIBCMT ref: 010EB4D8
GetProcAddress.KERNEL32(00000004,GetHandlerProperty2), ref: 010EB505
GetProcAddress.KERNEL32(00000004,GetIsArc), ref: 010EB511
GetProcAddress.KERNEL32(00000004,GetNumberOfFormats), ref: 010EB529
GetProcAddress.KERNEL32(00000004,GetHandlerProperty), ref: 010EB545
SysStringByteLen.OLEAUT32(?), ref: 010EB5DF

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Strings

GetNumberOfFormats, xrefs: 010EB522
GetHandlerProperty2, xrefs: 010EB4F9
GetHandlerProperty, xrefs: 010EB53E
GetIsArc, xrefs: 010EB507

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc$ByteH_prologStringfree
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 655409697-3984264347
Opcode ID: 25ecc771dd4bea0bd805e67e47e3b03b4bdd67ac3c8eb563fe74dc01f9cb679e
Instruction ID: 3d95e57920ef7dfe638ac6a6966ae84ddd64b916f605d31a1953bfdd7f105ed6
Opcode Fuzzy Hash: 25ecc771dd4bea0bd805e67e47e3b03b4bdd67ac3c8eb563fe74dc01f9cb679e
Instruction Fuzzy Hash: ADA18E71E0021ADFDF25DBA6CD88AEEBBF9BF54300F1440A9E485B3290DB709A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010DE57D Relevance: 15.7, APIs: 2, Strings: 6, Instructions: 1665
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E010DE57D() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t726;
				intOrPtr* _t728;
				signed int _t736;
				signed int _t737;
				signed int _t738;
				signed int _t740;
				signed int _t741;
				signed int _t743;
				signed int _t744;
				signed int _t747;
				signed int _t748;
				signed int _t750;
				signed int _t754;
				signed int _t760;
				signed int _t761;
				signed int _t763;
				signed int _t767;
				signed int _t769;
				signed int _t771;
				signed int _t775;
				void* _t783;
				void* _t784;
				void* _t789;
				signed int _t791;
				signed int _t792;
				signed int _t797;
				signed int _t798;
				signed int _t801;
				signed int _t809;
				signed int _t812;
				char _t813;
				signed int _t816;
				signed int _t819;
				signed int _t823;
				signed int _t826;
				signed int _t833;
				signed int _t838;
				signed int _t847;
				signed int _t869;
				void* _t879;
				void* _t888;
				void* _t889;
				signed int _t893;
				signed int _t900;
				signed int _t904;
				void* _t908;
				void* _t909;
				intOrPtr* _t911;
				signed int _t914;
				signed int _t916;
				signed int _t948;
				signed int _t957;
				signed int _t961;
				signed int _t966;
				void* _t975;
				void* _t980;
				signed int* _t991;
				signed int _t992;
				signed int _t998;
				signed int _t1000;
				void* _t1002;
				void* _t1010;
				signed int _t1013;
				signed int _t1015;
				signed int _t1017;
				signed int _t1021;
				signed int _t1023;
				signed int _t1028;
				signed int _t1034;
				signed int _t1040;
				signed int _t1041;
				signed int _t1042;
				void* _t1045;
				signed int* _t1055;
				signed int _t1056;
				void* _t1062;
				void* _t1065;
				signed int _t1074;
				signed int _t1096;
				signed int _t1097;
				signed int _t1098;
				void* _t1140;
				intOrPtr _t1211;
				signed int _t1273;
				signed int _t1277;
				void* _t1297;
				signed int _t1325;
				signed int _t1341;
				intOrPtr* _t1350;
				intOrPtr* _t1351;
				signed int _t1353;
				intOrPtr _t1354;
				signed int _t1355;
				signed int _t1356;
				intOrPtr* _t1357;
				signed int _t1358;
				intOrPtr* _t1360;
				signed int _t1362;
				intOrPtr* _t1366;
				intOrPtr* _t1367;
				intOrPtr* _t1368;
				signed int _t1369;
				signed int _t1371;
				signed int _t1373;
				void* _t1374;
				void* _t1376;
				signed int _t1394;

				E011039E0(E01105041, _t1374);
				_t1371 =  *(_t1374 + 8);
				 *( *(_t1374 + 0x10)) = 0;
				 *((intOrPtr*)(_t1374 - 0x10)) = _t1376 - 0xdc;
				 *((intOrPtr*)(_t1374 - 4)) = 0;
				if( *(_t1371 + 0x108) != 0) {
					E010E0430( *((intOrPtr*)(_t1371 + 0x104)) + 8);
				}
				_t1350 = _t1371 + 0x100;
				 *((char*)(_t1371 + 0x10c)) = 0;
				_t726 =  *_t1350;
				if(_t726 != 0) {
					 *((intOrPtr*)( *_t726 + 8))(_t726);
					 *_t1350 = 0;
				}
				 *((char*)(_t1371 + 0xc5)) = 0;
				 *(_t1371 + 0xb8) = 0;
				 *((intOrPtr*)(_t1371 + 0xbc)) = 0;
				 *(_t1371 + 0xc0) = 0;
				 *(_t1371 + 0xf0) = 0;
				 *(_t1371 + 0xf4) = 0;
				 *(_t1371 + 0xf8) = 0;
				 *((char*)(_t1371 + 0xf9)) = 0;
				 *(_t1371 + 0xe8) =  *(_t1374 + 0xc);
				_t728 = _t1371 + 0xac;
				_t1351 = _t1371 + 0x198;
				 *((intOrPtr*)(_t728 + 4)) = 0;
				 *((short*)( *_t728)) = 0;
				 *((intOrPtr*)(_t1351 + 4)) = 0;
				 *((short*)( *_t1351)) = 0;
				 *((char*)(_t1371 + 0xa4)) =  *(_t1371 + 0x11c);
				 *(_t1374 - 0x54) =  *( *(_t1371 + 0x14));
				if( *(_t1371 + 0x11c) != 0) {
					 *(_t1371 + 0xa8) =  *(_t1371 + 0x120);
					_t1074 =  *(_t1371 + 0x54);
					if(_t1074 == 0 || _t1074 == 3) {
						_t34 = _t1371 + 0xa8;
						 *_t34 =  *(_t1371 + 0xa8) | 0xffffffff;
						_t1394 =  *_t34;
					}
				}
				 *((char*)(_t1371 + 0x9d)) =  *((intOrPtr*)(_t1371 + 0x21));
				_push(_t1371 + 0x6c);
				_push( *(_t1374 + 0xc));
				_t736 = E010EDEAB( *(_t1371 + 0x14), _t1394);
				if(_t736 != 0) {
					L353:
					 *[fs:0x0] =  *((intOrPtr*)(_t1374 - 0xc));
					return _t736;
				}
				 *(_t1374 - 0x24) = 0;
				 *((short*)(_t1374 - 0x22)) = 0;
				 *(_t1374 - 0x1c) = 0;
				_t737 =  *(_t1374 - 0x54);
				 *((char*)(_t1374 - 4)) = 1;
				_t738 =  *((intOrPtr*)( *_t737 + 0x18))(_t737,  *(_t1374 + 0xc), 0x1d, _t1374 - 0x24);
				if(_t738 == 0) {
					__eflags =  *(_t1374 - 0x24);
					if( *(_t1374 - 0x24) == 0) {
						L17:
						E010D8173(_t1374 - 0x24);
						 *(_t1374 - 0x29) = 0;
						 *(_t1374 - 0x3a) = 0;
						 *(_t1374 + 0xb) = 0;
						 *(_t1374 - 0x24) = 0;
						 *((short*)(_t1374 - 0x22)) = 0;
						 *(_t1374 - 0x1c) = 0;
						_t740 =  *(_t1374 - 0x54);
						 *((char*)(_t1374 - 4)) = 2;
						_t741 =  *((intOrPtr*)( *_t740 + 0x18))(_t740,  *(_t1374 + 0xc), 0x5a, _t1374 - 0x24);
						__eflags = _t741;
						if(_t741 == 0) {
							__eflags =  *(_t1374 - 0x24) - 8;
							if( *(_t1374 - 0x24) != 8) {
								__eflags =  *(_t1374 - 0x24);
								if( *(_t1374 - 0x24) == 0) {
									goto L21;
								} else {
									_t1373 = 0x80004005;
									goto L25;
								}
							} else {
								 *(_t1374 - 0x29) = 1;
								 *(_t1374 + 0xb) = 0;
								E010D2B37(_t741, _t1351,  *(_t1374 - 0x1c));
								L21:
								E010D8173(_t1374 - 0x24);
								 *(_t1374 - 0x24) = 0;
								 *((short*)(_t1374 - 0x22)) = 0;
								 *(_t1374 - 0x1c) = 0;
								_t743 =  *(_t1374 - 0x54);
								 *((char*)(_t1374 - 4)) = 3;
								_t744 =  *((intOrPtr*)( *_t743 + 0x18))(_t743,  *(_t1374 + 0xc), 0x36, _t1374 - 0x24);
								__eflags = _t744;
								if(_t744 == 0) {
									__eflags =  *(_t1374 - 0x24) - 8;
									if( *(_t1374 - 0x24) != 8) {
										__eflags =  *(_t1374 - 0x24);
										if( *(_t1374 - 0x24) == 0) {
											goto L28;
										}
										_t1373 = 0x80004005;
										goto L43;
									} else {
										 *(_t1374 - 0x29) = 0;
										 *(_t1374 + 0xb) = 1;
										E010D2B37(_t744, _t1351,  *(_t1374 - 0x1c));
										L28:
										 *((char*)(_t1374 - 4)) = 0;
										E010D8173(_t1374 - 0x24);
										__eflags =  *(_t1371 + 0x19c);
										if( *(_t1371 + 0x19c) != 0) {
											L36:
											E010D2EFE(_t1351, 0x2f, 0x5c);
											_t747 = E010D211D( *_t1351, L"\\??\\");
											__eflags = _t747;
											if(_t747 == 0) {
												L39:
												_t748 = E010D741D( *_t1351, _t1371);
												__eflags = _t748;
												if(_t748 == 0) {
													__eflags =  *(_t1371 + 0x19c);
													if( *(_t1371 + 0x19c) == 0) {
														L54:
														_t736 = E010EDA0D( *(_t1374 - 0x54),  *(_t1374 + 0xc), 0xf, _t1371 + 0xc5);
														__eflags = _t736;
														if(_t736 != 0) {
															goto L353;
														}
														_t736 = E010DE24D(_t1371);
														__eflags = _t736;
														if(_t736 != 0) {
															goto L353;
														}
														__eflags =  *(_t1371 + 0x1e);
														if( *(_t1371 + 0x1e) != 0) {
															L58:
															_t1095 =  *(_t1371 + 0x24);
															_t1353 = _t1371 + 0x78;
															__eflags =  *(_t1371 + 0x24);
															if(__eflags == 0) {
																L60:
																__eflags =  *(_t1371 + 0x11c);
																if( *(_t1371 + 0x11c) == 0) {
																	_t750 =  *(_t1353 + 4);
																	__eflags = _t750;
																	if(_t750 != 0) {
																		L71:
																		_t1096 =  *(_t1371 + 0x54);
																		 *(_t1374 - 0x28) = 0;
																		__eflags = _t1096;
																		if(_t1096 < 0) {
																			L95:
																			_push( *(_t1374 - 0x28));
																			_t1097 = _t1371 + 0x78;
																			L96:
																			E010E03F4(_t1097, _t1353);
																			L97:
																			__eflags =  *(_t1371 + 0x60);
																			if( *(_t1371 + 0x60) == 0) {
																				 *(_t1374 - 0x14) = 0;
																				__eflags =  *(_t1374 + 0x14);
																				 *((char*)(_t1374 - 4)) = 0xa;
																				if( *(_t1374 + 0x14) != 0) {
																					L117:
																					__eflags =  *(_t1371 + 0x108);
																					if( *(_t1371 + 0x108) == 0) {
																						L121:
																						_t1098 =  *(_t1374 - 0x14);
																						__eflags = _t1098;
																						if(_t1098 != 0) {
																							_t754 = _t1098;
																							_t1098 = 0;
																							__eflags = 0;
																							 *(_t1374 - 0x14) = 0;
																							 *( *(_t1374 + 0x10)) = _t754;
																						}
																						__eflags = _t1098;
																						 *((char*)(_t1374 - 4)) = 0;
																						if(_t1098 != 0) {
																							 *((intOrPtr*)( *_t1098 + 8))(_t1098);
																						}
																						L125:
																						_t736 = 0;
																						goto L353;
																					}
																					__eflags =  *(_t1374 + 0x14);
																					if( *(_t1374 + 0x14) == 0) {
																						L120:
																						E010E0E48( *((intOrPtr*)(_t1371 + 0x104)) + 8,  *(_t1374 - 0x14));
																						E010E0E48(_t1374 - 0x14,  *(_t1371 + 0x108));
																						_t1354 =  *((intOrPtr*)(_t1371 + 0x104));
																						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1354 + 0x1c))))))();
																						 *((intOrPtr*)(_t1354 + 0x10)) = 0;
																						 *((intOrPtr*)(_t1354 + 0x14)) = 0;
																						 *((char*)(_t1354 + 0x18)) = 1;
																						 *((char*)(_t1371 + 0x10c)) = 1;
																						goto L121;
																					}
																					__eflags =  *(_t1374 + 0x14) - 1;
																					if( *(_t1374 + 0x14) != 1) {
																						goto L121;
																					}
																					goto L120;
																				}
																				__eflags =  *(_t1371 + 0x125);
																				if( *(_t1371 + 0x125) != 0) {
																					goto L117;
																				}
																				__eflags =  *(_t1371 + 0x124);
																				if( *(_t1371 + 0x124) == 0) {
																					 *(_t1374 - 0x24) = 0;
																					 *((short*)(_t1374 - 0x22)) = 0;
																					 *(_t1374 - 0x1c) = 0;
																					_t760 =  *(_t1374 - 0x54);
																					_t1355 =  *(_t1374 + 0xc);
																					 *((char*)(_t1374 - 4)) = 0xb;
																					_t761 =  *((intOrPtr*)( *_t760 + 0x18))(_t760, _t1355, 9, _t1374 - 0x24);
																					__eflags = _t761;
																					 *(_t1374 - 0x28) = _t761;
																					if(_t761 == 0) {
																						__eflags =  *(_t1374 - 0x24) - 0x13;
																						if( *(_t1374 - 0x24) != 0x13) {
																							__eflags =  *(_t1374 - 0x24);
																							if( *(_t1374 - 0x24) != 0) {
																								E010D8173(_t1374 - 0x24);
																								L236:
																								_t763 =  *(_t1374 - 0x14);
																								 *((char*)(_t1374 - 4)) = 0;
																								__eflags = _t763;
																								if(_t763 != 0) {
																									 *((intOrPtr*)( *_t763 + 8))(_t763);
																								}
																								L238:
																								_t736 = 0x80004005;
																								goto L353;
																							}
																							 *((char*)(_t1371 + 0xe7)) = 0;
																							L134:
																							 *((char*)(_t1374 - 4)) = 0xa;
																							E010D8173(_t1374 - 0x24);
																							_push(_t1371 + 0xe4);
																							_push(_t1371 + 0xc8);
																							_push(0xa);
																							_push(_t1355);
																							_t767 = E010DE1B8(_t1371);
																							__eflags = _t767;
																							 *(_t1374 - 0x28) = _t767;
																							if(_t767 == 0) {
																								_push(_t1371 + 0xe5);
																								_push(_t1371 + 0xd0);
																								_push(0xb);
																								_push(_t1355);
																								_t769 = E010DE1B8(_t1371);
																								__eflags = _t769;
																								 *(_t1374 - 0x28) = _t769;
																								if(_t769 == 0) {
																									_push(_t1371 + 0xe6);
																									_push(_t1371 + 0xd8);
																									_push(0xc);
																									_push(_t1355);
																									_t771 = E010DE1B8(_t1371);
																									__eflags = _t771;
																									 *(_t1374 - 0x28) = _t771;
																									if(_t771 == 0) {
																										 *(_t1374 - 0x39) = 0;
																										_t1113 =  *( *(_t1371 + 0x14));
																										_t1356 = E010EDA0D( *( *(_t1371 + 0x14)), _t1355, 0x15, _t1374 - 0x39);
																										__eflags = _t1356;
																										if(_t1356 != 0) {
																											L292:
																											_t775 =  *(_t1374 - 0x14);
																											 *((char*)(_t1374 - 4)) = 0;
																											__eflags = _t775;
																											if(_t775 != 0) {
																												 *((intOrPtr*)( *_t775 + 8))(_t775);
																											}
																											_t736 = _t1356;
																											goto L353;
																										}
																										__eflags =  *(_t1371 + 0x9c);
																										if( *(_t1371 + 0x9c) == 0) {
																											L151:
																											__eflags =  *(_t1371 + 0x54) - 3;
																											_t1357 = _t1371 + 0x78;
																											_push( *(_t1371 + 0x9f));
																											_push(_t1357);
																											__eflags =  *(_t1371 + 0x54) == 3;
																											E010EA0E7(_t1113 & 0xffffff00 |  *(_t1371 + 0x54) == 0x00000003,  *((intOrPtr*)(_t1371 + 0x5c)));
																											L152:
																											__eflags =  *(_t1371 + 0x9c);
																											if(__eflags == 0) {
																												L163:
																												E010EA270(_t1374 - 0x48, _t1357, __eflags);
																												__eflags =  *(_t1374 - 0x39);
																												 *((char*)(_t1374 - 4)) = 0xd;
																												if(__eflags != 0) {
																													L185:
																													E010D29BC(_t1374 - 0x38, __eflags, _t1374 - 0x48);
																													__eflags =  *(_t1371 + 0x54) - 3;
																													 *((char*)(_t1374 - 4)) = 0xf;
																													if(__eflags != 0) {
																														L187:
																														_push(_t1374 - 0x38);
																														_t783 = E010DFCE1(_t1374 - 0x20, _t1371 + 0x3c, __eflags);
																														 *((char*)(_t1374 - 4)) = 0x10;
																														_t784 = E010D2A8C(_t1374 - 0x38, _t783);
																														 *((char*)(_t1374 - 4)) = 0xf;
																														E010D1ABD(_t784,  *((intOrPtr*)(_t1374 - 0x20)));
																														L188:
																														__eflags =  *(_t1371 + 0x9c);
																														if( *(_t1371 + 0x9c) != 0) {
																															_t961 =  *(_t1371 + 0xa0);
																															__eflags = _t961 - 0xffffffff;
																															if(_t961 != 0xffffffff) {
																																 *(_t1374 - 0x24) = _t961;
																																E010D28E9(_t1374 - 0x20);
																																_t1366 = _t1371 + 0x1a4;
																																 *((char*)(_t1374 - 4)) = 0x11;
																																 *(_t1374 - 0x4c) = E010E0615(_t1366, _t1374 - 0x24);
																																 *((char*)(_t1374 - 4)) = 0xf;
																																E010D1ABD(_t964,  *((intOrPtr*)(_t1374 - 0x20)));
																																_t966 =  *(_t1374 - 0x4c);
																																__eflags = _t966;
																																if(_t966 >= 0) {
																																	__eflags =  *((intOrPtr*)( *_t1366 + _t966 * 4)) + 4;
																																	E010D2A8C(_t1374 - 0x38,  *((intOrPtr*)( *_t1366 + _t966 * 4)) + 4);
																																	E010D1089(_t1374 - 0x38, 0x3a);
																																	E010D29BC(_t1374 - 0x20, __eflags, _t1371 + 0x90);
																																	 *((char*)(_t1374 - 4)) = 0x12;
																																	E010E9ED7(_t1374 - 0x20);
																																	_t975 = E010D2C71(_t1374 - 0x38, __eflags, _t1374 - 0x20);
																																	 *((char*)(_t1374 - 4)) = 0xf;
																																	E010D1ABD(_t975,  *((intOrPtr*)(_t1374 - 0x20)));
																																}
																															}
																														}
																														__eflags =  *(_t1371 + 0x9e);
																														 *(_t1374 - 0x2a) = 0;
																														if( *(_t1371 + 0x9e) == 0) {
																															__eflags =  *(_t1371 + 0xc0);
																															if( *(_t1371 + 0xc0) != 0) {
																																goto L259;
																															}
																															E010D5C60(_t1374 - 0x98);
																															E010D28E9(_t1374 - 0x70);
																															_push( *((intOrPtr*)(_t1374 - 0x38)));
																															 *((char*)(_t1374 - 4)) = 0x13;
																															_t893 = E010D5D00(_t1374 - 0x98, __eflags); // executed
																															__eflags = _t893;
																															if(__eflags == 0) {
																																_t1362 = E010D73D8( *((intOrPtr*)(_t1374 - 0x38)), __eflags);
																																__eflags = _t1362;
																																if(_t1362 < 0) {
																																	L258:
																																	 *((char*)(_t1374 - 4)) = 0xf;
																																	E010D1ABD(_t894,  *((intOrPtr*)(_t1374 - 0x70)));
																																	goto L259;
																																}
																																_t894 =  *((intOrPtr*)(_t1374 - 0x38));
																																__eflags =  *( *((intOrPtr*)(_t1374 - 0x38)) + 2 + _t1362 * 2);
																																if(__eflags == 0) {
																																	goto L258;
																																}
																																E010D29BC(_t1374 - 0x20, __eflags, _t1374 - 0x38);
																																__eflags = _t1362 -  *(_t1374 - 0x1c);
																																 *((char*)(_t1374 - 4)) = 0x18;
																																if(_t1362 <  *(_t1374 - 0x1c)) {
																																	 *(_t1374 - 0x1c) = _t1362;
																																	 *((short*)( *((intOrPtr*)(_t1374 - 0x20)) + _t1362 * 2)) = 0;
																																}
																																E010D5C60(_t1374 - 0xe8);
																																E010D28E9(_t1374 - 0xc0);
																																_push( *((intOrPtr*)(_t1374 - 0x20)));
																																 *((char*)(_t1374 - 4)) = 0x19;
																																_t900 = E010D5D00(_t1374 - 0xe8, __eflags);
																																__eflags = _t900;
																																if(_t900 != 0) {
																																	_t1325 =  *(_t1374 - 0xc8);
																																	__eflags = _t1325 & 0x00000001;
																																	if((_t1325 & 0x00000001) != 0) {
																																		__eflags = _t1325 & 0xfffffffe;
																																		_t900 = E010D4D1A( *((intOrPtr*)(_t1374 - 0x20)), _t1325 & 0xfffffffe);
																																	}
																																}
																																_t894 = E010D1ABD(E010D1ABD(_t900,  *((intOrPtr*)(_t1374 - 0xc0))),  *((intOrPtr*)(_t1374 - 0x20)));
																																L257:
																																goto L258;
																															}
																															_t904 =  *(_t1371 + 0x58);
																															__eflags = _t904;
																															if(_t904 == 0) {
																																_t908 = E010DFB14(_t1374 - 0x38, _t1374 - 0x60, E010D2D7F(_t1374 - 0x38) + 1);
																																 *((char*)(_t1374 - 4)) = 0x14;
																																_t909 = E010D288E(_t1374 - 0x20, _t908, _t1374 - 0x70);
																																 *((char*)(_t1374 - 4)) = 0x16;
																																E010D1ABD(_t909,  *((intOrPtr*)(_t1374 - 0x60)));
																																_t911 =  *((intOrPtr*)(_t1371 + 0x28));
																																asm("sbb edx, edx");
																																asm("sbb edx, edx");
																																_t1356 =  *((intOrPtr*)( *_t911 + 0x14))(_t911,  *((intOrPtr*)(_t1374 - 0x20)), _t1374 - 0x80, _t1374 - 0x98,  *((intOrPtr*)(_t1371 + 0x6c)),  ~( *(_t1371 + 0xe6)) & _t1371 + 0x000000d8,  ~( *(_t1371 + 0xf8)) & _t1371 + 0x000000f0, _t1374 - 0x4c);
																																__eflags = _t1356;
																																if(_t1356 == 0) {
																																	_t914 =  *(_t1374 - 0x4c);
																																	__eflags = _t914;
																																	if(_t914 == 0) {
																																		L221:
																																		 *((char*)(_t1374 - 4)) = 0x13;
																																		E010D1ABD(_t914,  *((intOrPtr*)(_t1374 - 0x20)));
																																		L222:
																																		_t916 =  *(_t1371 + 0x58);
																																		__eflags = _t916 - 3;
																																		if(__eflags != 0) {
																																			__eflags = _t916 - 4;
																																			if(__eflags != 0) {
																																				_t1211 =  *((intOrPtr*)(_t1374 - 0x38));
																																				__eflags =  *(_t1374 - 0x78) >> 0x00000004 & 0x00000001;
																																				if(__eflags == 0) {
																																					__eflags = E010D6177(_t1211, __eflags);
																																					if(__eflags == 0) {
																																						goto L258;
																																					}
																																					_t894 = E010D5320( *((intOrPtr*)(_t1374 - 0x38)), __eflags);
																																					__eflags = _t894;
																																					if(_t894 != 0) {
																																						goto L258;
																																					}
																																					__eflags = GetLastError() - 2;
																																					if(__eflags == 0) {
																																						goto L258;
																																					}
																																					_push(_t1374 - 0x38);
																																					_push( *0x1108cbc);
																																					L247:
																																					_t920 = E010DE2D7(_t1371, __eflags);
																																					_push( *((intOrPtr*)(_t1374 - 0x70)));
																																					_t1373 = _t920;
																																					__eflags = _t1373;
																																					if(_t1373 != 0) {
																																						L225:
																																						E010D1ABD(E010D1ABD(E010D1ABD(_t920),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																						goto L313;
																																					}
																																					L248:
																																					E010D1ABD(E010D1ABD(E010D1ABD(_t920),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					goto L198;
																																				}
																																				__eflags = E010D4DBB(_t1211);
																																				if(__eflags != 0) {
																																					goto L258;
																																				}
																																				_push(_t1374 - 0x38);
																																				_push( *0x1108cc0);
																																				goto L247;
																																			}
																																			E010D29BC(_t1374 - 0x20, __eflags, _t1374 - 0x38);
																																			 *((char*)(_t1374 - 4)) = 0x17;
																																			__eflags = E010D9183(_t1374 - 0x20, __eflags);
																																			if(__eflags != 0) {
																																				__eflags = E010D4E3D( *((intOrPtr*)(_t1374 - 0x38)),  *((intOrPtr*)(_t1374 - 0x20)));
																																				if(__eflags != 0) {
																																					_t894 = E010D1ABD(_t931,  *((intOrPtr*)(_t1374 - 0x20)));
																																					goto L257;
																																				}
																																				_push(_t1374 - 0x38);
																																				_push(_t1374 - 0x20);
																																				_push( *0x1108cb8);
																																				_t934 = E010DE368(_t1371, __eflags);
																																				L233:
																																				_push( *((intOrPtr*)(_t1374 - 0x20)));
																																				_t1373 = _t934;
																																				__eflags = _t1373;
																																				if(_t1373 == 0) {
																																					L235:
																																					E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(_t934),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					goto L236;
																																				}
																																				E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(_t934),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																				goto L313;
																																			}
																																			_push(_t1374 - 0x38);
																																			_push( *0x1108cb4);
																																			_t934 = E010DE26A(_t1371, __eflags);
																																			goto L233;
																																		}
																																		__eflags = E010D9183(_t1374 - 0x38, __eflags);
																																		if(__eflags != 0) {
																																			 *(_t1374 - 0x2a) = 1;
																																			goto L258;
																																		}
																																		_push(_t1374 - 0x38);
																																		_push( *0x1108cb4);
																																		_t920 = E010DE26A(_t1371, __eflags);
																																		_push( *((intOrPtr*)(_t1374 - 0x70)));
																																		_t1373 = _t920;
																																		__eflags = _t1373;
																																		if(_t1373 == 0) {
																																			E010D1ABD(E010D1ABD(E010D1ABD(_t920),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																			goto L236;
																																		}
																																		goto L225;
																																	}
																																	_t914 = _t914 - 1;
																																	__eflags = _t914;
																																	if(_t914 == 0) {
																																		 *(_t1371 + 0x58) = 1;
																																		goto L221;
																																	}
																																	_t948 = _t914 - 1;
																																	__eflags = _t948;
																																	if(_t948 == 0) {
																																		L219:
																																		E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(_t948,  *((intOrPtr*)(_t1374 - 0x20))),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																		goto L198;
																																	}
																																	_t948 = _t948 - 1;
																																	__eflags = _t948;
																																	if(_t948 == 0) {
																																		 *(_t1371 + 0x58) = 2;
																																		goto L219;
																																	}
																																	_t914 = _t948 - 1;
																																	__eflags = _t914;
																																	if(_t914 == 0) {
																																		 *(_t1371 + 0x58) = 3;
																																		goto L221;
																																	}
																																	_push( *((intOrPtr*)(_t1374 - 0x20)));
																																	_t934 = _t914 != 1;
																																	__eflags = _t914 != 1;
																																	if(_t914 != 1) {
																																		goto L235;
																																	}
																																	E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(_t934),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																	_t957 =  *(_t1374 - 0x14);
																																	__eflags = _t957;
																																	 *((char*)(_t1374 - 4)) = 0;
																																	if(_t957 != 0) {
																																		 *((intOrPtr*)( *_t957 + 8))(_t957);
																																	}
																																	_t736 = 0x80004004;
																																	goto L353;
																																}
																																_t879 = E010D1ABD(_t912,  *((intOrPtr*)(_t1374 - 0x20)));
																																_push( *((intOrPtr*)(_t1374 - 0x70)));
																																goto L207;
																															}
																															_t920 = _t904 != 0;
																															__eflags = _t904 != 0;
																															if(_t904 != 0) {
																																goto L222;
																															}
																															_push( *((intOrPtr*)(_t1374 - 0x70)));
																															goto L248;
																														} else {
																															_t1365 = _t1371 + 0xac;
																															_t830 = E010D2A8C(_t1371 + 0xac, _t1374 - 0x38);
																															__eflags =  *(_t1374 - 0x39);
																															if( *(_t1374 - 0x39) != 0) {
																																_t830 = E010D4DBB( *_t1365);
																															}
																															__eflags =  *(_t1371 + 0x19c);
																															if( *(_t1371 + 0x19c) != 0) {
																																L259:
																																E010D2A8C(_t1371 + 0xac, _t1374 - 0x38);
																																__eflags =  *(_t1374 - 0x39);
																																if( *(_t1374 - 0x39) != 0) {
																																	L351:
																																	_t789 = E010D1ABD(E010E0E48(_t1374 - 0x14,  *((intOrPtr*)(_t1371 + 0x100))),  *((intOrPtr*)(_t1374 - 0x38)));
																																	 *((char*)(_t1374 - 4)) = 0xa;
																																	E010D1ABD(_t789,  *((intOrPtr*)(_t1374 - 0x48)));
																																	goto L117;
																																}
																																__eflags =  *(_t1371 + 0x19c);
																																if( *(_t1371 + 0x19c) == 0) {
																																	L288:
																																	__eflags =  *(_t1371 + 0x184);
																																	if( *(_t1371 + 0x184) == 0) {
																																		L299:
																																		_push(0x20);
																																		_t791 = E010D1A96();
																																		__eflags = _t791;
																																		if(_t791 == 0) {
																																			_t1358 = 0;
																																			__eflags = 0;
																																		} else {
																																			 *((intOrPtr*)(_t791 + 4)) = 0;
																																			 *(_t791 + 8) =  *(_t791 + 8) | 0xffffffff;
																																			 *_t791 = 0x1108ecc;
																																			_t1358 = _t791;
																																		}
																																		__eflags = _t1358;
																																		 *(_t1374 - 0x28) = _t1358;
																																		 *(_t1371 + 0xfc) = _t1358;
																																		 *(_t1374 - 0x4c) = _t1358;
																																		if(_t1358 != 0) {
																																			 *((intOrPtr*)( *_t1358 + 4))(_t1358);
																																		}
																																		_t792 =  *(_t1371 + 0xfc);
																																		 *((char*)(_t1374 - 4)) = 0x1f;
																																		asm("sbb edx, edx");
																																		 *((intOrPtr*)(_t792 + 0x18)) = 0;
																																		 *((intOrPtr*)(_t792 + 0x1c)) = 0;
																																		__eflags = E010D6985( *((intOrPtr*)(_t1374 - 0x38)), ( ~( *(_t1371 + 0xc0)) & 0x00000002) + 2);
																																		if(__eflags != 0) {
																																			__eflags =  *(_t1371 + 0x22);
																																			if( *(_t1371 + 0x22) == 0) {
																																				L337:
																																				__eflags =  *(_t1374 - 0x2a);
																																				if( *(_t1374 - 0x2a) != 0) {
																																					__eflags =  *(_t1371 + 0x9c);
																																					if(__eflags == 0) {
																																						 *(_t1374 - 0xb0) =  *(_t1374 + 0xc);
																																						E010D29BC(_t1374 - 0xac, __eflags, _t1374 - 0x38);
																																						 *(_t1374 + 0xc) =  *(_t1371 + 0x1a8);
																																						 *((char*)(_t1374 - 4)) = 0x20;
																																						_t809 = E010E0661(_t1374 - 0xb0);
																																						__eflags =  *(_t1374 + 0xc) -  *(_t1371 + 0x1a8);
																																						if( *(_t1374 + 0xc) ==  *(_t1371 + 0x1a8)) {
																																							_t695 =  *((intOrPtr*)( *((intOrPtr*)(_t1371 + 0x1a4)) + _t809 * 4)) + 4; // 0x4
																																							_t809 = E010D2A8C(_t695, _t1374 - 0x38);
																																						}
																																						 *((char*)(_t1374 - 4)) = 0x1f;
																																						E010D1ABD(_t809,  *((intOrPtr*)(_t1374 - 0xac)));
																																						_t1358 =  *(_t1374 - 0x28);
																																					}
																																				}
																																				__eflags =  *(_t1371 + 0xc0);
																																				if( *(_t1371 + 0xc0) == 0) {
																																					L349:
																																					E010E0E48(_t1371 + 0x100, _t1358);
																																					__eflags = _t1358;
																																					 *((char*)(_t1374 - 4)) = 0xf;
																																					if(_t1358 != 0) {
																																						 *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																					}
																																					goto L351;
																																				} else {
																																					_t797 =  *(_t1371 + 0xfc);
																																					_t798 =  *((intOrPtr*)( *_t797 + 0x10))(_t797,  *(_t1371 + 0xb8),  *((intOrPtr*)(_t1371 + 0xbc)), 0, 0);
																																					__eflags = _t798;
																																					 *(_t1374 + 0xc) = _t798;
																																					if(_t798 == 0) {
																																						goto L349;
																																					}
																																					__eflags = _t1358;
																																					 *((char*)(_t1374 - 4)) = 0xf;
																																					if(_t1358 != 0) {
																																						_t798 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																					}
																																					E010D1ABD(E010D1ABD(_t798,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					_t801 =  *(_t1374 - 0x14);
																																					__eflags = _t801;
																																					 *((char*)(_t1374 - 4)) = 0;
																																					if(_t801 != 0) {
																																						 *((intOrPtr*)( *_t801 + 8))(_t801);
																																					}
																																					_t736 =  *(_t1374 + 0xc);
																																					goto L353;
																																				}
																																			}
																																			__eflags =  *(_t1371 + 0xc0);
																																			if( *(_t1371 + 0xc0) != 0) {
																																				goto L337;
																																			}
																																			__eflags =  *(_t1371 + 0xf8);
																																			if( *(_t1371 + 0xf8) == 0) {
																																				goto L337;
																																			}
																																			_t812 =  *(_t1371 + 0xf4);
																																			_t1140 =  *(_t1371 + 0xf0);
																																			__eflags = _t812;
																																			if(_t812 > 0) {
																																				L323:
																																				_t813 = E010D6A6E( *(_t1371 + 0xfc) + 8, _t1140, _t812); // executed
																																				__eflags = _t813;
																																				 *((char*)(_t1371 + 0xf9)) = _t813;
																																				if(__eflags != 0) {
																																					L330:
																																					__eflags = E010D65B1();
																																					if(__eflags != 0) {
																																						goto L337;
																																					}
																																					_push(_t1374 - 0x38);
																																					_push("Can not seek to begin of file");
																																					_t816 = E010DE2D7(_t1371, __eflags);
																																					__eflags = _t816;
																																					 *(_t1374 + 8) = _t816;
																																					if(_t816 == 0) {
																																						goto L337;
																																					}
																																					__eflags = _t1358;
																																					 *((char*)(_t1374 - 4)) = 0xf;
																																					if(_t1358 != 0) {
																																						_t816 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																					}
																																					E010D1ABD(E010D1ABD(_t816,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					_t819 =  *(_t1374 - 0x14);
																																					__eflags = _t819;
																																					 *((char*)(_t1374 - 4)) = 0;
																																					if(_t819 != 0) {
																																						 *((intOrPtr*)( *_t819 + 8))(_t819);
																																					}
																																					_t736 =  *(_t1374 + 8);
																																					goto L353;
																																				}
																																				_push(_t1374 - 0x38);
																																				_push( *0x1108cd0);
																																				_t823 = E010DE2D7(_t1371, __eflags);
																																				__eflags = _t823;
																																				 *(_t1374 + 8) = _t823;
																																				if(_t823 == 0) {
																																					goto L330;
																																				}
																																				__eflags = _t1358;
																																				 *((char*)(_t1374 - 4)) = 0xf;
																																				if(_t1358 != 0) {
																																					_t823 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																				}
																																				E010D1ABD(E010D1ABD(_t823,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																				_t826 =  *(_t1374 - 0x14);
																																				__eflags = _t826;
																																				 *((char*)(_t1374 - 4)) = 0;
																																				if(_t826 != 0) {
																																					 *((intOrPtr*)( *_t826 + 8))(_t826);
																																				}
																																				_t736 =  *(_t1374 + 8);
																																				goto L353;
																																			}
																																			__eflags = _t1140 - 0x1000;
																																			if(_t1140 <= 0x1000) {
																																				goto L337;
																																			}
																																			goto L323;
																																		} else {
																																			_push(_t1374 - 0x38);
																																			_push( *0x1108ccc);
																																			_t1373 = E010DE2D7(_t1371, __eflags);
																																			 *((char*)(_t1374 - 4)) = 0xf;
																																			__eflags = _t1373;
																																			if(_t1373 == 0) {
																																				__eflags = _t1358;
																																				if(_t1358 != 0) {
																																					_t830 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																				}
																																				goto L196;
																																			}
																																			__eflags = _t1358;
																																			if(_t1358 != 0) {
																																				_t830 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																			}
																																			_push( *((intOrPtr*)(_t1374 - 0x38)));
																																			L312:
																																			E010D1ABD(E010D1ABD(_t830),  *((intOrPtr*)(_t1374 - 0x48)));
																																			L313:
																																			_t838 =  *(_t1374 - 0x14);
																																			 *((char*)(_t1374 - 4)) = 0;
																																			__eflags = _t838;
																																			if(_t838 != 0) {
																																				 *((intOrPtr*)( *_t838 + 8))(_t838);
																																			}
																																			goto L315;
																																		}
																																	}
																																	__eflags =  *(_t1371 + 0x9c);
																																	if( *(_t1371 + 0x9c) != 0) {
																																		goto L299;
																																	}
																																	_push(_t1374 + 0xb);
																																	_push(_t1374 - 0x24);
																																	_t1356 = E010DD7A6( *(_t1374 - 0x54),  *(_t1374 + 0xc));
																																	__eflags = _t1356;
																																	if(_t1356 == 0) {
																																		__eflags =  *(_t1374 + 0xb);
																																		if( *(_t1374 + 0xb) == 0) {
																																			goto L299;
																																		}
																																		_push(_t1374 - 0x24);
																																		_t847 = E010E0444(_t1371 + 0x180);
																																		__eflags = _t847;
																																		if(_t847 < 0) {
																																			goto L299;
																																		}
																																		_t1360 =  *((intOrPtr*)( *((intOrPtr*)(_t1371 + 0x18c)) + _t847 * 4));
																																		__eflags =  *(_t1360 + 4);
																																		if( *(_t1360 + 4) != 0) {
																																			__eflags = E010D4F0C( *((intOrPtr*)(_t1374 - 0x38)),  *_t1360);
																																			if(__eflags != 0) {
																																				goto L351;
																																			}
																																			_push(_t1360);
																																			_push(_t1374 - 0x38);
																																			_push( *0x1108cc4);
																																			_t830 = E010DE368(_t1371, __eflags);
																																			_push( *((intOrPtr*)(_t1374 - 0x38)));
																																			_t1373 = _t830;
																																			__eflags = _t1373;
																																			if(_t1373 != 0) {
																																				goto L312;
																																			}
																																			goto L197;
																																		}
																																		E010D2A8C(_t1360, _t1374 - 0x38);
																																		goto L299;
																																	}
																																	E010D1ABD(E010D1ABD(_t845,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																	goto L292;
																																}
																																E010D28E9(_t1374 - 0x60);
																																__eflags =  *(_t1374 + 0xb);
																																 *((char*)(_t1374 - 4)) = 0x1a;
																																if(__eflags != 0) {
																																	_t888 = E010DFC60(_t1374 - 0x20, _t1371 + 0x6c, __eflags);
																																	 *((char*)(_t1374 - 4)) = 0x1b;
																																	_t889 = E010D2A8C(_t1374 - 0x60, _t888);
																																	 *((char*)(_t1374 - 4)) = 0x1a;
																																	E010D1ABD(_t889,  *((intOrPtr*)(_t1374 - 0x20)));
																																}
																																_t1361 = _t1371 + 0x198;
																																E010D2C71(_t1374 - 0x60, __eflags, _t1371 + 0x198);
																																__eflags = E010DE3E2(_t1374 - 0x60);
																																if(__eflags != 0) {
																																	E010D28E9(_t1374 - 0x20);
																																	__eflags =  *(_t1374 - 0x29);
																																	 *((char*)(_t1374 - 4)) = 0x1c;
																																	if(__eflags != 0) {
																																		L269:
																																		_push(_t1374 - 0x20);
																																		__eflags = E010D7C2F( *((intOrPtr*)(_t1371 + 0x48)),  *((intOrPtr*)(_t1374 - 0x60)), __eflags);
																																		if(__eflags != 0) {
																																			L271:
																																			__eflags =  *(_t1374 - 0x1c);
																																			if( *(_t1374 - 0x1c) == 0) {
																																				L286:
																																				_t860 = E010D1ABD(_t859,  *((intOrPtr*)(_t1374 - 0x20)));
																																				goto L287;
																																			}
																																			__eflags =  *(_t1374 - 0x29);
																																			if( *(_t1374 - 0x29) == 0) {
																																				__eflags =  *(_t1371 + 0x1a);
																																				if( *(_t1371 + 0x1a) == 0) {
																																					goto L286;
																																				}
																																				 *((intOrPtr*)(_t1374 - 0x50)) = 0;
																																				 *(_t1374 - 0x4c) = 0;
																																				__eflags =  *(_t1374 - 0x3a);
																																				 *((char*)(_t1374 - 4)) = 0x1d;
																																				__eflags = E010D6ABB(0, _t1374 - 0x50,  *((intOrPtr*)(_t1374 - 0x20)), _t859 & 0xffffff00 |  *(_t1374 - 0x3a) == 0x00000000);
																																				if(__eflags == 0) {
																																					L285:
																																					_t859 = E010D1ABD(_t863,  *((intOrPtr*)(_t1374 - 0x50)));
																																					goto L286;
																																				}
																																				E010DFB2F(_t1374 - 0x80, __eflags);
																																				 *((char*)(_t1374 - 4)) = 0x1e;
																																				 *(_t1374 + 8) = 0;
																																				__eflags = E010D6C0B(_t1374 - 0x80,  *((intOrPtr*)(_t1374 - 0x50)),  *(_t1374 - 0x4c), _t1374 + 8);
																																				if(__eflags != 0) {
																																					_push( *(_t1374 - 0x4c));
																																					_push( *((intOrPtr*)(_t1374 - 0x50)));
																																					__eflags = E010D6EEA( *((intOrPtr*)(_t1374 - 0x38)),  *(_t1371 + 0x9e), __eflags);
																																					if(__eflags != 0) {
																																						L284:
																																						 *((char*)(_t1374 - 4)) = 0x1d;
																																						_t863 = E010FC31B(_t1374 - 0x80);
																																						goto L285;
																																					}
																																					_push(_t1374 - 0x38);
																																					_push( *0x1108cc8);
																																					_t869 = E010DE2D7(_t1371, __eflags);
																																					L280:
																																					_t1356 = _t869;
																																					__eflags = _t1356;
																																					if(_t1356 == 0) {
																																						goto L284;
																																					}
																																					 *((char*)(_t1374 - 4)) = 0x1d;
																																					E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(E010FC31B(_t1374 - 0x80),  *((intOrPtr*)(_t1374 - 0x50))),  *((intOrPtr*)(_t1374 - 0x20))),  *((intOrPtr*)(_t1374 - 0x60))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					goto L292;
																																				}
																																				_push(_t1371 + 0x6c);
																																				_push("Internal error for symbolic link file");
																																				_t869 = E010DE26A(_t1371, __eflags);
																																				goto L280;
																																			}
																																			__eflags = E010D4F0C( *((intOrPtr*)(_t1374 - 0x38)),  *((intOrPtr*)(_t1374 - 0x20)));
																																			if(__eflags != 0) {
																																				goto L286;
																																			}
																																			_push(_t1374 - 0x20);
																																			_push(_t1374 - 0x38);
																																			_push( *0x1108cc4);
																																			_t1356 = E010DE368(_t1371, __eflags);
																																			__eflags = _t1356;
																																			if(_t1356 == 0) {
																																				goto L286;
																																			}
																																			L275:
																																			_t879 = E010D1ABD(_t859,  *((intOrPtr*)(_t1374 - 0x20)));
																																			_push( *((intOrPtr*)(_t1374 - 0x60)));
																																			L207:
																																			E010D1ABD(E010D1ABD(E010D1ABD(_t879),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																			goto L292;
																																		}
																																		_push(_t1374 - 0x60);
																																		_push("Incorrect path");
																																		_t1356 = E010DE26A(_t1371, __eflags);
																																		__eflags = _t1356;
																																		if(_t1356 != 0) {
																																			goto L275;
																																		}
																																		goto L271;
																																	}
																																	__eflags =  *(_t1374 + 0xb);
																																	if(__eflags == 0) {
																																		goto L269;
																																	}
																																	_t859 = E010D2A8C(_t1374 - 0x20, _t1361);
																																	goto L271;
																																} else {
																																	_push(_t1374 - 0x60);
																																	_push("Dangerous link path was ignored");
																																	_t1356 = E010DE26A(_t1371, __eflags);
																																	__eflags = _t1356;
																																	if(_t1356 == 0) {
																																		L287:
																																		 *((char*)(_t1374 - 4)) = 0xf;
																																		E010D1ABD(_t860,  *((intOrPtr*)(_t1374 - 0x60)));
																																		__eflags =  *(_t1371 + 0x19c);
																																		if( *(_t1371 + 0x19c) != 0) {
																																			goto L351;
																																		}
																																		goto L288;
																																	}
																																	E010D1ABD(E010D1ABD(E010D1ABD(_t860,  *((intOrPtr*)(_t1374 - 0x60))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																	goto L292;
																																}
																															} else {
																																L196:
																																_push( *((intOrPtr*)(_t1374 - 0x38)));
																																L197:
																																E010D1ABD(E010D1ABD(_t830),  *((intOrPtr*)(_t1374 - 0x48)));
																																L198:
																																_t833 =  *(_t1374 - 0x14);
																																 *((char*)(_t1374 - 4)) = 0;
																																__eflags = _t833;
																																if(_t833 != 0) {
																																	 *((intOrPtr*)( *_t833 + 8))(_t833);
																																}
																																goto L125;
																															}
																														}
																													}
																													__eflags = E010D73B9( *((intOrPtr*)(_t1374 - 0x48)));
																													if(__eflags != 0) {
																														goto L188;
																													}
																													goto L187;
																												}
																												__eflags =  *(_t1371 + 0x9e);
																												if( *(_t1371 + 0x9e) != 0) {
																													L167:
																													__eflags =  *(_t1357 + 4);
																													if(__eflags == 0) {
																														goto L185;
																													}
																													E010D28E9(_t1374 - 0x20);
																													 *((char*)(_t1374 - 4)) = 0xe;
																													_t980 = E010DE104(_t1371, _t1357, _t1374 - 0x20);
																													__eflags =  *(_t1371 + 0x9e);
																													if(__eflags == 0) {
																														L184:
																														 *((char*)(_t1374 - 4)) = 0xd;
																														E010D1ABD(_t980,  *((intOrPtr*)(_t1374 - 0x20)));
																														goto L185;
																													}
																													_t1367 = E010E04FD(_t1371 + 0x144);
																													 *_t1367 =  *((intOrPtr*)(_t1371 + 0xc8));
																													 *((intOrPtr*)(_t1367 + 4)) =  *((intOrPtr*)(_t1371 + 0xcc));
																													__eflags =  *(_t1371 + 0xc2);
																													if( *(_t1371 + 0xc2) == 0) {
																														L172:
																														__eflags = 0;
																														L173:
																														 *((char*)(_t1367 + 0x18)) = 0;
																														 *((intOrPtr*)(_t1367 + 8)) =  *((intOrPtr*)(_t1371 + 0xd0));
																														 *((intOrPtr*)(_t1367 + 0xc)) =  *((intOrPtr*)(_t1371 + 0xd4));
																														__eflags =  *(_t1371 + 0xc3);
																														if( *(_t1371 + 0xc3) == 0) {
																															L176:
																															__eflags = 0;
																															L177:
																															 *((char*)(_t1367 + 0x19)) = 0;
																															 *((char*)(_t1367 + 0x1a)) = 0;
																															__eflags =  *(_t1371 + 0xc4);
																															if( *(_t1371 + 0xc4) == 0) {
																																L183:
																																_t370 = _t1367 + 0x1c; // 0x1c
																																E010D2A8C(_t370, _t1374 - 0x20);
																																_t980 = E010E02A0(_t1367);
																																goto L184;
																															}
																															__eflags =  *(_t1371 + 0xe6);
																															if( *(_t1371 + 0xe6) == 0) {
																																_t991 =  *(_t1371 + 0x14);
																																__eflags = _t991[0x29];
																																if(_t991[0x29] == 0) {
																																	goto L183;
																																}
																																 *(_t1367 + 0x10) = _t991[0x27];
																																_t992 = _t991[0x28];
																																L182:
																																 *(_t1367 + 0x14) = _t992;
																																 *((char*)(_t1367 + 0x1a)) = 1;
																																goto L183;
																															}
																															 *(_t1367 + 0x10) =  *(_t1371 + 0xd8);
																															_t992 =  *(_t1371 + 0xdc);
																															goto L182;
																														}
																														__eflags =  *(_t1371 + 0xe5);
																														if( *(_t1371 + 0xe5) == 0) {
																															goto L176;
																														}
																														_push(1);
																														_pop(0);
																														goto L177;
																													}
																													__eflags =  *(_t1371 + 0xe4);
																													if( *(_t1371 + 0xe4) == 0) {
																														goto L172;
																													}
																													_push(1);
																													_pop(0);
																													goto L173;
																												}
																												__eflags =  *(_t1357 + 4);
																												if(__eflags == 0) {
																													goto L185;
																												}
																												E010D44FC(_t1357);
																												goto L167;
																											}
																											E010D29BC(_t1374 - 0x20, __eflags, _t1371 + 0x90);
																											 *((char*)(_t1374 - 4)) = 0xc;
																											E010E9ED7(_t1374 - 0x20);
																											_t998 =  *(_t1357 + 4);
																											 *(_t1374 - 0x2a) = 1;
																											__eflags = _t998;
																											 *(_t1374 - 0x4c) = _t998;
																											if(_t998 != 0) {
																												__eflags =  *(_t1371 + 0x54) - 3;
																												if( *(_t1371 + 0x54) == 3) {
																													_t1010 = E010D3EC1(_t1357);
																													__eflags = _t1010 -  *(_t1374 - 0x4c);
																													if(_t1010 ==  *(_t1374 - 0x4c)) {
																														E010E03AC(_t1357);
																													}
																												}
																												L160:
																												__eflags =  *(_t1374 - 0x2a);
																												_t1000 =  *( *_t1357 +  *(_t1357 + 4) * 4 - 4);
																												 *(_t1374 - 0x28) = _t1000;
																												if(__eflags != 0) {
																													 *(_t1371 + 0x20) = ((_t1000 & 0xffffff00 |  *(_t1371 + 0x20) == 0x00000000) - 0x00000001 & 0x00000025) + 0x3a;
																													E010D1089( *(_t1374 - 0x28), ((_t1000 & 0xffffff00 |  *(_t1371 + 0x20) == 0x00000000) - 0x00000001 & 0x00000025) + 0x0000003a & 0x000000ff);
																												}
																												_t1002 = E010D2C71( *(_t1374 - 0x28), __eflags, _t1374 - 0x20);
																												 *((char*)(_t1374 - 4)) = 0xa;
																												E010D1ABD(_t1002,  *((intOrPtr*)(_t1374 - 0x20)));
																												goto L163;
																											}
																											E010E03AC(_t1357);
																											__eflags =  *(_t1371 + 0x10d);
																											if( *(_t1371 + 0x10d) != 0) {
																												L156:
																												 *(_t1374 - 0x2a) = 0;
																												goto L160;
																											}
																											__eflags =  *(_t1371 + 0x54) - 4;
																											if( *(_t1371 + 0x54) != 4) {
																												goto L160;
																											}
																											goto L156;
																										}
																										__eflags =  *(_t1371 + 0x7c);
																										_t1357 = _t1371 + 0x78;
																										if( *(_t1371 + 0x7c) != 0) {
																											goto L151;
																										}
																										__eflags =  *(_t1371 + 0x10d);
																										if( *(_t1371 + 0x10d) != 0) {
																											goto L152;
																										}
																										__eflags =  *(_t1371 + 0x54) - 4;
																										if( *(_t1371 + 0x54) == 4) {
																											goto L152;
																										}
																										goto L151;
																									}
																									_t1013 =  *(_t1374 - 0x14);
																									 *((char*)(_t1374 - 4)) = 0;
																									__eflags = _t1013;
																									if(_t1013 != 0) {
																										 *((intOrPtr*)( *_t1013 + 8))(_t1013);
																									}
																									_t736 =  *(_t1374 - 0x28);
																									goto L353;
																								}
																								_t1015 =  *(_t1374 - 0x14);
																								 *((char*)(_t1374 - 4)) = 0;
																								__eflags = _t1015;
																								if(_t1015 != 0) {
																									 *((intOrPtr*)( *_t1015 + 8))(_t1015);
																								}
																								_t736 =  *(_t1374 - 0x28);
																								goto L353;
																							}
																							_t1017 =  *(_t1374 - 0x14);
																							 *((char*)(_t1374 - 4)) = 0;
																							__eflags = _t1017;
																							if(_t1017 != 0) {
																								 *((intOrPtr*)( *_t1017 + 8))(_t1017);
																							}
																							_t736 =  *(_t1374 - 0x28);
																							goto L353;
																						}
																						 *((char*)(_t1371 + 0xe7)) = 1;
																						 *(_t1371 + 0xe0) =  *(_t1374 - 0x1c);
																						goto L134;
																					}
																					E010D8173(_t1374 - 0x24);
																					_t1021 =  *(_t1374 - 0x14);
																					 *((char*)(_t1374 - 4)) = 0;
																					__eflags = _t1021;
																					if(_t1021 != 0) {
																						 *((intOrPtr*)( *_t1021 + 8))(_t1021);
																					}
																					_t736 =  *(_t1374 - 0x28);
																					goto L353;
																				}
																				_push(0x10);
																				_t1023 = E010D1A96();
																				__eflags = _t1023;
																				if(_t1023 == 0) {
																					_t1023 = 0;
																					__eflags = 0;
																				} else {
																					 *((intOrPtr*)(_t1023 + 4)) = 0;
																					 *((intOrPtr*)(_t1023 + 8)) = 0;
																					 *((intOrPtr*)(_t1023 + 0xc)) = 0;
																					 *_t1023 = 0x1108f40;
																				}
																				E010E0E48(_t1374 - 0x14, _t1023);
																				goto L117;
																			}
																			__eflags =  *(_t1371 + 0x68);
																			_t1368 = _t1371 + 0x68;
																			if(__eflags == 0) {
																				_push(0x10);
																				_t1034 = E010D1A96();
																				__eflags = _t1034;
																				if(_t1034 == 0) {
																					_t1034 = 0;
																					__eflags = 0;
																				} else {
																					 *((intOrPtr*)(_t1034 + 4)) = 0;
																					 *_t1034 = 0x1108f54;
																				}
																				 *(_t1371 + 0x64) = _t1034;
																				E010E0E48(_t1368, _t1034);
																			}
																			 *( *(_t1371 + 0x64) + 8) =  *(_t1371 + 0x14);
																			 *( *(_t1371 + 0x64) + 0xc) =  *(_t1374 + 0xc);
																			E010EA270(_t1374 - 0x20, _t1371 + 0x78, __eflags);
																			__eflags =  *(_t1371 + 0x9c);
																			 *((char*)(_t1374 - 4)) = 9;
																			if( *(_t1371 + 0x9c) == 0) {
																				L109:
																				_t1028 =  *(_t1371 + 0x60);
																				__eflags =  *(_t1371 + 0x9e);
																				_t1373 =  *((intOrPtr*)( *_t1028 + 0x10))(_t1028,  *((intOrPtr*)(_t1374 - 0x20)), 0 |  *(_t1371 + 0x9e) != 0x00000000,  *(_t1374 + 0x10),  *(_t1374 + 0x14),  *_t1368);
																				E010D1ABD(_t1029,  *((intOrPtr*)(_t1374 - 0x20)));
																				goto L315;
																			} else {
																				__eflags =  *(_t1371 + 0x7c);
																				if( *(_t1371 + 0x7c) != 0) {
																					L107:
																					E010D1089(_t1374 - 0x20, 0x3a);
																					L108:
																					E010D2C71(_t1374 - 0x20, __eflags, _t1371 + 0x90);
																					goto L109;
																				}
																				__eflags =  *(_t1371 + 0x10d);
																				if(__eflags != 0) {
																					goto L108;
																				}
																				__eflags =  *(_t1371 + 0x54) - 4;
																				if(__eflags == 0) {
																					goto L108;
																				}
																				goto L107;
																			}
																		}
																		__eflags = _t1096 - 1;
																		if(_t1096 <= 1) {
																			_t1273 =  *(_t1371 + 0x114);
																			__eflags = _t1273;
																			if(_t1273 == 0) {
																				goto L95;
																			}
																			__eflags = _t750 - _t1273;
																			if(__eflags < 0) {
																				L90:
																				__eflags =  *(_t1374 + 0x14);
																				if( *(_t1374 + 0x14) != 0) {
																					goto L95;
																				}
																				__eflags =  *(_t1371 + 0x125);
																				if( *(_t1371 + 0x125) != 0) {
																					goto L95;
																				}
																				goto L238;
																			}
																			if(__eflags != 0) {
																				L85:
																				_t1353 = 0;
																				__eflags = 0;
																				while(1) {
																					__eflags = _t1353 -  *(_t1371 + 0x114);
																					if(_t1353 >=  *(_t1371 + 0x114)) {
																						break;
																					}
																					_t1040 = E010D3721( *((intOrPtr*)( *((intOrPtr*)( *(_t1371 + 0x78) + _t1353 * 4)))));
																					__eflags = _t1040;
																					if(_t1040 != 0) {
																						goto L90;
																					}
																					_t1353 = _t1353 + 1;
																				}
																				__eflags = 0;
																				if(0 == 0) {
																					_t750 =  *(_t1371 + 0x114);
																					L94:
																					 *(_t1374 - 0x28) = _t750;
																					goto L95;
																				}
																				goto L90;
																			}
																			__eflags =  *(_t1371 + 0x10d);
																			if( *(_t1371 + 0x10d) == 0) {
																				__eflags =  *(_t1371 + 0x9f);
																				if( *(_t1371 + 0x9f) == 0) {
																					goto L90;
																				}
																				goto L85;
																			}
																			__eflags =  *(_t1371 + 0x9c);
																			if( *(_t1371 + 0x9c) != 0) {
																				goto L85;
																			}
																			goto L90;
																		}
																		__eflags = _t1096 - 2;
																		if(_t1096 == 2) {
																			L76:
																			__eflags = _t750;
																			if(_t750 == 0) {
																				goto L95;
																			}
																			_t750 = _t750 - 1;
																			goto L94;
																		}
																		__eflags = _t1096 - 4;
																		if(_t1096 != 4) {
																			goto L95;
																		}
																		__eflags =  *(_t1371 + 0x9c);
																		if( *(_t1371 + 0x9c) != 0) {
																			goto L94;
																		}
																		goto L76;
																	}
																	__eflags =  *(_t1371 + 0x9e);
																	if( *(_t1371 + 0x9e) != 0) {
																		goto L125;
																	}
																	goto L71;
																}
																_t1341 =  *(_t1353 + 4);
																__eflags = _t1341;
																if(_t1341 == 0) {
																	goto L97;
																}
																_t1041 =  *(_t1371 + 0x54);
																_t1277 = 0;
																__eflags = _t1041 - 4;
																if(_t1041 != 4) {
																	L65:
																	__eflags = _t1041 - 2;
																	if(_t1041 == 2) {
																		L67:
																		_t1277 = _t1341 - 1;
																		L68:
																		_push(_t1277);
																		_t1097 = _t1353;
																		goto L96;
																	}
																	__eflags = _t1041 - 4;
																	if(_t1041 != 4) {
																		goto L68;
																	}
																	goto L67;
																}
																__eflags =  *(_t1371 + 0x9c);
																if( *(_t1371 + 0x9c) == 0) {
																	goto L65;
																}
																_t1277 = _t1341;
																goto L68;
															}
															_t1042 = E010DE567(_t1095, __eflags);
															__eflags = _t1042;
															if(_t1042 == 0) {
																goto L125;
															}
															goto L60;
														}
														__eflags =  *(_t1371 + 0x9c);
														if( *(_t1371 + 0x9c) != 0) {
															goto L125;
														}
														goto L58;
													}
													__eflags =  *(_t1374 + 0xb);
													if( *(_t1374 + 0xb) != 0) {
														goto L54;
													}
													__eflags =  *(_t1371 + 0x114);
													if(__eflags == 0) {
														goto L54;
													}
													 *((intOrPtr*)(_t1374 - 0x20)) = 0;
													 *(_t1374 - 0x1c) = 0;
													 *((intOrPtr*)(_t1374 - 0x18)) = 0;
													 *((char*)(_t1374 - 4)) = 7;
													E010D373A(_t1351, _t1374 - 0x20, __eflags);
													_t1369 = 0;
													__eflags = 0;
													while(1) {
														__eflags = _t1369 -  *(_t1371 + 0x114);
														if(_t1369 >=  *(_t1371 + 0x114)) {
															break;
														}
														__eflags = E010D3721( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1374 - 0x20)) + _t1369 * 4)))));
														if(__eflags != 0) {
															L53:
															_t1045 = E010EA270(_t1374 - 0x60, _t1374 - 0x20, __eflags);
															 *((char*)(_t1374 - 4)) = 8;
															E010D1ABD(E010D2A8C(_t1371 + 0x198, _t1045),  *((intOrPtr*)(_t1374 - 0x60)));
															 *((char*)(_t1374 - 4)) = 0;
															E010E8B2E(0, _t1374 - 0x20);
															goto L54;
														}
														_t1369 = _t1369 + 1;
													}
													__eflags = 0;
													if(0 == 0) {
														E010E03F4(_t1374 - 0x20, _t1369,  *(_t1371 + 0x114));
													}
													goto L53;
												}
												 *(_t1374 + 0xb) = 0;
												_push(_t748);
												L38:
												E010D3053(_t1351);
												goto L39;
											}
											 *(_t1374 + 0xb) = 0;
											_push(4);
											goto L38;
										}
										_t1055 =  *(_t1371 + 0x14);
										__eflags = _t1055[2];
										if(_t1055[2] == 0) {
											L35:
											__eflags =  *(_t1371 + 0x19c);
											if( *(_t1371 + 0x19c) == 0) {
												goto L54;
											}
											goto L36;
										}
										_t1056 = _t1055[2];
										 *((intOrPtr*)( *_t1056 + 0x10))(_t1056,  *(_t1371 + 0xe8), 0x59, _t1374 - 0x4c, _t1374 - 0x28, _t1374 - 0xa0);
										__eflags =  *(_t1374 - 0x28);
										if( *(_t1374 - 0x28) == 0) {
											goto L35;
										}
										__eflags =  *((intOrPtr*)(_t1374 - 0xa0)) - 1;
										if( *((intOrPtr*)(_t1374 - 0xa0)) != 1) {
											goto L238;
										}
										E010D28E9(_t1374 - 0x60);
										 *((char*)(_t1374 - 4)) = 4;
										E010DFB2F(_t1374 - 0x80, __eflags);
										 *((char*)(_t1374 - 4)) = 5;
										 *((intOrPtr*)(_t1374 - 0x9c)) = 0;
										__eflags = E010D6C0B(_t1374 - 0x80,  *(_t1374 - 0x4c),  *(_t1374 - 0x28), _t1374 - 0x9c);
										if(__eflags != 0) {
											_push(_t1374 - 0x20);
											 *(_t1374 - 0x29) = 0;
											_t1065 = E010D6DAA(_t1374 - 0x80, __eflags);
											 *((char*)(_t1374 - 4)) = 6;
											E010D1ABD(E010D2A8C(_t1351, _t1065),  *((intOrPtr*)(_t1374 - 0x20)));
											__eflags =  *((intOrPtr*)(_t1374 - 0x80)) - 0xa0000003;
											 *(_t1374 - 0x3a) =  *((intOrPtr*)(_t1374 - 0x80)) == 0xa0000003;
											__eflags =  *((intOrPtr*)(_t1374 - 0x7c)) - 1;
											_t118 = _t1374 + 0xb;
											 *_t118 =  *((intOrPtr*)(_t1374 - 0x7c)) == 1;
											__eflags =  *_t118;
										}
										 *((char*)(_t1374 - 4)) = 4;
										_t1062 = E010FC31B(_t1374 - 0x80);
										 *((char*)(_t1374 - 4)) = 0;
										E010D1ABD(_t1062,  *((intOrPtr*)(_t1374 - 0x60)));
										goto L35;
									}
								} else {
									_t1373 = _t744;
									L43:
									_t1297 = _t1374 - 0x24;
									goto L15;
								}
							}
						} else {
							_t1373 = _t741;
							L25:
							_t1297 = _t1374 - 0x24;
							goto L15;
						}
					}
					__eflags =  *(_t1374 - 0x24) - 0x15;
					if( *(_t1374 - 0x24) == 0x15) {
						 *(_t1371 + 0xb8) =  *(_t1374 - 0x1c);
						 *((intOrPtr*)(_t1371 + 0xbc)) =  *((intOrPtr*)(_t1374 - 0x18));
						 *(_t1371 + 0xc0) = 1;
						goto L17;
					} else {
						_t1373 = 0x80004005;
						goto L14;
					}
				} else {
					_t1373 = _t738;
					L14:
					_t1297 = _t1374 - 0x24;
					L15:
					E010D8173(_t1297);
					L315:
					_t736 = _t1373;
					goto L353;
				}
			}

0x010de582
0x010de592
0x010de598
0x010de5a0
0x010de5a3
0x010de5a6
0x010de5b1
0x010de5b1
0x010de5b6
0x010de5bc
0x010de5c2
0x010de5c6
0x010de5cb
0x010de5ce
0x010de5ce
0x010de5d3
0x010de5d9
0x010de5df
0x010de5e5
0x010de5eb
0x010de5f1
0x010de5f7
0x010de5fd
0x010de603
0x010de609
0x010de60f
0x010de615
0x010de61a
0x010de61f
0x010de622
0x010de630
0x010de63c
0x010de645
0x010de64d
0x010de653
0x010de658
0x010de65f
0x010de65f
0x010de65f
0x010de65f
0x010de658
0x010de669
0x010de675
0x010de676
0x010de679
0x010de680
0x010dfb03
0x010dfb08
0x010dfb11
0x010dfb11
0x010de686
0x010de68a
0x010de68e
0x010de691
0x010de69f
0x010de6a4
0x010de6a9
0x010de6af
0x010de6b3
0x010de6e7
0x010de6ea
0x010de6ef
0x010de6f2
0x010de6f5
0x010de6f8
0x010de6fc
0x010de700
0x010de703
0x010de711
0x010de716
0x010de719
0x010de71b
0x010de721
0x010de726
0x010de76d
0x010de771
0x00000000
0x010de773
0x010de773
0x00000000
0x010de773
0x010de728
0x010de72d
0x010de731
0x010de734
0x010de739
0x010de73c
0x010de741
0x010de745
0x010de749
0x010de74c
0x010de75a
0x010de75f
0x010de762
0x010de764
0x010de780
0x010de785
0x010de8bf
0x010de8c3
0x00000000
0x00000000
0x010de8c9
0x00000000
0x010de78b
0x010de790
0x010de793
0x010de797
0x010de79c
0x010de79f
0x010de7a2
0x010de7a7
0x010de7ad
0x010de887
0x010de88d
0x010de899
0x010de89e
0x010de8a0
0x010de8ae
0x010de8b0
0x010de8b5
0x010de8b7
0x010de8d6
0x010de8dc
0x010de97c
0x010de98b
0x010de990
0x010de992
0x00000000
0x00000000
0x010de99a
0x010de99f
0x010de9a1
0x00000000
0x00000000
0x010de9a7
0x010de9aa
0x010de9b8
0x010de9b8
0x010de9bb
0x010de9be
0x010de9c0
0x010de9d2
0x010de9d2
0x010de9d8
0x010dea10
0x010dea13
0x010dea15
0x010dea23
0x010dea23
0x010dea26
0x010dea29
0x010dea2b
0x010deac9
0x010deac9
0x010deacc
0x010deacf
0x010deacf
0x010dead4
0x010dead4
0x010dead7
0x010deb8f
0x010deb92
0x010deb95
0x010deb99
0x010debd7
0x010debd7
0x010debdd
0x010dec27
0x010dec27
0x010dec2a
0x010dec2c
0x010dec31
0x010dec33
0x010dec33
0x010dec35
0x010dec38
0x010dec38
0x010dec3a
0x010dec3c
0x010dec3f
0x010dec44
0x010dec44
0x010dec47
0x010dec47
0x00000000
0x010dec47
0x010debdf
0x010debe2
0x010debea
0x010debf6
0x010dec04
0x010dec09
0x010dec14
0x010dec16
0x010dec19
0x010dec1c
0x010dec20
0x00000000
0x010dec20
0x010debe4
0x010debe8
0x00000000
0x00000000
0x00000000
0x010debe8
0x010deb9b
0x010deba1
0x00000000
0x00000000
0x010deba3
0x010deba9
0x010dec4e
0x010dec52
0x010dec56
0x010dec59
0x010dec5c
0x010dec62
0x010dec6d
0x010dec70
0x010dec72
0x010dec75
0x010dec97
0x010dec9c
0x010decb0
0x010decb4
0x010dfaee
0x010df3ac
0x010df3ac
0x010df3af
0x010df3b2
0x010df3b4
0x010df3b9
0x010df3b9
0x010df3bc
0x010df3bc
0x00000000
0x010df3bc
0x010decba
0x010decc0
0x010decc3
0x010decc7
0x010decd8
0x010decd9
0x010decda
0x010decdc
0x010decdf
0x010dece4
0x010dece6
0x010dece9
0x010ded0f
0x010ded10
0x010ded11
0x010ded13
0x010ded16
0x010ded1b
0x010ded1d
0x010ded20
0x010ded46
0x010ded47
0x010ded48
0x010ded4a
0x010ded4d
0x010ded52
0x010ded54
0x010ded57
0x010ded74
0x010ded81
0x010ded88
0x010ded8a
0x010ded8c
0x010df789
0x010df789
0x010df78c
0x010df78f
0x010df791
0x010df796
0x010df796
0x010df799
0x00000000
0x010df799
0x010ded92
0x010ded98
0x010dedb0
0x010dedb6
0x010dedbd
0x010dedc0
0x010dedc1
0x010dedc2
0x010dedc5
0x010dedca
0x010dedca
0x010dedd0
0x010dee76
0x010dee7b
0x010dee80
0x010dee83
0x010dee87
0x010defa4
0x010defab
0x010defb0
0x010defb4
0x010defb8
0x010defc6
0x010defcc
0x010defd0
0x010defd9
0x010defdd
0x010defe5
0x010defe9
0x010defef
0x010defef
0x010deff5
0x010deffb
0x010df001
0x010df004
0x010df00d
0x010df010
0x010df015
0x010df021
0x010df02d
0x010df030
0x010df034
0x010df039
0x010df03d
0x010df03f
0x010df049
0x010df04d
0x010df057
0x010df066
0x010df06e
0x010df072
0x010df07e
0x010df086
0x010df08a
0x010df08f
0x010df03f
0x010df004
0x010df090
0x010df096
0x010df099
0x010df0ef
0x010df0f5
0x00000000
0x00000000
0x010df101
0x010df109
0x010df10e
0x010df117
0x010df11b
0x010df120
0x010df122
0x010df468
0x010df46a
0x010df46c
0x010df4f2
0x010df4f5
0x010df4f9
0x00000000
0x010df4fe
0x010df472
0x010df475
0x010df47a
0x00000000
0x00000000
0x010df483
0x010df488
0x010df48b
0x010df48f
0x010df494
0x010df497
0x010df497
0x010df4a1
0x010df4ac
0x010df4b1
0x010df4ba
0x010df4be
0x010df4c3
0x010df4c5
0x010df4c7
0x010df4cd
0x010df4d0
0x010df4d5
0x010df4d8
0x010df4d8
0x010df4d0
0x010df4eb
0x010df4f1
0x00000000
0x010df4f1
0x010df12b
0x010df12b
0x010df12d
0x010df150
0x010df15e
0x010df162
0x010df16a
0x010df16e
0x010df186
0x010df189
0x010df19c
0x010df1b8
0x010df1ba
0x010df1bc
0x010df1e9
0x010df1e9
0x010df1eb
0x010df284
0x010df287
0x010df28b
0x010df291
0x010df291
0x010df294
0x010df297
0x010df302
0x010df305
0x010df3d6
0x010df3dc
0x010df3de
0x010df3fe
0x010df400
0x00000000
0x00000000
0x010df409
0x010df40e
0x010df410
0x00000000
0x00000000
0x010df41c
0x010df41f
0x00000000
0x00000000
0x010df428
0x010df429
0x010df42f
0x010df431
0x010df436
0x010df439
0x010df43b
0x010df43d
0x010df2bf
0x010df2cf
0x00000000
0x010df2d4
0x010df443
0x010df453
0x00000000
0x010df458
0x010df3e5
0x010df3e7
0x00000000
0x00000000
0x010df3f0
0x010df3f1
0x00000000
0x010df3f1
0x010df312
0x010df31a
0x010df323
0x010df325
0x010df345
0x010df347
0x010df3c9
0x00000000
0x010df3c9
0x010df34e
0x010df352
0x010df353
0x010df359
0x010df35e
0x010df35e
0x010df361
0x010df363
0x010df365
0x010df38c
0x010df3a4
0x00000000
0x010df3a9
0x010df37f
0x00000000
0x010df384
0x010df32c
0x010df32d
0x010df333
0x00000000
0x010df333
0x010df2a1
0x010df2a3
0x010df2f9
0x00000000
0x010df2f9
0x010df2aa
0x010df2ab
0x010df2b1
0x010df2b6
0x010df2b9
0x010df2bb
0x010df2bd
0x010df2ec
0x00000000
0x010df2f1
0x00000000
0x010df2bd
0x010df1f1
0x010df1f1
0x010df1f2
0x010df27d
0x00000000
0x010df27d
0x010df1f8
0x010df1f8
0x010df1f9
0x010df255
0x010df270
0x00000000
0x010df275
0x010df1fb
0x010df1fb
0x010df1fc
0x010df24e
0x00000000
0x010df24e
0x010df1fe
0x010df1fe
0x010df1ff
0x010df245
0x00000000
0x010df245
0x010df201
0x010df204
0x010df204
0x010df205
0x00000000
0x00000000
0x010df223
0x010df228
0x010df22e
0x010df230
0x010df233
0x010df238
0x010df238
0x010df23b
0x00000000
0x010df23b
0x010df1c1
0x010df1c6
0x00000000
0x010df1c6
0x010df130
0x010df130
0x010df131
0x00000000
0x00000000
0x010df137
0x00000000
0x010df09b
0x010df09b
0x010df0a7
0x010df0ac
0x010df0af
0x010df0b3
0x010df0b3
0x010df0b8
0x010df0be
0x010df4ff
0x010df509
0x010df50e
0x010df511
0x010dfac2
0x010dfad3
0x010dfadb
0x010dfadf
0x00000000
0x010dfae5
0x010df517
0x010df51d
0x010df74e
0x010df74e
0x010df754
0x010df7d1
0x010df7d1
0x010df7d3
0x010df7d8
0x010df7db
0x010df820
0x010df820
0x010df7dd
0x010df7dd
0x010df7e0
0x010df7e4
0x010df7ea
0x010df7ea
0x010df822
0x010df824
0x010df827
0x010df82d
0x010df830
0x010df835
0x010df835
0x010df843
0x010df849
0x010df84d
0x010df852
0x010df856
0x010df864
0x010df866
0x010df8c9
0x010df8cc
0x010df9d1
0x010df9d1
0x010df9d4
0x010df9d6
0x010df9dc
0x010df9e7
0x010df9f1
0x010dfa02
0x010dfa12
0x010dfa16
0x010dfa1e
0x010dfa20
0x010dfa2f
0x010dfa32
0x010dfa32
0x010dfa3d
0x010dfa41
0x010dfa46
0x010dfa49
0x010df9dc
0x010dfa4a
0x010dfa50
0x010dfaa8
0x010dfaaf
0x010dfab4
0x010dfab6
0x010dfaba
0x010dfabf
0x010dfabf
0x00000000
0x010dfa52
0x010dfa52
0x010dfa69
0x010dfa6c
0x010dfa6e
0x010dfa71
0x00000000
0x00000000
0x010dfa73
0x010dfa75
0x010dfa79
0x010dfa7e
0x010dfa7e
0x010dfa8c
0x010dfa91
0x010dfa95
0x010dfa98
0x010dfa9b
0x010dfaa0
0x010dfaa0
0x010dfaa3
0x00000000
0x010dfaa3
0x010dfa50
0x010df8d2
0x010df8d8
0x00000000
0x00000000
0x010df8de
0x010df8e4
0x00000000
0x00000000
0x010df8ea
0x010df8f0
0x010df8f6
0x010df8f8
0x010df906
0x010df911
0x010df916
0x010df918
0x010df91e
0x010df970
0x010df97e
0x010df980
0x00000000
0x00000000
0x010df987
0x010df988
0x010df98d
0x010df992
0x010df994
0x010df997
0x00000000
0x00000000
0x010df999
0x010df99b
0x010df99f
0x010df9a4
0x010df9a4
0x010df9b2
0x010df9b7
0x010df9bb
0x010df9be
0x010df9c1
0x010df9c6
0x010df9c6
0x010df9c9
0x00000000
0x010df9c9
0x010df925
0x010df926
0x010df92c
0x010df931
0x010df933
0x010df936
0x00000000
0x00000000
0x010df938
0x010df93a
0x010df93e
0x010df943
0x010df943
0x010df951
0x010df956
0x010df95a
0x010df95d
0x010df960
0x010df965
0x010df965
0x010df968
0x00000000
0x010df968
0x010df8fa
0x010df900
0x00000000
0x00000000
0x00000000
0x010df868
0x010df86d
0x010df86e
0x010df879
0x010df87b
0x010df87f
0x010df881
0x010df8b6
0x010df8b8
0x010df8c1
0x010df8c1
0x00000000
0x010df8b8
0x010df883
0x010df885
0x010df88a
0x010df88a
0x010df88d
0x010df890
0x010df898
0x010df89f
0x010df89f
0x010df8a2
0x010df8a5
0x010df8a7
0x010df8ac
0x010df8ac
0x00000000
0x010df8a7
0x010df866
0x010df756
0x010df75c
0x00000000
0x00000000
0x010df767
0x010df76b
0x010df771
0x010df773
0x010df775
0x010df7a0
0x010df7a3
0x00000000
0x00000000
0x010df7ae
0x010df7af
0x010df7b4
0x010df7b6
0x00000000
0x00000000
0x010df7be
0x010df7c1
0x010df7c4
0x010df7f8
0x010df7fa
0x00000000
0x00000000
0x010df803
0x010df804
0x010df807
0x010df80d
0x010df812
0x010df815
0x010df817
0x010df819
0x00000000
0x00000000
0x00000000
0x010df81b
0x010df7cc
0x00000000
0x010df7cc
0x010df782
0x00000000
0x010df788
0x010df526
0x010df52b
0x010df52e
0x010df532
0x010df53a
0x010df543
0x010df547
0x010df54f
0x010df553
0x010df558
0x010df559
0x010df563
0x010df570
0x010df572
0x010df5b1
0x010df5b6
0x010df5b9
0x010df5bd
0x010df5cf
0x010df5d8
0x010df5de
0x010df5e0
0x010df5f8
0x010df5f8
0x010df5fb
0x010df72c
0x010df72f
0x00000000
0x010df734
0x010df601
0x010df604
0x010df648
0x010df64b
0x00000000
0x00000000
0x010df651
0x010df654
0x010df657
0x010df660
0x010df66d
0x010df66f
0x010df723
0x010df726
0x00000000
0x010df72b
0x010df678
0x010df684
0x010df68b
0x010df696
0x010df698
0x010df6ec
0x010df6f8
0x010df700
0x010df702
0x010df717
0x010df71a
0x010df71e
0x00000000
0x010df71e
0x010df709
0x010df70a
0x010df710
0x010df6aa
0x010df6aa
0x010df6ac
0x010df6ae
0x00000000
0x00000000
0x010df6b3
0x010df6df
0x00000000
0x010df6e4
0x010df69f
0x010df6a0
0x010df6a5
0x00000000
0x010df6a5
0x010df611
0x010df613
0x00000000
0x00000000
0x010df61e
0x010df622
0x010df623
0x010df62e
0x010df630
0x010df632
0x00000000
0x00000000
0x010df638
0x010df63b
0x010df640
0x010df1c9
0x010df1d9
0x00000000
0x010df1de
0x010df5e7
0x010df5e8
0x010df5f2
0x010df5f4
0x010df5f6
0x00000000
0x00000000
0x00000000
0x010df5f6
0x010df5bf
0x010df5c2
0x00000000
0x00000000
0x010df5c8
0x00000000
0x010df574
0x010df579
0x010df57a
0x010df584
0x010df586
0x010df588
0x010df735
0x010df738
0x010df73c
0x010df741
0x010df748
0x00000000
0x00000000
0x00000000
0x010df748
0x010df5a1
0x00000000
0x010df5a6
0x010df0c4
0x010df0c4
0x010df0c4
0x010df0c7
0x010df0cf
0x010df0d6
0x010df0d6
0x010df0d9
0x010df0dc
0x010df0de
0x010df0e7
0x010df0e7
0x00000000
0x010df0de
0x010df0be
0x010df099
0x010defc2
0x010defc4
0x00000000
0x00000000
0x00000000
0x010defc4
0x010dee8d
0x010dee93
0x010deea5
0x010deea5
0x010deea8
0x00000000
0x00000000
0x010deeb1
0x010deebd
0x010deec1
0x010deec6
0x010deecc
0x010def97
0x010def9a
0x010def9e
0x00000000
0x010defa3
0x010deee3
0x010deeeb
0x010deef0
0x010deef3
0x010deef9
0x010def08
0x010def08
0x010def0a
0x010def0a
0x010def19
0x010def1f
0x010def22
0x010def28
0x010def37
0x010def37
0x010def39
0x010def39
0x010def3c
0x010def3f
0x010def45
0x010def84
0x010def87
0x010def8b
0x010def92
0x00000000
0x010def92
0x010def47
0x010def4d
0x010def63
0x010def66
0x010def6c
0x00000000
0x00000000
0x010def74
0x010def77
0x010def7d
0x010def7d
0x010def80
0x00000000
0x010def80
0x010def5b
0x010def5e
0x00000000
0x010def5e
0x010def2a
0x010def30
0x00000000
0x00000000
0x010def32
0x010def34
0x00000000
0x010def34
0x010deefb
0x010def01
0x00000000
0x00000000
0x010def03
0x010def05
0x00000000
0x010def05
0x010dee95
0x010dee98
0x00000000
0x00000000
0x010deea0
0x00000000
0x010deea0
0x010dede0
0x010dede8
0x010dedec
0x010dedf1
0x010dedf4
0x010dedf8
0x010dedfa
0x010dedfd
0x010dee19
0x010dee1d
0x010dee21
0x010dee26
0x010dee29
0x010dee2d
0x010dee2d
0x010dee29
0x010dee32
0x010dee37
0x010dee3a
0x010dee3e
0x010dee41
0x010dee50
0x010dee58
0x010dee58
0x010dee64
0x010dee6c
0x010dee70
0x00000000
0x010dee75
0x010dee01
0x010dee06
0x010dee0c
0x010dee14
0x010dee14
0x00000000
0x010dee14
0x010dee0e
0x010dee12
0x00000000
0x00000000
0x00000000
0x010dee12
0x010ded9a
0x010ded9d
0x010deda0
0x00000000
0x00000000
0x010deda2
0x010deda8
0x00000000
0x00000000
0x010dedaa
0x010dedae
0x00000000
0x00000000
0x00000000
0x010dedae
0x010ded59
0x010ded5c
0x010ded5f
0x010ded61
0x010ded66
0x010ded66
0x010ded69
0x00000000
0x010ded69
0x010ded22
0x010ded25
0x010ded28
0x010ded2a
0x010ded2f
0x010ded2f
0x010ded32
0x00000000
0x010ded32
0x010deceb
0x010decee
0x010decf1
0x010decf3
0x010decf8
0x010decf8
0x010decfb
0x00000000
0x010decfb
0x010deca1
0x010deca8
0x00000000
0x010deca8
0x010dec7a
0x010dec7f
0x010dec82
0x010dec85
0x010dec87
0x010dec8c
0x010dec8c
0x010dec8f
0x00000000
0x010dec8f
0x010debaf
0x010debb1
0x010debb6
0x010debb9
0x010debcc
0x010debcc
0x010debbb
0x010debbb
0x010debbe
0x010debc1
0x010debc4
0x010debc4
0x010debd2
0x00000000
0x010debd2
0x010deadd
0x010deae0
0x010deae3
0x010deae5
0x010deae7
0x010deaec
0x010deaef
0x010deafc
0x010deafc
0x010deaf1
0x010deaf1
0x010deaf4
0x010deaf4
0x010deb01
0x010deb04
0x010deb04
0x010deb12
0x010deb1b
0x010deb21
0x010deb26
0x010deb2c
0x010deb30
0x010deb5e
0x010deb60
0x010deb69
0x010deb82
0x010deb84
0x00000000
0x010deb32
0x010deb32
0x010deb35
0x010deb45
0x010deb4a
0x010deb4f
0x010deb59
0x00000000
0x010deb59
0x010deb37
0x010deb3d
0x00000000
0x00000000
0x010deb3f
0x010deb43
0x00000000
0x00000000
0x00000000
0x010deb43
0x010deb30
0x010dea31
0x010dea34
0x010dea53
0x010dea59
0x010dea5b
0x00000000
0x00000000
0x010dea5d
0x010dea5f
0x010deaae
0x010deaae
0x010deab1
0x00000000
0x00000000
0x010deab3
0x010deab9
0x00000000
0x00000000
0x00000000
0x010deabb
0x010dea61
0x010dea7d
0x010dea7d
0x010dea7d
0x010dea7f
0x010dea7f
0x010dea85
0x00000000
0x00000000
0x010dea9c
0x010deaa1
0x010deaa3
0x00000000
0x00000000
0x010deaa5
0x010deaa5
0x010deaaa
0x010deaac
0x010deac0
0x010deac6
0x010deac6
0x00000000
0x010deac6
0x00000000
0x010deaac
0x010dea63
0x010dea69
0x010dea75
0x010dea7b
0x00000000
0x00000000
0x00000000
0x010dea7b
0x010dea6b
0x010dea71
0x00000000
0x00000000
0x00000000
0x010dea73
0x010dea36
0x010dea39
0x010dea4c
0x010dea4c
0x010dea4e
0x00000000
0x00000000
0x010dea50
0x00000000
0x010dea50
0x010dea3b
0x010dea3e
0x00000000
0x00000000
0x010dea44
0x010dea4a
0x00000000
0x00000000
0x00000000
0x010dea4a
0x010dea17
0x010dea1d
0x00000000
0x00000000
0x00000000
0x010dea1d
0x010de9da
0x010de9dd
0x010de9df
0x00000000
0x00000000
0x010de9e5
0x010de9e8
0x010de9ea
0x010de9ed
0x010de9fb
0x010de9fb
0x010de9fe
0x010dea05
0x010dea05
0x010dea08
0x010dea08
0x010dea09
0x00000000
0x010dea09
0x010dea00
0x010dea03
0x00000000
0x00000000
0x00000000
0x010dea03
0x010de9ef
0x010de9f5
0x00000000
0x00000000
0x010de9f7
0x00000000
0x010de9f7
0x010de9c5
0x010de9ca
0x010de9cc
0x00000000
0x00000000
0x00000000
0x010de9cc
0x010de9ac
0x010de9b2
0x00000000
0x00000000
0x00000000
0x010de9b2
0x010de8e2
0x010de8e5
0x00000000
0x00000000
0x010de8eb
0x010de8f1
0x00000000
0x00000000
0x010de8f7
0x010de8fa
0x010de8fd
0x010de905
0x010de909
0x010de90e
0x010de90e
0x010de910
0x010de910
0x010de916
0x00000000
0x00000000
0x010de932
0x010de934
0x010de94d
0x010de953
0x010de95f
0x010de96b
0x010de971
0x010de977
0x00000000
0x010de977
0x010de936
0x010de936
0x010de93b
0x010de93d
0x010de948
0x010de948
0x00000000
0x010de93d
0x010de8b9
0x010de8bc
0x010de8a7
0x010de8a9
0x00000000
0x010de8a9
0x010de8a2
0x010de8a5
0x00000000
0x010de8a5
0x010de7b3
0x010de7b6
0x010de7b9
0x010de87b
0x010de87b
0x010de881
0x00000000
0x00000000
0x00000000
0x010de881
0x010de7c5
0x010de7dc
0x010de7df
0x010de7e2
0x00000000
0x00000000
0x010de7e8
0x010de7ef
0x00000000
0x00000000
0x010de7f8
0x010de800
0x010de804
0x010de813
0x010de81a
0x010de828
0x010de82a
0x010de832
0x010de833
0x010de836
0x010de83e
0x010de84a
0x010de84f
0x010de857
0x010de85b
0x010de85f
0x010de85f
0x010de85f
0x010de85f
0x010de866
0x010de86a
0x010de872
0x010de875
0x00000000
0x010de87a
0x010de766
0x010de766
0x010de8ce
0x010de8ce
0x00000000
0x010de8ce
0x010de764
0x010de71d
0x010de71d
0x010de778
0x010de778
0x00000000
0x010de778
0x010de71b
0x010de6b5
0x010de6ba
0x010de6d1
0x010de6da
0x010de6e0
0x00000000
0x010de6bc
0x010de6bc
0x00000000
0x010de6bc
0x010de6ab
0x010de6ab
0x010de6c1
0x010de6c1
0x010de6c4
0x010de6c4
0x010df8af
0x010df8af
0x00000000
0x010df8af

APIs

__EH_prolog.LIBCMT ref: 010DE582

Part of subcall function 010D373A: __EH_prolog.LIBCMT ref: 010D373F

Part of subcall function 010D3721: wcscmp.MSVCRT ref: 010D372C

Strings

, xrefs: 010DFA12
Internal error for symbolic link file, xrefs: 010DF6A0
\??\, xrefs: 010DE894
Can not seek to begin of file, xrefs: 010DF988
Dangerous link path was ignored, xrefs: 010DF57A
Incorrect path, xrefs: 010DF5E8

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$wcscmp
String ID: $Can not seek to begin of file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 3232955128-2809321072
Opcode ID: 65178a9603172e2446e07bff712f8e29ad02475b4ab6e3c69a7c859acf518af9
Instruction ID: edac6cc6f7fee74617b2bbfa492c5192e8bded3aac0a5427493319a0aeed30e1
Opcode Fuzzy Hash: 65178a9603172e2446e07bff712f8e29ad02475b4ab6e3c69a7c859acf518af9
Instruction Fuzzy Hash: 5AE2803190438ADFDF25EBA8C890AEDBBF1BF15304F1484ADE5C6A7251DB316945CB22

Uniqueness

Uniqueness Score: -1.00%

Function 010EBD45 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E010EBD45(void* __ecx, void* __eflags) {
				void* __ebx;
				void* _t107;
				int _t108;
				int _t113;
				int _t115;
				_Unknown_base(*)()* _t117;
				unsigned int _t128;
				void* _t132;
				signed int _t134;
				signed char _t138;
				void* _t191;
				int _t194;
				struct HINSTANCE__** _t196;
				unsigned int* _t197;
				void** _t198;
				void* _t199;
				void* _t201;
				void* _t202;
				intOrPtr _t205;
				void* _t210;
				intOrPtr _t217;

				E011039E0(E01105EB3, _t199);
				_t202 = _t201 - 0x8c;
				_t191 = __ecx;
				E010ECA5D(__ecx + 0x28);
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(_t199 - 0x1c)) = 0;
				 *((short*)( *((intOrPtr*)(__ecx + 0x18)))) = 0;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				 *((intOrPtr*)(__ecx + 0x44)) = 0;
				_t205 =  *0x11146a4; // 0x0
				if(_t205 <= 0) {
					L11:
					E010EBFF8(_t199 - 0x38, _t210); // executed
					 *(_t199 - 4) = 3;
					_t107 = E010D28B2(_t199 - 0x28, _t199 - 0x38,  *0x110988c);
					 *(_t199 - 4) = 4;
					_t108 = E010EBB2D(_t191, _t107, 0, _t199 - 0x11); // executed
					_t194 = _t108;
					 *(_t199 - 4) = 3;
					_t109 = E010D1ABD(_t108,  *((intOrPtr*)(_t199 - 0x28)));
					if(_t194 != 0) {
						L26:
						E010D1ABD(_t109,  *((intOrPtr*)(_t199 - 0x38)));
						 *[fs:0x0] =  *((intOrPtr*)(_t199 - 0xc));
						return _t194;
					}
					if( *((intOrPtr*)(_t199 - 0x11)) == 0) {
						E010D2A28(_t191 + 0x18,  *0x110988c);
					}
					_push(E010D28B2(_t199 - 0x28, _t199 - 0x38, L"Codecs\\"));
					 *(_t199 - 4) = 5;
					_t113 = E010EBC55(0, _t191); // executed
					_t194 = _t113;
					 *(_t199 - 4) = 3;
					_t109 = E010D1ABD(_t113,  *((intOrPtr*)(_t199 - 0x28)));
					if(_t194 != 0) {
						goto L26;
					} else {
						_push(E010D28B2(_t199 - 0x28, _t199 - 0x38, L"Formats\\"));
						 *(_t199 - 4) = 6;
						_t115 = E010EBC55(0, _t191); // executed
						_t194 = _t115;
						 *(_t199 - 4) = 3;
						_t109 = E010D1ABD(_t115,  *((intOrPtr*)(_t199 - 0x28)));
						if(_t194 != 0) {
							goto L26;
						}
						 *((char*)(_t191 + 0x24)) = 1;
						_t109 =  *(_t191 + 0x10);
						if(_t109 == 0) {
							L19:
							 *((char*)(_t191 + 0x24)) = 0;
							L20:
							if( *((intOrPtr*)(_t191 + 0x24)) == 0) {
								L25:
								_t194 = 0;
								goto L26;
							}
							 *(_t199 - 0x10) = 0;
							if( *(_t191 + 0x10) <= 0) {
								goto L25;
							} else {
								goto L22;
							}
							do {
								L22:
								_t196 =  *( *((intOrPtr*)(_t191 + 0xc)) +  *(_t199 - 0x10) * 4);
								_t117 = GetProcAddress( *_t196, "SetCodecs");
								_t196[8] = _t117;
								if(_t117 == 0) {
									goto L24;
								}
								_t109 =  *_t117(_t191);
								if(_t109 != 0) {
									_t194 = _t109;
									goto L26;
								}
								L24:
								 *(_t199 - 0x10) =  *(_t199 - 0x10) + 1;
								_t109 =  *(_t199 - 0x10);
							} while ( *(_t199 - 0x10) <  *(_t191 + 0x10));
							goto L25;
						}
						if(_t109 != 1) {
							goto L20;
						}
						_t217 =  *0x11146a4; // 0x0
						if(_t217 != 0) {
							goto L20;
						}
						goto L19;
					}
				}
				 *(_t199 - 0x18) = 0x11145a4;
				do {
					_t197 =  *( *(_t199 - 0x18));
					E010EB825(_t199 - 0x98, _t205);
					 *(_t199 - 4) = 0;
					E010D2B8A(_t199 - 0x8c, _t197[3]);
					 *(_t199 - 0x94) = _t197[6];
					 *(_t199 - 0x90) = _t197[8];
					 *(_t199 - 0x98) =  *_t197 & 0x0000ffff;
					E010D28E9(_t199 - 0x28);
					 *(_t199 - 4) = 1;
					E010D28E9(_t199 - 0x44);
					_t127 = _t197[4];
					 *(_t199 - 4) = 2;
					if(_t197[4] != 0) {
						E010D2B8A(_t199 - 0x28, _t127);
					}
					_t128 = _t197[5];
					_t207 = _t128;
					if(_t128 != 0) {
						E010D2B8A(_t199 - 0x44, _t128);
					}
					_push(_t199 - 0x44);
					_push(_t199 - 0x28);
					_t132 = E010D1ABD(E010EB152(_t199 - 0x98, _t207),  *((intOrPtr*)(_t199 - 0x44)));
					 *(_t199 - 4) = 0;
					E010D1ABD(_t132,  *((intOrPtr*)(_t199 - 0x28)));
					_t134 = _t197[7];
					 *(_t199 - 0x74) = _t134;
					 *((char*)(_t199 - 0x70)) = _t134 & 0xffffff00 | _t197[7] != 0x00000000;
					 *(_t199 - 0x6c) = _t197[1] & 0x0000ffff;
					 *((char*)(_t199 - 0x6f)) = 1;
					_t138 =  *_t197 >> 4;
					_t209 = _t138 & 0x00000001;
					if((_t138 & 0x00000001) == 0) {
						 *(_t199 - 0x10) = _t197[0] & 0x000000ff;
						 *(_t199 - 0x2c) = _t197[2];
						_t198 = E010DB06C(_t199 - 0x68);
						E010D705A(_t198,  *(_t199 - 0x10));
						__eflags =  *(_t199 - 0x10);
						if( *(_t199 - 0x10) != 0) {
							memcpy( *_t198,  *(_t199 - 0x2c),  *(_t199 - 0x10));
							_t202 = _t202 + 0xc;
						}
					} else {
						E010EB862(_t197[2], _t197[0] & 0x000000ff, _t209, _t199 - 0x68);
					}
					_push(_t199 - 0x98);
					E010ECA16(_t191 + 0x28);
					 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
					E010EBAEB(0, _t199 - 0x98);
					 *((intOrPtr*)(_t199 - 0x1c)) =  *((intOrPtr*)(_t199 - 0x1c)) + 1;
					 *(_t199 - 0x18) =  &(( *(_t199 - 0x18))[1]);
					_t210 =  *((intOrPtr*)(_t199 - 0x1c)) -  *0x11146a4; // 0x0
				} while (_t210 < 0);
				goto L11;
			}

0x010ebd4a
0x010ebd4f
0x010ebd58
0x010ebd5d
0x010ebd67
0x010ebd6a
0x010ebd6d
0x010ebd70
0x010ebd73
0x010ebd76
0x010ebd7c
0x010ebec4
0x010ebec7
0x010ebed8
0x010ebedf
0x010ebee7
0x010ebef0
0x010ebef8
0x010ebefa
0x010ebefe
0x010ebf06
0x010ebfda
0x010ebfdd
0x010ebfeb
0x010ebff3
0x010ebff3
0x010ebf0f
0x010ebf1a
0x010ebf1a
0x010ebf2f
0x010ebf32
0x010ebf36
0x010ebf3e
0x010ebf40
0x010ebf44
0x010ebf4c
0x00000000
0x010ebf52
0x010ebf62
0x010ebf65
0x010ebf69
0x010ebf71
0x010ebf73
0x010ebf77
0x010ebf7f
0x00000000
0x00000000
0x010ebf81
0x010ebf85
0x010ebf8a
0x010ebf99
0x010ebf99
0x010ebf9c
0x010ebf9f
0x010ebfd8
0x010ebfd8
0x00000000
0x010ebfd8
0x010ebfa4
0x010ebfa7
0x00000000
0x00000000
0x00000000
0x00000000
0x010ebfa9
0x010ebfa9
0x010ebfb4
0x010ebfb9
0x010ebfc1
0x010ebfc4
0x00000000
0x00000000
0x010ebfc7
0x010ebfcb
0x010ebff4
0x00000000
0x010ebff4
0x010ebfcd
0x010ebfcd
0x010ebfd0
0x010ebfd3
0x00000000
0x010ebfa9
0x010ebf8f
0x00000000
0x00000000
0x010ebf91
0x010ebf97
0x00000000
0x00000000
0x00000000
0x010ebf97
0x010ebf4c
0x010ebd82
0x010ebd89
0x010ebd92
0x010ebd94
0x010ebda2
0x010ebda5
0x010ebdb0
0x010ebdb9
0x010ebdc2
0x010ebdc8
0x010ebdd0
0x010ebdd4
0x010ebdd9
0x010ebddc
0x010ebde2
0x010ebde8
0x010ebde8
0x010ebded
0x010ebdf0
0x010ebdf2
0x010ebdf8
0x010ebdf8
0x010ebe06
0x010ebe0a
0x010ebe13
0x010ebe1b
0x010ebe1e
0x010ebe23
0x010ebe27
0x010ebe31
0x010ebe38
0x010ebe3b
0x010ebe41
0x010ebe44
0x010ebe46
0x010ebe5e
0x010ebe67
0x010ebe72
0x010ebe76
0x010ebe7b
0x010ebe7e
0x010ebe88
0x010ebe8d
0x010ebe8d
0x010ebe48
0x010ebe53
0x010ebe53
0x010ebe99
0x010ebe9a
0x010ebe9f
0x010ebea9
0x010ebeae
0x010ebeb1
0x010ebeb8
0x010ebeb8
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010EBD4A
memcpy.MSVCRT ref: 010EBE88
GetProcAddress.KERNEL32(00000000,SetCodecs), ref: 010EBFB9

Strings

Codecs\, xrefs: 010EBF1F
SetCodecs, xrefs: 010EBFAF
Net, xrefs: 010EBFB9
Formats\, xrefs: 010EBF52

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressH_prologProcmemcpy
String ID: Codecs\$Formats\$SetCodecs$Net
API String ID: 1477616095-2690590729
Opcode ID: 123b2aa8f2657d4a056d5398052a0dea5fec91155be04ad50f98f71df87ce5f7
Instruction ID: 7ab525e2ad732740a6a6d0127ac5dc651a21431da37e6a6024584edad875c5e1
Opcode Fuzzy Hash: 123b2aa8f2657d4a056d5398052a0dea5fec91155be04ad50f98f71df87ce5f7
Instruction Fuzzy Hash: F6918F3080024ADFCF25EFA9C994AEDFBF4BF24314F0445A9E099A3251DB316A89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010EBB2D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 107
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E010EBB2D(intOrPtr __ecx, intOrPtr* _a4, signed int _a8, signed int _a12) {
				intOrPtr* _v8;
				void* __ebp;
				signed char* _t40;
				signed int _t45;
				signed int _t47;
				signed int _t48;
				signed int _t51;
				signed int _t52;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t63;
				signed int _t66;
				signed int _t67;
				struct HINSTANCE__** _t85;
				intOrPtr _t89;

				_push(__ecx);
				_t40 = _a12;
				_t89 = __ecx;
				if(_t40 != 0) {
					 *_t40 =  *_t40 & 0x00000000;
				}
				_t93 = _a8;
				if(_a8 == 0) {
					L6:
					_t63 = _t89 + 0xc;
					_v8 = _t63;
					E010EC931(_t63);
					_t85 =  *( *_t63 +  *(_t63 + 4) * 4 - 4);
					_t15 =  &(_t85[1]); // 0x8
					E010D2A8C(_t15, _a4);
					_a8 = _a8 & 0x00000000;
					_t45 = E010D4A51(_t85, __eflags,  *_a4);
					__eflags = _t45;
					if(_t45 == 0) {
						L21:
						E010EC9F1(_t63);
						L22:
						_t47 = _a8;
						L23:
						return _t47;
					}
					_t48 = _a12;
					__eflags = _t48;
					if(_t48 != 0) {
						 *_t48 = 1;
					}
					__eflags =  *0x1114720;
					if( *0x1114720 != 0) {
						_t55 = GetProcAddress( *_t85, "SetLargePageMode");
						__eflags = _t55;
						if(_t55 != 0) {
							 *_t55();
						}
					}
					__eflags =  *((char*)(_t89 + 0x4c));
					if( *((char*)(_t89 + 0x4c)) != 0) {
						_t53 = GetProcAddress( *_t85, "SetCaseSensitive");
						__eflags = _t53;
						if(_t53 != 0) {
							__eflags =  *(_t89 + 0x4d);
							_t23 =  *(_t89 + 0x4d) != 0;
							__eflags = _t23;
							 *_t53(0 | _t23);
						}
					}
					_t85[4] = GetProcAddress( *_t85, "CreateObject");
					_t66 =  *(_t89 + 0x38);
					_a4 =  *((intOrPtr*)(_t89 + 0x44));
					_t51 = E010EB2E8(_t89); // executed
					_a8 = _t51;
					__eflags = _a4 + _t66 -  *(_t89 + 0x38) +  *((intOrPtr*)(_t89 + 0x44));
					_t67 = _t66 & 0xffffff00 | _a4 + _t66 !=  *(_t89 + 0x38) +  *((intOrPtr*)(_t89 + 0x44));
					__eflags = _t51;
					if(_t51 == 0) {
						__eflags = _t85[4] - _t51;
						if(_t85[4] != _t51) {
							_t52 = E010EB4D3(_t89); // executed
							__eflags =  *((intOrPtr*)(_t89 + 0x2c)) -  *((intOrPtr*)(_t89 + 0x2c));
							_a8 = _t52;
							if( *((intOrPtr*)(_t89 + 0x2c)) !=  *((intOrPtr*)(_t89 + 0x2c))) {
								_t67 = 1;
							}
						}
					}
					__eflags = _t67;
					if(_t67 != 0) {
						goto L22;
					} else {
						_t63 = _v8;
						goto L21;
					}
				}
				_a8 = _a8 & 0x00000000;
				if(E010D4A26( &_a8, _t93,  *_a4, 2) != 0) {
					E010D4A07( &_a8);
					goto L6;
				} else {
					E010D4A07( &_a8);
					_t47 = 0;
					goto L23;
				}
			}

0x010ebb30
0x010ebb31
0x010ebb37
0x010ebb39
0x010ebb3b
0x010ebb3b
0x010ebb3e
0x010ebb42
0x010ebb70
0x010ebb71
0x010ebb77
0x010ebb7a
0x010ebb87
0x010ebb8b
0x010ebb8e
0x010ebb96
0x010ebb9e
0x010ebba3
0x010ebba5
0x010ebc44
0x010ebc46
0x010ebc4b
0x010ebc4b
0x010ebc50
0x010ebc52
0x010ebc52
0x010ebbab
0x010ebbae
0x010ebbb0
0x010ebbb2
0x010ebbb2
0x010ebbb5
0x010ebbc2
0x010ebbcb
0x010ebbcd
0x010ebbcf
0x010ebbd1
0x010ebbd1
0x010ebbcf
0x010ebbd3
0x010ebbd7
0x010ebbe0
0x010ebbe2
0x010ebbe4
0x010ebbe8
0x010ebbeb
0x010ebbeb
0x010ebbef
0x010ebbef
0x010ebbe4
0x010ebbfa
0x010ebc00
0x010ebc05
0x010ebc08
0x010ebc18
0x010ebc1b
0x010ebc1d
0x010ebc20
0x010ebc22
0x010ebc24
0x010ebc27
0x010ebc2e
0x010ebc33
0x010ebc36
0x010ebc39
0x010ebc3b
0x010ebc3b
0x010ebc39
0x010ebc27
0x010ebc3d
0x010ebc3f
0x00000000
0x010ebc41
0x010ebc41
0x00000000
0x010ebc41
0x010ebc3f
0x010ebb47
0x010ebb5d
0x010ebb6b
0x00000000
0x010ebb5f
0x010ebb5f
0x010ebb64
0x00000000
0x010ebb64

APIs

Part of subcall function 010D4A07: FreeLibrary.KERNELBASE(00000000,00000004,010D4A59,?,010EBBA3,00000000,00000000,?,00000000,00000000,?,?,010EBEF5,00000000,00000000,?), ref: 010D4A11

Part of subcall function 010EC931: __EH_prolog.LIBCMT ref: 010EC936

Part of subcall function 010D4A51: LoadLibraryW.KERNELBASE(00000000,?,010EBBA3,00000000,00000000,?,00000000,00000000,?,?,010EBEF5,00000000,00000000,?), ref: 010D4A61

GetProcAddress.KERNEL32(00000004,SetLargePageMode), ref: 010EBBCB
GetProcAddress.KERNEL32(00000004,SetCaseSensitive), ref: 010EBBE0
GetProcAddress.KERNEL32(00000004,CreateObject), ref: 010EBBF8

Strings

SetLargePageMode, xrefs: 010EBBC4
SetCaseSensitive, xrefs: 010EBBD9
Net, xrefs: 010EBBBC
CreateObject, xrefs: 010EBBF1

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc$Library$FreeH_prologLoad
String ID: CreateObject$SetCaseSensitive$SetLargePageMode$Net
API String ID: 1090236637-2353921683
Opcode ID: 150b7d5a1fd4bd01eafe80345cb3a2b4d17f5819b13c2a318a99a33f1d6108fc
Instruction ID: 54b0628f77cdf71fc5e68959e2379cc14187ae5e085a128a2313d6ddf0240767
Opcode Fuzzy Hash: 150b7d5a1fd4bd01eafe80345cb3a2b4d17f5819b13c2a318a99a33f1d6108fc
Instruction Fuzzy Hash: 8341B330200346AFDF25DF2AC894BAE7BE1AF54244F048469E9968B685DB71E950CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010D5D00 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 350
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E010D5D00(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				signed int _t155;
				signed int _t156;
				intOrPtr _t157;
				signed int _t158;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed char _t167;
				signed int _t174;
				intOrPtr _t181;
				intOrPtr _t182;
				signed int _t186;
				intOrPtr _t189;
				signed int _t190;
				signed int _t204;
				signed int _t208;
				signed int _t215;
				intOrPtr _t216;
				signed int _t220;
				signed int _t231;
				signed char _t232;
				signed int _t233;
				void* _t235;
				intOrPtr* _t236;
				intOrPtr* _t242;
				void* _t253;
				signed int _t279;
				intOrPtr* _t298;
				long _t300;
				intOrPtr* _t302;
				intOrPtr* _t304;
				void* _t305;

				E011039E0(E0110460C, _t305);
				_t298 =  *((intOrPtr*)(_t305 + 8));
				_t302 = __ecx;
				if(E010D7168(_t298) == 0) {
					_t231 = E010D73D8(_t298, __eflags);
					__eflags = _t231;
					if(_t231 < 0) {
						L39:
						 *(_t305 - 0x10) =  *(_t305 - 0x10) | 0xffffffff;
						 *(_t305 - 4) = 6;
						_t232 = 0;
						_t155 = E010D730C(_t298);
						__eflags = _t155;
						if(_t155 != 0) {
							_t232 = 4;
						}
						 *((intOrPtr*)(_t305 + 8)) = _t298 + _t232 * 2;
						_t156 = E010D70D8(_t298 + _t232 * 2);
						__eflags = _t156;
						if(_t156 == 0) {
							L48:
							_t157 =  *_t298;
							__eflags = _t157 - 0x5c;
							if(_t157 == 0x5c) {
								L50:
								__eflags =  *((short*)(_t298 + 2));
								_t242 = _t298;
								if( *((short*)(_t298 + 2)) != 0) {
									_t158 = E010D7286(_t242);
									__eflags = _t158;
									if(__eflags <= 0) {
										goto L65;
									}
									__eflags =  *((short*)(_t298 + _t158 * 2));
									_t246 = _t298 + _t158 * 2;
									 *((intOrPtr*)(_t305 - 0x14)) = _t298 + _t158 * 2;
									if(__eflags == 0) {
										goto L65;
									}
									__eflags = E010D7090(_t246);
									if(__eflags >= 0) {
										goto L65;
									}
									E010D292C(_t305 - 0x44, _t298);
									 *(_t305 - 4) = 7;
									E010D1089(_t305 - 0x44, 0x5c);
									E010D1089(_t305 - 0x44, 0x2a);
									 *(_t305 + 0xb) =  *(_t305 + 0xb) & 0x00000000;
									_push(_t302);
									_push( *((intOrPtr*)(_t305 - 0x44)));
									_t166 = E010D58CD(_t232, _t305 - 0x10, _t298, __eflags);
									__eflags = _t166;
									if(_t166 == 0) {
										L61:
										_t167 = E010D5C83(_t298);
										__eflags =  *(_t305 + 0xb);
										_t232 = _t167;
										if( *(_t305 + 0xb) != 0) {
											L69:
											E010D5C60(_t302);
											__eflags = _t232 - 0xffffffff;
											if(_t232 == 0xffffffff) {
												 *(_t302 + 0x20) = 0x10;
											} else {
												 *(_t302 + 0x20) = _t232;
											}
											_push( *((intOrPtr*)(_t305 - 0x14)));
											_t253 = _t302 + 0x28;
											L73:
											E010D1ABD(E010D2A28(_t253),  *((intOrPtr*)(_t305 - 0x44)));
											E010D58AD(_t305 - 0x10);
											L74:
											_t161 = 1;
											goto L68;
										}
										__eflags = _t232 - 0xffffffff;
										if(__eflags == 0) {
											L64:
											 *(_t305 - 4) = 6;
											E010D1ABD(_t167,  *((intOrPtr*)(_t305 - 0x44)));
											goto L65;
										}
										__eflags = _t232 & 0x00000010;
										if(__eflags != 0) {
											goto L69;
										}
										goto L64;
									}
									_t235 = _t302 + 0x28;
									_t174 = wcscmp( *(_t302 + 0x28), ".");
									__eflags = _t174;
									if(_t174 != 0) {
										 *(_t305 + 0xb) = 1;
										goto L61;
									}
									_push( *((intOrPtr*)(_t305 - 0x14)));
									_t253 = _t235;
									goto L73;
								}
								_t232 = E010D5C83(_t242);
								__eflags = _t232 - 0xffffffff;
								if(__eflags == 0) {
									goto L65;
								}
								__eflags = _t232 & 0x00000010;
								if(__eflags == 0) {
									goto L65;
								}
								E010D5C60(_t302);
								 *(_t302 + 0x2c) =  *(_t302 + 0x2c) & 0x00000000;
								 *( *(_t302 + 0x28)) =  *( *(_t302 + 0x28)) & 0x00000000;
								 *(_t302 + 0x20) = _t232;
								goto L47;
							}
							__eflags = _t157 - 0x2f;
							if(__eflags != 0) {
								goto L65;
							}
							goto L50;
						} else {
							__eflags =  *((short*)(_t298 + 6 + _t232 * 2));
							if( *((short*)(_t298 + 6 + _t232 * 2)) != 0) {
								goto L48;
							}
							_t232 = E010D5C83(_t298);
							__eflags = _t232 - 0xffffffff;
							if(__eflags == 0) {
								L65:
								_push(_t302);
								_push(_t298);
								_t159 = E010D58CD(_t232, _t305 - 0x10, _t298, __eflags); // executed
								_t233 = _t159;
								L66:
								E010D58AD(_t305 - 0x10);
								L67:
								_t161 = _t233;
								L68:
								 *[fs:0x0] =  *((intOrPtr*)(_t305 - 0xc));
								return _t161;
							}
							__eflags = _t232 & 0x00000010;
							if(__eflags == 0) {
								goto L65;
							}
							E010D5C60(_t302);
							 *(_t302 + 0x20) = _t232;
							_t304 = _t302 + 0x28;
							E010D2A28(_t304,  *((intOrPtr*)(_t305 + 8)));
							_t181 = 2;
							__eflags =  *((intOrPtr*)(_t304 + 4)) - _t181;
							if( *((intOrPtr*)(_t304 + 4)) > _t181) {
								 *((intOrPtr*)(_t304 + 4)) = _t181;
								_t182 =  *_t304;
								_t111 = _t182 + 4;
								 *_t111 =  *(_t182 + 4) & 0x00000000;
								__eflags =  *_t111;
							}
							L47:
							_t233 = 1;
							goto L66;
						}
					}
					__eflags =  *((short*)(_t298 + 2 + _t231 * 2));
					if( *((short*)(_t298 + 2 + _t231 * 2)) == 0) {
						goto L39;
					}
					E010D292C(_t305 - 0x2c, _t298 + _t231 * 2);
					 *(_t305 - 4) = 1;
					E010D292C(_t305 - 0x38, _t298);
					__eflags = _t231 -  *(_t305 - 0x34);
					 *(_t305 - 4) = 2;
					if(_t231 <  *(_t305 - 0x34)) {
						_t216 =  *((intOrPtr*)(_t305 - 0x38));
						 *(_t305 - 0x34) = _t231;
						_t40 = _t216 + _t231 * 2;
						 *_t40 =  *(_t216 + _t231 * 2) & 0x00000000;
						__eflags =  *_t40;
					}
					_t186 =  *(_t305 - 0x28);
					__eflags = _t186 - 6;
					if(_t186 <= 6) {
						L17:
						E010D2CAD(_t305 - 0x2c, ":$DATA");
						goto L18;
					} else {
						_t215 = E010D20D0( *((intOrPtr*)(_t305 - 0x2c)) + _t186 * 2 - 0xc, ":$DATA");
						__eflags = _t215;
						if(_t215 != 0) {
							L18:
							__eflags = E010D72E3( *((intOrPtr*)(_t305 - 0x38)));
							_t189 =  *((intOrPtr*)(_t305 - 0x38));
							if(__eflags == 0) {
								L24:
								_t190 = E010D5D00(_t302, __eflags, _t189);
								__eflags = _t190;
								if(_t190 == 0) {
									E010D1ABD(E010D1ABD(_t190,  *((intOrPtr*)(_t305 - 0x38))),  *((intOrPtr*)(_t305 - 0x2c)));
									goto L39;
								}
								_t300 = 0;
								__eflags = 0;
								L26:
								 *(_t302 + 0x20) =  *(_t302 + 0x20) & 0x0000fbef;
								_t59 = _t305 - 0x60;
								 *_t59 =  *(_t305 - 0x60) | 0xffffffff;
								__eflags =  *_t59;
								 *_t302 = _t300;
								 *((intOrPtr*)(_t302 + 4)) = _t300;
								 *(_t305 - 4) = 3;
								E010D29BC(_t305 - 0x5c,  *_t59, _t305 - 0x38);
								 *(_t305 - 4) = 4;
								E010D28E9(_t305 - 0x50);
								while(1) {
									_push(_t305 + 0xb);
									 *(_t305 - 4) = 5;
									_t198 = E010D5C20(_t305 - 0x60, _t305, _t305 - 0x50);
									__eflags = _t198;
									if(_t198 == 0) {
										break;
									}
									__eflags =  *(_t305 + 0xb);
									if( *(_t305 + 0xb) == 0) {
										SetLastError(2);
										break;
									}
									_t204 = E010D1FD4( *((intOrPtr*)(_t305 - 0x50)),  *((intOrPtr*)(_t305 - 0x2c)));
									__eflags = _t204;
									if(_t204 != 0) {
										_t279 =  *(_t305 - 0x4c);
										__eflags = _t279 - 7;
										if(__eflags > 0) {
											_t78 = _t279 - 6; // 0xfde3
											_t208 = _t78;
											__eflags = _t208 - _t279;
											if(__eflags < 0) {
												 *(_t305 - 0x4c) = _t208;
												 *((short*)( *((intOrPtr*)(_t305 - 0x50)) + _t208 * 2)) = _t300;
											}
										}
										E010D2C71(_t302 + 0x28, __eflags, _t305 - 0x50);
										 *((char*)(_t302 + 0x24)) = 1;
										 *_t302 =  *((intOrPtr*)(_t305 - 0x40));
										_t198 =  *((intOrPtr*)(_t305 - 0x3c));
										 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t305 - 0x3c));
										_t233 = 1;
										L37:
										E010D1ABD(E010D1ABD(_t198,  *((intOrPtr*)(_t305 - 0x50))),  *((intOrPtr*)(_t305 - 0x5c)));
										E010D1ABD(E010D1ABD(E010D58AD(_t305 - 0x60),  *((intOrPtr*)(_t305 - 0x38))),  *((intOrPtr*)(_t305 - 0x2c)));
										goto L67;
									}
									 *(_t305 - 4) = 4;
									E010D1ABD(_t204,  *((intOrPtr*)(_t305 - 0x50)));
									E010D28E9(_t305 - 0x50);
								}
								_t233 = 0;
								goto L37;
							}
							__eflags = _t231 - 2;
							if(_t231 == 2) {
								L22:
								E010D5C60(_t302);
								_t285 = _t302 + 0x28;
								_t300 = 0;
								__eflags = _t231 - 2;
								 *((intOrPtr*)(_t302 + 0x2c)) = 0;
								 *( *(_t302 + 0x28)) = 0;
								if(_t231 == 2) {
									E010D2A8C(_t285, _t305 - 0x38);
								}
								goto L26;
							}
							__eflags = _t231 - 3;
							if(__eflags != 0) {
								goto L24;
							}
							__eflags =  *((short*)(_t189 + 4)) - 0x5c;
							if(__eflags != 0) {
								goto L24;
							}
							goto L22;
						}
						goto L17;
					}
				}
				E010D5C60(__ecx);
				_t2 = _t298 + 8; // 0x9
				_t236 = _t2;
				E010D2A28(__ecx + 0x28, _t236);
				 *((char*)(__ecx + 0x25)) = 1;
				if(E010D72E3(_t236) == 0 ||  *((short*)(_t298 + 0xc)) != 0) {
					L5:
					 *(_t305 - 0x60) =  *(_t305 - 0x60) | 0xffffffff;
					 *(_t305 - 4) =  *(_t305 - 4) & 0x00000000;
					_t220 = E010D68C6(_t298);
					__eflags = _t220;
					if(_t220 != 0) {
						__eflags =  *((char*)(_t305 - 0x5b));
						if( *((char*)(_t305 - 0x5b)) != 0) {
							 *_t302 =  *((intOrPtr*)(_t305 - 0x58));
							 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t305 - 0x54));
						}
						_t233 = 1;
					} else {
						_t233 = 0;
					}
					E010D6497(_t305 - 0x60);
					goto L67;
				} else {
					 *(_t305 - 0x12) =  *(_t305 - 0x12) & 0x00000000;
					 *((short*)(_t305 - 0x18)) =  *_t236;
					 *((short*)(_t305 - 0x16)) = 0x3a;
					 *((short*)(_t305 - 0x14)) = 0x5c;
					if(E010D7DF4(_t305 - 0x18, _t305 - 0x34, _t305 - 0x20, _t305 - 0x28) == 0) {
						goto L5;
					} else {
						 *__ecx =  *((intOrPtr*)(_t305 - 0x20));
						 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t305 - 0x1c));
						goto L74;
					}
				}
			}

0x010d5d05
0x010d5d10
0x010d5d13
0x010d5d1e
0x010d5dcc
0x010d5dce
0x010d5dd0
0x010d5f87
0x010d5f87
0x010d5f8d
0x010d5f94
0x010d5f96
0x010d5f9b
0x010d5f9d
0x010d5fa1
0x010d5fa1
0x010d5fa5
0x010d5fa8
0x010d5fad
0x010d5faf
0x010d6004
0x010d6004
0x010d6007
0x010d600b
0x010d6017
0x010d6017
0x010d601c
0x010d601e
0x010d6050
0x010d6055
0x010d6057
0x00000000
0x00000000
0x010d605d
0x010d6062
0x010d6065
0x010d6068
0x00000000
0x00000000
0x010d6073
0x010d6075
0x00000000
0x00000000
0x010d607b
0x010d6085
0x010d6089
0x010d6093
0x010d6098
0x010d609c
0x010d609d
0x010d60a3
0x010d60a8
0x010d60aa
0x010d60cf
0x010d60d1
0x010d60d6
0x010d60da
0x010d60dc
0x010d611c
0x010d611e
0x010d6123
0x010d6126
0x010d612d
0x010d6128
0x010d6128
0x010d6128
0x010d6134
0x010d6137
0x010d613a
0x010d6142
0x010d614b
0x010d6150
0x010d6150
0x00000000
0x010d6150
0x010d60de
0x010d60e1
0x010d60e8
0x010d60eb
0x010d60ef
0x00000000
0x010d60f4
0x010d60e3
0x010d60e6
0x00000000
0x00000000
0x00000000
0x010d60e6
0x010d60af
0x010d60b8
0x010d60bf
0x010d60c2
0x010d60cb
0x00000000
0x010d60cb
0x010d60c4
0x010d60c7
0x00000000
0x010d60c7
0x010d6025
0x010d6027
0x010d602a
0x00000000
0x00000000
0x010d6030
0x010d6033
0x00000000
0x00000000
0x010d603b
0x010d6043
0x010d6047
0x010d604b
0x00000000
0x010d604b
0x010d600d
0x010d6011
0x00000000
0x00000000
0x00000000
0x010d5fb1
0x010d5fb1
0x010d5fb7
0x00000000
0x00000000
0x010d5fc0
0x010d5fc2
0x010d5fc5
0x010d60f5
0x010d60f5
0x010d60f6
0x010d60fa
0x010d60ff
0x010d6101
0x010d6104
0x010d6109
0x010d6109
0x010d610b
0x010d6111
0x010d6119
0x010d6119
0x010d5fcb
0x010d5fce
0x00000000
0x00000000
0x010d5fd6
0x010d5fde
0x010d5fe1
0x010d5fe6
0x010d5fed
0x010d5fee
0x010d5ff1
0x010d5ff3
0x010d5ff6
0x010d5ff8
0x010d5ff8
0x010d5ff8
0x010d5ff8
0x010d5ffd
0x010d5ffd
0x00000000
0x010d5ffd
0x010d5faf
0x010d5dd6
0x010d5ddc
0x00000000
0x00000000
0x010d5de9
0x010d5df2
0x010d5df9
0x010d5dfe
0x010d5e01
0x010d5e05
0x010d5e07
0x010d5e0a
0x010d5e0d
0x010d5e0d
0x010d5e0d
0x010d5e0d
0x010d5e12
0x010d5e15
0x010d5e18
0x010d5e2f
0x010d5e37
0x00000000
0x010d5e1a
0x010d5e26
0x010d5e2b
0x010d5e2d
0x010d5e3c
0x010d5e44
0x010d5e46
0x010d5e49
0x010d5e81
0x010d5e84
0x010d5e89
0x010d5e8b
0x010d5f80
0x00000000
0x010d5f86
0x010d5e91
0x010d5e91
0x010d5e93
0x010d5e93
0x010d5e99
0x010d5e99
0x010d5e99
0x010d5e9d
0x010d5e9f
0x010d5ea9
0x010d5ead
0x010d5eb5
0x010d5eb9
0x010d5ebe
0x010d5ec4
0x010d5ec9
0x010d5ecd
0x010d5ed2
0x010d5ed4
0x00000000
0x00000000
0x010d5ed6
0x010d5eda
0x010d5f04
0x00000000
0x010d5f04
0x010d5ee2
0x010d5ee7
0x010d5ee9
0x010d5f0e
0x010d5f11
0x010d5f14
0x010d5f16
0x010d5f16
0x010d5f19
0x010d5f1b
0x010d5f20
0x010d5f23
0x010d5f23
0x010d5f1b
0x010d5f2e
0x010d5f36
0x010d5f3a
0x010d5f3c
0x010d5f3f
0x010d5f42
0x010d5f44
0x010d5f4f
0x010d5f69
0x00000000
0x010d5f6f
0x010d5eee
0x010d5ef2
0x010d5efb
0x010d5efb
0x010d5f0a
0x00000000
0x010d5f0a
0x010d5e4b
0x010d5e4e
0x010d5e5c
0x010d5e5e
0x010d5e66
0x010d5e69
0x010d5e6b
0x010d5e6e
0x010d5e71
0x010d5e74
0x010d5e7a
0x010d5e7a
0x00000000
0x010d5e74
0x010d5e50
0x010d5e53
0x00000000
0x00000000
0x010d5e55
0x010d5e5a
0x00000000
0x00000000
0x00000000
0x010d5e5a
0x00000000
0x010d5e2d
0x010d5e18
0x010d5d26
0x010d5d2b
0x010d5d2b
0x010d5d32
0x010d5d39
0x010d5d44
0x010d5d8c
0x010d5d8c
0x010d5d90
0x010d5d98
0x010d5d9d
0x010d5d9f
0x010d5da5
0x010d5da9
0x010d5dae
0x010d5db3
0x010d5db3
0x010d5db6
0x010d5da1
0x010d5da1
0x010d5da1
0x010d5dbb
0x00000000
0x010d5d4d
0x010d5d50
0x010d5d55
0x010d5d67
0x010d5d6d
0x010d5d7a
0x00000000
0x010d5d7c
0x010d5d7f
0x010d5d84
0x00000000
0x010d5d84
0x010d5d7a

APIs

__EH_prolog.LIBCMT ref: 010D5D05
SetLastError.KERNEL32(00000002,?,00000000,00000001,:$DATA,00000001,00000000,00000001), ref: 010D5F04

Part of subcall function 010D7DF4: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,74651190,000000FF,00000000,?,?,?,?,?,?,?,?,?,010D6787,00000001), ref: 010D7E10
Part of subcall function 010D7DF4: GetProcAddress.KERNEL32(00000000), ref: 010D7E17
Part of subcall function 010D7DF4: GetDiskFreeSpaceW.KERNEL32(00000001,010D6787,?,?,?,?,?,?,?,?,?,?,?,?,010D6787,00000001), ref: 010D7E67

Strings

\, xrefs: 010D5D6D
:, xrefs: 010D5D67
:$DATA, xrefs: 010D5E1D, 010D5E2F

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressDiskErrorFreeH_prologHandleLastModuleProcSpace
String ID: :$:$DATA$\
API String ID: 3991446108-1004618218
Opcode ID: 2a6868d98a4fe2f5b24d2e6d46ebc37bff4c68579e404f2fcf9a01ba63fd4f44
Instruction ID: 32bda70e7127d470db870e0f8558de21096bbdca3d875ecf9af90acd979032d1
Opcode Fuzzy Hash: 2a6868d98a4fe2f5b24d2e6d46ebc37bff4c68579e404f2fcf9a01ba63fd4f44
Instruction Fuzzy Hash: 70D1C13090030ADEDF25EFA8C884BEEBBF1AF24314F148159E8D66B2D1DB725949CB11

Uniqueness

Uniqueness Score: -1.00%

Function 01103DB6 Relevance: 10.6, APIs: 7, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 63%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				int _v32;
				char** _v36;
				int _v40;
				void _v44;
				char** _v48;
				intOrPtr _v52;
				intOrPtr* _t18;
				intOrPtr* _t19;
				void* _t22;
				void _t24;
				int _t31;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t39;
				intOrPtr _t47;

				_push(0xffffffff);
				_push(0x110ce40);
				_push(0x1103db0);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t47;
				_v28 = _t47 - 0x20;
				_v8 = _v8 & 0x00000000;
				__set_app_type(1);
				 *0x1116748 =  *0x1116748 | 0xffffffff;
				 *0x111674c =  *0x111674c | 0xffffffff;
				_t18 = __p__fmode();
				_t35 =  *0x1114730; // 0x0
				 *_t18 = _t35;
				_t19 = __p__commode();
				_t36 =  *0x111472c; // 0x0
				 *_t19 = _t36;
				 *0x1116744 = _adjust_fdiv;
				_t22 = E01103EF9( *_adjust_fdiv);
				_t50 =  *0x1114420;
				if( *0x1114420 == 0) {
					__setusermatherr(E01103EF6);
				}
				E01103EE4(_t22);
				_push(0x1114034);
				_push(0x1114030);
				L01103EDE();
				_t24 =  *0x1114728; // 0x0
				_v44 = _t24;
				__getmainargs( &_v32,  &_v48,  &_v36,  *0x1114724,  &_v44);
				_push(0x111402c);
				_push(0x1114000);
				L01103EDE();
				 *(__p___initenv()) = _v36;
				_push(_v36);
				_push(_v48);
				_push(_v32);
				_t31 = L011012EF(_t50); // executed
				_v40 = _t31;
				exit(_t31); // executed
				_t32 = _v24;
				_t39 =  *((intOrPtr*)( *_t32));
				_v52 = _t39;
				_push(_t32);
				_push(_t39);
				L01103ED8();
				return _t32;
			}

0x01103db9
0x01103dbb
0x01103dc0
0x01103dcb
0x01103dcc
0x01103dd9
0x01103ddc
0x01103de2
0x01103de9
0x01103df0
0x01103df7
0x01103dfd
0x01103e03
0x01103e05
0x01103e0b
0x01103e11
0x01103e1a
0x01103e1f
0x01103e24
0x01103e2b
0x01103e32
0x01103e38
0x01103e39
0x01103e3e
0x01103e43
0x01103e48
0x01103e4d
0x01103e52
0x01103e6b
0x01103e71
0x01103e76
0x01103e7b
0x01103e89
0x01103e8b
0x01103e8e
0x01103e91
0x01103e94
0x01103e9c
0x01103ea0
0x01103ea6
0x01103eab
0x01103ead
0x01103eb0
0x01103eb1
0x01103eb2
0x01103eb9

APIs

__set_app_type.MSVCRT ref: 01103DE2
__p__fmode.MSVCRT ref: 01103DF7
__p__commode.MSVCRT ref: 01103E05
_initterm.MSVCRT ref: 01103E48
__getmainargs.MSVCRT ref: 01103E6B
_initterm.MSVCRT ref: 01103E7B
__p___initenv.MSVCRT ref: 01103E80

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: _initterm$__getmainargs__p___initenv__p__commode__p__fmode__set_app_type
String ID:
API String ID: 4012487245-0
Opcode ID: 88401550b9a786e1b8a8e50272006b9fcf30f158d4ac3b7051e085da3e4616b5
Instruction ID: aa3189955bf47d63a6b57a4a38c0a94553a9e8910c7ade549541240a9ebd815d
Opcode Fuzzy Hash: 88401550b9a786e1b8a8e50272006b9fcf30f158d4ac3b7051e085da3e4616b5
Instruction Fuzzy Hash: 11210E71D04705EFCB2E9FA5D949F9ABBB4FB0D725F000229E131A2698D7B55880CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01103E2D Relevance: 10.5, APIs: 7, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E01103E2D() {
				void* _t13;
				void _t15;
				int _t22;
				intOrPtr* _t23;
				intOrPtr _t27;
				void* _t30;
				void* _t33;

				__setusermatherr(E01103EF6);
				E01103EE4(_t13);
				_push(0x1114034);
				_push(0x1114030);
				L01103EDE();
				_t15 =  *0x1114728; // 0x0
				 *(_t30 - 0x28) = _t15;
				__getmainargs(_t30 - 0x1c, _t30 - 0x2c, _t30 - 0x20,  *0x1114724, _t30 - 0x28);
				_push(0x111402c);
				_push(0x1114000);
				L01103EDE();
				 *(__p___initenv()) =  *(_t30 - 0x20);
				_push( *(_t30 - 0x20));
				_push( *(_t30 - 0x2c));
				_push( *(_t30 - 0x1c));
				_t22 = L011012EF(_t33); // executed
				 *(_t30 - 0x24) = _t22;
				exit(_t22); // executed
				_t23 =  *((intOrPtr*)(_t30 - 0x14));
				_t27 =  *((intOrPtr*)( *_t23));
				 *((intOrPtr*)(_t30 - 0x30)) = _t27;
				_push(_t23);
				_push(_t27);
				L01103ED8();
				return _t23;
			}

0x01103e32
0x01103e39
0x01103e3e
0x01103e43
0x01103e48
0x01103e4d
0x01103e52
0x01103e6b
0x01103e71
0x01103e76
0x01103e7b
0x01103e89
0x01103e8b
0x01103e8e
0x01103e91
0x01103e94
0x01103e9c
0x01103ea0
0x01103ea6
0x01103eab
0x01103ead
0x01103eb0
0x01103eb1
0x01103eb2
0x01103eb9

APIs

__setusermatherr.MSVCRT ref: 01103E32

Part of subcall function 01103EE4: _controlfp.MSVCRT ref: 01103EEE

_initterm.MSVCRT ref: 01103E48
__getmainargs.MSVCRT ref: 01103E6B
_initterm.MSVCRT ref: 01103E7B
__p___initenv.MSVCRT ref: 01103E80
exit.KERNELBASE ref: 01103EA0
_XcptFilter.MSVCRT ref: 01103EB2

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: _initterm$FilterXcpt__getmainargs__p___initenv__setusermatherr_controlfpexit
String ID:
API String ID: 279829931-0
Opcode ID: cdfaa123fcd16481cdc6cb793b47895fa2335144b46ca895e45d24118a3f18e3
Instruction ID: 66e72bc91eceb5f0f18c3f79e90ae137b0cc1ded03dc37d81b32984ebb864449
Opcode Fuzzy Hash: cdfaa123fcd16481cdc6cb793b47895fa2335144b46ca895e45d24118a3f18e3
Instruction Fuzzy Hash: 4C014CB1D04209AFCF1EEFE1D849CEEBBB8FF0C7147100129E521A6294DBB59840CB20

Uniqueness

Uniqueness Score: -1.00%

Function 010E8549 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E010E8549(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				intOrPtr _t109;
				signed int _t120;
				void* _t135;
				void* _t141;
				void* _t148;
				signed char _t155;
				void* _t158;
				signed int _t168;
				signed int _t185;
				intOrPtr* _t213;
				signed int _t218;
				signed int _t219;
				signed int _t224;
				void* _t227;

				E011039E0(E0110592B, _t227);
				_push(__ebx);
				E010F801B(_t227 - 0x30);
				_t162 = 0;
				 *(_t227 - 4) = 0;
				E010E711F(_t227 - 0xdc); // executed
				 *((intOrPtr*)(_t227 - 0x44)) =  *((intOrPtr*)(_t227 + 0x18));
				_push(_t227 - 0xdc);
				_push( *((intOrPtr*)(_t227 + 8)));
				 *(_t227 - 4) = 1;
				_t109 = E010E7410(__ecx, __edx); // executed
				_t168 = 0xc;
				 *((intOrPtr*)(_t227 + 0x18)) = _t109;
				memcpy( *(_t227 + 0x14), _t227 - 0xa4, _t168 << 2);
				if(_t109 == 0) {
					_t218 = 0;
					__eflags =  *(_t227 - 0xb4);
					if( *(_t227 - 0xb4) > 0) {
						do {
							_t155 =  *( *((intOrPtr*)( *((intOrPtr*)(_t227 - 0xb8)) + _t218 * 4)) + 0x3c) >> 4;
							__eflags = _t155 & 0x00000001;
							if((_t155 & 0x00000001) == 0) {
								_push(E010E7072(_t227 - 0xdc, _t227 - 0x24, _t218));
								 *(_t227 - 4) = 2;
								_t158 = E010D150C(_t227 - 0x30);
								 *(_t227 - 4) = 1;
								E010D1ABD(_t158,  *(_t227 - 0x24));
							}
							_t218 = _t218 + 1;
							__eflags = _t218 -  *(_t227 - 0xb4);
						} while (_t218 <  *(_t227 - 0xb4));
					}
					 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
					L17();
					__eflags =  *((intOrPtr*)(_t227 - 0x2c)) - _t162;
					if(__eflags == 0) {
						_push(_t162);
						_push( *0x1109754);
						E010E8A22(_t227 - 0x24, __eflags);
						_push(0x110ded0);
						_push(_t227 - 0x24);
						L01103CAC();
					}
					E010F801B(_t227 - 0x3c);
					_t219 = 0;
					__eflags =  *((intOrPtr*)(_t227 - 0x2c)) - _t162;
					 *(_t227 - 4) = 3;
					if(__eflags > 0) {
						do {
							E010D28E9(_t227 - 0x24);
							 *(_t227 - 4) = 4;
							E010D555E( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t227 - 0x30)) + _t219 * 4)))), _t227 - 0x24);
							_push(_t227 - 0x24);
							_t148 = E010D150C(_t227 - 0x3c);
							 *(_t227 - 4) = 3;
							E010D1ABD(_t148,  *(_t227 - 0x24));
							_t219 = _t219 + 1;
							__eflags = _t219 -  *((intOrPtr*)(_t227 - 0x2c));
						} while (__eflags < 0);
					}
					 *(_t227 - 0x18) = _t162;
					 *(_t227 - 0x14) = _t162;
					 *(_t227 - 0x10) = _t162;
					 *(_t227 - 4) = 5;
					E010F411F(_t227 - 0x3c, _t227 - 0x18, __eflags);
					E010EC900( *((intOrPtr*)(_t227 + 0xc)));
					E010DB092( *((intOrPtr*)(_t227 + 0xc)),  *(_t227 - 0x14));
					_t213 =  *((intOrPtr*)(_t227 + 0x10));
					E010EC900(_t213);
					_t116 = E010DB092(_t213,  *(_t227 - 0x14));
					__eflags =  *(_t227 - 0x14);
					if( *(_t227 - 0x14) <= 0) {
						L14:
						E010D1ABD(_t116,  *(_t227 - 0x18));
						 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
						E010E8B2E(_t162, _t227 - 0x3c);
						 *(_t227 - 4) =  *(_t227 - 4) | 0xffffffff;
						E010E8B2E(_t162, _t227 - 0x30);
						_t120 = 0;
						__eflags = 0;
						goto L15;
					} else {
						do {
							_t224 =  *( *(_t227 - 0x18) + _t162 * 4) << 2;
							_push( *((intOrPtr*)(_t224 +  *((intOrPtr*)(_t227 - 0x30)))));
							E010E8ABA( *((intOrPtr*)(_t227 + 0xc)));
							_push( *((intOrPtr*)(_t224 +  *((intOrPtr*)(_t227 - 0x3c)))));
							_t116 = E010E8ABA(_t213);
							__eflags = _t162;
							if(_t162 <= 0) {
								goto L13;
							} else {
								__eflags = E010D3721( *((intOrPtr*)( *((intOrPtr*)( *_t213 + _t162 * 4 - 4)))));
								if(__eflags == 0) {
									_t185 = _t227 - 0x24;
									_push( *((intOrPtr*)( *((intOrPtr*)( *_t213 + _t162 * 4)))));
									_push("Duplicate archive path:");
									E010E8A22(_t185, __eflags);
									_push(0x110ded0);
									_push(_t227 - 0x24);
									L01103CAC();
									_t135 = E011039E0(E01105961, _t227);
									_push(_t185);
									_push(_t224);
									_t225 = _t185;
									 *(_t227 - 0x10) = _t185;
									 *(_t227 - 4) = 3;
									E010D1ABD(_t135,  *((intOrPtr*)(_t185 + 0x8c)));
									E010E71E4(_t225 + 0x68);
									 *(_t227 - 4) = 2;
									E010D1ABD(E010D1ABD(E010E8C1C(_t162, _t225 + 0x24),  *((intOrPtr*)(_t225 + 0x18))),  *((intOrPtr*)(_t225 + 0xc)));
									_t100 = _t227 - 4;
									 *_t100 =  *(_t227 - 4) | 0xffffffff;
									__eflags =  *_t100;
									_t141 = E010E8B2E(_t162, _t225);
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t141;
								} else {
									goto L13;
								}
							}
							goto L18;
							L13:
							_t162 = _t162 + 1;
							__eflags = _t162 -  *(_t227 - 0x14);
						} while (_t162 <  *(_t227 - 0x14));
						goto L14;
					}
				} else {
					 *(_t227 - 4) =  *(_t227 - 4) & 0;
					L17();
					 *(_t227 - 4) =  *(_t227 - 4) | 0xffffffff;
					E010E8B2E(0, _t227 - 0x30);
					_t120 =  *((intOrPtr*)(_t227 + 0x18));
					L15:
					 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
					return _t120;
				}
				L18:
			}

0x010e854e
0x010e8559
0x010e8563
0x010e8568
0x010e8570
0x010e8573
0x010e857d
0x010e8586
0x010e8589
0x010e858c
0x010e8590
0x010e85a2
0x010e85a3
0x010e85a6
0x010e85a8
0x010e85cc
0x010e85ce
0x010e85d4
0x010e85d6
0x010e85e2
0x010e85e5
0x010e85e7
0x010e85f9
0x010e85fd
0x010e8601
0x010e8606
0x010e860d
0x010e8612
0x010e8613
0x010e8614
0x010e8614
0x010e85d6
0x010e861c
0x010e8626
0x010e862b
0x010e862e
0x010e8630
0x010e8634
0x010e863a
0x010e8642
0x010e8647
0x010e8648
0x010e8648
0x010e8650
0x010e8655
0x010e8657
0x010e865a
0x010e865e
0x010e8660
0x010e8663
0x010e866e
0x010e8679
0x010e8684
0x010e8685
0x010e868a
0x010e8691
0x010e8696
0x010e8698
0x010e8698
0x010e8660
0x010e869d
0x010e86a0
0x010e86a3
0x010e86ac
0x010e86b0
0x010e86bb
0x010e86c4
0x010e86c9
0x010e86d1
0x010e86d9
0x010e86de
0x010e86e2
0x010e872e
0x010e8731
0x010e8736
0x010e873e
0x010e8743
0x010e874a
0x010e874f
0x010e874f
0x00000000
0x010e86e4
0x010e86e4
0x010e86f2
0x010e86f5
0x010e86f8
0x010e8702
0x010e8705
0x010e870a
0x010e870c
0x00000000
0x010e870e
0x010e8724
0x010e8726
0x010e8764
0x010e876a
0x010e876c
0x010e8771
0x010e8779
0x010e877e
0x010e877f
0x010e8789
0x010e878e
0x010e878f
0x010e8790
0x010e8792
0x010e879b
0x010e87a2
0x010e87ab
0x010e87b3
0x010e87c7
0x010e87cc
0x010e87cc
0x010e87cc
0x010e87d4
0x010e87dd
0x010e87e5
0x00000000
0x00000000
0x00000000
0x010e8726
0x00000000
0x010e8728
0x010e8728
0x010e8729
0x010e8729
0x00000000
0x010e86e4
0x010e85aa
0x010e85aa
0x010e85b3
0x010e85b8
0x010e85bf
0x010e85c4
0x010e8751
0x010e8757
0x010e875f
0x010e875f
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010E854E

Part of subcall function 010E711F: __EH_prolog.LIBCMT ref: 010E7124

Part of subcall function 010E7410: __EH_prolog.LIBCMT ref: 010E7415

_CxxThrowException.MSVCRT(?,0110DED0), ref: 010E8648

Part of subcall function 010E8784: __EH_prolog.LIBCMT ref: 010E8789

Strings

Duplicate archive path:, xrefs: 010E876C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrow
String ID: Duplicate archive path:
API String ID: 2366012087-4000988232
Opcode ID: e7c467c037dc2d8779720f257fc36f5d9925c0bfeb38d1cfcba7429812f3995a
Instruction ID: 0e48ffd33835a060cb7345a0d6e7a5430fe6b18982cbae7cfee20cd798e75b34
Opcode Fuzzy Hash: e7c467c037dc2d8779720f257fc36f5d9925c0bfeb38d1cfcba7429812f3995a
Instruction Fuzzy Hash: 72816E31D0025ADFCF15EFA9D944ADDBBF5BF28310F10819AE595632A0DB70AE05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010E8D6E Relevance: 6.7, APIs: 4, Instructions: 654
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E010E8D6E(intOrPtr __ecx, signed int __edx) {
				void* __ebx;
				signed int _t394;
				signed int* _t396;
				signed int _t399;
				intOrPtr* _t400;
				signed int _t401;
				intOrPtr* _t402;
				intOrPtr _t415;
				signed int _t419;
				signed int _t433;
				signed char _t436;
				signed int _t439;
				char* _t444;
				signed int _t448;
				signed int _t456;
				char* _t461;
				signed int _t463;
				signed int _t468;
				char* _t473;
				intOrPtr _t475;
				char* _t476;
				void* _t483;
				signed int _t485;
				signed int _t486;
				signed int _t487;
				signed int _t493;
				intOrPtr* _t501;
				signed int _t505;
				char* _t513;
				void* _t519;
				signed int* _t525;
				char* _t529;
				void* _t540;
				char* _t569;
				intOrPtr _t579;
				signed int _t591;
				unsigned int _t609;
				signed int _t610;
				signed int _t622;
				signed int _t623;
				signed int _t636;
				void* _t639;
				signed int _t644;
				signed int _t646;
				void* _t647;

				_t622 = __edx;
				E011039E0(E01105A78, _t647);
				_t525 =  *(_t647 + 0x2c);
				_t525[0xc] = 0;
				_t525[0xa] = 0;
				_t525[8] = 0;
				_t525[6] = 0;
				_t525[4] = 0;
				_t525[2] = 0;
				 *_t525 = 0;
				 *((intOrPtr*)(_t647 - 0xa4)) = __edx;
				 *((intOrPtr*)(_t647 - 0x3c)) = __ecx;
				_t525[0xd] = 0;
				_t525[0xb] = 0;
				_t525[9] = 0;
				_t525[7] = 0;
				_t525[5] = 0;
				_t525[3] = 0;
				_t525[1] = 0;
				 *(_t647 - 0x24) = 0;
				 *(_t647 - 0x20) = 0;
				 *((intOrPtr*)(_t647 - 0x50)) = 0;
				 *((intOrPtr*)(_t647 - 0x4c)) = 0;
				 *((intOrPtr*)(_t647 - 0x48)) = 0;
				_t394 =  *(_t647 + 0x18);
				 *(_t647 - 4) = 0;
				if( *((char*)(_t394 + 0x24)) == 0) {
					_t394 =  *( *((intOrPtr*)(_t647 + 0xc)) + 4);
					 *(_t647 - 0x14) = _t394;
				} else {
					 *(_t647 - 0x14) = 1;
				}
				_t636 = 0;
				if( *(_t647 - 0x14) <= 0) {
					L8:
					 *(_t647 - 0x1c) = 0;
					if( *(_t647 - 0x14) != 0) {
						 *(_t647 - 0x1c) = E010D1A96();
					}
					 *(_t647 - 4) = 2;
					if( *(_t647 - 0x14) > 0) {
						_t609 =  *(_t647 - 0x14);
						_t639 =  *(_t647 - 0x1c);
						_t622 = _t609;
						_t610 = _t609 >> 2;
						memset(_t639 + _t610, memset(_t639, 0, _t610 << 2), (_t622 & 0x00000003) << 0);
					}
					_push(0x1b0);
					_t396 = E010D1A96();
					 *(_t647 + 0x2c) = _t396;
					_t664 = _t396;
					 *(_t647 - 4) = 3;
					if(_t396 == 0) {
						goto L18;
					} else {
						_t505 = E010DD8E1(_t396, _t664); // executed
						_t644 = _t505;
						goto L19;
					}
				} else {
					do {
						E010D5C60(_t647 - 0x9c);
						E010D28E9(_t647 - 0x74);
						_t513 =  *(_t647 + 0x18);
						 *(_t647 - 4) = 1;
						 *((intOrPtr*)(_t647 - 0x9c)) = 0;
						 *((intOrPtr*)(_t647 - 0x98)) = 0;
						_t656 = _t513[0x24];
						if(_t513[0x24] != 0) {
							goto L7;
						}
						_t519 = E010D5D00(_t647 - 0x9c, _t656,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0xc)))) + _t636 * 4))))); // executed
						if(_t519 == 0) {
							_push(0x110d248);
							_push(_t647 + 0x18);
							 *(_t647 + 0x18) = "there is no such archive";
							L01103CAC();
							L17:
							_push(0x110d248);
							_push(_t647 + 0x18);
							 *(_t647 + 0x18) = "can\'t decompress folder";
							L01103CAC();
							L18:
							_t644 = 0;
							__eflags = 0;
							L19:
							 *(_t647 - 4) = 2;
							 *(_t647 - 0xa8) = _t644;
							if(_t644 != 0) {
								 *((intOrPtr*)( *_t644 + 4))(_t644);
							}
							_t529 =  *(_t647 + 0x18);
							 *(_t647 - 4) = 4;
							_t623 = _t622 & 0xffffff00 |  *(_t647 - 0x14) - 0x00000001 > 0x00000000;
							 *(_t644 + 0x5c) =  *(_t644 + 0x5c) & 0x00000000;
							 *(_t644 + 0x54) = _t529[4];
							 *(_t644 + 0x178) = 0;
							 *(_t644 + 0x170) = 0;
							 *(_t644 + 0x168) = 0;
							 *(_t644 + 0x160) = 0;
							 *(_t644 + 0x158) = 0;
							 *(_t647 + 0x2f) = _t623;
							 *(_t644 + 0x126) = _t623;
							 *(_t644 + 0x58) = _t529[8];
							 *(_t644 + 0x17c) = 0;
							 *(_t644 + 0x174) = 0;
							 *(_t644 + 0x16c) = 0;
							 *(_t644 + 0x164) = 0;
							 *(_t644 + 0x15c) = 0;
							E010E980D(_t644,  *(_t647 + 0x24));
							if( *(_t647 + 0x2f) == 0) {
								L26:
								 *(_t647 - 0x15) =  *(_t647 - 0x15) & 0x00000000;
								_t399 = 0;
								__eflags =  *(_t647 - 0x14);
								 *((intOrPtr*)(_t647 - 0x38)) = 0;
								 *((intOrPtr*)(_t647 - 0x34)) = 0;
								 *(_t647 - 0x28) = 0;
								if( *(_t647 - 0x14) <= 0) {
									L69:
									__eflags =  *(_t647 + 0x2f);
									if( *(_t647 + 0x2f) != 0) {
										L71:
										_t400 =  *((intOrPtr*)(_t647 + 0x20));
										_t401 =  *((intOrPtr*)( *_t400 + 0xc))(_t400,  *(_t647 - 0x24),  *(_t647 - 0x20));
										__eflags = _t401;
										 *(_t647 + 0x18) = _t401;
										if(_t401 == 0) {
											L94:
											_t402 =  *((intOrPtr*)(_t647 + 0x20));
											_t401 =  *((intOrPtr*)( *_t402 + 0x10))(_t402, _t647 - 0x38);
											__eflags = _t401;
											 *(_t647 + 0x18) = _t401;
											if(_t401 == 0) {
												L99:
												__eflags = _t644;
												_t525[8] =  *(_t644 + 0x158);
												_t525[9] =  *(_t644 + 0x15c);
												_t525[0xa] =  *(_t644 + 0x160);
												_t525[0xb] =  *(_t644 + 0x164);
												_t525[0xc] =  *(_t644 + 0x168);
												_t525[0xd] =  *(_t644 + 0x16c);
												_t525[2] =  *(_t644 + 0x170);
												_t525[3] =  *(_t644 + 0x174);
												_t525[4] =  *(_t644 + 0x178);
												_t525[5] =  *(_t644 + 0x17c);
												 *(_t647 - 4) = 2;
												 *_t525 =  *( *((intOrPtr*)(_t647 + 0xc)) + 4);
												_t525[1] = 0;
												_t415 =  *((intOrPtr*)(_t644 + 0x154));
												_t525[6] =  *(_t415 + 0x20);
												_t416 =  *(_t415 + 0x24);
												_t525[7] =  *(_t415 + 0x24);
												if(_t644 != 0) {
													_t416 =  *((intOrPtr*)( *_t644 + 8))(_t644);
												}
												E010D1ABD(E010D1ABD(_t416,  *(_t647 - 0x1c)),  *((intOrPtr*)(_t647 - 0x50)));
												_t419 = 0;
												__eflags = 0;
												goto L102;
											}
											__eflags = _t644;
											 *(_t647 - 4) = 2;
											if(_t644 != 0) {
												_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
											}
											_t646 =  *(_t647 + 0x18);
											goto L98;
										}
										__eflags = _t644;
										 *(_t647 - 4) = 2;
										if(_t644 != 0) {
											_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
										}
										_t646 =  *(_t647 + 0x18);
										goto L98;
									}
									__eflags =  *(_t647 - 0x15);
									if( *(_t647 - 0x15) == 0) {
										goto L99;
									}
									goto L71;
								} else {
									goto L27;
								}
								do {
									L27:
									_t540 =  *(_t647 - 0x1c);
									__eflags =  *((char*)(_t540 + _t399));
									if( *((char*)(_t540 + _t399)) != 0) {
										goto L68;
									}
									 *((intOrPtr*)(_t647 - 0x30)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0xc)))) +  *(_t647 - 0x28) * 4));
									E010D5C60(_t647 - 0x9c);
									E010D28E9(_t647 - 0x74);
									 *(_t647 - 4) = 5;
									__eflags = ( *(_t647 + 0x18))[0x24];
									if(__eflags == 0) {
										_t433 = E010D5D00(_t647 - 0x9c, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30))))); // executed
										__eflags = _t433;
										if(_t433 == 0) {
											L93:
											_push(0x110d248);
											_push(_t647 + 0x18);
											 *(_t647 + 0x18) = "there is no such archive";
											L01103CAC();
											goto L94;
										}
										_t436 =  *(_t647 - 0x7c) >> 4;
										__eflags = _t436 & 0x00000001;
										if((_t436 & 0x00000001) != 0) {
											goto L93;
										}
										L32:
										_t439 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0x20)))) + 0x24))( *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30)))), ( *(_t647 + 0x18))[0x27]);
										__eflags = _t439;
										 *(_t647 - 0x10) = _t439;
										if(_t439 != 0) {
											_t401 = E010D1ABD(_t439,  *((intOrPtr*)(_t647 - 0x74)));
											__eflags = _t644;
											 *(_t647 - 4) = 2;
											if(_t644 != 0) {
												_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
											}
											_t646 =  *(_t647 - 0x10);
											goto L98;
										}
										E010E96F4(_t647 - 0x108);
										_push( *((intOrPtr*)(_t647 - 0xa4)));
										 *(_t647 - 4) = 6;
										E010E9D84(_t647 - 0x5c);
										 *(_t647 - 4) = 7;
										E010E9660(_t647 - 0x160);
										_t444 =  *(_t647 + 0x18);
										 *(_t647 - 4) = 8;
										 *((intOrPtr*)(_t647 - 0x130)) = 0;
										 *(_t647 - 0x120) =  &(_t444[0x28]);
										 *((intOrPtr*)(_t647 - 0x160)) =  *((intOrPtr*)(_t647 - 0x3c));
										 *((intOrPtr*)(_t647 - 0x138)) = _t647 - 0x5c;
										 *((intOrPtr*)(_t647 - 0x134)) =  *((intOrPtr*)(_t647 + 8));
										 *((char*)(_t647 - 0x11c)) = _t444[0x24];
										E010D2A8C(_t647 - 0x118,  *((intOrPtr*)(_t647 - 0x30)));
										_t448 = L010F2C25(_t647 - 0x108, __eflags, _t647 - 0x160,  *((intOrPtr*)(_t647 + 0x1c)));
										__eflags = _t448;
										 *(_t647 - 0x10) = _t448;
										if(_t448 != 0) {
											L36:
											__eflags =  *(_t647 - 0x10) - 0x80004004;
											if( *(_t647 - 0x10) == 0x80004004) {
												E010D1ABD(_t448,  *((intOrPtr*)(_t647 - 0x118)));
												 *(_t647 - 4) = 6;
												E010E9E21(_t647 - 0x5c);
												 *(_t647 - 4) = 5;
												_t401 = E010D1ABD(E010E97A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
												__eflags = _t644;
												 *(_t647 - 4) = 2;
												if(_t644 != 0) {
													_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
												}
												_t646 = 0x80004004;
												goto L98;
											}
											L37:
											_t456 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0x20)))) + 0x28))( *((intOrPtr*)(_t647 - 0x3c)), _t647 - 0x108,  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30)))),  *(_t647 - 0x10));
											__eflags = _t456;
											 *(_t647 - 0x2c) = _t456;
											if(_t456 != 0) {
												E010D1ABD(_t456,  *((intOrPtr*)(_t647 - 0x118)));
												 *(_t647 - 4) = 6;
												E010E9E21(_t647 - 0x5c);
												 *(_t647 - 4) = 5;
												_t401 = E010D1ABD(E010E97A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
												__eflags = _t644;
												 *(_t647 - 4) = 2;
												if(_t644 != 0) {
													_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
												}
												_t646 =  *(_t647 - 0x2c);
												goto L98;
											}
											__eflags =  *(_t647 - 0x10);
											if( *(_t647 - 0x10) == 0) {
												_t461 =  *(_t647 + 0x18);
												__eflags = _t461[0x24];
												if(_t461[0x24] != 0) {
													L58:
													_t463 =  *( *((intOrPtr*)(_t647 - 0x108)) +  *(_t647 - 0x104) * 4 - 4);
													_t569 =  *(_t647 + 0x18);
													__eflags = _t569[0x24];
													if(_t569[0x24] != 0) {
														L61:
														__eflags = 0;
														L62:
														__eflags =  *(_t647 + 0x24);
														 *((char*)(_t463 + 0xa4)) = 0;
														 *((intOrPtr*)(_t463 + 0x9c)) =  *((intOrPtr*)(_t647 - 0x84));
														 *((intOrPtr*)(_t463 + 0xa0)) =  *((intOrPtr*)(_t647 - 0x80));
														 *((char*)(_t647 - 0xa0)) = _t463 & 0xffffff00 | __eflags != 0x00000000;
														_push(_t647 - 0x64);
														_push( *(_t647 + 0x28));
														_push(_t644);
														_push( *((intOrPtr*)(_t647 + 0x20)));
														asm("adc ecx, [ebp-0x98]");
														_push( *((intOrPtr*)(_t647 - 0xa0)));
														_push( *(_t647 + 0x18));
														_push( *((intOrPtr*)(_t647 + 0x14)));
														_push( *(_t647 - 0xec));
														_push( *(_t647 - 0xf0) +  *((intOrPtr*)(_t647 - 0x9c))); // executed
														_t468 = E010E98A7( *((intOrPtr*)(_t647 - 0x3c)), _t647 - 0x108, __eflags); // executed
														__eflags = _t468;
														 *(_t647 - 0x2c) = _t468;
														if(_t468 != 0) {
															E010D1ABD(_t468,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E010E9E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t401 = E010D1ABD(E010E97A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
															__eflags = _t644;
															 *(_t647 - 4) = 2;
															if(_t644 != 0) {
																_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
															}
															_t646 =  *(_t647 - 0x2c);
															goto L98;
														}
														_t473 =  *(_t647 + 0x18);
														__eflags = _t473[0x24];
														if(_t473[0x24] != 0) {
															_t579 =  *((intOrPtr*)(_t647 - 0x64));
														} else {
															_t579 =  *(_t647 - 0xf0) +  *((intOrPtr*)(_t647 - 0x9c));
															asm("adc edx, [ebp-0x98]");
															 *((intOrPtr*)(_t647 - 0x64)) = _t579;
															 *(_t647 - 0x60) =  *(_t647 - 0xec);
														}
														 *((intOrPtr*)(_t647 - 0x38)) =  *((intOrPtr*)(_t647 - 0x38)) + _t579;
														asm("adc [ebp-0x34], edx");
														 *((intOrPtr*)( *((intOrPtr*)(_t644 + 0x154)) + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t644 + 0x154)) + 0x20)) + _t579;
														asm("adc [eax+0x24], edx");
														_t475 =  *((intOrPtr*)(_t644 + 0x154));
														 *(_t475 + 0x28) =  *(_t644 + 0x170);
														 *(_t475 + 0x2c) =  *(_t644 + 0x174);
														_t476 =  *(_t647 + 0x28);
														__eflags = _t476[4];
														if(_t476[4] != 0) {
															E010D1ABD(_t476,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E010E9E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t401 = E010D1ABD(E010E97A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
															__eflags = _t644;
															 *(_t647 - 4) = 2;
															if(_t644 != 0) {
																_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
															}
															_t646 = 0x80004005;
															goto L98;
														} else {
															L67:
															E010D1ABD(_t476,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E010E9E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t483 = E010E97A0(_t525, _t647 - 0x108); // executed
															 *(_t647 - 4) = 4;
															E010D1ABD(_t483,  *((intOrPtr*)(_t647 - 0x74)));
															goto L68;
														}
													}
													__eflags =  *((char*)(_t647 - 0x77));
													if( *((char*)(_t647 - 0x77)) != 0) {
														goto L61;
													}
													_push(1);
													_pop(0);
													goto L62;
												}
												__eflags =  *(_t647 - 0xf8);
												if(__eflags == 0) {
													goto L58;
												}
												_t485 =  *(_t647 - 0xf0);
												_t591 =  *(_t647 - 0xec);
												 *(_t647 - 0x44) = _t485;
												 *(_t647 - 0x40) = _t591;
												 *(_t647 - 0x10) = 0;
												if(__eflags <= 0) {
													L52:
													__eflags = _t485 | _t591;
													if((_t485 | _t591) == 0) {
														goto L58;
													}
													_t486 = _t485 +  *(_t647 - 0x24);
													asm("adc ecx, [ebp-0x20]");
													__eflags = _t591;
													if(__eflags > 0) {
														L57:
														 *(_t647 - 0x24) = _t486;
														 *(_t647 - 0x20) = _t591;
														_t487 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0x20)))) + 0xc))( *((intOrPtr*)(_t647 + 0x20)), _t486, _t591);
														__eflags = _t487;
														 *(_t647 - 0x2c) = _t487;
														if(_t487 != 0) {
															E010D1ABD(_t487,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E010E9E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t401 = E010D1ABD(E010E97A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
															__eflags = _t644;
															 *(_t647 - 4) = 2;
															if(_t644 != 0) {
																_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
															}
															_t646 =  *(_t647 - 0x2c);
															goto L98;
														}
														goto L58;
													}
													if(__eflags < 0) {
														L56:
														_t486 = 0;
														_t591 = 0;
														__eflags = 0;
														goto L57;
													}
													__eflags = _t486;
													if(_t486 >= 0) {
														goto L57;
													}
													goto L56;
												} else {
													goto L47;
												}
												do {
													L47:
													_t493 = E010E8D25( *((intOrPtr*)( *((intOrPtr*)(_t647 - 0xfc)) +  *(_t647 - 0x10) * 4)));
													__eflags = _t493;
													if(_t493 >= 0) {
														__eflags = _t493 -  *(_t647 - 0x28);
														if(_t493 >  *(_t647 - 0x28)) {
															 *((char*)( *(_t647 - 0x1c) + _t493)) = 1;
															 *(_t647 - 0x44) =  *(_t647 - 0x44) -  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x50)) + _t493 * 8));
															asm("sbb [ebp-0x40], eax");
														}
													}
													 *(_t647 - 0x10) =  *(_t647 - 0x10) + 1;
													__eflags =  *(_t647 - 0x10) -  *(_t647 - 0xf8);
												} while ( *(_t647 - 0x10) <  *(_t647 - 0xf8));
												_t591 =  *(_t647 - 0x40);
												_t485 =  *(_t647 - 0x44);
												goto L52;
											}
											_t476 =  *(_t647 + 0x18);
											 *(_t647 - 0x15) = 1;
											__eflags = _t476[0x24];
											if(_t476[0x24] == 0) {
												E010D5C60(_t647 - 0x198);
												E010D28E9(_t647 - 0x170);
												 *(_t647 - 4) = 9;
												_t499 = E010D5D00(_t647 - 0x198, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30)))));
												__eflags = _t499;
												if(_t499 != 0) {
													_t499 =  *(_t647 - 0x178) >> 4;
													__eflags = _t499 & 0x00000001;
													if((_t499 & 0x00000001) == 0) {
														_t499 =  *(_t647 - 0x198);
														 *((intOrPtr*)(_t647 - 0x38)) =  *((intOrPtr*)(_t647 - 0x38)) +  *(_t647 - 0x198);
														asm("adc [ebp-0x34], ecx");
													}
												}
												_t476 = E010D1ABD(_t499,  *((intOrPtr*)(_t647 - 0x170)));
											}
											goto L67;
										}
										__eflags =  *(_t647 - 0xcc);
										if( *(_t647 - 0xcc) < 0) {
											goto L37;
										}
										 *(_t647 - 0x10) = 1;
										goto L36;
									}
									 *((intOrPtr*)(_t647 - 0x9c)) = 0;
									 *((intOrPtr*)(_t647 - 0x98)) = 0;
									 *(_t647 - 0x7c) = 0;
									goto L32;
									L68:
									_t399 =  *(_t647 - 0x28) + 1;
									__eflags = _t399 -  *(_t647 - 0x14);
									 *(_t647 - 0x28) = _t399;
								} while (_t399 <  *(_t647 - 0x14));
								goto L69;
							} else {
								_t501 =  *((intOrPtr*)(_t647 + 0x20));
								_t401 =  *((intOrPtr*)( *_t501 + 0xc))(_t501,  *(_t647 - 0x24),  *(_t647 - 0x20));
								 *(_t647 - 0x28) = _t401;
								if(_t401 == 0) {
									goto L26;
								}
								 *(_t647 - 4) = 2;
								if(_t644 != 0) {
									_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
								}
								_t646 =  *(_t647 - 0x28);
								L98:
								E010D1ABD(E010D1ABD(_t401,  *(_t647 - 0x1c)),  *((intOrPtr*)(_t647 - 0x50)));
								_t419 = _t646;
								L102:
								 *[fs:0x0] =  *((intOrPtr*)(_t647 - 0xc));
								return _t419;
							}
						}
						if(( *(_t647 - 0x7c) >> 0x00000004 & 0x00000001) != 0) {
							goto L17;
						}
						L7:
						E010D9123(_t647 - 0x50,  *((intOrPtr*)(_t647 - 0x9c)),  *((intOrPtr*)(_t647 - 0x98)));
						 *(_t647 - 0x24) =  *(_t647 - 0x24) +  *((intOrPtr*)(_t647 - 0x9c));
						asm("adc [ebp-0x20], ecx");
						 *(_t647 - 4) =  *(_t647 - 4) & 0x00000000;
						_t394 = E010D1ABD( *((intOrPtr*)(_t647 - 0x9c)),  *((intOrPtr*)(_t647 - 0x74)));
						_t636 = _t636 + 1;
					} while (_t636 <  *(_t647 - 0x14));
					goto L8;
				}
			}

0x010e8d6e
0x010e8d73
0x010e8d7f
0x010e8d85
0x010e8d88
0x010e8d8b
0x010e8d8e
0x010e8d91
0x010e8d94
0x010e8d97
0x010e8d9a
0x010e8da0
0x010e8da3
0x010e8da6
0x010e8da9
0x010e8dac
0x010e8daf
0x010e8db2
0x010e8db5
0x010e8db8
0x010e8dbb
0x010e8dbe
0x010e8dc1
0x010e8dc4
0x010e8dc7
0x010e8dca
0x010e8dd1
0x010e8ddf
0x010e8de2
0x010e8dd3
0x010e8dd3
0x010e8dd3
0x010e8de5
0x010e8dea
0x010e8e84
0x010e8e87
0x010e8e8a
0x010e8e9e
0x010e8e9e
0x010e8ea4
0x010e8ea8
0x010e8eaa
0x010e8ead
0x010e8eb0
0x010e8eb4
0x010e8ebe
0x010e8ebe
0x010e8ec0
0x010e8ec5
0x010e8ecb
0x010e8ece
0x010e8ed0
0x010e8ed4
0x00000000
0x010e8ed6
0x010e8ed8
0x010e8edd
0x00000000
0x010e8edd
0x010e8df0
0x010e8df0
0x010e8df6
0x010e8dfe
0x010e8e03
0x010e8e06
0x010e8e0a
0x010e8e10
0x010e8e16
0x010e8e1a
0x00000000
0x00000000
0x010e8e2c
0x010e8e33
0x010e8ee4
0x010e8ee9
0x010e8eea
0x010e8ef1
0x010e8ef6
0x010e8ef9
0x010e8efe
0x010e8eff
0x010e8f06
0x010e8f0b
0x010e8f0b
0x010e8f0b
0x010e8f0d
0x010e8f0f
0x010e8f15
0x010e8f1b
0x010e8f20
0x010e8f20
0x010e8f23
0x010e8f2d
0x010e8f37
0x010e8f3a
0x010e8f3e
0x010e8f41
0x010e8f47
0x010e8f4d
0x010e8f53
0x010e8f59
0x010e8f61
0x010e8f64
0x010e8f6a
0x010e8f6d
0x010e8f73
0x010e8f79
0x010e8f7f
0x010e8f85
0x010e8f8b
0x010e8f94
0x010e8fc2
0x010e8fc2
0x010e8fc6
0x010e8fc8
0x010e8fcb
0x010e8fce
0x010e8fd1
0x010e8fd4
0x010e93a8
0x010e93a8
0x010e93ac
0x010e93b8
0x010e93bb
0x010e93c4
0x010e93c7
0x010e93c9
0x010e93cc
0x010e9578
0x010e9578
0x010e9582
0x010e9585
0x010e9587
0x010e958a
0x010e95b6
0x010e95bc
0x010e95be
0x010e95c7
0x010e95d0
0x010e95d9
0x010e95e2
0x010e95eb
0x010e95f4
0x010e95fd
0x010e9606
0x010e960f
0x010e9615
0x010e961c
0x010e961e
0x010e9621
0x010e962a
0x010e962d
0x010e9630
0x010e9633
0x010e9638
0x010e9638
0x010e9646
0x010e964c
0x010e964c
0x00000000
0x010e964e
0x010e958c
0x010e958e
0x010e9592
0x010e9597
0x010e9597
0x010e959a
0x00000000
0x010e959a
0x010e93d2
0x010e93d4
0x010e93d8
0x010e93dd
0x010e93dd
0x010e93e0
0x00000000
0x010e93e0
0x010e93ae
0x010e93b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010e8fda
0x010e8fda
0x010e8fda
0x010e8fdd
0x010e8fe1
0x00000000
0x00000000
0x010e8ff8
0x010e8ffb
0x010e9003
0x010e900b
0x010e900f
0x010e9013
0x010e9031
0x010e9036
0x010e9038
0x010e9563
0x010e9566
0x010e956b
0x010e956c
0x010e9573
0x00000000
0x010e9573
0x010e9041
0x010e9044
0x010e9046
0x00000000
0x00000000
0x010e904c
0x010e9061
0x010e9064
0x010e9066
0x010e9069
0x010e93eb
0x010e93f0
0x010e93f3
0x010e93f7
0x010e93fc
0x010e93fc
0x010e93ff
0x00000000
0x010e93ff
0x010e9075
0x010e907a
0x010e9083
0x010e9087
0x010e9092
0x010e9096
0x010e909b
0x010e90a1
0x010e90a5
0x010e90b1
0x010e90ba
0x010e90c3
0x010e90cc
0x010e90d8
0x010e90de
0x010e90f3
0x010e90f8
0x010e90fa
0x010e90fd
0x010e910e
0x010e910e
0x010e9115
0x010e940d
0x010e9413
0x010e941a
0x010e9425
0x010e9431
0x010e9436
0x010e9439
0x010e943d
0x010e9442
0x010e9442
0x010e9445
0x00000000
0x010e9445
0x010e911b
0x010e9133
0x010e9136
0x010e9138
0x010e913b
0x010e9455
0x010e945b
0x010e9462
0x010e946d
0x010e9479
0x010e947e
0x010e9481
0x010e9485
0x010e948a
0x010e948a
0x010e948d
0x00000000
0x010e948d
0x010e9141
0x010e9144
0x010e91b5
0x010e91b8
0x010e91bc
0x010e9268
0x010e9274
0x010e9278
0x010e927b
0x010e927f
0x010e928c
0x010e928c
0x010e928e
0x010e928e
0x010e9291
0x010e92a3
0x010e92ac
0x010e92bb
0x010e92c4
0x010e92cb
0x010e92d4
0x010e92d5
0x010e92d8
0x010e92de
0x010e92e4
0x010e92e7
0x010e92ea
0x010e92ee
0x010e92ef
0x010e92f4
0x010e92f6
0x010e92f9
0x010e94e1
0x010e94e7
0x010e94ee
0x010e94f9
0x010e9505
0x010e950a
0x010e950d
0x010e9511
0x010e9516
0x010e9516
0x010e9519
0x00000000
0x010e9519
0x010e92ff
0x010e9302
0x010e9306
0x010e932b
0x010e9308
0x010e9314
0x010e931a
0x010e9320
0x010e9323
0x010e9323
0x010e932e
0x010e9331
0x010e933a
0x010e933d
0x010e9340
0x010e934c
0x010e9355
0x010e9358
0x010e935b
0x010e935e
0x010e9524
0x010e952a
0x010e9531
0x010e953c
0x010e9548
0x010e954d
0x010e9550
0x010e9554
0x010e9559
0x010e9559
0x010e955c
0x00000000
0x010e9364
0x010e9364
0x010e936a
0x010e9370
0x010e9377
0x010e9382
0x010e9386
0x010e938b
0x010e9392
0x00000000
0x010e9397
0x010e935e
0x010e9281
0x010e9285
0x00000000
0x00000000
0x010e9287
0x010e9289
0x00000000
0x010e9289
0x010e91c2
0x010e91c8
0x00000000
0x00000000
0x010e91ce
0x010e91d4
0x010e91da
0x010e91dd
0x010e91e0
0x010e91e3
0x010e9230
0x010e9232
0x010e9234
0x00000000
0x00000000
0x010e9236
0x010e9239
0x010e923c
0x010e923e
0x010e924a
0x010e924f
0x010e9257
0x010e925a
0x010e925d
0x010e925f
0x010e9262
0x010e949b
0x010e94a1
0x010e94a8
0x010e94b3
0x010e94bf
0x010e94c4
0x010e94c7
0x010e94cb
0x010e94d0
0x010e94d0
0x010e94d3
0x00000000
0x010e94d3
0x00000000
0x010e9262
0x010e9240
0x010e9246
0x010e9246
0x010e9248
0x010e9248
0x00000000
0x010e9248
0x010e9242
0x010e9244
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010e91e5
0x010e91e5
0x010e91f4
0x010e91f9
0x010e91fb
0x010e91fd
0x010e9200
0x010e9205
0x010e920f
0x010e9219
0x010e9219
0x010e9200
0x010e921c
0x010e9222
0x010e9222
0x010e922a
0x010e922d
0x00000000
0x010e922d
0x010e9146
0x010e9149
0x010e914d
0x010e9151
0x010e915d
0x010e9168
0x010e9176
0x010e917c
0x010e9181
0x010e9183
0x010e918b
0x010e918e
0x010e9190
0x010e9192
0x010e919e
0x010e91a1
0x010e91a1
0x010e9190
0x010e91aa
0x010e91af
0x00000000
0x010e9151
0x010e90ff
0x010e9105
0x00000000
0x00000000
0x010e9107
0x00000000
0x010e9107
0x010e9015
0x010e901b
0x010e9021
0x00000000
0x010e9398
0x010e939b
0x010e939c
0x010e939f
0x010e939f
0x00000000
0x010e8f96
0x010e8f99
0x010e8fa2
0x010e8fa7
0x010e8faa
0x00000000
0x00000000
0x010e8fae
0x010e8fb2
0x010e8fb7
0x010e8fb7
0x010e8fba
0x010e959d
0x010e95a8
0x010e95ae
0x010e964f
0x010e9655
0x010e965d
0x010e965d
0x010e8f94
0x010e8e41
0x00000000
0x00000000
0x010e8e47
0x010e8e56
0x010e8e67
0x010e8e6d
0x010e8e70
0x010e8e74
0x010e8e79
0x010e8e7b
0x00000000
0x010e8df0

APIs

__EH_prolog.LIBCMT ref: 010E8D73
_CxxThrowException.MSVCRT(?,0110D248), ref: 010E8EF1
_CxxThrowException.MSVCRT(?,0110D248), ref: 010E9573
_CxxThrowException.MSVCRT(011097A4,0110D248), ref: 010E8F06

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Part of subcall function 010E97A0: __EH_prolog.LIBCMT ref: 010E97A5

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog$free
String ID:
API String ID: 1223536468-0
Opcode ID: bb4a65238f654d0e3cc2fcbf716eda170dd26faca5230254119a7f78a7bc14c1
Instruction ID: 9db36f9e7f35d3c1735fdb2e95aefd2518f1b716d52eaeacac15a6bb03391ded
Opcode Fuzzy Hash: bb4a65238f654d0e3cc2fcbf716eda170dd26faca5230254119a7f78a7bc14c1
Instruction Fuzzy Hash: 66624770D04259DFCF25DFA9C988ADDBBF1BF58308F14819AE899A7251CB709A80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010EF7EB Relevance: 6.6, APIs: 3, Strings: 1, Instructions: 624
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E010EF7EB(void* __ebx) {
				intOrPtr* _t1078;
				void* _t1084;
				void* _t1085;
				void* _t1086;
				void* _t1090;
				void* _t1093;

				_t1085 = __ebx;
				 *((char*)(_t1093 - 0xe)) = 1;
				 *(__ebp - 0x7c) = __ebx;
				 *(__ebp - 0x78) = __ebx;
				 *(__ebp - 0x74) = __ebx;
				 *(__ebp - 0x20) =  *(__ebp - 0x20) | 0xffffffff;
				__eflags =  *((intOrPtr*)(__ebp - 0x88)) - __ebx;
				 *((char*)(__ebp - 4)) = 0xd;
				 *(__ebp - 0x2c) = __ebx;
				if( *((intOrPtr*)(__ebp - 0x88)) <= __ebx) {
					L38:
					__eflags =  *(__ebp - 0x78) - __ebx;
					 *(__ebp - 0x2c) = __ebx;
					if( *(__ebp - 0x78) <= __ebx) {
						L128:
						__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
						 *(__ebp - 0xd4) = __ebx;
						 *(__ebp - 0xd0) = __ebx;
						 *(__ebp - 0xcc) = __ebx;
						 *(__ebp - 0xe0) = __ebx;
						 *(__ebp - 0xdc) = __ebx;
						 *(__ebp - 0xd8) = __ebx;
						__eax =  *(__ebp + 8);
						 *((char*)(__ebp - 4)) = 0x11;
						 *(__ebp - 0x20) = __ebx;
						__edi = 0;
						__eax =  *( *(__ebp + 8));
						__eflags =  *((intOrPtr*)(__eax + 0x2c)) - __ebx;
						if( *((intOrPtr*)(__eax + 0x2c)) <= __ebx) {
							L132:
							__esi = 0x10000;
							 *(__ebp - 0x14) = __ebx;
							_push(0x10000);
							__eax = E010D1A96();
							 *(__ebp - 0xac) = __eax;
							 *(__ebp - 0x14) = __eax;
							__edi = 0xff;
							__eax = memset(__eax, 0xff, 0x10000);
							__esi = 0x100;
							__eax = __ebp - 0x2cc;
							__eax = memset(__ebp - 0x2cc, 0xff, 0x100);
							__eflags =  *(__ebp - 0xdc) - 0xff;
							if( *(__ebp - 0xdc) < 0xff) {
								 *(__ebp - 0x7c) = __ebx;
								 *(__ebp - 0x78) = __ebx;
								 *(__ebp - 0x74) = __ebx;
								 *((char*)(__ebp - 4)) = 0x13;
								 *(__ebp - 0x50) = __ebx;
								__eax = E010D1A96();
								__ecx = 0x100;
								 *(__ebp - 0x50) = __eax;
								 *((char*)(__ebp - 4)) = 0x14;
								__eax = 0;
								__eflags = 0;
								do {
									__ecx =  *(__ebp - 0x50);
									 *(__eax +  *(__ebp - 0x50)) = __bl;
									__eax = __eax + 1;
									__eflags = __eax - 0x100;
								} while (__eax < 0x100);
								__eax = 0;
								__eflags =  *((intOrPtr*)(__ebp - 0x88)) - __ebx;
								 *(__ebp - 0x20) = 0;
								if( *((intOrPtr*)(__ebp - 0x88)) <= __ebx) {
									L150:
									__edi =  *(__ebp - 0x30);
									__eax =  *( *(__ebp - 0x30));
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __ebx, __ebx, __ebx, __ebx);
									__esi = __eax;
									__eflags = __esi - __ebx;
									if(__esi != __ebx) {
										L438:
										__eax = E010D1ABD(__eax,  *(__ebp - 0x50));
										__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
										__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
										__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
										__eax =  *(__ebp - 0x1c);
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0xa;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax =  *(__ebp - 0x24);
										 *((char*)(__ebp - 4)) = 6;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										L463:
										__eax = E010D1ABD(__eax,  *(__ebp - 0x58));
										__eax = E010D1ABD(__eax,  *(__ebp - 0x38));
										__eax = E010D1ABD(__eax,  *(__ebp - 0x8c));
										__eax = E010D1ABD(__eax,  *(__ebp - 0xec));
										__eax = __esi;
										goto L465;
									}
									__eax = E010D1A96();
									__eflags = __eax - __ebx;
									__ecx = 0x48;
									if(__eax == __ebx) {
										__esi = 0;
										__eflags = 0;
									} else {
										 *__eax = 0x1108454;
										 *__eax = 0x1109bac;
										 *(__eax + 4) = __ebx;
										 *(__eax + 8) = __ebx;
										 *(__eax + 0x3c) = __ebx;
										 *(__eax + 0x40) = __ebx;
										 *__eax = 0x1109b98;
										__esi = __eax;
									}
									__eflags = __esi - __ebx;
									 *(__ebp - 0x28) = __esi;
									 *(__ebp - 0x68) = __esi;
									if(__esi != __ebx) {
										__eax =  *__esi;
										__eax =  *((intOrPtr*)( *__esi + 4))(__esi);
									}
									 *((char*)(__ebp - 4)) = 0x15;
									_t356 = __esi + 8; // 0x8
									__ecx = _t356;
									__eax = E010E0E48(_t356,  *__edi);
									 *(__ebp - 0xa8) = __ebx;
									 *(__ebp - 0x5c) = __ebx;
									__eax =  *(__ebp + 8);
									 *((char*)(__ebp - 4)) = 0x16;
									__eflags =  *((intOrPtr*)(__eax + 0x38)) - __ebx;
									if( *((intOrPtr*)(__eax + 0x38)) != __ebx) {
										__eax = E010D1A96();
										__ecx = 0x30;
										 *(__ebp - 0xb0) = __eax;
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0x17;
										if(__eax == __ebx) {
											__esi = 0;
											__eflags = 0;
										} else {
											__ecx = __eax;
											__esi = __eax;
										}
										__ecx = __ebp - 0x5c;
										 *((char*)(__ebp - 4)) = 0x16;
										 *(__ebp - 0xa8) = __esi;
										E010E0E48(__ebp - 0x5c, __esi) =  *(__ebp + 8);
										_t368 = __esi + 0x10; // 0x10
										__edi = _t368;
										__ecx = __edi;
										__eax = E010E0E48(__edi,  *( *(__ebp + 8) + 0x38));
										__eax =  *__edi;
										_t370 = __esi + 0x14; // 0x14
										__edx = _t370;
										__ecx =  *__eax;
										__eax =  *( *__eax)(__eax, 0x110c4c8, __edx);
										__edi =  *__edi;
										__esi = __esi + 0x28;
										__eflags = __esi;
										__eax =  *__edi;
										__eax =  *( *__edi)(__edi, 0x110c408, __esi);
									}
									__eax =  *(__ebp + 8);
									__eax =  *( *(__ebp + 8) + 0x38);
									__eflags = __eax - __ebx;
									if(__eax == __ebx) {
										L163:
										 *(__ebp - 0x28) =  *(__ebp - 0x28) + 0x3c;
										__ecx =  *(__ebp - 0x28) + 0x3c;
										__eax = E010D705A( *(__ebp - 0x28) + 0x3c, 0x400000);
										__eax =  *(__ebp - 0x48);
										__edi = 0;
										 *(__ebp - 0xf8) = __ebx;
										 *(__ebp - 0xf4) = __ebx;
										 *(__ebp - 0x70) = 0;
										 *(__ebp - 0x6c) = __ebx;
										__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
										 *(__ebp - 0xf) = 1;
										 *(__ebp - 0x15) = __bl;
										 *(__ebp - 0x2c) = __ebx;
										 *(__ebp - 0x44) = __ebx;
										 *(__ebp - 0x40) = __ebx;
										if( *((intOrPtr*)(__eax + 0x13)) == __bl) {
											__eax =  *(__ebp - 0x80);
											__eflags =  *((intOrPtr*)(__eax + 0x10)) - 1;
											if( *((intOrPtr*)(__eax + 0x10)) == 1) {
												__eax =  *(__eax + 0xc);
												__eax =  *__eax;
												__eflags =  *((intOrPtr*)(__eax + 0x6c)) - __bl;
												if( *((intOrPtr*)(__eax + 0x6c)) == __bl) {
													 *__eax =  *__eax |  *(__eax + 4);
													__eflags =  *__eax |  *(__eax + 4);
													if(( *__eax |  *(__eax + 4)) == 0) {
														__ecx =  *(__eax + 8);
														__eax =  *(__eax + 0xc);
														 *(__ebp - 0x44) = __ecx;
														 *(__ebp - 0x40) = __eax;
													}
												}
											}
										}
										while(1) {
											__esi =  *(__ebp - 0x44);
											__eax =  *(__ebp - 0x40);
											__esi =  *(__ebp - 0x44) - __edi;
											asm("sbb eax, [ebp-0x6c]");
											__eflags =  *(__ebp - 0x15) - __bl;
											if( *(__ebp - 0x15) != __bl) {
												goto L186;
											}
											L169:
											__edx =  *(__ebp - 0x2c);
											__eflags = __edx - 0x400000;
											if(__edx >= 0x400000) {
												__ecx = 0;
												__eflags = 0 - __eax;
												if(__eflags > 0) {
													L183:
													__edx = __edx - __esi;
													__eflags = __edx;
													asm("sbb ecx, eax");
													 *(__ebp - 0xb0) = __ecx;
													if(__edx != 0) {
														goto L186;
													}
													__eflags = __edx - 0x100000;
													if(__edx >= 0x100000) {
														goto L186;
													}
													__eax =  *(__ebp - 0x28);
													__edi =  *(__ebp - 0x2c);
													__eax =  *(__ebp - 0x28) + 0x3c;
													__esi = __esi + 0xffff0000;
													__edi =  *(__ebp - 0x2c) - __esi;
													__eax =  *( *(__ebp - 0x28) + 0x3c);
													__ecx = __eax + __esi;
													__eax = memmove(__eax, __eax + __esi, __edi);
													 *(__ebp - 0x70) =  *(__ebp - 0x70) + __esi;
													 *(__ebp - 0x2c) = __edi;
													asm("adc [ebp-0x6c], ebx");
													L367:
													__edi =  *(__ebp - 0x70);
													continue;
													do {
														while(1) {
															__esi =  *(__ebp - 0x44);
															__eax =  *(__ebp - 0x40);
															__esi =  *(__ebp - 0x44) - __edi;
															asm("sbb eax, [ebp-0x6c]");
															__eflags =  *(__ebp - 0x15) - __bl;
															if( *(__ebp - 0x15) != __bl) {
																goto L186;
															}
															goto L169;
														}
														goto L186;
														L213:
														__eax = __eax - __esi;
														__ecx = __eax - __esi -  *(__ebp - 0x108);
														 *(__ebp - 0x44) =  *(__ebp - 0x44) + __ecx;
														 *(__ebp - 0x104) = __ecx;
														asm("adc [ebp-0x40], ebx");
														__eflags = __eax -  *(__ebp - 0x4c);
													} while (__eax ==  *(__ebp - 0x4c));
													L214:
													__eax =  *__eax & 0x0000ffff;
													__ecx =  *(__ebp - 0xac);
													 *(__ebp - 0xa1) = 1;
													 *(__ebp - 0x108) = __ebx;
													 *(__ebp - 0x5e) = __bl;
													 *(__ebp - 0x4c) = __eax;
													while(1) {
														__esi =  *(__ebp - 0x28);
														while(1) {
															L216:
															__eflags =  *(__ebp - 0xf) - __bl;
															if( *(__ebp - 0xf) == __bl) {
																goto L219;
															}
															L217:
															__ecx =  *(__ebp - 0x108);
															__eflags = __ecx -  *(__ebp - 0x78);
															if(__ecx >=  *(__ebp - 0x78)) {
																goto L219;
															}
															__eax = __ecx;
															 *(__ebp - 0xd) = 1;
															__eax = __ecx << 2;
															 *(__ebp - 0x108) = __ecx;
															__ecx =  *(__ebp - 0x7c);
															__edi =  *( *(__ebp - 0x7c) + __eax);
															 *(__ebp - 0x34) = __edi;
															L231:
															__eax =  *(__ebp + 8);
															__eflags =  *(__ebp - 0xd) - __bl;
															 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
															__ecx =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
															 *(__ebp - 0x10c) = __ecx;
															if( *(__ebp - 0xd) == __bl) {
																L233:
																__eax =  *(__ecx + 0x2c);
																__edx = 0;
																__eflags =  *(__ecx + 0x2c) -  *(__ebp - 0x44);
																if( *(__ecx + 0x2c) !=  *(__ebp - 0x44)) {
																	L236:
																	__edi =  *(__ebp - 0x44);
																	__edx =  *(__ebp - 0x40);
																	__eflags =  *(__ebp - 0xd) - __bl;
																	 *(__ebp - 0x98) = __edi;
																	 *(__ebp - 0x94) = __edx;
																	if( *(__ebp - 0xd) != __bl) {
																		L241:
																		__ecx =  *(__ecx + 8);
																		__eflags = __ecx - __ebx;
																		 *(__ebp - 0x20) = __ecx;
																		if(__ecx == __ebx) {
																			L249:
																			__eax =  *(__ebp - 0x38);
																			__ecx =  *(__ebp - 0x34);
																			__eflags =  *((intOrPtr*)(__ebp - 0x5d)) - __bl;
																			__al =  *((intOrPtr*)( *(__ebp - 0x34) +  *(__ebp - 0x38)));
																			if(__eflags == 0) {
																				__eflags = __al - __bl;
																				if(__eflags == 0) {
																					__eflags =  *((intOrPtr*)(__ebp - 0x39)) - __bl;
																					__eax =  *(__ebp - 0x48);
																					if(__eflags == 0) {
																						__eax = __eax + 0xa;
																						__eflags = __eax;
																					} else {
																						__eax = __eax + 0xd;
																					}
																				} else {
																					__eax =  *(__ebp - 0x48);
																					__eax =  *(__ebp - 0x48) + 7;
																				}
																			} else {
																				__eax =  *(__ebp - 0x48);
																				__eax =  *(__ebp - 0x48) + 4;
																			}
																			 *(__ebp - 0xb8) = __eax;
																			 *(__ebp - 0x64) = __ebx;
																			__eax = __ebp - 0x64;
																			__ecx =  *(__ebp - 0x54);
																			_push(__ebp - 0x64);
																			 *((char*)(__ebp - 4)) = 0x18;
																			_push( *(__ebp - 0x34));
																			_push( *(__ebp + 8));
																			__esi = L010EE7E8(__eflags);
																			__eflags = __esi - __ebx;
																			if(__esi != __ebx) {
																				L432:
																				__eax =  *(__ebp - 0x64);
																				 *((char*)(__ebp - 4)) = 0x16;
																				__eflags = __eax - __ebx;
																				if(__eax != __ebx) {
																					__ecx =  *__eax;
																					__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																				}
																				goto L434;
																			} else {
																				__eflags =  *(__ebp - 0x64) - __ebx;
																				if( *(__ebp - 0x64) == __ebx) {
																					L454:
																					__eax =  *(__ebp - 0x5c);
																					 *((char*)(__ebp - 4)) = 0x15;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x68);
																					 *((char*)(__ebp - 4)) = 0x14;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax = E010D1ABD(__eax,  *(__ebp - 0x50));
																					__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
																					__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
																					__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
																					__eax =  *(__ebp - 0x1c);
																					__eflags = __eax - __ebx;
																					 *((char*)(__ebp - 4)) = 0xa;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x24);
																					 *((char*)(__ebp - 4)) = 6;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__esi = 0x80004005;
																					goto L463;
																				}
																				__eax =  *(__ebp - 0xa0);
																				__edx =  *(__ebp - 0x10c);
																				__ecx =  *(__ebp - 0x9c);
																				__eax =  *(__ebp - 0xa0) - __edi;
																				__edx =  *( *(__ebp - 0x10c));
																				 *(__ebp - 0x114) = __ebx;
																				asm("sbb ecx, [ebp-0x94]");
																				 *(__ebp - 0x110) = __ebx;
																				__edx =  *( *(__ebp - 0x10c)) >> 5;
																				__eflags = __dl & 0x00000001;
																				if((__dl & 0x00000001) == 0) {
																					__esi =  *(__ebp - 0x28);
																					__edi =  *(__ebp - 0x98);
																					__edx =  *(__ebp - 0x94);
																					 *(__esi + 0x20) = __eax;
																					 *(__esi + 0x24) = __ecx;
																					 *(__esi + 0x28) = __edi;
																					 *(__esi + 0x18) = __edi;
																					 *(__esi + 0x10) = __ebx;
																					__ecx = __esi;
																					 *(__esi + 0x2c) = __edx;
																					 *(__esi + 0x1c) = __edx;
																					 *(__esi + 0x14) = __ebx;
																					E010D9EF5(__esi) =  *(__ebp - 0x94);
																					 *(__ebp - 0x114) = __edi;
																					 *(__ebp - 0x110) =  *(__ebp - 0x94);
																				} else {
																					__esi =  *(__ebp - 0x28);
																					__eax =  *(__ebp - 0xa0);
																					__ecx =  *(__ebp - 0x9c);
																					 *(__esi + 0x20) =  *(__ebp - 0xa0);
																					 *(__esi + 0x24) =  *(__ebp - 0x9c);
																					 *(__esi + 0x28) = __ebx;
																					 *(__esi + 0x18) = __ebx;
																					 *(__esi + 0x10) = __ebx;
																					__ecx = __esi;
																					 *(__esi + 0x2c) = __ebx;
																					 *(__esi + 0x1c) = __ebx;
																					 *(__esi + 0x14) = __ebx;
																					__eax = E010D9EF5(__esi);
																					__eax =  *(__ebp - 0x68);
																					__edi =  *(__ebp - 0x98);
																					__ecx =  *__eax;
																					__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __edi,  *(__ebp - 0x94), __ebx, __ebx);
																				}
																				__eflags =  *(__ebp - 0x5c) - __ebx;
																				 *(__ebp - 0x1b4) = __ebx;
																				 *(__ebp - 0x1b0) = __ebx;
																				if( *(__ebp - 0x5c) != __ebx) {
																					__eax =  *(__ebp - 0x80);
																					__ecx =  *( *(__ebp - 0x80) + 0x10);
																					__eax =  *(__ebp - 0xa8);
																					 *(__eax + 0x18) =  *( *(__ebp - 0x80) + 0x10);
																					 *(__eax + 0x1c) = __ebx;
																					 *(__eax + 0x20) = __edi;
																					__ecx =  *(__ebp - 0x94);
																					 *(__eax + 0x24) =  *(__ebp - 0x94);
																				}
																				__eax =  *(__ebp - 0x1a0);
																				__ecx =  *(__ebp - 0x94);
																				__eflags =  *(__ebp - 0xe) - __bl;
																				 *__eax = __ebx;
																				 *(__eax + 4) = __ebx;
																				__eax =  *(__ebp - 0x1a4);
																				 *__eax = __edi;
																				 *(__eax + 4) =  *(__ebp - 0x94);
																				if( *(__ebp - 0xe) == __bl) {
																					 *(__ebp + 8) =  *( *(__ebp + 8) + 0x38);
																				} else {
																					__eax =  *(__ebp - 0x5c);
																				}
																				__ecx =  *(__ebp - 0x64);
																				__dl = 1;
																				__eax = __ebp - 0x1b4;
																				 *(__ebp - 0x20) = E010F1B59( *(__ebp - 0x64), __edx,  *(__ebp - 0x68), __ebp - 0x1b4, __ebp - 0x1b4,  *(__ebp - 0x1c));
																				 *(__ebp - 0x10c) =  *( *(__ebp - 0x10c));
																				__eax =  *( *(__ebp - 0x10c)) >> 5;
																				__eflags = __al & 0x00000001;
																				if(__eflags == 0) {
																					__ecx =  *(__ebp - 0x94);
																					__eax = __edi;
																				} else {
																					__eax = 0;
																					__ecx = 0;
																				}
																				_push( *(__ebp - 0x20));
																				_push(__ecx);
																				__ecx =  *(__ebp - 0x54);
																				_push(__eax);
																				_push( *(__ebp - 0x64));
																				__eax = E010EE40F( *(__ebp - 0x54), __eflags);
																				__eflags = __eax - __ebx;
																				 *(__ebp - 0xb0) = __eax;
																				if(__eax != __ebx) {
																					__eax =  *(__ebp - 0x64);
																					 *((char*)(__ebp - 4)) = 0x16;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x5c);
																					 *((char*)(__ebp - 4)) = 0x15;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x68);
																					 *((char*)(__ebp - 4)) = 0x14;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax = E010D1ABD(__eax,  *(__ebp - 0x50));
																					__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
																					__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
																					__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
																					__eax =  *(__ebp - 0x1c);
																					__eflags = __eax - __ebx;
																					 *((char*)(__ebp - 4)) = 0xa;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x24);
																					 *((char*)(__ebp - 4)) = 6;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__esi =  *(__ebp - 0xb0);
																					goto L463;
																				} else {
																					__eflags =  *(__ebp - 0x20) - 1;
																					 *(__ebp - 0xd) = __bl;
																					if( *(__ebp - 0x20) != 1) {
																						__eflags =  *(__ebp - 0x20) - __ebx;
																						 *(__ebp - 0xd) = 1;
																						if(__eflags != 0) {
																							__eax =  *(__ebp - 0x64);
																							 *((char*)(__ebp - 4)) = 0x16;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax =  *(__ebp - 0x5c);
																							 *((char*)(__ebp - 4)) = 0x15;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax =  *(__ebp - 0x68);
																							 *((char*)(__ebp - 4)) = 0x14;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax = E010D1ABD(__eax,  *(__ebp - 0x50));
																							__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
																							__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
																							__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
																							__eax =  *(__ebp - 0x1c);
																							__eflags = __eax - __ebx;
																							 *((char*)(__ebp - 4)) = 0xa;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax =  *(__ebp - 0x24);
																							 *((char*)(__ebp - 4)) = 6;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__esi =  *(__ebp - 0x20);
																							goto L463;
																						}
																						L283:
																						__ecx = __ebp - 0x190;
																						E010ECE85(__ebp - 0x190, __eflags) =  *(__ebp - 0x94);
																						 *((char*)(__ebp - 4)) = 0x19;
																						 *(__ebp - 0x18c) =  *(__ebp - 0x94);
																						__eax =  *(__ebp - 0x10c);
																						 *(__ebp - 0x190) = __edi;
																						 *( *(__ebp - 0x10c)) =  *( *(__ebp - 0x10c)) >> 5;
																						__eflags = __al & 0x00000001;
																						__eax =  *(__ebp - 0x54);
																						if((__al & 0x00000001) == 0) {
																							__ecx =  *(__eax + 0xa8);
																							__ecx = __ecx |  *(__eax + 4);
																							__eflags = __ecx;
																							if(__ecx != 0) {
																								L452:
																								__ecx = __ebp - 0x190;
																								__eax = E010ECEE9(__ebp - 0x190);
																								__eax =  *(__ebp - 0x64);
																								 *((char*)(__ebp - 4)) = 0x16;
																								__eflags = __eax - __ebx;
																								if(__eax != __ebx) {
																									__ecx =  *__eax;
																									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																								}
																								goto L454;
																							}
																							L286:
																							__edx =  *(__ebp - 0x54);
																							__eax =  *(__edx + 0xc0);
																							__ecx = __edx + 0xc0;
																							 *(__ebp - 0x198) = __eax;
																							__eax = __eax -  *(__ebp - 0x190);
																							__ecx =  *(__edx + 0xc4);
																							 *(__ebp - 0x194) = __ecx;
																							__esi = __eax;
																							asm("sbb ecx, [ebp-0x18c]");
																							 *(__ebp - 0x11c) = __esi;
																							__edi = __ecx;
																							 *(__ebp - 0x118) = __edi;
																							__dl =  *((intOrPtr*)(__edx + 0xb8));
																							__eflags = __dl - __bl;
																							 *(__ebp - 0xa2) = __dl;
																							if(__dl == __bl) {
																								L292:
																								__esi = __esi | __edi;
																								__eflags = __esi | __edi;
																								if((__esi | __edi) == 0) {
																									goto L452;
																								}
																								__eflags = __edi - 0x80000000;
																								if(__eflags > 0) {
																									goto L452;
																								}
																								if(__eflags < 0) {
																									L296:
																									__cl = 0;
																									__eflags =  *(__ebp - 0xd) - __bl;
																									if( *(__ebp - 0xd) != __bl) {
																										__eflags =  *(__ebp - 0xa2) - __bl;
																										if( *(__ebp - 0xa2) == __bl) {
																											__esi =  *(__ebp - 0x11c);
																											__edi =  *(__ebp - 0x118);
																											 *((char*)(__ebp - 0x124)) = 1;
																											__cl = 1;
																											__eflags = 1;
																											 *(__ebp - 0xa1) = __bl;
																										}
																									}
																									__eflags =  *(__ebp - 0x18c) - __ebx;
																									 *(__ebp - 0x188) = __esi;
																									 *(__ebp - 0x184) = __edi;
																									if(__eflags > 0) {
																										L303:
																										 *(__ebp - 0x190) =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
																										__eflags =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
																										if(( *(__ebp - 0x190) |  *(__ebp - 0x18c)) != 0) {
																											L311:
																											__eax =  *(__ebp - 0x48);
																											__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
																											if( *((intOrPtr*)(__eax + 0x13)) == __bl) {
																												__eflags = __cl - __bl;
																												if(__cl != __bl) {
																													goto L312;
																												}
																												__esi = __esi +  *(__ebp - 0x190);
																												__eflags = __esi;
																												asm("adc edi, [ebp-0x18c]");
																												 *(__ebp - 0x44) = __esi;
																												 *(__ebp - 0x40) = __edi;
																												L315:
																												__edx =  *(__ebp - 0x10c);
																												__ecx =  *(__ebp - 0x64);
																												__eax = __ebp - 0x190;
																												_push(__ebp - 0x190);
																												__esi = E010F16BA( *(__ebp - 0x64),  *(__ebp - 0x10c));
																												__eflags = __esi - __ebx;
																												if(__esi != __ebx) {
																													__ecx = __ebp - 0x190;
																													__eax = E010ECEE9(__ebp - 0x190);
																													goto L432;
																												}
																												__eax =  *(__ebp - 0x18c);
																												__eflags =  *(__ebp - 0x18c) -  *(__ebp - 0x94);
																												if(__eflags > 0) {
																													L329:
																													__eflags =  *(__ebp - 0xd) - __bl;
																													if(__eflags == 0) {
																														L362:
																														__eax =  *(__ebp - 0x34);
																														__ecx =  *(__ebp - 0x80);
																														 *(__ebp - 0x128) =  *(__ebp - 0x34);
																														__ebp - 0x190 = E010ECF11( *(__ebp - 0x80), __ebp, __eflags, __ebp - 0x190);
																														__ecx = __ebp - 0x190;
																														 *(__ebp - 0x5e) = 1;
																														__eax = E010ECEE9(__ebp - 0x190);
																														__ecx = __ebp - 0x64;
																														 *((char*)(__ebp - 4)) = 0x16;
																														__eax = E010D9116(__ebp - 0x64);
																														L364:
																														__eflags =  *(__ebp - 0xa1) - __bl;
																														if( *(__ebp - 0xa1) == __bl) {
																															L368:
																															 *(__ebp - 0xf) = __bl;
																															goto L367;
																														}
																														__eflags =  *(__ebp - 0x5e) - __bl;
																														if( *(__ebp - 0x5e) == __bl) {
																															goto L368;
																														}
																														 *(__ebp - 0xf) = 1;
																														goto L367;
																													}
																													__ecx =  *(__ebp - 0x48);
																													__eflags =  *((intOrPtr*)(__ecx + 0x11)) - __bl;
																													if(__eflags == 0) {
																														goto L362;
																													}
																													__eflags =  *(__ebp - 0xa2) - __bl;
																													if(__eflags == 0) {
																														goto L362;
																													}
																													__esi =  *(__ebp - 0x54);
																													 *(__ebp - 0x5e) = __bl;
																													__al =  *(__esi + 0x10);
																													__eflags = __al - __bl;
																													 *(__ebp - 0xe) = __al;
																													if(__al == __bl) {
																														L337:
																														__edi =  *(__ebp - 0x190);
																														__edi = __edi |  *(__ebp - 0x18c);
																														__eflags = __edi |  *(__ebp - 0x18c);
																														if((__edi |  *(__ebp - 0x18c)) == 0) {
																															__eflags =  *(__ebp - 0xe) - __bl;
																															if( *(__ebp - 0xe) != __bl) {
																																__eax =  *(__ebp - 0xb8);
																																__al =  *( *(__ebp - 0xb8));
																															} else {
																																__al = 1;
																															}
																															__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - 0xfffffffe;
																															if( *((intOrPtr*)(__ebp - 0xc8)) >= 0xfffffffe) {
																																__al = 1;
																															}
																														} else {
																															__eflags =  *((intOrPtr*)(__ebp - 0x143)) - __bl;
																															if( *((intOrPtr*)(__ebp - 0x143)) != __bl) {
																																__al =  *(__ebp - 0x5e);
																															} else {
																																__eflags =  *(__ebp - 0xe) - __bl;
																																__eax =  *(__ebp - 0xb8);
																																if( *(__ebp - 0xe) == __bl) {
																																	__al =  *(__eax + 1);
																																} else {
																																	__al =  *((intOrPtr*)(__eax + 2));
																																}
																															}
																														}
																														__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - __ebx;
																														if( *((intOrPtr*)(__ebp - 0xc8)) < __ebx) {
																															__eflags =  *((intOrPtr*)(__ebp - 0x144)) - __bl;
																															if( *((intOrPtr*)(__ebp - 0x144)) != __bl) {
																																__al = 0;
																																__eflags = 0;
																															}
																														}
																														__eflags = __al - __bl;
																														if(__al != __bl) {
																															L449:
																															__eax =  *(__ebp - 0x30);
																															__ecx = __esi + 4;
																															E010E0E48(__esi + 4,  *( *(__ebp - 0x30))) = __ebp - 0x64;
																															__ecx = __esi;
																															E010F2F6D(__ebp - 0x64) =  *(__ebp - 0x34);
																															__ecx =  *(__ebp - 0x114);
																															 *(__esi + 0x94) =  *(__ebp - 0x34);
																															__eax =  *(__ebp - 0x19c);
																															 *__eax =  *(__ebp - 0x114);
																															__ecx =  *(__ebp - 0x110);
																															 *(__eax + 4) =  *(__ebp - 0x110);
																															__ecx = __ebp - 0x190;
																															__eax = E010ECEE9(__ebp - 0x190);
																															__ecx = __ebp - 0x64;
																															 *((char*)(__ebp - 4)) = 0x16;
																															__eax = E010D9116(__ebp - 0x64);
																															L450:
																															__ecx = __ebp - 0x5c;
																															 *((char*)(__ebp - 4)) = 0x15;
																															__eax = E010D9116(__ebp - 0x5c);
																															__ecx = __ebp - 0x68;
																															 *((char*)(__ebp - 4)) = 0x14;
																															__eax = E010D9116(__ebp - 0x68);
																															__ecx = __ebp - 0x50;
																															 *((char*)(__ebp - 4)) = 0x13;
																															__eax = E010D616E(__ebp - 0x50);
																															__ecx = __ebp - 0x7c;
																															 *((char*)(__ebp - 4)) = 0x12;
																															__eax = E010D616E(__ebp - 0x7c);
																															L451:
																															__ecx = __ebp - 0x14;
																															 *((char*)(__ebp - 4)) = 0x11;
																															__eax = E010D616E(__ebp - 0x14);
																															L395:
																															__ecx = __ebp - 0xe0;
																															 *((char*)(__ebp - 4)) = 0x10;
																															__eax = E010D616E(__ebp - 0xe0);
																															__ecx = __ebp - 0xd4;
																															 *((char*)(__ebp - 4)) = 0xb;
																															__eax = E010D616E(__ebp - 0xd4);
																															__ecx = __ebp - 0x1c;
																															 *((char*)(__ebp - 4)) = 0xa;
																															__eax = E010D9116(__ebp - 0x1c);
																															__ecx = __ebp - 0x24;
																															 *((char*)(__ebp - 4)) = 6;
																															__eax = E010D9116(__ebp - 0x24);
																															__ecx = __ebp - 0x58;
																															 *((char*)(__ebp - 4)) = 3;
																															__eax = E010D616E(__ebp - 0x58);
																															__ecx = __ebp - 0x38;
																															 *((char*)(__ebp - 4)) = 2;
																															__eax = E010D616E(__ebp - 0x38);
																															__ecx = __ebp - 0x8c;
																															 *((char*)(__ebp - 4)) = 1;
																															__eax = E010D616E(__ebp - 0x8c);
																															__ecx = __ebp - 0xc4;
																															__eax = E010D616E(__ebp - 0xc4);
																															__ecx = __ebp - 0xec;
																															__eax = E010D616E(__ebp - 0xec);
																															goto L396;
																														} else {
																															__eflags =  *((intOrPtr*)(__ebp - 0x144)) - __bl;
																															if(__eflags != 0) {
																																goto L362;
																															}
																															__eflags =  *(__ebp - 0xe) - __bl;
																															if(__eflags != 0) {
																																goto L362;
																															}
																															__eflags =  *((intOrPtr*)(__ebp - 0x143)) - __bl;
																															if( *((intOrPtr*)(__ebp - 0x143)) == __bl) {
																																L356:
																																__eax =  *(__ebp - 0x80);
																																__edi =  *(__ebp - 0x80) + 0xc;
																																__ecx = __edi;
																																__eax = E010F2FF6(__edi);
																																__eflags = __al;
																																if(__al == 0) {
																																	__ecx = __edi;
																																	__eflags = E010F2FF2(__edi) - 1;
																																	if(__eflags != 0) {
																																		goto L362;
																																	}
																																	__ecx = __edi;
																																	__eflags =  *((intOrPtr*)(E010F2FFF(__edi, __ebx) + 0x4c)) - __bl;
																																	if(__eflags == 0) {
																																		goto L362;
																																	}
																																	__eax =  *(__ebp - 0x48);
																																	__eflags =  *((intOrPtr*)( *(__ebp - 0x48) + 0xe)) - __bl;
																																	L361:
																																	if(__eflags != 0) {
																																		goto L449;
																																	}
																																	goto L362;
																																}
																																__eax =  *(__ebp - 0xb8);
																																__eflags =  *( *(__ebp - 0xb8) + 1) - __bl;
																																goto L361;
																															}
																															__eflags = __edi;
																															if(__eflags != 0) {
																																goto L362;
																															}
																															goto L356;
																														}
																													}
																													__eflags =  *((intOrPtr*)(__ecx + 0x14)) - __bl;
																													if( *((intOrPtr*)(__ecx + 0x14)) == __bl) {
																														goto L337;
																													}
																													__eax =  *(__esi + 0xb0);
																													__ecx =  *(__esi + 0xb4);
																													__eax =  *(__esi + 0xb0) +  *(__esi + 0xa8);
																													asm("adc ecx, [esi+0xac]");
																													__eax =  *(__esi + 0xb0) +  *(__esi + 0xa8) +  *(__ebp - 0x114);
																													asm("adc ecx, [ebp-0x110]");
																													__ecx = __esi;
																													__edi = E010EE980(__esi,  *(__ebp + 8),  *(__esi + 0xb0) +  *(__esi + 0xa8) +  *(__ebp - 0x114),  *(__esi + 0xb4));
																													__eflags = __edi - __ebx;
																													if(__edi != __ebx) {
																														__ecx = __ebp - 0x190;
																														__eax = E010ECEE9(__ebp - 0x190);
																														__eax =  *(__ebp - 0x64);
																														 *((char*)(__ebp - 4)) = 0x16;
																														__eflags = __eax - __ebx;
																														if(__eax != __ebx) {
																															__ecx =  *__eax;
																															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																														}
																														__eax =  *(__ebp - 0x5c);
																														 *((char*)(__ebp - 4)) = 0x15;
																														__eflags = __eax - __ebx;
																														if(__eax != __ebx) {
																															__ecx =  *__eax;
																															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																														}
																														__eax =  *(__ebp - 0x68);
																														 *((char*)(__ebp - 4)) = 0x14;
																														__eflags = __eax - __ebx;
																														if(__eax != __ebx) {
																															__ecx =  *__eax;
																															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																														}
																														__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
																														__ebx = __edi;
																														goto L451;
																													}
																													__eflags =  *((intOrPtr*)(__esi + 0x12)) - __bl;
																													if( *((intOrPtr*)(__esi + 0x12)) != __bl) {
																														 *(__ebp - 0xe) = __bl;
																													}
																													goto L337;
																												}
																												if(__eflags < 0) {
																													L319:
																													__eax =  *(__ebp - 0x48);
																													__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
																													if( *((intOrPtr*)(__eax + 0x13)) != __bl) {
																														goto L329;
																													}
																													__eax =  *(__ebp - 0x80);
																													__eflags =  *((intOrPtr*)(__eax + 0x10)) - __ebx;
																													if( *((intOrPtr*)(__eax + 0x10)) == __ebx) {
																														goto L329;
																													}
																													__edi = __eax + 0xc;
																													while(1) {
																														__eax =  *(__edi + 4);
																														__ecx =  *__edi;
																														__eax =  *( *__edi +  *(__edi + 4) * 4 - 4);
																														__ecx =  *(__eax + 4);
																														__esi =  *__eax;
																														__eflags =  *(__eax + 4) -  *(__ebp - 0x18c);
																														if(__eflags < 0) {
																															goto L329;
																														}
																														if(__eflags > 0) {
																															L325:
																															__edx =  *(__eax + 8);
																															__eax =  *(__eax + 0xc);
																															__edx = __edx + __esi;
																															__esi =  *(__ebp - 0x188);
																															asm("adc eax, ecx");
																															__esi =  *(__ebp - 0x188) +  *(__ebp - 0x190);
																															__ecx =  *(__ebp - 0x184);
																															asm("adc ecx, [ebp-0x18c]");
																															__eflags = __eax -  *(__ebp - 0x184);
																															if(__eflags > 0) {
																																goto L329;
																															}
																															if(__eflags < 0) {
																																L328:
																																__ecx = __edi;
																																__eax = E010F3100(__edi);
																																__eax =  *(__ebp - 0x80);
																																__eflags =  *((intOrPtr*)(__eax + 0x10)) - __ebx;
																																if( *((intOrPtr*)(__eax + 0x10)) != __ebx) {
																																	continue;
																																}
																																goto L329;
																															}
																															__eflags = __edx - __esi;
																															if(__edx > __esi) {
																																goto L329;
																															}
																															goto L328;
																														}
																														__eflags = __esi -  *(__ebp - 0x190);
																														if(__esi <  *(__ebp - 0x190)) {
																															goto L329;
																														}
																														goto L325;
																													}
																													goto L329;
																												}
																												__eax =  *(__ebp - 0x190);
																												__eflags =  *(__ebp - 0x190) -  *(__ebp - 0x98);
																												if( *(__ebp - 0x190) >=  *(__ebp - 0x98)) {
																													goto L329;
																												}
																												goto L319;
																											}
																											L312:
																											 *(__ebp - 0x44) =  *(__ebp - 0x44) + 1;
																											asm("adc [ebp-0x40], ebx");
																											goto L315;
																										}
																										__eflags =  *((intOrPtr*)(__ebp - 0x124)) - __bl;
																										if( *((intOrPtr*)(__ebp - 0x124)) != __bl) {
																											goto L311;
																										}
																										__eax =  *(__ebp - 0x54);
																										__eax =  *(__ebp - 0x54) + 0xc0;
																										__eflags = __edi -  *(__eax + 4);
																										if(__eflags < 0) {
																											goto L311;
																										}
																										if(__eflags > 0) {
																											L308:
																											__eax =  *(__ebp - 0x48);
																											__eflags =  *((intOrPtr*)(__eax + 0x11)) - __bl;
																											if( *((intOrPtr*)(__eax + 0x11)) != __bl) {
																												goto L311;
																											}
																											__ecx = __ebp - 0x190;
																											__eax = E010ECEE9(__ebp - 0x190);
																											__eax =  *(__ebp - 0x64);
																											 *((char*)(__ebp - 4)) = 0x16;
																											__eflags = __eax - __ebx;
																											if(__eax != __ebx) {
																												__ecx =  *__eax;
																												__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																											}
																											__esi =  *(__ebp - 0x28);
																											do {
																												do {
																													do {
																														do {
																															do {
																																while(1) {
																																	L216:
																																	__eflags =  *(__ebp - 0xf) - __bl;
																																	if( *(__ebp - 0xf) == __bl) {
																																		goto L219;
																																	}
																																	goto L217;
																																}
																																L235:
																																__eax =  *(__ebp - 0x58);
																																__eflags =  *(__eax + __edi) - __bl;
																															} while ( *(__eax + __edi) != __bl);
																															goto L236;
																														} while (__eflags < 0);
																														if(__eflags > 0) {
																															break;
																														}
																														__eflags = __edi - __eax;
																													} while (__edi < __eax);
																													__edi =  *(__ebp - 0x44);
																													__edi =  *(__ebp - 0x44) - __eax;
																													__eflags = __edi;
																													__eax =  *(__ebp - 0x40);
																													asm("sbb eax, ebx");
																													 *(__ebp - 0x98) = __edi;
																													 *(__ebp - 0x94) =  *(__ebp - 0x40);
																													goto L241;
																													L246:
																													__edx =  *(__ebp - 0x2c);
																													__ecx = __esi + 0x3c;
																													__edx =  *(__ebp - 0x2c) - __eax;
																													__ecx =  *(__esi + 0x3c);
																													__eax =  *(__ebp - 0x20)(__eax, __edx);
																													__eflags = __eax - __ebx;
																												} while (__eax == __ebx);
																												__eflags = __eax - 2;
																												if(__eax != 2) {
																													goto L249;
																												}
																												__eflags =  *(__ebp - 0x15) - __bl;
																											} while ( *(__ebp - 0x15) != __bl);
																											goto L249;
																										}
																										__eflags = __esi -  *__eax;
																										if(__esi <  *__eax) {
																											goto L311;
																										}
																										goto L308;
																									} else {
																										if(__eflags < 0) {
																											L302:
																											__esi = __esi +  *(__ebp - 0x190);
																											__eflags = __esi;
																											 *(__ebp - 0x190) = __ebx;
																											asm("adc edi, [ebp-0x18c]");
																											 *(__ebp - 0x188) = __esi;
																											 *(__ebp - 0x18c) = __ebx;
																											 *(__ebp - 0x184) = __edi;
																											goto L303;
																										}
																										__eflags =  *(__ebp - 0x190) - __ebx;
																										if( *(__ebp - 0x190) >= __ebx) {
																											goto L303;
																										}
																										goto L302;
																									}
																								}
																								__eflags = __esi - __ebx;
																								if(__esi > __ebx) {
																									goto L452;
																								}
																								goto L296;
																							}
																							__edx =  *(__ebp - 0x54);
																							__esi =  *(__ebp - 0x190);
																							__edx =  *(__ebp - 0x54) + 0xb0;
																							__esi =  *(__ebp - 0x190) +  *__edx;
																							 *(__ebp - 0x1c4) =  *(__ebp - 0x190) +  *__edx;
																							__esi =  *(__ebp - 0x18c);
																							asm("adc esi, [edx+0x4]");
																							__eflags =  *(__ebp - 0x18c) -  *(__ebp - 0x194);
																							if(__eflags < 0) {
																								L291:
																								__esi =  *__edx;
																								__edi =  *(__edx + 4);
																								goto L292;
																							}
																							if(__eflags > 0) {
																								L290:
																								 *__edx = __eax;
																								 *(__edx + 4) = __ecx;
																								goto L291;
																							}
																							__esi =  *(__ebp - 0x198);
																							__eflags =  *(__ebp - 0x1c4) -  *(__ebp - 0x198);
																							if( *(__ebp - 0x1c4) <=  *(__ebp - 0x198)) {
																								goto L291;
																							}
																							goto L290;
																						}
																						__ecx =  *(__eax + 0xa8);
																						 *(__ebp - 0x190) =  *(__eax + 0xa8);
																						 *(__ebp - 0x18c) = __eax;
																						goto L286;
																					}
																					__eax =  *(__ebp - 0x48);
																					__eflags =  *((intOrPtr*)(__eax + 0x12)) - __bl;
																					if( *((intOrPtr*)(__eax + 0x12)) != __bl) {
																						__eax =  *(__ebp - 0x54);
																						__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
																						if( *((intOrPtr*)(__eax + 0x13)) == __bl) {
																							L280:
																							__eax =  *(__ebp - 0x64);
																							 *((char*)(__ebp - 4)) = 0x16;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							continue;
																							do {
																								do {
																									do {
																										do {
																											L216:
																											__eflags =  *(__ebp - 0xf) - __bl;
																											if( *(__ebp - 0xf) == __bl) {
																												goto L219;
																											}
																											goto L217;
																											L221:
																											__edx =  *(__ebp - 0x50);
																											__eflags =  *((intOrPtr*)(__edi + __edx)) - __bl;
																										} while ( *((intOrPtr*)(__edi + __edx)) != __bl);
																										L222:
																										__edx =  *(__ebp + 8);
																										__eflags =  *(__ebp - 0x40) - __ebx;
																										 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
																										__ecx =  *( *( *( *(__ebp + 8)) + 0x28) + __ecx);
																										__edx =  *(__ecx + 0x2c);
																									} while (__eflags < 0);
																									if(__eflags > 0) {
																										goto L225;
																									}
																									__eflags =  *(__ebp - 0x44) - __edx;
																								} while ( *(__ebp - 0x44) < __edx);
																								L225:
																								__ecx =  *(__ecx + 0x30);
																								__edx =  *(__ebp - 0x104);
																								__eax =  *(__ecx + __eax * 4);
																								__ecx =  *(__eax + 4);
																								__edx =  *(__ebp - 0x104) + __ecx;
																								__eflags = __edx -  *(__ebp - 0xf0);
																							} while (__edx >  *(__ebp - 0xf0));
																							__eax =  *__eax;
																							__eflags = __ecx - __ebx;
																							 *(__ebp - 0x20) = __ebx;
																							if(__ecx <= __ebx) {
																								L230:
																								__edi =  *(__ebp - 0x34);
																								 *(__ebp - 0xd) = __bl;
																								goto L231;
																							}
																							__edx =  *(__ebp - 0x90);
																							__edi = __eax;
																							__edx =  *(__ebp - 0x90) - __eax;
																							__eflags = __edx;
																							while(1) {
																								__al =  *((intOrPtr*)(__edx + __edi));
																								__eflags = __al -  *__edi;
																								if(__al !=  *__edi) {
																									goto L216;
																								}
																								 *(__ebp - 0x20) =  *(__ebp - 0x20) + 1;
																								__edi = __edi + 1;
																								__eflags =  *(__ebp - 0x20) - __ecx;
																								if( *(__ebp - 0x20) < __ecx) {
																									continue;
																								}
																								goto L230;
																							}
																							continue;
																						}
																						__eflags =  *(__eax + 0x14) & 0x00000001;
																						if(( *(__eax + 0x14) & 0x00000001) != 0) {
																							goto L280;
																						}
																						__eflags =  *((intOrPtr*)(__eax + 0xb8)) - __bl;
																						if( *((intOrPtr*)(__eax + 0xb8)) == __bl) {
																							goto L280;
																						}
																						__ecx =  *(__eax + 0xb0);
																						__eflags = __ecx;
																						if(__eflags != 0) {
																							goto L283;
																						}
																						goto L280;
																					}
																					__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - __ebx;
																					if( *((intOrPtr*)(__ebp - 0xc8)) >= __ebx) {
																						goto L280;
																					}
																					__eax =  *(__ebp - 0x54);
																					__eax =  *(__ebp - 0x54) + 0x10;
																					__eflags =  *((intOrPtr*)(__eax + 3)) - __bl;
																					if( *((intOrPtr*)(__eax + 3)) == __bl) {
																						goto L280;
																					}
																					__eflags =  *(__eax + 4) & 0x00000001;
																					if(( *(__eax + 4) & 0x00000001) == 0) {
																						__ecx =  *(__ebp - 0x54);
																						__edx =  *(__ebp - 0x34);
																						 *(__ecx + 0x1c) =  *(__ebp - 0x34);
																						__eax = E010F1C2F(__ecx, __eax);
																						__eax =  *(__ebp - 0x64);
																						 *((char*)(__ebp - 4)) = 0x16;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax =  *(__ebp - 0x5c);
																						 *((char*)(__ebp - 4)) = 0x15;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax =  *(__ebp - 0x68);
																						 *((char*)(__ebp - 4)) = 0x14;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax = E010D1ABD(__eax,  *(__ebp - 0x50));
																						__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
																						__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
																						__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
																						L415:
																						__eax =  *(__ebp - 0x1c);
																						 *((char*)(__ebp - 4)) = 0xa;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax =  *(__ebp - 0x24);
																						 *((char*)(__ebp - 4)) = 6;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__esi = 1;
																						goto L463;
																					}
																					goto L280;
																				}
																			}
																		}
																		__eax =  *(__ebp - 0x94);
																		__eflags =  *(__ebp - 0x94) -  *(__ebp - 0x6c);
																		if(__eflags < 0) {
																			goto L249;
																		}
																		if(__eflags > 0) {
																			L245:
																			__eax = __edi;
																			__eax = __edi -  *(__ebp - 0x70);
																			__eflags = __eax -  *(__ebp - 0x2c);
																			if(__eax >=  *(__ebp - 0x2c)) {
																				goto L249;
																			}
																			goto L246;
																		}
																		__eflags = __edi -  *(__ebp - 0x70);
																		if(__edi <  *(__ebp - 0x70)) {
																			goto L249;
																		}
																		goto L245;
																	}
																	__eax =  *(__ecx + 0x2c);
																	__eflags = __edx - __ebx;
																}
																__eflags = 0 -  *(__ebp - 0x40);
																if(0 !=  *(__ebp - 0x40)) {
																	goto L236;
																}
																goto L235;
															}
															 *(__ebp - 0x44) =  *(__ebp - 0x44) |  *(__ebp - 0x40);
															__eflags =  *(__ebp - 0x44) |  *(__ebp - 0x40);
															if(( *(__ebp - 0x44) |  *(__ebp - 0x40)) == 0) {
																goto L235;
															}
															goto L233;
															L219:
															__eax =  *(__ebp - 0x4c);
															__eflags = __eax - 0xff;
															if(__eax == 0xff) {
																 *(__ebp - 0x44) =  *(__ebp - 0x44) + 1;
																asm("adc [ebp-0x40], ebx");
																goto L364;
															}
															__ecx =  *(__ebp - 0xe0);
															__edx =  *(__ebp - 0xd4);
															__edi =  *( *(__ebp - 0xe0) + __eax * 4);
															__ecx = __edi;
															 *(__ebp - 0x34) = __edi;
															__ecx = __edi << 2;
															__eax = __eax -  *((intOrPtr*)(__ecx +  *(__ebp - 0xd4)));
															__edx =  *(__ebp - 0x4c);
															__eflags =  *(__ebp - 0xf) - __bl;
															__edx =  *(__ebp +  *(__ebp - 0x4c) - 0x2cc) & 0x000000ff;
															 *(__ebp - 0x4c) =  *(__ebp +  *(__ebp - 0x4c) - 0x2cc) & 0x000000ff;
															if( *(__ebp - 0xf) == __bl) {
																goto L222;
															}
															goto L221;
														}
													}
												}
												if(__eflags < 0) {
													L178:
													__esi = __esi - __edx;
													__eflags = __esi;
													asm("sbb eax, ecx");
													__ecx = __esi;
													 *(__ebp - 0xb0) = __eax;
													if(__esi != 0) {
														L181:
														__edi =  *(__ebp - 0x44);
														__eax =  *(__ebp - 0x40);
														__edi =  *(__ebp - 0x44) - 0x10000;
														 *(__ebp - 0x2c) = __ebx;
														 *(__ebp - 0x70) = __edi;
														asm("sbb eax, ebx");
														L182:
														 *(__ebp - 0x6c) = __eax;
														continue;
													}
													__eflags = __ecx - 0x10000;
													if(__ecx > 0x10000) {
														goto L181;
													}
													__eax =  *(__ebp - 0x28);
													__esi = 0x10000;
													__eax =  *(__ebp - 0x28) + 0x3c;
													__esi = 0x10000 - __ecx;
													__eax =  *( *(__ebp - 0x28) + 0x3c);
													__eax = __eax - 0x10000;
													__ecx = __eax - 0x10000 +  *(__ebp - 0x2c);
													__eax = memmove(__eax, __eax - 0x10000 +  *(__ebp - 0x2c), 0x10000);
													__edi =  *(__ebp - 0x44);
													__eax =  *(__ebp - 0x40);
													__esp = __esp + 0xc;
													__ecx = 0;
													__edi =  *(__ebp - 0x44) - 0x10000;
													 *(__ebp - 0x2c) = __esi;
													 *(__ebp - 0x70) = __edi;
													asm("sbb eax, ecx");
													goto L182;
												}
												__eflags = __edx - __esi;
												if(__edx >= __esi) {
													goto L183;
												}
												goto L178;
											}
											__ecx = 0x400000;
											__eax = __edx;
											__edx =  *(__ebp - 0x30);
											__ecx = 0x400000 - __eax;
											 *(__ebp - 0x120) = 0x400000 - __eax;
											__edx =  *( *(__ebp - 0x30));
											__eax = __eax + __edi;
											__ecx = 0;
											 *(__ebp - 0x1ac) = __eax;
											asm("adc ecx, [ebp-0x6c]");
											__esi =  *__edx;
											 *(__ebp - 0x1a8) = __ecx;
											__esi =  *((intOrPtr*)( *__edx + 0x10))(__edx, __eax, 0x400000, __ebx, __ebx);
											__eflags = __esi - __ebx;
											if(__esi != __ebx) {
												goto L434;
											}
											__esi =  *(__ebp - 0x28);
											__ebp - 0x120 =  *(__ebp - 0x2c);
											__esi + 0x3c =  *(__esi + 0x3c);
											__edx =  *(__ebp - 0x2c) +  *(__esi + 0x3c);
											__eax =  *(__ebp - 0x30);
											__ecx =  *( *(__ebp - 0x30));
											__eax = E010DAF2F( *( *(__ebp - 0x30)), __edx, __ebp - 0x120);
											__eflags = __eax - __ebx;
											 *(__ebp - 0xf0) = __eax;
											if(__eax != __ebx) {
												__eax =  *(__ebp - 0x5c);
												 *((char*)(__ebp - 4)) = 0x15;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax =  *(__ebp - 0x68);
												 *((char*)(__ebp - 4)) = 0x14;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax = E010D1ABD(__eax,  *(__ebp - 0x50));
												__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
												__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
												__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
												__eax =  *(__ebp - 0x1c);
												__eflags = __eax - __ebx;
												 *((char*)(__ebp - 4)) = 0xa;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax =  *(__ebp - 0x24);
												 *((char*)(__ebp - 4)) = 6;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__esi =  *(__ebp - 0xf0);
												goto L463;
											}
											__eax =  *(__ebp - 0x120);
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx =  *(__esi + 0x3c);
												 *(__ebp - 0x2c) = __eax +  *(__ebp - 0x2c);
												 *(__esi + 0x30) =  *(__esi + 0x3c);
												 *(__esi + 0x34) = __eax;
												 *(__esi + 0x38) = __edi;
											} else {
												__eax =  *(__ebp - 0x1ac);
												 *(__ebp - 0x15) = 1;
												 *(__ebp - 0xa0) =  *(__ebp - 0x1ac);
												__eax =  *(__ebp - 0x1a8);
												 *(__ebp - 0x9c) =  *(__ebp - 0x1a8);
											}
											continue;
											L186:
											__eflags =  *(__ebp - 0x2c) - __esi;
											if( *(__ebp - 0x2c) <= __esi) {
												L387:
												__eax =  *(__ebp - 0x48);
												__eflags =  *((intOrPtr*)(__eax + 0x12)) - __bl;
												if( *((intOrPtr*)(__eax + 0x12)) == __bl) {
													L393:
													__ecx = __ebp - 0x5c;
													 *((char*)(__ebp - 4)) = 0x15;
													__eax = E010D9116(__ebp - 0x5c);
													__ecx = __ebp - 0x68;
													 *((char*)(__ebp - 4)) = 0x14;
													__eax = E010D9116(__ebp - 0x68);
													__ecx = __ebp - 0x50;
													 *((char*)(__ebp - 4)) = 0x13;
													__eax = E010D616E(__ebp - 0x50);
													__ecx = __ebp - 0x7c;
													 *((char*)(__ebp - 4)) = 0x12;
													__eax = E010D616E(__ebp - 0x7c);
													__ecx = __ebp - 0x14;
													 *((char*)(__ebp - 4)) = 0x11;
													__eax = E010D616E(__ebp - 0x14);
													__ecx =  *(__ebp - 0x54);
													__eax = E010F2F7B( *(__ebp - 0x54));
													__eflags = __al;
													if(__al != 0) {
														__ebx = 1;
													}
													goto L395;
												}
												__esi =  *(__ebp - 0x80);
												__edi = __esi + 0xc;
												__ecx = __edi;
												__eax = E010F2FF2(__edi);
												_push( *(__ebp - 0x9c));
												__eax =  ~__eax;
												_push( *(__ebp - 0xa0));
												__ecx = __esi;
												asm("sbb al, al");
												__al = __al + 1;
												 *(__ebp + 0xb) = __al;
												__eax = E010ECDD1(__esi);
												__ecx = __edi;
												__eax = E010F2FF2(__edi);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags =  *(__ebp + 0xb) - __bl;
													if( *(__ebp + 0xb) != __bl) {
														L392:
														__eax =  *(__ebp - 0x30);
														__ecx = __esi + 0x20;
														__eax = E010E0E48(__esi + 0x20,  *( *(__ebp - 0x30)));
														__esi =  *(__ebp - 0x54);
														__eax = __ebp - 0x24;
														__ecx = __esi;
														__eax = E010F2F6D(__ebp - 0x24);
														__ecx = __esi + 0x10;
														__eax = E010EE3E3(__esi + 0x10);
														 *((char*)(__esi + 0xd8)) = 1;
														 *(__esi + 0x94) =  *(__esi + 0x94) | 0xffffffff;
														 *(__esi + 0xa8) = __ebx;
														 *(__esi + 0xac) = __ebx;
														goto L450;
													}
													__ecx = __edi;
													__eax = E010F2FF2(__edi);
													__eflags = __eax - 1;
													if(__eax == 1) {
														goto L393;
													}
													goto L392;
												}
												__ebx = 1;
												goto L450;
											}
											__eflags =  *(__ebp - 0x5c) - __ebx;
											 *(__ebp - 0xe) = __bl;
											if( *(__ebp - 0x5c) == __ebx) {
												L196:
												__eax =  *(__ebp - 0x2c);
												__ecx = 0;
												__eax =  *(__ebp - 0x2c) + __edi;
												asm("adc ecx, [ebp-0x6c]");
												 *(__ebp - 0x1cc) = __eax;
												__eflags =  *(__ebp - 0x9c);
												if(__eflags > 0) {
													L200:
													__ecx =  *(__ebp - 0x2c);
													__ecx =  *(__ebp - 0x2c) - __esi;
													__eflags = __ecx - 2;
													 *(__ebp - 0xf0) = __ecx;
													if(__ecx < 2) {
														goto L387;
													}
													__eax = 0x100000;
													__eflags = __ecx - 0x100000;
													asm("sbb edx, edx");
													__edx = __edx & 0xfff00002;
													__edx = 0x100000 + __edx;
													__eax =  *(__ebp - 0x48);
													__ecx = __ecx - __edx;
													__eflags =  *((intOrPtr*)(__eax + 0x12)) - __bl;
													if( *((intOrPtr*)(__eax + 0x12)) != __bl) {
														L209:
														__eax =  *(__ebp - 0x28);
														__ecx = __ecx + 1;
														__eax =  *(__ebp - 0x28) + 0x3c;
														 *(__ebp - 0x104) = __ebx;
														__eax =  *( *(__ebp - 0x28) + 0x3c);
														 *(__ebp - 0x108) = __eax;
														__eax = __eax + __esi;
														__ecx = __eax + __ecx;
														__eflags =  *(__ebp - 0xf) - __bl;
														 *(__ebp - 0x90) = __eax;
														 *(__ebp - 0x4c) = __ecx;
														if( *(__ebp - 0xf) != __bl) {
															goto L214;
														}
														__eflags = __eax - __ecx;
														if(__eax >= __ecx) {
															goto L213;
														} else {
															goto L211;
														}
														while(1) {
															L211:
															__ecx =  *__eax & 0x0000ffff;
															__edx =  *(__ebp - 0xac);
															__eflags =  *(__ecx + __edx) - 0xff;
															if( *(__ecx + __edx) != 0xff) {
																goto L213;
															}
															__eax = __eax + 1;
															__eflags = __eax -  *(__ebp - 0x4c);
															 *(__ebp - 0x90) = __eax;
															if(__eax <  *(__ebp - 0x4c)) {
																continue;
															}
															goto L213;
														}
														goto L213;
													}
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x40) -  *(__ebp - 0xfc);
													if(__eflags > 0) {
														goto L387;
													}
													if(__eflags < 0) {
														L205:
														 *(__ebp - 0x100) =  *(__ebp - 0x100) -  *(__ebp - 0x44);
														 *(__ebp - 0x1bc) =  *(__ebp - 0x100) -  *(__ebp - 0x44);
														__eax =  *(__ebp - 0xfc);
														asm("sbb eax, [ebp-0x40]");
														__eflags = __ebx -  *(__ebp - 0xfc);
														if(__eflags < 0) {
															goto L209;
														}
														if(__eflags > 0) {
															L208:
															__ecx =  *(__ebp - 0x1bc);
															goto L209;
														}
														__eflags = __ecx -  *(__ebp - 0x1bc);
														if(__ecx <=  *(__ebp - 0x1bc)) {
															goto L209;
														}
														goto L208;
													}
													__eax =  *(__ebp - 0x44);
													__eflags =  *(__ebp - 0x44) -  *(__ebp - 0x100);
													if( *(__ebp - 0x44) >  *(__ebp - 0x100)) {
														goto L387;
													}
													goto L205;
												}
												if(__eflags < 0) {
													L199:
													__eax =  *(__ebp - 0x54);
													__edx =  *(__ebp - 0xa0);
													__eax =  *(__ebp - 0x54) + 0xc0;
													__eflags = __eax;
													 *__eax =  *(__ebp - 0xa0);
													__edx =  *(__ebp - 0x9c);
													 *(__eax + 4) = __edx;
													__eax =  *(__ebp - 0x1cc);
													 *(__ebp - 0xa0) =  *(__ebp - 0x1cc);
													 *(__ebp - 0x9c) = __ecx;
													goto L200;
												}
												__eflags =  *(__ebp - 0xa0) - __eax;
												if( *(__ebp - 0xa0) >= __eax) {
													goto L200;
												}
												goto L199;
											}
											__eax =  *(__ebp - 0x80);
											__edx =  *(__ebp - 0xa8);
											__eax =  *(__ebp - 0x80) + 0x10;
											__ecx =  *__eax;
											 *(__edx + 0x18) =  *__eax;
											__ecx =  *(__ebp - 0x44);
											 *(__edx + 0x1c) = __ebx;
											 *(__edx + 0x20) =  *(__ebp - 0x44);
											__ecx =  *(__ebp - 0xa8);
											__edx =  *(__ebp - 0x40);
											 *( *(__ebp - 0xa8) + 0x24) = __edx;
											__ecx =  *(__ebp + 8);
											__eflags =  *((intOrPtr*)(__ecx + 0x19)) - __bl;
											if( *((intOrPtr*)(__ecx + 0x19)) == __bl) {
												L190:
												 *(__ebp - 0xe) = 1;
												L191:
												__ecx =  *(__ebp - 0xf8);
												__eax =  *(__ebp - 0xf4);
												__ecx =  *(__ebp - 0xf8) + 0x800000;
												asm("adc eax, ebx");
												__eflags = __edx -  *(__ebp - 0xf4);
												if(__eflags < 0) {
													goto L196;
												}
												if(__eflags > 0) {
													L194:
													__eax =  *(__ebp - 0xa8);
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __ebx, __ebx);
													__eflags = __eax - __ebx;
													 *(__ebp - 0xf0) = __eax;
													if(__eax != __ebx) {
														__eax =  *(__ebp - 0x5c);
														 *((char*)(__ebp - 4)) = 0x15;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax =  *(__ebp - 0x68);
														 *((char*)(__ebp - 4)) = 0x14;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax = E010D1ABD(__eax,  *(__ebp - 0x50));
														__eax = E010D1ABD(__eax,  *(__ebp - 0x7c));
														__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
														__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
														__eax =  *(__ebp - 0x1c);
														__eflags = __eax - __ebx;
														 *((char*)(__ebp - 4)) = 0xa;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax =  *(__ebp - 0x24);
														 *((char*)(__ebp - 4)) = 6;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__esi =  *(__ebp - 0xf0);
														goto L463;
													}
													__eax =  *(__ebp - 0x44);
													 *(__ebp - 0xf8) =  *(__ebp - 0x44);
													__eax =  *(__ebp - 0x40);
													 *(__ebp - 0xf4) =  *(__ebp - 0x40);
													goto L196;
												}
												__eflags =  *(__ebp - 0x44) - __ecx;
												if( *(__ebp - 0x44) < __ecx) {
													goto L196;
												}
												goto L194;
											}
											__eflags =  *__eax - 1;
											 *(__ebp - 0xe) = __bl;
											if( *__eax <= 1) {
												goto L191;
											}
											goto L190;
										}
									} else {
										__ecx =  *__eax;
										__edx = __ebp - 0xa0;
										_push(__edx);
										_push(__ebx);
										_push(__eax);
										__esi = __eax;
										__eflags = __esi - __ebx;
										if(__esi != __ebx) {
											L434:
											__eax =  *(__ebp - 0x5c);
											 *((char*)(__ebp - 4)) = 0x15;
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx =  *__eax;
												__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
											}
											__eax =  *(__ebp - 0x68);
											 *((char*)(__ebp - 4)) = 0x14;
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx =  *__eax;
												__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
											}
											goto L438;
										}
										goto L163;
									}
								} else {
									goto L137;
								}
								do {
									L137:
									__ecx =  *(__ebp - 0x8c);
									__edi =  *( *(__ebp - 0x8c) + __eax * 4);
									__eflags = __edi - __ebx;
									 *(__ebp - 0x4c) = __edi;
									if(__edi < __ebx) {
										goto L149;
									}
									__eax =  *(__ebp + 8);
									 *(__ebp - 0xd) = __bl;
									 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
									__esi =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
									__eflags =  *((intOrPtr*)(__esi + 0x29)) - __bl;
									if( *((intOrPtr*)(__esi + 0x29)) == __bl) {
										L148:
										__ecx = __ebp - 0x7c;
										E010D1553(__ebp - 0x7c, __edi) =  *(__ebp - 0x50);
										 *((char*)(__edi +  *(__ebp - 0x50))) = 1;
										goto L149;
									}
									 *__esi =  *__esi >> 6;
									__eflags = __al & 0x00000001;
									if((__al & 0x00000001) != 0) {
										 *(__ebp - 0xd) = 1;
									}
									__edi = 0;
									__eflags =  *(__esi + 0x34) - __ebx;
									if( *(__esi + 0x34) <= __ebx) {
										L146:
										__eflags =  *(__ebp - 0xd) - __bl;
										if( *(__ebp - 0xd) == __bl) {
											goto L149;
										}
										__edi =  *(__ebp - 0x4c);
										goto L148;
									} else {
										do {
											__eax =  *(__esi + 0x30);
											__eax =  *( *(__esi + 0x30) + __edi * 4);
											__eflags =  *(__eax + 4) - 2;
											if( *(__eax + 4) >= 2) {
												__eax =  *__eax;
												__edx =  *(__ebp - 0x4c);
												__ecx =  *__eax & 0x0000ffff;
												 *(__ebp - 0xd4) =  *((intOrPtr*)( *(__ebp - 0xd4) +  *(__ebp - 0x4c) * 4));
												__edx =  *(__ebp - 0xac);
												__eax =  *((intOrPtr*)( *(__ebp - 0xd4) +  *(__ebp - 0x4c) * 4)) + __edi;
												__ecx = __ecx + __edx;
												__eflags = __ecx;
												__dl =  *__ecx;
												 *(__ebp +  *((intOrPtr*)( *(__ebp - 0xd4) +  *(__ebp - 0x4c) * 4)) + __edi - 0x2cc) = __dl;
												 *__ecx = __al;
											} else {
												 *(__ebp - 0xd) = 1;
											}
											__edi = __edi + 1;
											__eflags = __edi -  *(__esi + 0x34);
										} while (__edi <  *(__esi + 0x34));
										goto L146;
									}
									L149:
									__eax =  *(__ebp - 0x20);
									__eax =  *(__ebp - 0x20) + 1;
									__eflags = __eax -  *((intOrPtr*)(__ebp - 0x88));
									 *(__ebp - 0x20) = __eax;
								} while (__eax <  *((intOrPtr*)(__ebp - 0x88)));
								goto L150;
							}
							__eax = E010D1ABD(__eax,  *(__ebp - 0x14));
							__eax = E010D1ABD(__eax,  *(__ebp - 0xd4));
							goto L415;
						} else {
							goto L129;
						}
						do {
							L129:
							__ecx = __ebp - 0xd4;
							E010D1553(__ebp - 0xd4,  *(__ebp - 0x20)) =  *(__ebp + 8);
							 *(__ebp - 0xb8) = __ebx;
							 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
							__esi =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
							__eax =  *(__esi + 0x34);
							 *(__ebp - 0x20) = __eax +  *(__ebp - 0x20);
							__eflags = __eax - __ebx;
							if(__eax <= __ebx) {
								goto L131;
							} else {
								goto L130;
							}
							do {
								L130:
								__ecx = __ebp - 0xe0;
								__eax = E010D1553(__ebp - 0xe0, __edi);
								 *(__ebp - 0xb8) =  *(__ebp - 0xb8) + 1;
								__eax =  *(__ebp - 0xb8);
								__eflags =  *(__ebp - 0xb8) -  *(__esi + 0x34);
							} while ( *(__ebp - 0xb8) <  *(__esi + 0x34));
							L131:
							__eax =  *(__ebp + 8);
							__edi = __edi + 1;
							__eax =  *( *(__ebp + 8));
							__eflags = __edi -  *((intOrPtr*)(__eax + 0x2c));
						} while (__edi <  *((intOrPtr*)(__eax + 0x2c)));
						goto L132;
					} else {
						__eax =  *(__ebp - 0x54);
						__edi =  *(__ebp - 0x54) + 0x94;
						 *(__ebp - 0x28) = __edi;
						while(1) {
							__eax =  *(__ebp - 0x7c);
							__ecx =  *(__ebp - 0x2c);
							__esi =  *(__ebp + 8);
							__eax =  *( *(__ebp - 0x7c) +  *(__ebp - 0x2c) * 4);
							 *__edi = __eax;
							 *__esi =  *((intOrPtr*)( *__esi + 0x28));
							 *(__ebp - 0xac) = __eax;
							__eax =  *(__esi + 0x38);
							__eflags = __eax - __ebx;
							if(__eax == __ebx) {
								goto L42;
							}
							__ecx =  *__eax;
							__edx = __ebp - 0xa0;
							__eax =  *((intOrPtr*)( *__eax + 0xc))(__eax, __ebx, __ebp - 0xa0);
							__eflags = __eax - __ebx;
							 *(__ebp - 0x90) = __eax;
							if(__eax != __ebx) {
								__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
								__eax =  *(__ebp - 0x1c);
								__eflags = __eax - __ebx;
								 *((char*)(__ebp - 4)) = 0xa;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax =  *(__ebp - 0x24);
								 *((char*)(__ebp - 4)) = 6;
								__eflags = __eax - __ebx;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__ebx =  *(__ebp - 0x90);
								L6:
								E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(_t1078,  *((intOrPtr*)(_t1093 - 0x58))),  *((intOrPtr*)(_t1093 - 0x38))),  *((intOrPtr*)(_t1093 - 0x8c))),  *((intOrPtr*)(_t1093 - 0xc4))),  *((intOrPtr*)(_t1093 - 0xec)));
								L396:
								_t1084 = _t1086;
								L465:
								 *[fs:0x0] =  *((intOrPtr*)(_t1093 - 0xc));
								return _t1084;
							}
							L42:
							__eax =  *(__ebp - 0x30);
							__eax =  *( *(__ebp - 0x30));
							__ecx =  *__eax;
							__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __ebx, __ebx, __ebx, __ebx);
							__eflags = __eax - __ebx;
							 *(__ebp - 0x90) = __eax;
							if(__eflags != 0) {
								__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
								__eax =  *(__ebp - 0x1c);
								__eflags = __eax - __ebx;
								 *((char*)(__ebp - 4)) = 0xa;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax =  *(__ebp - 0x24);
								 *((char*)(__ebp - 4)) = 6;
								__eflags = __eax - __ebx;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__ebx =  *(__ebp - 0x90);
								goto L6;
							}
							 *(__ebp - 0x14) = __ebx;
							__eax = __ebp - 0x14;
							 *((char*)(__ebp - 4)) = 0xe;
							_push(__ebp - 0x14);
							_push( *__edi);
							_push(__esi);
							__esi =  *(__ebp - 0x54);
							__ecx = __esi; // executed
							__eax = L010EE7E8(__eflags); // executed
							__edi = __eax;
							__eflags = __eax - __ebx;
							if(__eax != __ebx) {
								L96:
								__eax =  *(__ebp - 0x14);
								 *((char*)(__ebp - 4)) = 0xd;
								__eflags = __eax - __ebx;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
								__eax =  *(__ebp - 0x1c);
								__eflags = __eax - __ebx;
								 *((char*)(__ebp - 4)) = 0xa;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax =  *(__ebp - 0x24);
								 *((char*)(__ebp - 4)) = 6;
								if(_t1078 != _t1085) {
									_t1078 =  *((intOrPtr*)( *_t1078 + 8))(_t1078);
								}
								_t1086 = _t1090;
								goto L6;
							}
							__ecx =  *(__ebp - 0x14);
							__eflags = __ecx - __ebx;
							if(__ecx != __ebx) {
								__eax =  *(__ebp + 8);
								__edi =  *(__ebp - 0x48);
								 *(__ebp - 0x11c) = __ebx;
								 *(__ebp - 0x118) = __ebx;
								__eflags =  *((intOrPtr*)(__edi + 0x11)) - __bl;
								__ebp - 0x11c =  *(__ebp - 0x30);
								__edx = __edx & 0xffffff00 |  *((intOrPtr*)(__edi + 0x11)) == __bl;
								__eax = E010F1B59(__ecx, __edx,  *( *(__ebp - 0x30)), __ebp - 0x11c,  *((intOrPtr*)( *(__ebp - 0x30) + 0x38)),  *(__ebp - 0x1c)); // executed
								__eflags = __eax - 1;
								 *(__ebp - 0x4c) = __eax;
								if(__eax != 1) {
									__eflags =  *(__ebp - 0x4c) - __ebx;
									if(__eflags != 0) {
										__eax =  *(__ebp - 0x14);
										 *((char*)(__ebp - 4)) = 0xd;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
										__eax =  *(__ebp - 0x1c);
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0xa;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax =  *(__ebp - 0x24);
										 *((char*)(__ebp - 4)) = 6;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__ebx =  *(__ebp - 0x4c);
										goto L6;
									}
									_push(__ebx);
									_push(__ebx);
									_push(__ebx);
									__ecx = __esi;
									_push( *(__ebp - 0x14));
									__eax = E010EE40F(__esi, __eflags);
									__eflags = __eax - __ebx;
									 *(__ebp - 0x90) = __eax;
									if(__eax != __ebx) {
										__eax =  *(__ebp - 0x14);
										 *((char*)(__ebp - 4)) = 0xd;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
										__eax =  *(__ebp - 0x1c);
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0xa;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax =  *(__ebp - 0x24);
										 *((char*)(__ebp - 4)) = 6;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__ebx =  *(__ebp - 0x90);
										goto L6;
									}
									__eflags =  *(__esi + 0xac) - __ebx;
									if(__eflags < 0) {
										L53:
										__ecx = __ebp - 0x190;
										__eax = E010ECE85(__ebp - 0x190, __eflags);
										 *((char*)(__ebp - 4)) = 0xf;
										__eax =  *(__esi + 0xa8);
										 *(__ebp - 0x190) = __eax;
										__ecx =  *(__esi + 0xac);
										 *(__ebp - 0x18c) = __ecx;
										__edx =  *(__esi + 0xc8);
										 *(__ebp - 0x188) =  *(__esi + 0xc8);
										__edx =  *(__esi + 0xcc);
										 *(__ebp - 0x184) = __edx;
										__eflags =  *((intOrPtr*)(__esi + 0xb8)) - __bl;
										if( *((intOrPtr*)(__esi + 0xb8)) == __bl) {
											 *((char*)(__ebp - 0x124)) = 1;
										}
										__eflags = __ecx - __ebx;
										if(__eflags > 0) {
											L59:
											__eflags =  *((intOrPtr*)(__edi + 0x11)) - __bl;
											if( *((intOrPtr*)(__edi + 0x11)) == __bl) {
												L74:
												__eax =  *(__ebp - 0x28);
												__ecx =  *(__ebp - 0x58);
												__eax =  *( *(__ebp - 0x28));
												 *((char*)( *(__ebp - 0x58) +  *( *(__ebp - 0x28)))) = 1;
												 *(__ebp - 0x190) =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
												__eflags =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
												if(( *(__ebp - 0x190) |  *(__ebp - 0x18c)) != 0) {
													L79:
													__edx =  *(__ebp - 0xac);
													__ecx =  *(__ebp - 0x14);
													__eax = __ebp - 0x190;
													_push(__ebp - 0x190);
													__esi = E010F16BA( *(__ebp - 0x14),  *(__ebp - 0xac));
													__eflags = __esi - __ebx;
													if(__eflags != 0) {
														__ecx = __ebp - 0x190;
														__eax = E010ECEE9(__ebp - 0x190);
														__eax =  *(__ebp - 0x14);
														 *((char*)(__ebp - 4)) = 0xd;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
														__eax =  *(__ebp - 0x1c);
														__eflags = __eax - __ebx;
														 *((char*)(__ebp - 4)) = 0xa;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax =  *(__ebp - 0x24);
														 *((char*)(__ebp - 4)) = 6;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__ebx = __esi;
														goto L6;
													}
													__ecx =  *(__ebp - 0x80);
													__ebp - 0x190 = E010ECF11( *(__ebp - 0x80), __ebp, __eflags, __ebp - 0x190);
													L81:
													__ecx = __ebp - 0x190;
													__eax = E010ECEE9(__ebp - 0x190);
													goto L82;
												}
												__eflags =  *((intOrPtr*)(__ebp - 0x124)) - __bl;
												if( *((intOrPtr*)(__ebp - 0x124)) != __bl) {
													goto L79;
												}
												__ecx =  *(__ebp - 0x184);
												__eax = __esi + 0xc0;
												__eflags =  *(__ebp - 0x184) -  *(__eax + 4);
												if(__eflags < 0) {
													goto L79;
												}
												if(__eflags > 0) {
													goto L81;
												}
												__ecx =  *(__ebp - 0x188);
												__eflags =  *(__ebp - 0x188) -  *__eax;
												if( *(__ebp - 0x188) >=  *__eax) {
													goto L81;
												}
												goto L79;
											}
											__eax =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x38);
											__eflags =  *((intOrPtr*)(__ebp - 0x5d)) - __bl;
											__eax =  *( *(__ebp - 0x28));
											__al =  *((intOrPtr*)( *( *(__ebp - 0x28)) +  *(__ebp - 0x38)));
											if( *((intOrPtr*)(__ebp - 0x5d)) == __bl) {
												__eflags = __al - __bl;
												if(__al == __bl) {
													__eflags =  *((intOrPtr*)(__ebp - 0x39)) - __bl;
													__eax = __edi + 0xd;
													if( *((intOrPtr*)(__ebp - 0x39)) == __bl) {
														__eax = __edi + 0xa;
													}
												} else {
													__eax = __edi + 7;
												}
											} else {
												__eax = __edi + 4;
											}
											 *(__ebp - 0x4c) = __eax;
											__eflags =  *(__esi + 0x10) - __bl;
											if( *(__esi + 0x10) == __bl) {
												L116:
												__eax =  *(__ebp - 0x30);
												__ecx = __esi + 4;
												__eax = E010E0E48(__esi + 4,  *( *(__ebp - 0x30)));
												__ecx = __esi;
												__eax = E010E0E48(__esi,  *(__ebp - 0x14));
												__ecx = __ebp - 0x190;
												__eax = E010ECEE9(__ebp - 0x190);
												__eax =  *(__ebp - 0x14);
												 *((char*)(__ebp - 4)) = 0xd;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax = E010D1ABD(__eax,  *(__ebp - 0x70));
												__eax =  *(__ebp - 0x1c);
												__eflags = __eax - __ebx;
												 *((char*)(__ebp - 4)) = 0xa;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax =  *(__ebp - 0x24);
												 *((char*)(__ebp - 4)) = 6;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												goto L6;
											}
											__eflags =  *((intOrPtr*)(__edi + 0x14)) - __bl;
											if( *((intOrPtr*)(__edi + 0x14)) == __bl) {
												L70:
												__eax =  *(__ebp - 0x4c);
												__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - __ebx;
												__al =  *( *(__ebp - 0x4c));
												 *(__ebp - 0x15) = __al;
												if( *((intOrPtr*)(__ebp - 0xc8)) < __ebx) {
													__ecx =  *(__ebp - 0xac);
													__eax = E010F1654( *(__ebp - 0xac));
													__eflags = __al;
													if(__al != 0) {
														 *(__ebp - 0x15) = __bl;
													}
												}
												__eflags =  *(__ebp - 0x15) - __bl;
												if( *(__ebp - 0x15) != __bl) {
													goto L116;
												} else {
													goto L74;
												}
											}
											__eax =  *(__esi + 0xb0);
											__ecx =  *(__esi + 0xb4);
											__eax =  *(__esi + 0xb0) +  *(__esi + 0xa8);
											asm("adc ecx, [esi+0xac]");
											__ecx = __esi;
											__eax = E010EE980(__esi,  *(__ebp + 8),  *(__esi + 0xb0) +  *(__esi + 0xa8),  *(__esi + 0xb4));
											__edi = __eax;
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx = __ebp - 0x190;
												__eax = E010ECEE9(__ebp - 0x190);
												goto L96;
											}
											__eflags =  *((intOrPtr*)(__esi + 0x12)) - __bl;
											if( *((intOrPtr*)(__esi + 0x12)) != __bl) {
												goto L116;
											}
											goto L70;
										}
										if(__eflags < 0) {
											L58:
											 *(__ebp - 0x188) = __eax +  *(__ebp - 0x188);
											 *(__ebp - 0x190) = __ebx;
											 *(__ebp - 0x18c) = __ebx;
											asm("adc [ebp-0x184], ecx");
											goto L59;
										}
										__eflags = __eax - __ebx;
										if(__eax >= __ebx) {
											goto L59;
										}
										goto L58;
									}
									if(__eflags > 0) {
										goto L82;
									}
									__eflags =  *(__esi + 0xa8) - __ebx;
									if(__eflags > 0) {
										goto L82;
									}
									goto L53;
								} else {
									__eax =  *(__ebp - 0x28);
									__ecx =  *(__ebp - 0x58);
									__eax =  *( *(__ebp - 0x28));
									 *((char*)( *(__ebp - 0x58) +  *( *(__ebp - 0x28)))) = 1;
									L82:
									__eax =  *(__ebp - 0x14);
									 *((char*)(__ebp - 4)) = 0xd;
									__eflags = __eax - __ebx;
									if(__eax != __ebx) {
										__ecx =  *__eax;
										__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
									}
									goto L84;
								}
							} else {
								 *((char*)(__ebp - 4)) = 0xd;
								L84:
								 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x78);
								if(__eax >=  *(__ebp - 0x78)) {
									goto L128;
								}
								__edi =  *(__ebp - 0x28);
								continue;
							}
						}
					}
				} else {
					goto L8;
					L9:
					__eax =  *(__ebp + 8);
					__edx = 0x1109c18;
					 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
					__esi =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
					__ecx =  *(__esi + 0xc);
					__eax = E010D20D0( *(__esi + 0xc), 0x1109c18);
					__eflags = __al;
					if(__al == 0) {
						__eax =  *(__esi + 8);
						__eflags = __eax - __ebx;
						if(__eax == __ebx) {
							__ecx = __esi;
							__eax = E010F16A1(__esi);
							__eflags = __al - __bl;
							if(__al == __bl) {
								L21:
								 *(__ebp - 0xd) = 1;
								L22:
								__eflags = __al - __bl;
								if(__al == __bl) {
									L33:
									__eflags =  *(__ebp - 0xd) - __bl;
									if( *(__ebp - 0xd) != __bl) {
										__ecx = __ebp - 0x7c;
										__eax = E010D1553(__ebp - 0x7c, __edi);
									}
									goto L35;
								}
								__eax =  *(__esi + 0x34);
								__eflags =  *(__esi + 0x34) - __ebx;
								if(__eflags == 0) {
									goto L33;
								}
								 *(__ebp - 0x28) = __ebx;
								if(__eflags <= 0) {
									L31:
									__eax =  *(__ebp - 0x28);
									__eflags =  *(__ebp - 0x28) -  *(__esi + 0x34);
									if( *(__ebp - 0x28) ==  *(__esi + 0x34)) {
										goto L33;
									}
									L32:
									__ecx = __ebp - 0x7c;
									__eax = E010F31C7(__ebp - 0x7c, __ebx, __edi);
									goto L35;
								} else {
									goto L25;
								}
								do {
									L25:
									__eax =  *(__esi + 0x30);
									__ecx =  *(__ebp - 0x28);
									__eax =  *( *(__esi + 0x30) +  *(__ebp - 0x28) * 4);
									__ecx =  *(__esi + 0x2c);
									__edx =  *(__eax + 4);
									__edi = __ecx + __edx;
									__eflags =  *(__ebp - 0x34) - __ecx + __edx;
									if( *(__ebp - 0x34) >= __ecx + __edx) {
										__eax =  *__eax;
										_push(__edx);
										__edx =  *(__ebp - 0x70);
										_push(__ecx);
										_push(__eax);
										L01103D72();
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax == 0) {
											break;
										}
									} else {
										__eflags =  *(__ebp - 0xe) - __bl;
										if( *(__ebp - 0xe) == __bl) {
											 *(__ebp - 0xd) = 1;
										}
									}
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
									__eax =  *(__ebp - 0x28);
									__eflags =  *(__ebp - 0x28) -  *(__esi + 0x34);
								} while ( *(__ebp - 0x28) <  *(__esi + 0x34));
								__edi =  *(__ebp - 0x90);
								goto L31;
							}
							__eflags =  *(__esi + 0x34) - __ebx;
							if( *(__esi + 0x34) == __ebx) {
								goto L21;
							}
							__ecx =  *__esi;
							__edx = __ecx;
							__edx = __ecx >> 7;
							__eflags = __dl & 0x00000001;
							if((__dl & 0x00000001) != 0) {
								goto L21;
							}
							__edx = __ecx;
							__edx = __ecx >> 6;
							__eflags = __dl & 0x00000001;
							if((__dl & 0x00000001) != 0) {
								goto L21;
							}
							__ecx = __ecx >> 8;
							__eflags = __cl & 0x00000001;
							 *(__ebp - 0xd) = __bl;
							if((__cl & 0x00000001) == 0) {
								goto L22;
							}
							goto L21;
						}
						__eax =  *__eax( *(__ebp - 0x70),  *(__ebp - 0x34));
						__eflags = __eax - __ebx;
						if(__eax == __ebx) {
							goto L35;
						}
						__eflags = __eax - 2;
						if(__eax != 2) {
							goto L32;
						}
						__eflags =  *(__ebp - 0xe) - __bl;
						if( *(__ebp - 0xe) != __bl) {
							goto L35;
						} else {
							goto L32;
						}
					} else {
						 *(__ebp - 0x20) = __edi;
					}
					L35:
					 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
					__eax =  *(__ebp - 0x2c);
					__eflags = __eax -  *((intOrPtr*)(__ebp - 0x88));
					if(__eax <  *((intOrPtr*)(__ebp - 0x88))) {
						L8:
						__eax =  *(__ebp - 0x8c);
						__ecx =  *(__ebp - 0x2c);
						__edi =  *( *(__ebp - 0x8c) +  *(__ebp - 0x2c) * 4);
						__eax =  *(__ebp - 0x58);
						 *(__ebp - 0x90) = __edi;
						__eflags =  *(__eax + __edi) - __bl;
						if( *(__eax + __edi) != __bl) {
							goto L35;
						}
						goto L9;
					} else {
						__eflags =  *(__ebp - 0x20) - __ebx;
						if( *(__ebp - 0x20) >= __ebx) {
							__ecx = __ebp - 0x7c;
							__eax = E010F31C7(__ebp - 0x7c, __ebx,  *(__ebp - 0x20));
						}
						goto L38;
					}
				}
			}

0x010ef7eb
0x010ef7eb
0x010ef7ef
0x010ef7f2
0x010ef7f5
0x010ef7f8
0x010ef7fc
0x010ef802
0x010ef806
0x010ef809
0x010ef952
0x010ef952
0x010ef955
0x010ef958
0x010efe57
0x010efe62
0x010efe68
0x010efe6f
0x010efe75
0x010efe7b
0x010efe81
0x010efe87
0x010efe8d
0x010efe90
0x010efe94
0x010efe97
0x010efe99
0x010efe9b
0x010efe9e
0x010efef1
0x010efef1
0x010efef6
0x010efef9
0x010efefa
0x010efeff
0x010eff05
0x010eff08
0x010eff10
0x010eff15
0x010eff1a
0x010eff23
0x010eff2b
0x010eff31
0x010eff59
0x010eff5c
0x010eff5f
0x010eff63
0x010eff67
0x010eff6a
0x010eff6f
0x010eff70
0x010eff73
0x010eff77
0x010eff77
0x010eff79
0x010eff79
0x010eff7c
0x010eff7f
0x010eff80
0x010eff80
0x010eff84
0x010eff86
0x010eff8c
0x010eff8f
0x010f0035
0x010f0035
0x010f003b
0x010f003f
0x010f0041
0x010f0044
0x010f0046
0x010f0048
0x010f1193
0x010f1196
0x010f119e
0x010f11a6
0x010f11bc
0x010f11c1
0x010f11c7
0x010f11c9
0x010f11cd
0x010f11cf
0x010f11d2
0x010f11d2
0x010f11d5
0x010f11d8
0x010f11dc
0x010f11de
0x010f11e4
0x010f11e7
0x010f11e7
0x010f1369
0x010f136c
0x010f1374
0x010f137f
0x010f1395
0x010f139d
0x00000000
0x010f139d
0x010f0050
0x010f0055
0x010f0057
0x010f0058
0x010f007c
0x010f007c
0x010f005a
0x010f005a
0x010f0060
0x010f0066
0x010f0069
0x010f006c
0x010f006f
0x010f0072
0x010f0078
0x010f0078
0x010f007e
0x010f0080
0x010f0083
0x010f0086
0x010f0088
0x010f008b
0x010f008b
0x010f008e
0x010f0094
0x010f0094
0x010f0097
0x010f009c
0x010f00a2
0x010f00a5
0x010f00a8
0x010f00ac
0x010f00af
0x010f00b3
0x010f00b8
0x010f00b9
0x010f00bf
0x010f00c1
0x010f00c5
0x010f00d2
0x010f00d2
0x010f00c7
0x010f00c7
0x010f00ce
0x010f00ce
0x010f00d5
0x010f00d8
0x010f00dc
0x010f00e7
0x010f00ea
0x010f00ea
0x010f00ed
0x010f00f2
0x010f00f7
0x010f00f9
0x010f00f9
0x010f0102
0x010f0105
0x010f0107
0x010f0109
0x010f0109
0x010f0112
0x010f0115
0x010f0115
0x010f0117
0x010f011a
0x010f011d
0x010f011f
0x010f0139
0x010f0141
0x010f0144
0x010f0146
0x010f014b
0x010f014e
0x010f0150
0x010f0156
0x010f015c
0x010f015f
0x010f0162
0x010f0165
0x010f0169
0x010f016c
0x010f016f
0x010f0172
0x010f0175
0x010f0177
0x010f017a
0x010f017e
0x010f0180
0x010f0183
0x010f0185
0x010f0188
0x010f018c
0x010f018c
0x010f018f
0x010f0191
0x010f0194
0x010f0197
0x010f019a
0x010f019a
0x010f018f
0x010f0188
0x010f017e
0x010f019d
0x010f019d
0x010f01a0
0x010f01a3
0x010f01a5
0x010f01a8
0x010f01ab
0x00000000
0x00000000
0x010f01b1
0x010f01b1
0x010f01b4
0x010f01ba
0x010f0269
0x010f026b
0x010f026d
0x010f02dd
0x010f02dd
0x010f02dd
0x010f02df
0x010f02e1
0x010f02e7
0x00000000
0x00000000
0x010f02e9
0x010f02ef
0x00000000
0x00000000
0x010f02f1
0x010f02f4
0x010f02f7
0x010f02fa
0x010f0300
0x010f0302
0x010f0305
0x010f030a
0x010f0313
0x010f0316
0x010f0319
0x010f0d28
0x010f0d28
0x010f0d2b
0x010f019d
0x010f019d
0x010f019d
0x010f01a0
0x010f01a3
0x010f01a5
0x010f01a8
0x010f01ab
0x00000000
0x00000000
0x00000000
0x010f01ab
0x00000000
0x010f04cb
0x010f04cd
0x010f04cf
0x010f04d5
0x010f04d8
0x010f04de
0x010f04e1
0x010f04e1
0x010f04ea
0x010f04ea
0x010f04ed
0x010f04f3
0x010f04fa
0x010f0500
0x010f0507
0x010f050a
0x010f050a
0x010f050d
0x010f050d
0x010f050d
0x010f0510
0x00000000
0x00000000
0x010f0512
0x010f0512
0x010f0518
0x010f051b
0x00000000
0x00000000
0x010f051d
0x010f051f
0x010f0523
0x010f0527
0x010f052d
0x010f0530
0x010f0533
0x010f05ea
0x010f05ea
0x010f05ed
0x010f05f2
0x010f05f5
0x010f05f8
0x010f05fe
0x010f0608
0x010f0608
0x010f060b
0x010f060d
0x010f0610
0x010f0623
0x010f0623
0x010f0626
0x010f0629
0x010f062c
0x010f0632
0x010f0638
0x010f0665
0x010f0665
0x010f0668
0x010f066a
0x010f066d
0x010f06b2
0x010f06b2
0x010f06b5
0x010f06b8
0x010f06bb
0x010f06be
0x010f06c8
0x010f06ca
0x010f06d4
0x010f06d7
0x010f06da
0x010f06e1
0x010f06e1
0x010f06dc
0x010f06dc
0x010f06dc
0x010f06cc
0x010f06cc
0x010f06cf
0x010f06cf
0x010f06c0
0x010f06c0
0x010f06c3
0x010f06c3
0x010f06e4
0x010f06ea
0x010f06ed
0x010f06f0
0x010f06f3
0x010f06f4
0x010f06f8
0x010f06fb
0x010f0703
0x010f0705
0x010f0707
0x010f1160
0x010f1160
0x010f1163
0x010f1167
0x010f1169
0x010f116b
0x010f116e
0x010f116e
0x00000000
0x010f070d
0x010f070d
0x010f0710
0x010f12ef
0x010f12ef
0x010f12f2
0x010f12f6
0x010f12f8
0x010f12fa
0x010f12fd
0x010f12fd
0x010f1300
0x010f1303
0x010f1307
0x010f1309
0x010f130b
0x010f130e
0x010f130e
0x010f1314
0x010f131c
0x010f1324
0x010f133a
0x010f133f
0x010f1345
0x010f1347
0x010f134b
0x010f134d
0x010f1350
0x010f1350
0x010f1353
0x010f1356
0x010f135a
0x010f135c
0x010f135e
0x010f1361
0x010f1361
0x010f1364
0x00000000
0x010f1364
0x010f0716
0x010f071c
0x010f0722
0x010f0728
0x010f072a
0x010f072c
0x010f0732
0x010f0738
0x010f073e
0x010f0741
0x010f0744
0x010f078e
0x010f0791
0x010f0797
0x010f079d
0x010f07a0
0x010f07a3
0x010f07a6
0x010f07a9
0x010f07ac
0x010f07ae
0x010f07b1
0x010f07b4
0x010f07bc
0x010f07c2
0x010f07c8
0x010f0746
0x010f0746
0x010f0749
0x010f074f
0x010f0755
0x010f0758
0x010f075b
0x010f075e
0x010f0761
0x010f0764
0x010f0766
0x010f0769
0x010f076c
0x010f076f
0x010f0774
0x010f0777
0x010f0785
0x010f0789
0x010f0789
0x010f07ce
0x010f07d1
0x010f07d7
0x010f07dd
0x010f07df
0x010f07e2
0x010f07e5
0x010f07eb
0x010f07ee
0x010f07f1
0x010f07f4
0x010f07fa
0x010f07fa
0x010f07fd
0x010f0803
0x010f0809
0x010f080c
0x010f080e
0x010f0811
0x010f0817
0x010f0819
0x010f081c
0x010f0826
0x010f081e
0x010f081e
0x010f081e
0x010f082c
0x010f082f
0x010f0832
0x010f0841
0x010f084a
0x010f084c
0x010f084f
0x010f0851
0x010f0859
0x010f085f
0x010f0853
0x010f0853
0x010f0855
0x010f0855
0x010f0861
0x010f0864
0x010f0865
0x010f0868
0x010f0869
0x010f086c
0x010f0871
0x010f0873
0x010f0879
0x010f0f96
0x010f0f99
0x010f0f9d
0x010f0f9f
0x010f0fa1
0x010f0fa4
0x010f0fa4
0x010f0fa7
0x010f0faa
0x010f0fae
0x010f0fb0
0x010f0fb2
0x010f0fb5
0x010f0fb5
0x010f0fb8
0x010f0fbb
0x010f0fbf
0x010f0fc1
0x010f0fc3
0x010f0fc6
0x010f0fc6
0x010f0fcc
0x010f0fd4
0x010f0fdc
0x010f0ff2
0x010f0ff7
0x010f0ffd
0x010f0fff
0x010f1003
0x010f1005
0x010f1008
0x010f1008
0x010f100b
0x010f100e
0x010f1012
0x010f1014
0x010f1016
0x010f1019
0x010f1019
0x010f101c
0x00000000
0x010f087f
0x010f087f
0x010f0883
0x010f0886
0x010f08ef
0x010f08f2
0x010f08f6
0x010f10c7
0x010f10ca
0x010f10ce
0x010f10d0
0x010f10d2
0x010f10d5
0x010f10d5
0x010f10d8
0x010f10db
0x010f10df
0x010f10e1
0x010f10e3
0x010f10e6
0x010f10e6
0x010f10e9
0x010f10ec
0x010f10f0
0x010f10f2
0x010f10f4
0x010f10f7
0x010f10f7
0x010f10fd
0x010f1105
0x010f110d
0x010f1123
0x010f1128
0x010f112e
0x010f1130
0x010f1134
0x010f1136
0x010f1139
0x010f1139
0x010f113c
0x010f113f
0x010f1143
0x010f1145
0x010f1147
0x010f114a
0x010f114a
0x010f114d
0x00000000
0x010f114d
0x010f08fc
0x010f08fc
0x010f0907
0x010f090d
0x010f0911
0x010f0917
0x010f091d
0x010f0925
0x010f0928
0x010f092a
0x010f092d
0x010f0949
0x010f0954
0x010f0954
0x010f0957
0x010f12d3
0x010f12d3
0x010f12d9
0x010f12de
0x010f12e1
0x010f12e5
0x010f12e7
0x010f12e9
0x010f12ec
0x010f12ec
0x00000000
0x010f12e7
0x010f095d
0x010f095d
0x010f0960
0x010f0966
0x010f096c
0x010f0972
0x010f0978
0x010f097b
0x010f0981
0x010f0983
0x010f0989
0x010f098f
0x010f0991
0x010f0997
0x010f099d
0x010f099f
0x010f09a5
0x010f09e9
0x010f09eb
0x010f09eb
0x010f09ed
0x00000000
0x00000000
0x010f09f3
0x010f09f9
0x00000000
0x00000000
0x010f09ff
0x010f0a09
0x010f0a09
0x010f0a0b
0x010f0a0e
0x010f0a10
0x010f0a16
0x010f0a18
0x010f0a1e
0x010f0a24
0x010f0a2b
0x010f0a2b
0x010f0a2d
0x010f0a2d
0x010f0a16
0x010f0a33
0x010f0a39
0x010f0a3f
0x010f0a45
0x010f0a75
0x010f0a7b
0x010f0a7b
0x010f0a81
0x010f0acb
0x010f0acb
0x010f0ace
0x010f0ad1
0x010f0adc
0x010f0ade
0x00000000
0x00000000
0x010f0ae0
0x010f0ae0
0x010f0ae6
0x010f0aec
0x010f0aef
0x010f0af2
0x010f0af2
0x010f0af8
0x010f0afb
0x010f0b01
0x010f0b07
0x010f0b09
0x010f0b0b
0x010f1155
0x010f115b
0x00000000
0x010f115b
0x010f0b11
0x010f0b17
0x010f0b1d
0x010f0b9d
0x010f0b9d
0x010f0ba0
0x010f0cdb
0x010f0cdb
0x010f0cde
0x010f0ce1
0x010f0cee
0x010f0cf3
0x010f0cf9
0x010f0cfd
0x010f0d02
0x010f0d05
0x010f0d09
0x010f0d17
0x010f0d17
0x010f0d1d
0x010f0d30
0x010f0d30
0x00000000
0x010f0d30
0x010f0d1f
0x010f0d22
0x00000000
0x00000000
0x010f0d24
0x00000000
0x010f0d24
0x010f0ba6
0x010f0ba9
0x010f0bac
0x00000000
0x00000000
0x010f0bb2
0x010f0bb8
0x00000000
0x00000000
0x010f0bbe
0x010f0bc1
0x010f0bc4
0x010f0bc7
0x010f0bc9
0x010f0bcc
0x010f0c15
0x010f0c15
0x010f0c1d
0x010f0c1d
0x010f0c23
0x010f0c42
0x010f0c45
0x010f0c4b
0x010f0c51
0x010f0c47
0x010f0c47
0x010f0c47
0x010f0c53
0x010f0c5a
0x010f0c5c
0x010f0c5c
0x010f0c25
0x010f0c25
0x010f0c2b
0x010f0c60
0x010f0c2d
0x010f0c2d
0x010f0c30
0x010f0c36
0x010f0c3d
0x010f0c38
0x010f0c38
0x010f0c38
0x010f0c36
0x010f0c2b
0x010f0c63
0x010f0c69
0x010f0c6b
0x010f0c71
0x010f0c73
0x010f0c73
0x010f0c73
0x010f0c71
0x010f0c75
0x010f0c77
0x010f1243
0x010f1243
0x010f1246
0x010f1250
0x010f1253
0x010f125b
0x010f125e
0x010f1264
0x010f126a
0x010f1270
0x010f1272
0x010f1278
0x010f127b
0x010f1281
0x010f1286
0x010f1289
0x010f128d
0x010f1292
0x010f1292
0x010f1295
0x010f1299
0x010f129e
0x010f12a1
0x010f12a5
0x010f12aa
0x010f12ad
0x010f12b1
0x010f12b6
0x010f12b9
0x010f12bd
0x010f12c2
0x010f12c2
0x010f12c5
0x010f12c9
0x010f0f1c
0x010f0f1c
0x010f0f22
0x010f0f26
0x010f0f2b
0x010f0f31
0x010f0f35
0x010f0f3a
0x010f0f3d
0x010f0f41
0x010f0f46
0x010f0f49
0x010f0f4d
0x010f0f52
0x010f0f55
0x010f0f59
0x010f0f5e
0x010f0f61
0x010f0f65
0x010f0f6a
0x010f0f70
0x010f0f74
0x010f0f79
0x010f0f7f
0x010f0f84
0x010f0f8a
0x00000000
0x010f0c7d
0x010f0c7d
0x010f0c83
0x00000000
0x00000000
0x010f0c85
0x010f0c88
0x00000000
0x00000000
0x010f0c8a
0x010f0c90
0x010f0c9a
0x010f0c9a
0x010f0c9d
0x010f0ca0
0x010f0ca2
0x010f0ca7
0x010f0ca9
0x010f0cb6
0x010f0cbd
0x010f0cc0
0x00000000
0x00000000
0x010f0cc3
0x010f0cca
0x010f0ccd
0x00000000
0x00000000
0x010f0ccf
0x010f0cd2
0x010f0cd5
0x010f0cd5
0x00000000
0x00000000
0x00000000
0x010f0cd5
0x010f0cab
0x010f0cb1
0x00000000
0x010f0cb1
0x010f0c92
0x010f0c98
0x00000000
0x00000000
0x00000000
0x010f0c98
0x010f0c77
0x010f0bce
0x010f0bd1
0x00000000
0x00000000
0x010f0bd3
0x010f0bd9
0x010f0bdf
0x010f0be5
0x010f0beb
0x010f0bf1
0x010f0bfc
0x010f0c03
0x010f0c05
0x010f0c07
0x010f11ef
0x010f11f5
0x010f11fa
0x010f11fd
0x010f1201
0x010f1203
0x010f1205
0x010f1208
0x010f1208
0x010f120b
0x010f120e
0x010f1212
0x010f1214
0x010f1216
0x010f1219
0x010f1219
0x010f121c
0x010f121f
0x010f1223
0x010f1225
0x010f1227
0x010f122a
0x010f122a
0x010f1238
0x010f123e
0x00000000
0x010f1240
0x010f0c0d
0x010f0c10
0x010f0c12
0x010f0c12
0x00000000
0x010f0c10
0x010f0b1f
0x010f0b2f
0x010f0b2f
0x010f0b32
0x010f0b35
0x00000000
0x00000000
0x010f0b37
0x010f0b3a
0x010f0b3d
0x00000000
0x00000000
0x010f0b3f
0x010f0b42
0x010f0b42
0x010f0b45
0x010f0b47
0x010f0b4b
0x010f0b4e
0x010f0b50
0x010f0b56
0x00000000
0x00000000
0x010f0b58
0x010f0b62
0x010f0b62
0x010f0b65
0x010f0b68
0x010f0b6a
0x010f0b70
0x010f0b72
0x010f0b78
0x010f0b7e
0x010f0b84
0x010f0b86
0x00000000
0x00000000
0x010f0b88
0x010f0b8e
0x010f0b8e
0x010f0b90
0x010f0b95
0x010f0b98
0x010f0b9b
0x00000000
0x00000000
0x00000000
0x010f0b9b
0x010f0b8a
0x010f0b8c
0x00000000
0x00000000
0x00000000
0x010f0b8c
0x010f0b5a
0x010f0b60
0x00000000
0x00000000
0x00000000
0x010f0b60
0x00000000
0x010f0b42
0x010f0b21
0x010f0b27
0x010f0b2d
0x00000000
0x00000000
0x00000000
0x010f0b2d
0x010f0ad3
0x010f0ad3
0x010f0ad7
0x00000000
0x010f0ad7
0x010f0a83
0x010f0a89
0x00000000
0x00000000
0x010f0a8b
0x010f0a8e
0x010f0a93
0x010f0a96
0x00000000
0x00000000
0x010f0a98
0x010f0a9e
0x010f0a9e
0x010f0aa1
0x010f0aa4
0x00000000
0x00000000
0x010f0aa6
0x010f0aac
0x010f0ab1
0x010f0ab4
0x010f0ab8
0x010f0aba
0x010f0ac0
0x010f0ac3
0x010f0ac3
0x010f050a
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f0510
0x00000000
0x00000000
0x00000000
0x010f0510
0x010f0617
0x010f0617
0x010f061a
0x010f061a
0x00000000
0x010f050d
0x010f0645
0x00000000
0x00000000
0x010f0647
0x010f0647
0x010f064f
0x010f0652
0x010f0652
0x010f0654
0x010f0657
0x010f0659
0x010f065f
0x00000000
0x010f068b
0x010f068b
0x010f068e
0x010f0691
0x010f0693
0x010f0699
0x010f069c
0x010f069c
0x010f06a4
0x010f06a7
0x00000000
0x00000000
0x010f06a9
0x010f06a9
0x00000000
0x010f050d
0x010f0a9a
0x010f0a9c
0x00000000
0x00000000
0x00000000
0x010f0a47
0x010f0a47
0x010f0a51
0x010f0a51
0x010f0a51
0x010f0a57
0x010f0a5d
0x010f0a63
0x010f0a69
0x010f0a6f
0x00000000
0x010f0a6f
0x010f0a49
0x010f0a4f
0x00000000
0x00000000
0x00000000
0x010f0a4f
0x010f0a45
0x010f0a01
0x010f0a03
0x00000000
0x00000000
0x00000000
0x010f0a03
0x010f09a7
0x010f09aa
0x010f09b0
0x010f09b6
0x010f09b8
0x010f09be
0x010f09c4
0x010f09c7
0x010f09cd
0x010f09e4
0x010f09e4
0x010f09e6
0x00000000
0x010f09e6
0x010f09cf
0x010f09df
0x010f09df
0x010f09e1
0x00000000
0x010f09e1
0x010f09d1
0x010f09d7
0x010f09dd
0x00000000
0x00000000
0x00000000
0x010f09dd
0x010f092f
0x010f0935
0x010f0941
0x00000000
0x010f0941
0x010f0888
0x010f088b
0x010f088e
0x010f08af
0x010f08b2
0x010f08b5
0x010f08d5
0x010f08d5
0x010f08d8
0x010f08dc
0x010f08de
0x010f08e4
0x010f08e7
0x010f08e7
0x00000000
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f050d
0x010f0510
0x00000000
0x00000000
0x00000000
0x010f0576
0x010f0576
0x010f0579
0x010f0579
0x010f057e
0x010f057e
0x010f0581
0x010f0586
0x010f0589
0x010f058c
0x010f058c
0x010f0595
0x00000000
0x00000000
0x010f0597
0x010f0597
0x010f05a0
0x010f05a0
0x010f05a3
0x010f05a9
0x010f05ac
0x010f05af
0x010f05b1
0x010f05b1
0x010f05bd
0x010f05bf
0x010f05c1
0x010f05c4
0x010f05e4
0x010f05e4
0x010f05e7
0x00000000
0x010f05e7
0x010f05c6
0x010f05cc
0x010f05ce
0x010f05ce
0x010f05d0
0x010f05d0
0x010f05d3
0x010f05d5
0x00000000
0x00000000
0x010f05db
0x010f05de
0x010f05df
0x010f05e2
0x00000000
0x00000000
0x00000000
0x010f05e2
0x00000000
0x010f05d0
0x010f08b7
0x010f08bb
0x00000000
0x00000000
0x010f08bd
0x010f08c3
0x00000000
0x00000000
0x010f08c5
0x010f08d0
0x010f08d3
0x00000000
0x00000000
0x00000000
0x010f08d3
0x010f0890
0x010f0896
0x00000000
0x00000000
0x010f0898
0x010f089b
0x010f089e
0x010f08a1
0x00000000
0x00000000
0x010f08a3
0x010f08a7
0x010f1027
0x010f102a
0x010f102e
0x010f1034
0x010f1039
0x010f103c
0x010f1040
0x010f1042
0x010f1044
0x010f1047
0x010f1047
0x010f104a
0x010f104d
0x010f1051
0x010f1053
0x010f1055
0x010f1058
0x010f1058
0x010f105b
0x010f105e
0x010f1062
0x010f1064
0x010f1066
0x010f1069
0x010f1069
0x010f106f
0x010f1077
0x010f107f
0x010f1095
0x010f109d
0x010f109d
0x010f10a0
0x010f10a4
0x010f10a6
0x010f10a8
0x010f10ab
0x010f10ab
0x010f10ae
0x010f10b1
0x010f10b5
0x010f10b7
0x010f10b9
0x010f10bc
0x010f10bc
0x010f10c1
0x00000000
0x010f10c1
0x00000000
0x010f08ad
0x010f0879
0x010f0707
0x010f066f
0x010f0675
0x010f0678
0x00000000
0x00000000
0x010f067a
0x010f0681
0x010f0681
0x010f0683
0x010f0686
0x010f0689
0x00000000
0x00000000
0x00000000
0x010f0689
0x010f067c
0x010f067f
0x00000000
0x00000000
0x00000000
0x010f067f
0x010f063a
0x010f063d
0x010f063d
0x010f0612
0x010f0615
0x00000000
0x00000000
0x00000000
0x010f0615
0x010f0603
0x010f0603
0x010f0606
0x00000000
0x00000000
0x00000000
0x010f053b
0x010f053b
0x010f053e
0x010f0543
0x010f0d10
0x010f0d14
0x00000000
0x010f0d14
0x010f0549
0x010f054f
0x010f0555
0x010f0558
0x010f055a
0x010f055d
0x010f0560
0x010f0563
0x010f0566
0x010f0569
0x010f0571
0x010f0574
0x00000000
0x00000000
0x00000000
0x010f0574
0x010f050d
0x010f050a
0x010f026f
0x010f0275
0x010f0275
0x010f0275
0x010f0277
0x010f0279
0x010f027b
0x010f0281
0x010f02c1
0x010f02c1
0x010f02c4
0x010f02c7
0x010f02cd
0x010f02d0
0x010f02d3
0x010f02d5
0x010f02d5
0x00000000
0x010f02d5
0x010f0283
0x010f0289
0x00000000
0x00000000
0x010f028b
0x010f028e
0x010f0293
0x010f0296
0x010f0299
0x010f029d
0x010f029f
0x010f02a4
0x010f02aa
0x010f02ad
0x010f02b0
0x010f02b3
0x010f02b5
0x010f02b7
0x010f02ba
0x010f02bd
0x00000000
0x010f02bd
0x010f0271
0x010f0273
0x00000000
0x00000000
0x00000000
0x010f0273
0x010f01c0
0x010f01c5
0x010f01c7
0x010f01ca
0x010f01ce
0x010f01d4
0x010f01d6
0x010f01d8
0x010f01d9
0x010f01df
0x010f01e2
0x010f01e9
0x010f01f2
0x010f01f4
0x010f01f6
0x00000000
0x00000000
0x010f01fc
0x010f0206
0x010f020c
0x010f020f
0x010f0212
0x010f0215
0x010f0217
0x010f021c
0x010f021e
0x010f0224
0x010f0d35
0x010f0d38
0x010f0d3c
0x010f0d3e
0x010f0d40
0x010f0d43
0x010f0d43
0x010f0d46
0x010f0d49
0x010f0d4d
0x010f0d4f
0x010f0d51
0x010f0d54
0x010f0d54
0x010f0d5a
0x010f0d62
0x010f0d6a
0x010f0d80
0x010f0d85
0x010f0d8b
0x010f0d8d
0x010f0d91
0x010f0d93
0x010f0d96
0x010f0d96
0x010f0d99
0x010f0d9c
0x010f0da0
0x010f0da2
0x010f0da4
0x010f0da7
0x010f0da7
0x010f0daa
0x00000000
0x010f0daa
0x010f022a
0x010f0230
0x010f0232
0x010f0255
0x010f0258
0x010f025b
0x010f025e
0x010f0261
0x010f0234
0x010f0234
0x010f023a
0x010f023e
0x010f0244
0x010f024a
0x010f024a
0x00000000
0x010f0321
0x010f0321
0x010f0324
0x010f0e35
0x010f0e35
0x010f0e38
0x010f0e3b
0x010f0ed1
0x010f0ed1
0x010f0ed4
0x010f0ed8
0x010f0edd
0x010f0ee0
0x010f0ee4
0x010f0ee9
0x010f0eec
0x010f0ef0
0x010f0ef5
0x010f0ef8
0x010f0efc
0x010f0f01
0x010f0f04
0x010f0f08
0x010f0f0d
0x010f0f10
0x010f0f15
0x010f0f17
0x010f0f1b
0x010f0f1b
0x00000000
0x010f0f17
0x010f0e41
0x010f0e44
0x010f0e47
0x010f0e49
0x010f0e4e
0x010f0e55
0x010f0e57
0x010f0e5d
0x010f0e5f
0x010f0e61
0x010f0e63
0x010f0e66
0x010f0e6b
0x010f0e6d
0x010f0e72
0x010f0e74
0x010f0e7e
0x010f0e81
0x010f0e8f
0x010f0e8f
0x010f0e92
0x010f0e97
0x010f0e9c
0x010f0e9f
0x010f0ea3
0x010f0ea5
0x010f0eaa
0x010f0ead
0x010f0eb2
0x010f0eb9
0x010f0ec0
0x010f0ec6
0x00000000
0x010f0ec6
0x010f0e83
0x010f0e85
0x010f0e8a
0x010f0e8d
0x00000000
0x00000000
0x00000000
0x010f0e8d
0x010f0e78
0x00000000
0x010f0e78
0x010f032a
0x010f032d
0x010f0330
0x010f03bd
0x010f03bd
0x010f03c0
0x010f03c2
0x010f03c4
0x010f03c7
0x010f03cd
0x010f03d3
0x010f040a
0x010f040a
0x010f040d
0x010f040f
0x010f0412
0x010f0418
0x00000000
0x00000000
0x010f041e
0x010f0423
0x010f0425
0x010f0427
0x010f042d
0x010f042f
0x010f0432
0x010f0434
0x010f0437
0x010f0485
0x010f0485
0x010f0488
0x010f0489
0x010f048c
0x010f0492
0x010f0494
0x010f049a
0x010f049c
0x010f049e
0x010f04a1
0x010f04a7
0x010f04aa
0x00000000
0x00000000
0x010f04ac
0x010f04ae
0x00000000
0x00000000
0x00000000
0x00000000
0x010f04b0
0x010f04b0
0x010f04b0
0x010f04b3
0x010f04b9
0x010f04bd
0x00000000
0x00000000
0x010f04bf
0x010f04c0
0x010f04c3
0x010f04c9
0x00000000
0x00000000
0x00000000
0x010f04c9
0x00000000
0x010f04b0
0x010f0439
0x010f043c
0x010f0442
0x00000000
0x00000000
0x010f0448
0x010f0459
0x010f045f
0x010f0462
0x010f0468
0x010f046e
0x010f0471
0x010f0473
0x00000000
0x00000000
0x010f0475
0x010f047f
0x010f047f
0x00000000
0x010f047f
0x010f0477
0x010f047d
0x00000000
0x00000000
0x00000000
0x010f047d
0x010f044a
0x010f044d
0x010f0453
0x00000000
0x00000000
0x00000000
0x010f0453
0x010f03d5
0x010f03df
0x010f03df
0x010f03e2
0x010f03e8
0x010f03e8
0x010f03ed
0x010f03ef
0x010f03f5
0x010f03f8
0x010f03fe
0x010f0404
0x00000000
0x010f0404
0x010f03d7
0x010f03dd
0x00000000
0x00000000
0x00000000
0x010f03dd
0x010f0336
0x010f0339
0x010f033f
0x010f0342
0x010f0344
0x010f0347
0x010f034a
0x010f034d
0x010f0350
0x010f0356
0x010f0359
0x010f035c
0x010f035f
0x010f0362
0x010f036c
0x010f036c
0x010f0370
0x010f0370
0x010f0376
0x010f037c
0x010f0382
0x010f0384
0x010f0386
0x00000000
0x00000000
0x010f0388
0x010f038f
0x010f038f
0x010f0398
0x010f039a
0x010f039d
0x010f039f
0x010f03a5
0x010f0db5
0x010f0db8
0x010f0dbc
0x010f0dbe
0x010f0dc0
0x010f0dc3
0x010f0dc3
0x010f0dc6
0x010f0dc9
0x010f0dcd
0x010f0dcf
0x010f0dd1
0x010f0dd4
0x010f0dd4
0x010f0dda
0x010f0de2
0x010f0dea
0x010f0e00
0x010f0e05
0x010f0e0b
0x010f0e0d
0x010f0e11
0x010f0e13
0x010f0e16
0x010f0e16
0x010f0e19
0x010f0e1c
0x010f0e20
0x010f0e22
0x010f0e24
0x010f0e27
0x010f0e27
0x010f0e2a
0x00000000
0x010f0e2a
0x010f03ab
0x010f03ae
0x010f03b4
0x010f03b7
0x00000000
0x010f03b7
0x010f038a
0x010f038d
0x00000000
0x00000000
0x00000000
0x010f038d
0x010f0364
0x010f0367
0x010f036a
0x00000000
0x00000000
0x00000000
0x010f036a
0x010f0121
0x010f0121
0x010f0123
0x010f0129
0x010f012a
0x010f012b
0x010f012f
0x010f0131
0x010f0133
0x010f1171
0x010f1171
0x010f1174
0x010f1178
0x010f117a
0x010f117c
0x010f117f
0x010f117f
0x010f1182
0x010f1185
0x010f1189
0x010f118b
0x010f118d
0x010f1190
0x010f1190
0x00000000
0x010f118b
0x00000000
0x010f0133
0x00000000
0x00000000
0x00000000
0x010eff95
0x010eff95
0x010eff95
0x010eff9b
0x010eff9e
0x010effa0
0x010effa3
0x00000000
0x00000000
0x010effa5
0x010effa8
0x010effad
0x010effb0
0x010effb3
0x010effb6
0x010f0012
0x010f0013
0x010f001b
0x010f001e
0x00000000
0x010f001e
0x010effba
0x010effbd
0x010effbf
0x010effc1
0x010effc1
0x010effc5
0x010effc7
0x010effca
0x010f000a
0x010f000a
0x010f000d
0x00000000
0x00000000
0x010f000f
0x00000000
0x010effcc
0x010effcc
0x010effcc
0x010effcf
0x010effd2
0x010effd6
0x010effde
0x010effe0
0x010effe3
0x010effec
0x010effef
0x010efff5
0x010efff7
0x010efff7
0x010efff9
0x010efffb
0x010f0002
0x010effd8
0x010effd8
0x010effd8
0x010f0004
0x010f0005
0x010f0005
0x00000000
0x010effcc
0x010f0022
0x010f0022
0x010f0025
0x010f0026
0x010f002c
0x010f002c
0x00000000
0x010eff95
0x010eff36
0x010eff4c
0x00000000
0x00000000
0x00000000
0x00000000
0x010efea0
0x010efea0
0x010efea3
0x010efeae
0x010efeb1
0x010efeb9
0x010efebc
0x010efebf
0x010efec2
0x010efec5
0x010efec7
0x00000000
0x00000000
0x00000000
0x00000000
0x010efec9
0x010efec9
0x010efeca
0x010efed0
0x010efed5
0x010efedb
0x010efee1
0x010efee1
0x010efee6
0x010efee6
0x010efee9
0x010efeea
0x010efeec
0x010efeec
0x00000000
0x010ef95e
0x010ef95e
0x010ef961
0x010ef967
0x010ef96a
0x010ef96a
0x010ef96d
0x010ef970
0x010ef973
0x010ef976
0x010ef97a
0x010ef980
0x010ef986
0x010ef989
0x010ef98b
0x00000000
0x00000000
0x010ef98d
0x010ef98f
0x010ef998
0x010ef99b
0x010ef99d
0x010ef9a3
0x010efc3e
0x010efc43
0x010efc47
0x010efc4a
0x010efc4e
0x010efc50
0x010efc53
0x010efc53
0x010efc56
0x010efc59
0x010efc5d
0x010efc5f
0x010efc61
0x010efc64
0x010efc64
0x010efc67
0x010ef5f0
0x010ef61c
0x010f0f8f
0x010f0f8f
0x010f139f
0x010f13a4
0x010f13ad
0x010f13ad
0x010ef9a9
0x010ef9a9
0x010ef9af
0x010ef9b3
0x010ef9b5
0x010ef9b8
0x010ef9ba
0x010ef9c0
0x010efc7d
0x010efc82
0x010efc86
0x010efc89
0x010efc8d
0x010efc8f
0x010efc92
0x010efc92
0x010efc95
0x010efc98
0x010efc9c
0x010efc9e
0x010efca0
0x010efca3
0x010efca3
0x010efca6
0x00000000
0x010efca6
0x010ef9c6
0x010ef9c9
0x010ef9cc
0x010ef9d0
0x010ef9d1
0x010ef9d3
0x010ef9d4
0x010ef9d7
0x010ef9d9
0x010ef9de
0x010ef9e0
0x010ef9e2
0x010efcb1
0x010efcb1
0x010efcb4
0x010efcb8
0x010efcba
0x010efcbc
0x010efcbf
0x010efcbf
0x010efccd
0x010efcd2
0x010efcd6
0x010efcd9
0x010efcdd
0x010efcdf
0x010efce2
0x010efce2
0x010efce5
0x010efce8
0x010ef548
0x010ef54d
0x010ef54d
0x010ef550
0x00000000
0x010ef550
0x010ef9e8
0x010ef9eb
0x010ef9ed
0x010ef9fb
0x010ef9fe
0x010efa01
0x010efa07
0x010efa10
0x010efa1a
0x010efa1d
0x010efa22
0x010efa27
0x010efa2a
0x010efa2d
0x010efa40
0x010efa43
0x010efcf1
0x010efcf4
0x010efcf8
0x010efcfa
0x010efcfc
0x010efcff
0x010efcff
0x010efd0d
0x010efd12
0x010efd16
0x010efd19
0x010efd1d
0x010efd1f
0x010efd22
0x010efd22
0x010efd25
0x010efd28
0x010efd2c
0x010efd2e
0x010efd30
0x010efd33
0x010efd33
0x010efd36
0x00000000
0x010efd36
0x010efa49
0x010efa4a
0x010efa4b
0x010efa4c
0x010efa4e
0x010efa51
0x010efa56
0x010efa58
0x010efa5e
0x010efd3e
0x010efd41
0x010efd45
0x010efd47
0x010efd49
0x010efd4c
0x010efd4c
0x010efd5a
0x010efd5f
0x010efd63
0x010efd66
0x010efd6a
0x010efd6c
0x010efd6f
0x010efd6f
0x010efd72
0x010efd75
0x010efd79
0x010efd7b
0x010efd7d
0x010efd80
0x010efd80
0x010efd83
0x00000000
0x010efd83
0x010efa64
0x010efa6a
0x010efa7e
0x010efa7e
0x010efa84
0x010efa89
0x010efa8d
0x010efa93
0x010efa99
0x010efa9f
0x010efaa5
0x010efaab
0x010efab1
0x010efab7
0x010efabd
0x010efac3
0x010efac5
0x010efac5
0x010efacc
0x010eface
0x010efaee
0x010efaee
0x010efaf1
0x010efb93
0x010efb93
0x010efb96
0x010efb99
0x010efb9b
0x010efba5
0x010efba5
0x010efbab
0x010efbd2
0x010efbd2
0x010efbd8
0x010efbdb
0x010efbe1
0x010efbe7
0x010efbe9
0x010efbeb
0x010efe00
0x010efe06
0x010efe0b
0x010efe0e
0x010efe12
0x010efe14
0x010efe16
0x010efe19
0x010efe19
0x010efe27
0x010efe2c
0x010efe30
0x010efe33
0x010efe37
0x010efe39
0x010efe3c
0x010efe3c
0x010efe3f
0x010efe42
0x010efe46
0x010efe48
0x010efe4a
0x010efe4d
0x010efe4d
0x010efe50
0x00000000
0x010efe50
0x010efbf1
0x010efbfb
0x010efc00
0x010efc00
0x010efc06
0x00000000
0x010efc06
0x010efbad
0x010efbb3
0x00000000
0x00000000
0x010efbb5
0x010efbbb
0x010efbc1
0x010efbc4
0x00000000
0x00000000
0x010efbc6
0x00000000
0x00000000
0x010efbc8
0x010efbce
0x010efbd0
0x00000000
0x00000000
0x00000000
0x010efbd0
0x010efaf7
0x010efafa
0x010efafd
0x010efb00
0x010efb02
0x010efb05
0x010efb0c
0x010efb0e
0x010efb15
0x010efb18
0x010efb1b
0x010efb1d
0x010efb1d
0x010efb10
0x010efb10
0x010efb10
0x010efb07
0x010efb07
0x010efb07
0x010efb20
0x010efb23
0x010efb26
0x010efd9e
0x010efd9e
0x010efda1
0x010efda6
0x010efdae
0x010efdb0
0x010efdb5
0x010efdbb
0x010efdc0
0x010efdc3
0x010efdc7
0x010efdc9
0x010efdcb
0x010efdce
0x010efdce
0x010efddc
0x010efde1
0x010efde5
0x010efde8
0x010efdec
0x010efdee
0x010efdf1
0x010efdf1
0x010efdf4
0x010efdf7
0x010ef5e6
0x010ef5e8
0x010ef5ea
0x010ef5ed
0x010ef5ed
0x00000000
0x010ef5e8
0x010efb2c
0x010efb2f
0x010efb68
0x010efb68
0x010efb6b
0x010efb71
0x010efb73
0x010efb76
0x010efb78
0x010efb7e
0x010efb83
0x010efb85
0x010efb87
0x010efb87
0x010efb85
0x010efb8a
0x010efb8d
0x00000000
0x00000000
0x00000000
0x00000000
0x010efb8d
0x010efb31
0x010efb37
0x010efb3d
0x010efb43
0x010efb4e
0x010efb50
0x010efb55
0x010efb57
0x010efb59
0x010efd8e
0x010efd94
0x00000000
0x010efd94
0x010efb5f
0x010efb62
0x00000000
0x00000000
0x00000000
0x010efb62
0x010efad0
0x010efad6
0x010efad6
0x010efadc
0x010efae2
0x010efae8
0x00000000
0x010efae8
0x010efad2
0x010efad4
0x00000000
0x00000000
0x00000000
0x010efad4
0x010efa6c
0x00000000
0x00000000
0x010efa72
0x010efa78
0x00000000
0x00000000
0x00000000
0x010efa2f
0x010efa2f
0x010efa32
0x010efa35
0x010efa37
0x010efc0b
0x010efc0b
0x010efc0e
0x010efc12
0x010efc14
0x010efc16
0x010efc19
0x010efc19
0x00000000
0x010efc14
0x010ef9ef
0x010ef9ef
0x010efc1c
0x010efc1c
0x010efc1f
0x010efc22
0x010efc25
0x00000000
0x00000000
0x010efc2b
0x00000000
0x010efc2b
0x010ef9ed
0x010ef96a
0x010ef82d
0x00000000
0x010ef82d
0x010ef82d
0x010ef830
0x010ef837
0x010ef83a
0x010ef83d
0x010ef840
0x010ef845
0x010ef847
0x010ef851
0x010ef854
0x010ef856
0x010ef87f
0x010ef881
0x010ef886
0x010ef888
0x010ef8b0
0x010ef8b0
0x010ef8b4
0x010ef8b4
0x010ef8b6
0x010ef921
0x010ef921
0x010ef924
0x010ef927
0x010ef92a
0x010ef92a
0x00000000
0x010ef924
0x010ef8b8
0x010ef8bb
0x010ef8bd
0x00000000
0x00000000
0x010ef8bf
0x010ef8c2
0x010ef90d
0x010ef90d
0x010ef910
0x010ef913
0x00000000
0x00000000
0x010ef915
0x010ef917
0x010ef91a
0x00000000
0x00000000
0x00000000
0x00000000
0x010ef8c4
0x010ef8c4
0x010ef8c4
0x010ef8c7
0x010ef8ca
0x010ef8cd
0x010ef8d0
0x010ef8d3
0x010ef8d6
0x010ef8d9
0x010ef8e6
0x010ef8e8
0x010ef8e9
0x010ef8ee
0x010ef8ef
0x010ef8f0
0x010ef8f5
0x010ef8f8
0x010ef8fa
0x00000000
0x00000000
0x010ef8db
0x010ef8db
0x010ef8de
0x010ef8e0
0x010ef8e0
0x010ef8de
0x010ef8fc
0x010ef8ff
0x010ef902
0x010ef902
0x010ef907
0x00000000
0x010ef907
0x010ef88a
0x010ef88d
0x00000000
0x00000000
0x010ef88f
0x010ef891
0x010ef893
0x010ef896
0x010ef899
0x00000000
0x00000000
0x010ef89b
0x010ef89d
0x010ef8a0
0x010ef8a3
0x00000000
0x00000000
0x010ef8a5
0x010ef8a8
0x010ef8ab
0x010ef8ae
0x00000000
0x00000000
0x00000000
0x010ef8ae
0x010ef85e
0x010ef860
0x010ef862
0x00000000
0x00000000
0x010ef868
0x010ef86b
0x00000000
0x00000000
0x010ef871
0x010ef874
0x00000000
0x010ef87a
0x00000000
0x010ef87a
0x010ef849
0x010ef849
0x010ef849
0x010ef92f
0x010ef92f
0x010ef932
0x010ef935
0x010ef93b
0x010ef80f
0x010ef80f
0x010ef815
0x010ef818
0x010ef81b
0x010ef81e
0x010ef824
0x010ef827
0x00000000
0x00000000
0x00000000
0x010ef941
0x010ef941
0x010ef944
0x010ef949
0x010ef94d
0x010ef94d
0x00000000
0x010ef944
0x010ef93b

APIs

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

memset.MSVCRT ref: 010EFF10
memset.MSVCRT ref: 010EFF23

Strings

Split, xrefs: 010EF830

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memset$free
String ID: Split
API String ID: 1508699874-1882502421
Opcode ID: b52f2d6013c394deab8b7dd2c534db5011f469bdcc47f07213dac0b21635e6c5
Instruction ID: d072650b79d6e97adb4472139f582bce1f94c0e9399b53099b2b9c38e7d86409
Opcode Fuzzy Hash: b52f2d6013c394deab8b7dd2c534db5011f469bdcc47f07213dac0b21635e6c5
Instruction Fuzzy Hash: 8D425B70A0424ADFDF21DFA9C988ADDBBF1BF49304F2444A9E589A7251CB31AD85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 010E98A7 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E010E98A7(signed int __ecx, intOrPtr* __edx, void* __eflags) {
				void* __ebx;
				void* __esi;
				intOrPtr* _t175;
				void* _t183;
				void* _t184;
				void* _t186;
				intOrPtr* _t202;
				signed int _t204;
				signed int _t206;
				signed int _t217;
				intOrPtr* _t227;
				signed int _t233;
				signed int _t235;
				signed int _t236;
				signed int _t238;
				intOrPtr _t242;
				intOrPtr* _t256;
				intOrPtr _t301;
				intOrPtr* _t318;
				signed int _t320;
				void* _t322;
				intOrPtr _t323;
				intOrPtr* _t326;
				signed int _t327;
				intOrPtr* _t329;
				intOrPtr* _t330;
				void* _t331;
				void* _t337;
				void* _t340;

				_t337 = __eflags;
				E011039E0(E01105B7B, _t331);
				_t318 = __edx;
				 *(_t331 - 0x18) = __ecx;
				_t175 =  *((intOrPtr*)( *__edx +  *(__edx + 4) * 4 - 4));
				_t256 =  *((intOrPtr*)(_t331 + 0x28));
				 *((intOrPtr*)(_t331 - 0x14)) = _t175;
				 *_t256 = 0;
				 *((intOrPtr*)(_t256 + 4)) = 0;
				 *((intOrPtr*)(_t331 - 0x40)) = 0;
				 *((intOrPtr*)(_t331 - 0x1c)) =  *_t175;
				 *(_t331 - 0x3c) = 0;
				 *((intOrPtr*)(_t331 - 0x38)) = 0;
				 *((intOrPtr*)(_t331 - 4)) = 0;
				E010F801B(_t331 - 0x74);
				_t326 =  *((intOrPtr*)(_t331 + 0x14));
				 *((char*)(_t331 - 4)) = 1;
				_t18 = _t326 + 0xc; // 0xd
				E010D29BC(_t331 - 0x34, _t337, _t18);
				 *((char*)(_t331 - 4)) = 2;
				E010D29BC(_t331 - 0x68, _t337,  *((intOrPtr*)(_t331 - 0x14)) + 0x88);
				 *((char*)(_t331 - 4)) = 3;
				if( *((intOrPtr*)(_t318 + 4)) > 1) {
					_t323 =  *((intOrPtr*)( *_t318));
					if(E010D20D0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *(_t331 - 0x18) + 0x28)) +  *(_t323 + 0x94) * 4)) + 0xc)), "pe") != 0) {
						_t340 = _t323 + 0x88;
						E010D2A8C(_t331 - 0x68, _t323 + 0x88);
					}
				}
				_t308 = _t331 - 0x68;
				_t183 = E010E9F3E(_t331 - 0x58, _t331 - 0x68, _t340);
				 *((char*)(_t331 - 4)) = 4;
				_t184 = E010D296F(_t331 - 0x4c, "*");
				 *((char*)(_t331 - 4)) = 5;
				_t186 = E010D1ABD(E010D2F43(_t331 - 0x34, _t184, _t183),  *((intOrPtr*)(_t331 - 0x4c)));
				 *((char*)(_t331 - 4)) = 3;
				E010D1ABD(_t186,  *((intOrPtr*)(_t331 - 0x58)));
				 *(_t331 + 0x17) = 0;
				E010D28E9(_t331 - 0x28);
				 *((char*)(_t331 - 4)) = 6;
				E010D29BC(_t331 - 0x80, _t340, _t331 - 0x34);
				 *((char*)(_t331 - 4)) = 7;
				if( *_t326 != 0 &&  *((intOrPtr*)(_t326 + 4)) != 3) {
					E010D28E9(_t331 - 0x4c);
					 *((char*)(_t331 - 4)) = 8;
					_t242 = E010D381F(_t331 - 0x34, _t331 - 0x4c, _t331 - 0x28);
					_t308 =  *(_t331 - 0x24);
					if(_t308 != 0) {
						_t242 =  *((intOrPtr*)(_t331 - 0x28));
						_t301 =  *((intOrPtr*)(_t242 + _t308 * 2 - 2));
						if(_t301 == 0x5c || _t301 == 0x2f) {
							_t308 = _t308 - 1;
							 *(_t331 - 0x24) = _t308;
							 *((short*)(_t242 + _t308 * 2)) = 0;
						}
						if( *(_t331 - 0x24) != 0) {
							_t242 = E010D2A8C(_t331 - 0x80, _t331 - 0x4c);
							 *(_t331 + 0x17) = 1;
						}
					}
					 *((char*)(_t331 - 4)) = 7;
					E010D1ABD(_t242,  *((intOrPtr*)(_t331 - 0x4c)));
				}
				 *(_t331 - 0xd) = E010D3A7D(0,  *(_t331 + 0x10), _t308, _t326);
				if( *(_t326 + 0x24) != 0) {
					L41:
					__eflags =  *(_t331 + 0x17);
					if( *(_t331 + 0x17) != 0) {
						_push(_t331 - 0x28);
						E010D150C(_t331 - 0x74);
					}
					__eflags =  *(_t331 - 0x30);
					if(__eflags != 0) {
						__eflags = E010D509E( *((intOrPtr*)(_t331 - 0x34)), __eflags);
						if(__eflags != 0) {
							goto L45;
						}
						_t327 = GetLastError();
						__eflags = _t327;
						if(_t327 == 0) {
							_t327 = 0x80004005;
						}
						E010D2B8A( *((intOrPtr*)(_t331 + 0x24)), "Can not create output directory: ");
						_t206 = E010D2C71( *((intOrPtr*)(_t331 + 0x24)), __eflags, _t331 - 0x34);
						goto L68;
					} else {
						E010D2B8A(_t331 - 0x34, ".\\");
						L45:
						_t320 =  *(_t331 + 0x20);
						asm("sbb eax, eax");
						_t124 = _t326 + 0x18; // 0x19
						E010DDD71(_t320, __eflags, _t124,  ~( *(_t326 + 0x24)) &  *(_t331 + 0x10),  *((intOrPtr*)(_t331 - 0x14)),  *((intOrPtr*)(_t331 + 0x1c)),  *((intOrPtr*)(_t326 + 0x25)),  *(_t326 + 0x27), _t331 - 0x34, _t331 - 0x74, 0,  *((intOrPtr*)(_t331 + 8)),  *((intOrPtr*)(_t331 + 0xc)));
						__eflags =  *(_t326 + 0x24);
						if( *(_t326 + 0x24) != 0) {
							L49:
							__eflags =  *(_t326 + 0x27);
							if( *(_t326 + 0x27) == 0) {
								L56:
								__eflags = 0;
								L57:
								 *(_t331 + 0x10) = _t320;
								__eflags =  *(_t326 + 0x24);
								 *((char*)(_t331 - 4)) = 0xa;
								if( *(_t326 + 0x24) == 0) {
									_t202 =  *((intOrPtr*)(_t331 - 0x1c));
									 *(_t331 + 0x18) =  *((intOrPtr*)( *_t202 + 0x1c))(_t202,  *((intOrPtr*)(_t331 - 0x40)),  *(_t331 - 0x3c), 0, _t320);
								} else {
									_t329 =  *((intOrPtr*)(_t331 - 0x1c));
									 *(_t331 + 0x18) =  *((intOrPtr*)( *_t329 + 0x1c))(_t329, 0, 0xffffffff, 0, _t320);
									 *((short*)(_t331 - 0x5c)) = 0;
									 *((short*)(_t331 - 0x5a)) = 0;
									 *((intOrPtr*)(_t331 - 0x54)) = 0;
									 *((char*)(_t331 - 4)) = 0xb;
									_t217 =  *((intOrPtr*)( *_t329 + 0x20))(_t329, 0x2c, _t331 - 0x5c);
									__eflags = _t217;
									if(_t217 == 0) {
										E010DD87D(_t331 - 0x5c,  *((intOrPtr*)(_t331 + 0x28)));
									}
									 *((char*)(_t331 - 4)) = 0xa;
									E010D8173(_t331 - 0x5c);
								}
								_t204 = 0;
								__eflags = _t320;
								if(__eflags != 0) {
									_t204 = E010E038B(_t320, __eflags);
									 *(_t331 + 0x10) = 0;
								}
								__eflags =  *(_t331 + 0x18);
								if( *(_t331 + 0x18) == 0) {
									 *(_t331 + 0x18) = _t204;
								}
								_t206 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x1c)))) + 0x30))( *(_t331 + 0x18));
								_t272 =  *(_t331 + 0x10);
								_t327 = _t206;
								__eflags =  *(_t331 + 0x10);
								 *((char*)(_t331 - 4)) = 7;
								if(__eflags != 0) {
									_t206 = E010E038B(_t272, __eflags);
								}
								goto L68;
							}
							L50:
							__eflags =  *(_t331 + 0x18);
							if( *(_t331 + 0x18) != 0) {
								goto L56;
							}
							_push(1);
							_pop(0);
							goto L57;
						}
						__eflags =  *(_t326 + 0x27);
						if( *(_t326 + 0x27) != 0) {
							goto L50;
						}
						__eflags =  *(_t326 + 0x1c);
						if(__eflags == 0) {
							goto L49;
						}
						_t206 = E010DD60E(_t320, __eflags, _t331 - 0x40);
						__eflags = _t206;
						if(_t206 != 0) {
							goto L14;
						}
						goto L49;
					}
				} else {
					_t227 =  *((intOrPtr*)(_t331 - 0x1c));
					_t206 =  *((intOrPtr*)( *_t227 + 0x14))(_t227, _t331 - 0x18);
					if(_t206 == 0) {
						E010DDA55(_t331 - 0xc0, __eflags);
						_t322 = 0;
						__eflags =  *(_t331 - 0x18);
						 *((char*)(_t331 - 4)) = 9;
						if( *(_t331 - 0x18) <= 0) {
							L37:
							__eflags =  *(_t331 - 0x3c);
							if( *(_t331 - 0x3c) != 0) {
								 *((char*)(_t331 - 4)) = 7;
								E010DDCFB(_t331 - 0xc0);
								goto L41;
							}
							_t330 =  *((intOrPtr*)(_t331 + 0x1c));
							 *((intOrPtr*)( *_t330 + 0x2c))();
							_t233 =  *((intOrPtr*)( *_t330 + 0x30))(0);
							L39:
							_t327 = _t233;
							 *((char*)(_t331 - 4)) = 7;
							_t206 = E010DDCFB(_t331 - 0xc0);
							L68:
							E010D1ABD(E010D1ABD(E010D1ABD(E010D1ABD(_t206,  *((intOrPtr*)(_t331 - 0x80))),  *((intOrPtr*)(_t331 - 0x28))),  *(_t331 - 0x68)),  *((intOrPtr*)(_t331 - 0x34)));
							 *((char*)(_t331 - 4)) = 0;
							E010D1ABD(E010E8B2E(0, _t331 - 0x74),  *((intOrPtr*)(_t331 - 0x40)));
							 *[fs:0x0] =  *((intOrPtr*)(_t331 - 0xc));
							return _t327;
						} else {
							goto L16;
						}
						do {
							L16:
							__eflags =  *(_t331 + 0x17);
							if(__eflags != 0) {
								L21:
								_push(_t331 - 0xc0);
								_push(_t322);
								_t233 = E010EDEAB( *((intOrPtr*)(_t331 - 0x14)), __eflags);
								L22:
								__eflags = _t233;
								if(_t233 != 0) {
									goto L39;
								}
								L23:
								__eflags =  *(_t326 + 0x1e);
								if( *(_t326 + 0x1e) != 0) {
									L25:
									__eflags =  *(_t331 + 0x17);
									if( *(_t331 + 0x17) == 0) {
										L33:
										__eflags =  *(_t331 - 0xd);
										if(__eflags != 0) {
											L35:
											_t235 = E010D1553(_t331 - 0x40, _t322);
											goto L36;
										}
										_t235 = E010DE567( *(_t331 + 0x10), __eflags);
										__eflags = _t235;
										if(_t235 == 0) {
											goto L36;
										}
										goto L35;
									}
									_t236 = E010D370E(_t235,  *((intOrPtr*)(_t331 - 0xa8)),  *((intOrPtr*)(_t331 - 0x28)));
									__eflags = _t236;
									if(_t236 == 0) {
										L32:
										 *(_t331 + 0x17) = 0;
										goto L33;
									}
									_t238 =  *((intOrPtr*)( *((intOrPtr*)(_t331 - 0xa8)) +  *(_t331 - 0x24) * 2));
									__eflags = _t238;
									if(_t238 != 0) {
										__eflags = _t238 - 0x5c;
										if(_t238 == 0x5c) {
											goto L33;
										}
										__eflags = _t238 - 0x2f;
										if(_t238 == 0x2f) {
											goto L33;
										}
										goto L32;
									}
									__eflags =  *(_t331 - 0x8d);
									if( *(_t331 - 0x8d) != 0) {
										goto L33;
									}
									goto L32;
								}
								__eflags =  *(_t331 - 0x90);
								if( *(_t331 - 0x90) != 0) {
									goto L36;
								}
								goto L25;
							}
							__eflags =  *(_t331 - 0xd);
							if(__eflags == 0) {
								goto L21;
							}
							__eflags =  *(_t326 + 0x1e);
							 *(_t331 - 0x90) = 0;
							if( *(_t326 + 0x1e) != 0) {
								goto L25;
							}
							_t235 =  *((intOrPtr*)(_t331 - 0x14));
							__eflags =  *(_t235 + 0xdc);
							if( *(_t235 + 0xdc) == 0) {
								goto L23;
							} else {
								_t233 = E010EDA88(_t331 - 0x90);
								goto L22;
							}
							L36:
							_t322 = _t322 + 1;
							__eflags = _t322 -  *(_t331 - 0x18);
						} while (_t322 <  *(_t331 - 0x18));
						goto L37;
					}
					L14:
					_t327 = _t206;
					goto L68;
				}
			}

0x010e98a7
0x010e98ac
0x010e98ba
0x010e98bc
0x010e98c6
0x010e98ca
0x010e98cd
0x010e98d0
0x010e98d2
0x010e98d7
0x010e98da
0x010e98dd
0x010e98e0
0x010e98e6
0x010e98e9
0x010e98ee
0x010e98f4
0x010e98f8
0x010e98fc
0x010e990c
0x010e9911
0x010e991a
0x010e991e
0x010e992a
0x010e9944
0x010e9946
0x010e9950
0x010e9950
0x010e9944
0x010e9955
0x010e995b
0x010e996a
0x010e996e
0x010e9978
0x010e9984
0x010e998c
0x010e9990
0x010e9996
0x010e999d
0x010e99a9
0x010e99ad
0x010e99b4
0x010e99b8
0x010e99c3
0x010e99d2
0x010e99d6
0x010e99db
0x010e99e0
0x010e99e2
0x010e99e5
0x010e99ee
0x010e99f6
0x010e99f7
0x010e99fa
0x010e99fa
0x010e9a01
0x010e9a0a
0x010e9a0f
0x010e9a0f
0x010e9a01
0x010e9a16
0x010e9a1a
0x010e9a1f
0x010e9a2b
0x010e9a2e
0x010e9b67
0x010e9b67
0x010e9b6a
0x010e9b72
0x010e9b73
0x010e9b73
0x010e9b78
0x010e9b7b
0x010e9bf9
0x010e9bfb
0x00000000
0x00000000
0x010e9c03
0x010e9c05
0x010e9c07
0x010e9c09
0x010e9c09
0x010e9c16
0x010e9c22
0x00000000
0x010e9b7d
0x010e9b85
0x010e9b8a
0x010e9b90
0x010e9bb1
0x010e9bb7
0x010e9bbb
0x010e9bc0
0x010e9bc3
0x010e9be2
0x010e9be2
0x010e9be5
0x010e9c2c
0x010e9c2c
0x010e9c2e
0x010e9c2e
0x010e9c31
0x010e9c34
0x010e9c38
0x010e9c83
0x010e9c94
0x010e9c3a
0x010e9c3a
0x010e9c48
0x010e9c4b
0x010e9c4f
0x010e9c53
0x010e9c5f
0x010e9c63
0x010e9c66
0x010e9c68
0x010e9c70
0x010e9c70
0x010e9c78
0x010e9c7c
0x010e9c7c
0x010e9c97
0x010e9c99
0x010e9c9b
0x010e9c9f
0x010e9ca4
0x010e9ca4
0x010e9ca7
0x010e9caa
0x010e9cac
0x010e9cac
0x010e9cb7
0x010e9cba
0x010e9cbd
0x010e9cbf
0x010e9cc1
0x010e9cc5
0x010e9cc7
0x010e9cc7
0x00000000
0x010e9cc5
0x010e9be7
0x010e9be7
0x010e9bea
0x00000000
0x00000000
0x010e9bec
0x010e9bee
0x00000000
0x010e9bee
0x010e9bc5
0x010e9bc8
0x00000000
0x00000000
0x010e9bca
0x010e9bcd
0x00000000
0x00000000
0x010e9bd5
0x010e9bda
0x010e9bdc
0x00000000
0x00000000
0x00000000
0x010e9bdc
0x010e9a34
0x010e9a34
0x010e9a3e
0x010e9a43
0x010e9a52
0x010e9a57
0x010e9a59
0x010e9a5c
0x010e9a60
0x010e9b2b
0x010e9b2b
0x010e9b2e
0x010e9b5e
0x010e9b62
0x00000000
0x010e9b62
0x010e9b30
0x010e9b37
0x010e9b3f
0x010e9b42
0x010e9b48
0x010e9b4a
0x010e9b4e
0x010e9ccc
0x010e9ce7
0x010e9cf2
0x010e9cfd
0x010e9d0b
0x010e9d13
0x00000000
0x00000000
0x00000000
0x010e9a66
0x010e9a66
0x010e9a66
0x010e9a69
0x010e9a9a
0x010e9aa3
0x010e9aa4
0x010e9aa5
0x010e9aaa
0x010e9aaa
0x010e9aac
0x00000000
0x00000000
0x010e9ab2
0x010e9ab2
0x010e9ab5
0x010e9abf
0x010e9abf
0x010e9ac2
0x010e9b01
0x010e9b01
0x010e9b04
0x010e9b18
0x010e9b1c
0x00000000
0x010e9b1c
0x010e9b0f
0x010e9b14
0x010e9b16
0x00000000
0x00000000
0x00000000
0x010e9b16
0x010e9acd
0x010e9ad2
0x010e9ad4
0x010e9afe
0x010e9afe
0x00000000
0x010e9afe
0x010e9adf
0x010e9ae3
0x010e9ae6
0x010e9af2
0x010e9af6
0x00000000
0x00000000
0x010e9af8
0x010e9afc
0x00000000
0x00000000
0x00000000
0x010e9afc
0x010e9ae8
0x010e9aee
0x00000000
0x00000000
0x00000000
0x010e9af0
0x010e9ab7
0x010e9abd
0x00000000
0x00000000
0x00000000
0x010e9abd
0x010e9a6b
0x010e9a6e
0x00000000
0x00000000
0x010e9a70
0x010e9a73
0x010e9a79
0x00000000
0x00000000
0x010e9a7b
0x010e9a7e
0x010e9a84
0x00000000
0x010e9a86
0x010e9a93
0x00000000
0x010e9a93
0x010e9b21
0x010e9b21
0x010e9b22
0x010e9b22
0x00000000
0x010e9a66
0x010e9a45
0x010e9a45
0x00000000
0x010e9a45

APIs

__EH_prolog.LIBCMT ref: 010E98AC

Part of subcall function 010EDEAB: __EH_prolog.LIBCMT ref: 010EDEB0

GetLastError.KERNEL32(?,01108294,-00000087,0000000D,00000000,00000000,?), ref: 010E9BFD

Strings

Can not create output directory: , xrefs: 010E9C11

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ErrorLast
String ID: Can not create output directory:
API String ID: 2901101390-3123869724
Opcode ID: ec20a117b97c887a0c98e4c50ebf48c0a08fcdb6be29f8d179218c7e28bac043
Instruction ID: 8342921ade2913bdc661652299ed975f20a68fd6c559347611ebb9c486f8334c
Opcode Fuzzy Hash: ec20a117b97c887a0c98e4c50ebf48c0a08fcdb6be29f8d179218c7e28bac043
Instruction Fuzzy Hash: 5BE1E070D0428AEFDF25EFA9C988AEDBFF5BF18308F184199E48563251DB309A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010EBFF8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E010EBFF8(void* __ecx, void* __eflags) {
				void* __ebx;
				intOrPtr* _t39;
				void* _t40;
				void* _t48;
				void* _t53;
				void* _t55;
				void* _t57;
				intOrPtr* _t60;
				signed char _t61;
				intOrPtr* _t62;
				signed char _t63;
				signed char _t65;
				intOrPtr _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t100;
				void* _t104;
				void* _t106;

				_t111 = __eflags;
				E011039E0(E01105EE8, _t106);
				 *(_t106 - 0x10) =  *(_t106 - 0x10) & 0x00000000;
				_t104 = __ecx;
				E010D4ACE(_t106 - 0x28, __eflags);
				 *(_t106 - 4) =  *(_t106 - 4) & 0x00000000;
				_t39 = E010D28B2(_t106 - 0x40, _t106 - 0x28,  *0x110988c);
				 *(_t106 - 4) = 1;
				_t40 = E010D6177( *_t39, _t111); // executed
				_t112 = _t40;
				if(_t40 != 0) {
					L4:
					_t65 = 0;
					__eflags = 0;
				} else {
					_t60 = E010D28B2(_t106 - 0x1c, _t106 - 0x28, L"Codecs");
					 *(_t106 - 4) = 2;
					_t61 = E010D61D0( *_t60, _t112);
					 *(_t106 - 4) = 1;
					asm("sbb bl, bl");
					_t40 = E010D1ABD(_t61,  *((intOrPtr*)(_t106 - 0x1c)));
					_t113 =  ~_t61 + 1;
					if( ~_t61 + 1 == 0) {
						goto L4;
					} else {
						_t62 = E010D28B2(_t106 - 0x34, _t106 - 0x28, L"Formats");
						 *(_t106 - 4) = 3;
						_t63 = E010D61D0( *_t62, _t113);
						asm("sbb bl, bl");
						_t40 = E010D1ABD(_t63,  *((intOrPtr*)(_t106 - 0x34)));
						if( ~_t63 + 1 == 0) {
							goto L4;
						} else {
							_t65 = 1;
						}
					}
				}
				 *(_t106 - 4) =  *(_t106 - 4) & 0x00000000;
				E010D1ABD(_t40,  *((intOrPtr*)(_t106 - 0x40)));
				if(_t65 == 0) {
					L13:
					E010D1ABD(E010D29BC(_t104, __eflags, _t106 - 0x28),  *((intOrPtr*)(_t106 - 0x28)));
				} else {
					E010D28E9(_t106 - 0x1c);
					_t97 =  *0x1109898; // 0x11098b4
					_push(_t106 - 0x1c);
					 *(_t106 - 4) = 4;
					_t48 = E010EC172(0x80000001, 0x80000001, _t97);
					_push(_t106 - 0x1c);
					if(_t48 != 0) {
						L11:
						E010D1ABD(E010D1ABD(E010D29BC(_t104, _t119),  *((intOrPtr*)(_t106 - 0x1c))),  *((intOrPtr*)(_t106 - 0x28)));
					} else {
						_t98 =  *0x1109898; // 0x11098b4
						_t53 = E010EC172(0x80000001, 0x80000002, _t98);
						_push(_t106 - 0x1c);
						if(_t53 != 0) {
							goto L11;
						} else {
							_t99 =  *0x1109894; // 0x11098c4
							_t55 = E010EC172(0x80000001, 0x80000001, _t99);
							_push(_t106 - 0x1c);
							if(_t55 != 0) {
								goto L11;
							} else {
								_t100 =  *0x1109894; // 0x11098c4
								_t57 = E010EC172(0x80000001, 0x80000002, _t100);
								_t119 = _t57;
								if(_t57 == 0) {
									_t31 = _t106 - 4;
									 *_t31 =  *(_t106 - 4) & 0x00000000;
									__eflags =  *_t31;
									E010D1ABD(_t57,  *((intOrPtr*)(_t106 - 0x1c)));
									goto L13;
								} else {
									_push(_t106 - 0x1c);
									goto L11;
								}
							}
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t106 - 0xc));
				return _t104;
			}

0x010ebff8
0x010ebffd
0x010ec005
0x010ec00b
0x010ec010
0x010ec01b
0x010ec025
0x010ec02c
0x010ec030
0x010ec035
0x010ec037
0x010ec0a1
0x010ec0a1
0x010ec0a1
0x010ec039
0x010ec044
0x010ec04b
0x010ec04f
0x010ec056
0x010ec05f
0x010ec063
0x010ec068
0x010ec06b
0x00000000
0x010ec06d
0x010ec078
0x010ec07f
0x010ec083
0x010ec08f
0x010ec093
0x010ec09b
0x00000000
0x010ec09d
0x010ec09d
0x010ec09d
0x010ec09b
0x010ec06b
0x010ec0a6
0x010ec0aa
0x010ec0b2
0x010ec14e
0x010ec15c
0x010ec0b8
0x010ec0bb
0x010ec0c0
0x010ec0ce
0x010ec0d1
0x010ec0d5
0x010ec0df
0x010ec0e0
0x010ec127
0x010ec139
0x010ec0e2
0x010ec0e2
0x010ec0ed
0x010ec0f7
0x010ec0f8
0x00000000
0x010ec0fa
0x010ec0fa
0x010ec102
0x010ec10c
0x010ec10d
0x00000000
0x010ec10f
0x010ec10f
0x010ec11a
0x010ec11f
0x010ec121
0x010ec144
0x010ec144
0x010ec144
0x010ec148
0x00000000
0x010ec123
0x010ec126
0x00000000
0x010ec126
0x010ec121
0x010ec10d
0x010ec0f8
0x010ec0e0
0x010ec169
0x010ec171

APIs

__EH_prolog.LIBCMT ref: 010EBFFD

Part of subcall function 010D4ACE: __EH_prolog.LIBCMT ref: 010D4AD3

Part of subcall function 010D6177: __EH_prolog.LIBCMT ref: 010D617C

Part of subcall function 010D61D0: __EH_prolog.LIBCMT ref: 010D61D5

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Strings

Formats, xrefs: 010EC06D
Codecs, xrefs: 010EC039

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$free
String ID: Codecs$Formats
API String ID: 2654054672-513325466
Opcode ID: 5c6708ff11fa1761ba0e3812c0364e6f4cced96640a29e6e77b49e04f8197227
Instruction ID: e17c6defabd865508b4f88dc14c2b740d0a979dde978b7ae59ae5424716780b9
Opcode Fuzzy Hash: 5c6708ff11fa1761ba0e3812c0364e6f4cced96640a29e6e77b49e04f8197227
Instruction Fuzzy Hash: C3412930D4134BDEDF06EBA4D650BEDBBF6AF66208F184199E4D1332A1CB754A4AC711

Uniqueness

Uniqueness Score: -1.00%

Function 010D63E5 Relevance: 4.6, APIs: 3, Instructions: 64
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D63E5(void** __ecx, void* __eflags) {
				signed int _t28;
				intOrPtr _t29;
				signed int _t31;
				void* _t35;
				void** _t50;
				void* _t52;

				E011039E0(E01104678, _t52);
				_t50 = __ecx;
				_t28 = E010D6497(__ecx);
				if(_t28 != 0) {
					 *((char*)(__ecx + 4)) = 0;
					_t29 = E010D7553( *(_t52 + 8));
					 *((intOrPtr*)(_t52 - 0x10)) = _t29;
					if(_t29 != 1) {
						_t35 = CreateFileW( *(_t52 + 8),  *(_t52 + 0xc),  *(_t52 + 0x10), 0,  *(_t52 + 0x14),  *(_t52 + 0x18), 0); // executed
						 *_t50 = _t35;
					}
					if( *_t50 == 0xffffffff &&  *((intOrPtr*)(_t52 - 0x10)) != 0) {
						_t31 = E010D28E9(_t52 - 0x1c);
						 *((intOrPtr*)(_t52 - 4)) = 0;
						if(E010D765C( *(_t52 + 8), _t52 - 0x1c, _t52, _t31 & 0xffffff00 |  *((intOrPtr*)(_t52 - 0x10)) != 0x00000001) != 0) {
							 *_t50 = CreateFileW( *(_t52 - 0x1c),  *(_t52 + 0xc),  *(_t52 + 0x10), 0,  *(_t52 + 0x14),  *(_t52 + 0x18), 0);
						}
						E010D1ABD(_t33,  *(_t52 - 0x1c));
					}
					_t28 = 0 |  *_t50 != 0xffffffff;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t28;
			}

0x010d63ea
0x010d63f3
0x010d63f5
0x010d63fc
0x010d6409
0x010d640c
0x010d641a
0x010d641d
0x010d6430
0x010d6432
0x010d6432
0x010d6437
0x010d6441
0x010d6450
0x010d645e
0x010d6473
0x010d6473
0x010d6478
0x010d647d
0x010d6485
0x010d6485
0x010d648c
0x010d6494

APIs

__EH_prolog.LIBCMT ref: 010D63EA

Part of subcall function 010D6497: FindCloseChangeNotification.KERNELBASE(00000000,?,010D63FA,000000FF,00000009,00000001), ref: 010D64A2

CreateFileW.KERNELBASE(?,00000001,00000009,00000000,000000FF,00000009,00000000,00000001,00000009,000000FF,00000009,00000001), ref: 010D6430
CreateFileW.KERNEL32(00000001,00000001,00000001,00000000,000000FF,00000009,00000000,00000000,00000001,00000009,000000FF), ref: 010D6471

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CreateFile$ChangeCloseFindH_prologNotification
String ID:
API String ID: 3273702577-0
Opcode ID: b21470ab40044275f7ff3b6bde6bdf1e0863c97e803170b106758062bebef483
Instruction ID: 34bd41c1c50c06f15d1e137190578d3e5487ca073cacd7be8de3f57791a1297c
Opcode Fuzzy Hash: b21470ab40044275f7ff3b6bde6bdf1e0863c97e803170b106758062bebef483
Instruction Fuzzy Hash: 99116A7180030BEFCF159FA4DC408EEBBB6FF54354B108629F9A0561A0DB769961DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010D4D1A Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4D1A(WCHAR* __ecx, long __edx) {
				signed int _t19;
				signed int _t20;
				int _t24;
				int _t26;
				void* _t28;
				WCHAR* _t39;
				void* _t45;

				E011039E0(E01104450, _t45);
				 *(_t45 - 0x10) = __edx;
				_t39 = __ecx;
				_t28 = E010D7553(__ecx);
				if(_t28 == 1) {
					L3:
					if(_t28 == 0) {
						L7:
						_t19 = 0;
					} else {
						_t20 = E010D28E9(_t45 - 0x1c);
						 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
						if(E010D765C(_t39, _t45 - 0x1c, _t45, _t20 & 0xffffff00 | _t28 != 0x00000001) == 0) {
							E010D1ABD(_t22,  *(_t45 - 0x1c));
							goto L7;
						} else {
							_t24 = SetFileAttributesW( *(_t45 - 0x1c),  *(_t45 - 0x10));
							_t19 = E010D1ABD(_t24,  *(_t45 - 0x1c)) & 0xffffff00 | _t24 != 0x00000000;
						}
					}
				} else {
					_t26 = SetFileAttributesW(__ecx,  *(_t45 - 0x10)); // executed
					if(_t26 == 0) {
						goto L3;
					} else {
						_t19 = 1;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t19;
			}

0x010d4d1f
0x010d4d2a
0x010d4d2d
0x010d4d3a
0x010d4d3f
0x010d4d4f
0x010d4d51
0x010d4d97
0x010d4d97
0x010d4d53
0x010d4d56
0x010d4d5b
0x010d4d72
0x010d4d91
0x00000000
0x010d4d74
0x010d4d7a
0x010d4d89
0x010d4d89
0x010d4d72
0x010d4d41
0x010d4d45
0x010d4d49
0x00000000
0x010d4d4b
0x010d4d4b
0x010d4d4b
0x010d4d49
0x010d4d9f
0x010d4da7

APIs

__EH_prolog.LIBCMT ref: 010D4D1F
SetFileAttributesW.KERNELBASE(?,?,?,00000000,?), ref: 010D4D45
SetFileAttributesW.KERNEL32(?,?,00000000,?,00000000,?), ref: 010D4D7A

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AttributesFile$H_prolog
String ID:
API String ID: 3790360811-0
Opcode ID: f396149a0f2588a25383e9e8d7f054cc1b5d125d895e0bd1aee0c20e6186a34c
Instruction ID: 7fb6a2ea898ba8594ca8f14c8dcd8b1faf220cb130f8860e745620d99015ab24
Opcode Fuzzy Hash: f396149a0f2588a25383e9e8d7f054cc1b5d125d895e0bd1aee0c20e6186a34c
Instruction Fuzzy Hash: 8B014732D00317DBCF15BFA8DD406FEBBB6EF50214F04806AED61E3690CBB64801AA90

Uniqueness

Uniqueness Score: -1.00%

Function 010DFF48 Relevance: 3.1, APIs: 2, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E010DFF48() {
				intOrPtr* _t67;
				void* _t68;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr _t74;
				intOrPtr* _t75;
				long _t96;
				intOrPtr _t98;
				intOrPtr* _t116;
				struct _SECURITY_DESCRIPTOR* _t118;
				void* _t120;
				void* _t122;

				E011039E0(E01105098, _t120);
				_t118 =  *(_t120 + 8);
				 *((intOrPtr*)(_t120 - 4)) = 0;
				_t67 =  *((intOrPtr*)(_t118 + 0x60));
				 *((intOrPtr*)(_t120 - 0x10)) = _t122 - 0xc;
				if(_t67 == 0) {
					if( *((intOrPtr*)(_t118 + 0x10c)) != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x104)) + 0x1c)))) + 0xc))( *((intOrPtr*)(_t118 + 0x9e)),  *((intOrPtr*)(_t118 + 0x9c)), _t118 + 0x6c);
						_t98 =  *((intOrPtr*)(_t118 + 0x104));
						 *((intOrPtr*)(_t118 + 0xf0)) =  *((intOrPtr*)(_t98 + 0x10));
						 *((intOrPtr*)(_t118 + 0xf4)) =  *((intOrPtr*)(_t98 + 0x14));
						 *((char*)(_t118 + 0xf8)) = 1;
						E010E0128(_t98);
						 *((char*)(_t118 + 0x10c)) = 0;
					}
					_t68 = E010DFE1C(_t118); // executed
					if(_t68 != 0) {
						goto L30;
					} else {
						if( *((intOrPtr*)(_t118 + 0x124)) != 0 ||  *((intOrPtr*)(_t118 + 0xc1)) == 0 ||  *((intOrPtr*)(_t118 + 0x18)) == 0) {
							L16:
							_t116 = _t118 + 0xf8;
							if( *((intOrPtr*)(_t118 + 0xf8)) != 0) {
								L18:
								_t69 = _t118 + 0x178;
								if( *((intOrPtr*)(_t118 + 0x9c)) == 0) {
									_t69 = _t118 + 0x170;
								}
								 *_t69 =  *_t69 +  *((intOrPtr*)(_t118 + 0xf0));
								asm("adc [eax+0x4], edx");
								L21:
								if( *((intOrPtr*)(_t118 + 0x9e)) == 0) {
									_t70 = _t118 + 0x168;
									if( *((intOrPtr*)(_t118 + 0x9c)) == 0) {
										_t70 = _t118 + 0x160;
									}
								} else {
									_t70 = _t118 + 0x158;
								}
								 *_t70 =  *_t70 + 1;
								asm("adc [eax+0x4], ebx");
								if( *((intOrPtr*)(_t118 + 0x124)) == 0 &&  *((intOrPtr*)(_t118 + 0xc1)) != 0 &&  *((intOrPtr*)(_t118 + 0xe7)) != 0) {
									E010D4DA8( *(_t118 + 0xac),  *((intOrPtr*)(_t118 + 0xe0))); // executed
								}
								_t71 =  *((intOrPtr*)(_t118 + 0x28));
								_t68 =  *((intOrPtr*)( *_t71 + 0x20))(_t71,  *((intOrPtr*)(_t120 + 0xc)), 0 |  *((intOrPtr*)(_t118 + 0xc5)) != 0x00000000);
								goto L30;
							}
							E010DE24D(_t118);
							if( *_t116 == 0) {
								goto L21;
							}
							goto L18;
						} else {
							_t74 =  *((intOrPtr*)(_t118 + 0x14));
							if( *((intOrPtr*)(_t74 + 8)) == 0) {
								goto L16;
							}
							_t75 =  *((intOrPtr*)(_t74 + 8));
							 *((intOrPtr*)( *_t75 + 0x10))(_t75,  *((intOrPtr*)(_t118 + 0xe8)), 0x3e, _t120 + 8, _t120 - 0x14, _t120 - 0x18);
							_t107 =  *((intOrPtr*)(_t120 - 0x14));
							if( *((intOrPtr*)(_t120 - 0x14)) == 0) {
								goto L16;
							}
							if( *((intOrPtr*)(_t120 - 0x18)) == 1) {
								if(E010F3C48( *(_t120 + 8), _t107) != 0) {
									_t96 = 7;
									if( *((intOrPtr*)(_t118 + 0x150)) != 0) {
										_t96 = 0xf;
									}
									SetFileSecurityW( *(_t118 + 0xac), _t96,  *(_t120 + 8));
								}
								goto L16;
							}
							_t68 = 0x80004005;
							goto L30;
						}
					}
				} else {
					_t68 =  *((intOrPtr*)( *_t67 + 0x18))(_t67,  *((intOrPtr*)(_t120 + 0xc)), 0 |  *((intOrPtr*)(_t118 + 0xc5)) != 0x00000000);
					L30:
					 *[fs:0x0] =  *((intOrPtr*)(_t120 - 0xc));
					return _t68;
				}
			}

0x010dff4d
0x010dff57
0x010dff5d
0x010dff60
0x010dff63
0x010dff68
0x010dff8a
0x010dffa9
0x010dffac
0x010dffb8
0x010dffbe
0x010dffc4
0x010dffcb
0x010dffd0
0x010dffd0
0x010dffd8
0x010dffdf
0x00000000
0x010dffe5
0x010dffeb
0x010e0061
0x010e0067
0x010e006d
0x010e007a
0x010e0080
0x010e0086
0x010e0088
0x010e0088
0x010e009a
0x010e009c
0x010e009f
0x010e00a5
0x010e00b5
0x010e00bb
0x010e00bd
0x010e00bd
0x010e00a7
0x010e00a7
0x010e00a7
0x010e00c3
0x010e00c6
0x010e00cf
0x010e00ed
0x010e00ed
0x010e00f2
0x010e0107
0x00000000
0x010e0107
0x010e0071
0x010e0078
0x00000000
0x00000000
0x00000000
0x010dfffa
0x010dfffa
0x010e0000
0x00000000
0x00000000
0x010e0005
0x010e001c
0x010e001f
0x010e0024
0x00000000
0x00000000
0x010e002a
0x010e0040
0x010e004a
0x010e004b
0x010e004f
0x010e004f
0x010e005b
0x010e005b
0x00000000
0x010e0040
0x010e002c
0x00000000
0x010e002c
0x010dffeb
0x010dff6a
0x010dff7c
0x010e0117
0x010e011c
0x010e0125
0x010e0125

APIs

__EH_prolog.LIBCMT ref: 010DFF4D

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bb0d9a403d8615a1f45c85a4bd7c5791f1b777ac6edd574f3b5c81d0940b4c69
Instruction ID: 56035cb4c0c2d773f49ceee45bfb7cdbcaee7e875b95aeddaee8539022004065
Opcode Fuzzy Hash: bb0d9a403d8615a1f45c85a4bd7c5791f1b777ac6edd574f3b5c81d0940b4c69
Instruction Fuzzy Hash: FE51A0716007819FEB75CB35C884AEABFF1AF45300F08889DF5EA4B206D3B1A884DB50

Uniqueness

Uniqueness Score: -1.00%

Function 010F1FE2 Relevance: 3.1, APIs: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E010F1FE2(void* __ecx) {
				long _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				long _t46;
				intOrPtr _t49;
				long _t55;
				intOrPtr* _t56;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t76;
				intOrPtr _t83;
				long _t84;
				void* _t88;
				long _t90;
				void* _t91;

				E011039E0(E011064F2, _t91);
				_t65 = 0;
				_t88 = __ecx;
				 *((intOrPtr*)(_t91 - 0x14)) = 0;
				 *(_t91 - 4) = 0;
				 *((intOrPtr*)(_t91 - 0x10)) = 0;
				_t83 =  *((intOrPtr*)(_t91 + 8));
				 *(_t91 - 4) = 1;
				if( *((intOrPtr*)(_t83 + 0x44)) == 0) {
					if( *((intOrPtr*)(_t83 + 0x30)) != 0) {
						goto L15;
					} else {
						_push(0x58);
						_t49 = E010D1A96();
						 *((intOrPtr*)(_t91 - 0x18)) = _t49;
						 *(_t91 - 4) = 2;
						if(_t49 != 0) {
							_t65 = E010D929A(_t49);
						}
						 *(_t91 - 4) = 1;
						E010E0E48(_t91 - 0x14, _t65);
						E010D2A8C(_t88 + 0x70, _t88 + 0x7c);
						if(E010D68C6( *((intOrPtr*)(_t88 + 0x70))) != 0) {
							_t76 =  *((intOrPtr*)(_t91 + 8));
							_t83 = _t76;
							_t65 = 0;
							 *((intOrPtr*)(_t76 + 0x30)) =  *((intOrPtr*)(_t91 - 0x14));
							goto L15;
						} else {
							_t55 = GetLastError();
							 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
							_t90 = _t55;
							_t56 =  *((intOrPtr*)(_t91 - 0x10));
							if(_t56 != 0) {
								 *((intOrPtr*)( *_t56 + 8))(_t56);
							}
							_t57 =  *((intOrPtr*)(_t91 - 0x14));
							 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
							if(_t57 != 0) {
								 *((intOrPtr*)( *_t57 + 8))(_t57);
							}
							_t46 = _t90;
						}
					}
				} else {
					_push(8);
					_t61 = E010D1A96();
					if(_t61 == 0) {
						_t61 = 0;
					} else {
						 *((intOrPtr*)(_t61 + 4)) = 0;
						 *_t61 = 0x1109848;
					}
					E010E0E48(_t91 - 0x10, _t61);
					 *((intOrPtr*)(_t83 + 0x34)) =  *((intOrPtr*)(_t91 - 0x10));
					L15:
					_push(_t83);
					_t43 = L010F1DC7(_t88); // executed
					 *(_t88 + 0xdf) =  *(_t88 + 0xdf) & 0x00000000;
					 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
					_t84 = _t43;
					_t44 =  *((intOrPtr*)(_t91 - 0x10));
					if(_t44 != _t65) {
						 *((intOrPtr*)( *_t44 + 8))(_t44);
					}
					_t45 =  *((intOrPtr*)(_t91 - 0x14));
					 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
					if(_t45 != _t65) {
						 *((intOrPtr*)( *_t45 + 8))(_t45);
					}
					_t46 = _t84;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t46;
			}

0x010f1fe7
0x010f1ff0
0x010f1ff4
0x010f1ff6
0x010f1ff9
0x010f1ffc
0x010f1fff
0x010f2002
0x010f2009
0x010f203b
0x00000000
0x010f2041
0x010f2041
0x010f2043
0x010f2049
0x010f204e
0x010f2052
0x010f205b
0x010f205b
0x010f2061
0x010f2065
0x010f2073
0x010f2084
0x010f20b4
0x010f20ba
0x010f20bc
0x010f20be
0x00000000
0x010f2086
0x010f2086
0x010f208c
0x010f2090
0x010f2092
0x010f2097
0x010f209c
0x010f209c
0x010f209f
0x010f20a2
0x010f20a8
0x010f20ad
0x010f20ad
0x010f20b0
0x010f20b0
0x010f2084
0x010f200b
0x010f200b
0x010f200d
0x010f2015
0x010f2022
0x010f2017
0x010f2017
0x010f201a
0x010f201a
0x010f2028
0x010f2030
0x010f20c1
0x010f20c1
0x010f20c4
0x010f20c9
0x010f20d0
0x010f20d4
0x010f20d6
0x010f20db
0x010f20e0
0x010f20e0
0x010f20e3
0x010f20e6
0x010f20ec
0x010f20f1
0x010f20f1
0x010f20f4
0x010f20f4
0x010f20fc
0x010f2104

APIs

__EH_prolog.LIBCMT ref: 010F1FE7
GetLastError.KERNEL32(?,?,00000000), ref: 010F2086

Part of subcall function 010D1A96: malloc.MSVCRT ref: 010D1A9C
Part of subcall function 010D1A96: _CxxThrowException.MSVCRT(?,0110D020), ref: 010D1AB6

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorExceptionH_prologLastThrowmalloc
String ID:
API String ID: 3967182680-0
Opcode ID: d50543ec11accef01bb43ab5d09c0c0095e34afeacd8952d196aff464a7462f3
Instruction ID: dfd70a0dba5c5d0e23862dc250949b7b3262997d34b06aeb36f024bd32d5c0f8
Opcode Fuzzy Hash: d50543ec11accef01bb43ab5d09c0c0095e34afeacd8952d196aff464a7462f3
Instruction Fuzzy Hash: F9411372A00206DFDB15DFA8C5856AEFBF5BF44300F1044ADE696E7282CB71DA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010EB152 Relevance: 3.1, APIs: 2, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010EB152(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* _t47;
				void* _t53;
				signed int _t58;
				char _t60;
				void* _t85;
				signed int _t87;
				void* _t89;

				E011039E0(E01105D70, _t89);
				 *((intOrPtr*)(_t89 - 0x18)) = 0;
				 *((intOrPtr*)(_t89 - 0x14)) = 0;
				 *((intOrPtr*)(_t89 - 0x10)) = 0;
				 *(_t89 - 4) = 0;
				 *((intOrPtr*)(_t89 - 0x24)) = 0;
				 *((intOrPtr*)(_t89 - 0x20)) = 0;
				 *((intOrPtr*)(_t89 - 0x1c)) = 0;
				 *(_t89 - 4) = 1;
				E010EB253( *((intOrPtr*)(_t89 + 8)), _t89 - 0x18, __eflags);
				E010EB253( *((intOrPtr*)(_t89 + 0xc)), _t89 - 0x24, __eflags);
				_t87 = 0;
				if( *((intOrPtr*)(_t89 - 0x14)) <= 0) {
					L6:
					 *(_t89 - 4) = 0;
					E010E8B2E(0, _t89 - 0x24);
					 *(_t89 - 4) =  *(_t89 - 4) | 0xffffffff;
					_t47 = E010E8B2E(0, _t89 - 0x18);
					 *[fs:0x0] =  *((intOrPtr*)(_t89 - 0xc));
					return _t47;
				}
				_t85 = __ecx + 0x18;
				do {
					E010D28E9(_t89 - 0x3c);
					 *(_t89 - 4) = 2;
					E010D28E9(_t89 - 0x30);
					 *(_t89 - 4) = 3;
					E010D2A8C(_t89 - 0x3c,  *((intOrPtr*)( *((intOrPtr*)(_t89 - 0x18)) + _t87 * 4)));
					if(_t87 <  *((intOrPtr*)(_t89 - 0x20))) {
						E010D2A8C(_t89 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(_t89 - 0x24)) + _t87 * 4)));
						_t58 = wcscmp( *(_t89 - 0x30), "*");
						asm("sbb al, al");
						_t60 =  ~_t58 + 1;
						 *((char*)(_t89 + 0xb)) = _t60;
						if(_t60 != 0) {
							 *((intOrPtr*)(_t89 - 0x2c)) = 0;
							 *( *(_t89 - 0x30)) = 0;
						}
					}
					_push(_t89 - 0x3c); // executed
					_t53 = E010EC812(_t85, _t85); // executed
					 *(_t89 - 4) = 1;
					E010D1ABD(E010D1ABD(_t53,  *(_t89 - 0x30)),  *((intOrPtr*)(_t89 - 0x3c)));
					_t87 = _t87 + 1;
				} while (_t87 <  *((intOrPtr*)(_t89 - 0x14)));
				goto L6;
			}

0x010eb157
0x010eb166
0x010eb169
0x010eb16c
0x010eb16f
0x010eb172
0x010eb175
0x010eb178
0x010eb181
0x010eb185
0x010eb190
0x010eb195
0x010eb19a
0x010eb22b
0x010eb22e
0x010eb231
0x010eb236
0x010eb23d
0x010eb248
0x010eb250
0x010eb250
0x010eb1a0
0x010eb1a3
0x010eb1a6
0x010eb1ae
0x010eb1b2
0x010eb1bd
0x010eb1c4
0x010eb1cc
0x010eb1d7
0x010eb1e4
0x010eb1ec
0x010eb1ef
0x010eb1f2
0x010eb1f5
0x010eb1fa
0x010eb1fd
0x010eb1fd
0x010eb1f5
0x010eb205
0x010eb206
0x010eb20e
0x010eb21a
0x010eb21f
0x010eb224
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010EB157

Part of subcall function 010EB253: __EH_prolog.LIBCMT ref: 010EB258

wcscmp.MSVCRT ref: 010EB1E4

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$wcscmp
String ID:
API String ID: 3232955128-0
Opcode ID: 16b455563754e37d5887d0040dcfe9ef6f04a0d075ed0e9f28ec8b5389d372af
Instruction ID: e2c8f283f3ea3846abca434d8191d500a6d6044dd3adc3a8c3b2fbe2152b4c97
Opcode Fuzzy Hash: 16b455563754e37d5887d0040dcfe9ef6f04a0d075ed0e9f28ec8b5389d372af
Instruction Fuzzy Hash: 07310431C0125AEECF09EFEAD9859EDFBB1BF18200F50806AE455B32A1CB705A05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010D651E Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E010D651E(void** __ecx, long _a4, signed int _a8, long _a12, intOrPtr* _a16) {
				long _v8;
				signed int _t17;
				long _t19;
				void* _t20;
				intOrPtr* _t22;
				void* _t23;
				void** _t29;
				signed int _t33;
				long _t36;

				_t29 = __ecx;
				_push(__ecx);
				if(__ecx[1] != 0 && __ecx[1] != 0 && _a12 == 2) {
					_a4 = __ecx[2] + _a4;
					_a12 = 0;
					asm("adc [ebp+0xc], edx");
				}
				_t17 = _a8;
				_v8 = _t17;
				_t33 = _t17 >> 0x1f;
				_t19 = SetFilePointer( *_t29, _a4,  &_v8, _a12); // executed
				_t36 = _t19;
				if(_t36 != 0xffffffff || GetLastError() == 0) {
					_t20 = E01103D00(_v8, 0, 0, 1);
					asm("adc edx, eax");
					_t22 = _a16;
					 *_t22 = _t20 + _t36;
					 *(_t22 + 4) = _t33;
					_t23 = 1;
				} else {
					_t23 = 0;
				}
				return _t23;
			}

0x010d651e
0x010d6521
0x010d6529
0x010d653c
0x010d653f
0x010d6542
0x010d6542
0x010d6545
0x010d654d
0x010d6557
0x010d655c
0x010d6562
0x010d6567
0x010d657e
0x010d6589
0x010d658b
0x010d658e
0x010d6590
0x010d6593
0x010d6573
0x010d6573
0x010d6573
0x010d6598

APIs

SetFilePointer.KERNELBASE(000000FF,?,00000000,?,000000FF,?,000000FF,?,010D65AE,?,?,00000000,?,010D65E9,?,?), ref: 010D655C
GetLastError.KERNEL32(?,010D65AE,?,?,00000000,?,010D65E9,?,?,?,?,00000000), ref: 010D6569

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: d12c6329ba248333560750b3930ad9ed9cf5cb6cacda7716815088a8c3268d02
Instruction ID: 121484238512b324f4712f22e68e977bb2f81ceff9c6dc4bb62a11da15a79f44
Opcode Fuzzy Hash: d12c6329ba248333560750b3930ad9ed9cf5cb6cacda7716815088a8c3268d02
Instruction Fuzzy Hash: 0D11C4B1A00308AFCB51CF68D84099E7BF9AF05324B14C1A9F9598B25AD773DD91DB50

Uniqueness

Uniqueness Score: -1.00%

Function 010D9438 Relevance: 2.7, APIs: 2, Instructions: 223
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E010D9438(char _a4, signed int _a8, int _a12, signed int _a16) {
				signed int _v8;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int* _t84;
				signed int _t85;
				signed int _t87;
				signed int _t89;
				signed int _t93;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t101;
				signed int _t106;
				signed int _t107;
				signed int _t108;
				signed int _t110;
				signed int _t112;
				intOrPtr _t113;
				int _t114;
				signed int* _t117;
				signed int _t120;
				intOrPtr _t123;
				signed int _t124;
				signed int _t125;
				signed int _t132;
				signed int _t133;
				intOrPtr _t135;
				signed int _t136;
				signed int _t137;
				intOrPtr _t140;
				signed int _t141;
				signed int _t149;
				signed int _t154;
				signed int _t155;
				int _t156;
				intOrPtr _t157;
				char _t160;
				void* _t168;

				_t84 = _a16;
				if(_t84 != 0) {
					 *_t84 =  *_t84 & 0x00000000;
				}
				if(_a12 == 0) {
					L10:
					_t85 = 0;
					L59:
					return _t85;
				}
				_t160 = _a4;
				if( *((char*)(_t160 + 0x1c)) == 0) {
					L49:
					_t87 = E010D6901(_a8, _a12,  &_a4); // executed
					_t141 = _a16;
					_t123 = _a4;
					__eflags = _t141;
					if(_t141 != 0) {
						 *_t141 = _t123;
					}
					 *(_t160 + 0x28) =  *(_t160 + 0x28) + _t123;
					asm("adc [esi+0x2c], edx");
					 *(_t160 + 0x30) =  *(_t160 + 0x30) + _t123;
					asm("adc [esi+0x34], edx");
					__eflags = _t87;
					if(_t87 != 0) {
						goto L10;
					} else {
						_t85 = GetLastError();
						_t124 =  *(_t160 + 0x4c);
						__eflags = _t124;
						if(_t124 == 0) {
							__eflags = _t85;
							if(__eflags != 0) {
								if(__eflags > 0) {
									_t85 = _t85 & 0x0000ffff | 0x80070000;
									__eflags = _t85;
								}
								goto L59;
							}
							L56:
							_t85 = 0x80004005;
							goto L59;
						}
						_t85 =  *((intOrPtr*)( *_t124))( *((intOrPtr*)(_t160 + 0x50)), _t85);
						goto L59;
					}
				}
				if( *((char*)(_t160 + 0x1d)) == 0) {
					L15:
					_t117 = _t160 + 0x44;
					while(1) {
						_t89 =  *(_t160 + 0x28);
						_t125 =  *((intOrPtr*)(_t160 + 0x2c));
						_v8 = _t125;
						_t154 = _t89 & 0xfffc0000;
						__eflags =  *_t117;
						if( *_t117 <= 0) {
							goto L19;
						}
						__eflags =  *(_t160 + 0x38) - _t154;
						if( *(_t160 + 0x38) != _t154) {
							goto L19;
						}
						__eflags =  *((intOrPtr*)(_t160 + 0x3c)) - _t125;
						if( *((intOrPtr*)(_t160 + 0x3c)) == _t125) {
							_t120 =  *_t117;
							_t110 =  *(_t160 + 0x28) & 0x0003ffff;
							__eflags = _t110 - _t120;
							if(_t110 < _t120) {
								_t156 = _t120 - _t110;
								__eflags = _t156 - _a12;
								if(_t156 >= _a12) {
									_t156 = _a12;
								}
								memcpy(_a8,  *(_t160 + 0x40) + _t110, _t156);
								_t112 = _a16;
								 *(_t160 + 0x28) =  *(_t160 + 0x28) + _t156;
								asm("adc dword [esi+0x2c], 0x0");
								__eflags = _t112;
								if(_t112 != 0) {
									 *_t112 =  *_t112 + _t156;
								}
							}
							goto L10;
						}
						L19:
						__eflags = _t89 & 0x0003ffff;
						if((_t89 & 0x0003ffff) != 0) {
							L25:
							__eflags = _t154 -  *(_t160 + 0x30);
							if(_t154 !=  *(_t160 + 0x30)) {
								L27:
								_t93 = E010D651E(_t160 + 0x18, _t154, _v8, 0,  &_v20);
								__eflags = _t93;
								if(_t93 == 0) {
									L42:
									_t85 = E010D96B8(0);
									goto L59;
								} else {
									 *(_t160 + 0x30) = _v20;
									 *((intOrPtr*)(_t160 + 0x34)) = _v16;
									L29:
									__eflags =  *((char*)(_t160 + 0x1d));
									 *(_t160 + 0x38) = _t154;
									 *((intOrPtr*)(_t160 + 0x3c)) = _v8;
									_t155 = 0x40000;
									if( *((char*)(_t160 + 0x1d)) == 0) {
										L33:
										__eflags =  *(_t160 + 0x40);
										if( *(_t160 + 0x40) != 0) {
											L35:
											_t117 = _t160 + 0x44;
											_t97 = E010D68D4(_t160 + 0x18,  *(_t160 + 0x40), _t155, _t117);
											__eflags = _t97;
											if(_t97 == 0) {
												goto L42;
											}
											_t98 =  *_t117;
											__eflags = _t98;
											if(_t98 == 0) {
												goto L10;
											}
											 *(_t160 + 0x30) =  *(_t160 + 0x30) + _t98;
											asm("adc dword [esi+0x34], 0x0");
											continue;
										}
										_t99 = E01103390(0x40000);
										__eflags = _t99;
										 *(_t160 + 0x40) = _t99;
										if(_t99 == 0) {
											_t85 = 0x8007000e;
											goto L59;
										}
										goto L35;
									}
									_t101 =  *((intOrPtr*)(_t160 + 0x20)) -  *(_t160 + 0x30);
									__eflags = _t101;
									asm("sbb edx, [esi+0x34]");
									_v24 =  *((intOrPtr*)(_t160 + 0x24));
									if(_t101 != 0) {
										L32:
										_t155 = 0x40000;
										goto L33;
									}
									__eflags = _t101 - 0x40000;
									_t155 = _t101;
									if(_t101 < 0x40000) {
										goto L33;
									}
									goto L32;
								}
							}
							__eflags = _v8 -  *((intOrPtr*)(_t160 + 0x34));
							if(_v8 ==  *((intOrPtr*)(_t160 + 0x34))) {
								goto L29;
							}
							goto L27;
						}
						__eflags = _a8 & 0x0003ffff;
						if((_a8 & 0x0003ffff) != 0) {
							goto L25;
						}
						_t132 = _a12 +  *(_t160 + 0x28);
						asm("adc edx, [esi+0x2c]");
						__eflags = _t132 & 0x0003ffff;
						if((_t132 & 0x0003ffff) == 0) {
							L39:
							_t106 =  *(_t160 + 0x28);
							_t133 =  *((intOrPtr*)(_t160 + 0x2c));
							__eflags = _t106 -  *(_t160 + 0x30);
							if(_t106 !=  *(_t160 + 0x30)) {
								L41:
								_t107 = E010D651E(_t160 + 0x18, _t106, _t133, 0,  &_v20);
								__eflags = _t107;
								if(_t107 != 0) {
									_t108 = _v20;
									_t135 = _v16;
									 *(_t160 + 0x28) = _t108;
									 *(_t160 + 0x30) = _t108;
									 *((intOrPtr*)(_t160 + 0x2c)) = _t135;
									 *((intOrPtr*)(_t160 + 0x34)) = _t135;
									goto L49;
								}
								goto L42;
							}
							__eflags = _t133 -  *((intOrPtr*)(_t160 + 0x34));
							if(_t133 ==  *((intOrPtr*)(_t160 + 0x34))) {
								goto L49;
							}
							goto L41;
						}
						_t136 = _t132 & 0xfffc0000;
						__eflags = 0 -  *((intOrPtr*)(_t160 + 0x2c));
						if(__eflags > 0) {
							L38:
							_t137 = _t136 -  *(_t160 + 0x28);
							__eflags = _t137;
							_a12 = _t137;
							goto L39;
						}
						if(__eflags < 0) {
							goto L25;
						}
						__eflags = _t136 -  *(_t160 + 0x28);
						if(_t136 >  *(_t160 + 0x28)) {
							goto L38;
						}
						goto L25;
					}
				}
				_t157 =  *((intOrPtr*)(_t160 + 0x2c));
				_t140 =  *((intOrPtr*)(_t160 + 0x24));
				_t149 =  *(_t160 + 0x28);
				_t113 =  *((intOrPtr*)(_t160 + 0x20));
				_t168 = _t157 - _t140;
				if(_t168 < 0 || _t168 <= 0 && _t149 < _t113) {
					_t114 = _t113 - _t149;
					asm("sbb ecx, edi");
					__eflags = 0 - _t140;
					if(__eflags < 0) {
						goto L15;
					}
					if(__eflags > 0) {
						L14:
						_a12 = _t114;
						goto L15;
					}
					__eflags = _a12 - _t114;
					if(_a12 <= _t114) {
						goto L15;
					}
					goto L14;
				} else {
					if(_t149 != _t113 || _t157 != _t140) {
						goto L56;
					} else {
						goto L10;
					}
				}
			}

0x010d943e
0x010d9443
0x010d9445
0x010d9445
0x010d944f
0x010d948a
0x010d948a
0x010d96b1
0x010d96b5
0x010d96b5
0x010d9451
0x010d9458
0x010d9648
0x010d9655
0x010d965a
0x010d965d
0x010d9660
0x010d9662
0x010d9664
0x010d9664
0x010d9668
0x010d966b
0x010d966e
0x010d9671
0x010d9674
0x010d9676
0x00000000
0x010d967c
0x010d967c
0x010d9682
0x010d9685
0x010d9687
0x010d969a
0x010d969c
0x010d96a5
0x010d96ac
0x010d96ac
0x010d96ac
0x00000000
0x010d96a5
0x010d969e
0x010d969e
0x00000000
0x010d969e
0x010d968f
0x00000000
0x010d968f
0x010d9676
0x010d9462
0x010d94a5
0x010d94a5
0x010d94a8
0x010d94a8
0x010d94ab
0x010d94b0
0x010d94b3
0x010d94b9
0x010d94bc
0x00000000
0x00000000
0x010d94c1
0x010d94c3
0x00000000
0x00000000
0x010d94c8
0x010d94ca
0x010d95f0
0x010d95f2
0x010d95f7
0x010d95f9
0x010d9601
0x010d9603
0x010d9606
0x010d9608
0x010d9608
0x010d9615
0x010d961a
0x010d9620
0x010d9623
0x010d9627
0x010d9629
0x010d962f
0x010d962f
0x010d9629
0x00000000
0x010d95f9
0x010d94d0
0x010d94d9
0x010d94db
0x010d9515
0x010d9515
0x010d9518
0x010d9522
0x010d952f
0x010d9534
0x010d9536
0x010d95e1
0x010d95e3
0x00000000
0x010d953c
0x010d953f
0x010d9545
0x010d9548
0x010d954b
0x010d9554
0x010d9557
0x010d955a
0x010d955c
0x010d9577
0x010d9577
0x010d957b
0x010d958d
0x010d958d
0x010d9598
0x010d959d
0x010d959f
0x00000000
0x00000000
0x010d95a1
0x010d95a3
0x010d95a5
0x00000000
0x00000000
0x010d95ab
0x010d95ae
0x00000000
0x010d95ae
0x010d957d
0x010d9582
0x010d9584
0x010d9587
0x010d9693
0x00000000
0x010d9693
0x00000000
0x010d9587
0x010d9564
0x010d9564
0x010d9567
0x010d956a
0x010d956d
0x010d9575
0x010d9575
0x00000000
0x010d9575
0x010d956f
0x010d9571
0x010d9573
0x00000000
0x00000000
0x00000000
0x010d9573
0x010d9536
0x010d951d
0x010d9520
0x00000000
0x00000000
0x00000000
0x010d9520
0x010d94dd
0x010d94e0
0x00000000
0x00000000
0x010d94e7
0x010d94ea
0x010d94f3
0x010d94f5
0x010d95bd
0x010d95bd
0x010d95c0
0x010d95c3
0x010d95c6
0x010d95cd
0x010d95d8
0x010d95dd
0x010d95df
0x010d9636
0x010d9639
0x010d963c
0x010d963f
0x010d9642
0x010d9645
0x00000000
0x010d9645
0x00000000
0x010d95df
0x010d95c8
0x010d95cb
0x00000000
0x00000000
0x00000000
0x010d95cb
0x010d94fb
0x010d9501
0x010d9504
0x010d95b7
0x010d95b7
0x010d95b7
0x010d95ba
0x00000000
0x010d95ba
0x010d950a
0x00000000
0x00000000
0x010d950c
0x010d950f
0x00000000
0x00000000
0x00000000
0x010d950f
0x010d94a8
0x010d9464
0x010d9467
0x010d946a
0x010d946d
0x010d9470
0x010d9472
0x010d9491
0x010d9493
0x010d9497
0x010d9499
0x00000000
0x00000000
0x010d949b
0x010d94a2
0x010d94a2
0x00000000
0x010d94a2
0x010d949d
0x010d94a0
0x00000000
0x00000000
0x00000000
0x010d947a
0x010d947c
0x00000000
0x00000000
0x00000000
0x00000000
0x010d947c

APIs

memcpy.MSVCRT ref: 010D9615
GetLastError.KERNEL32(?,00000000,?), ref: 010D967C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorLastmemcpy
String ID:
API String ID: 2523627151-0
Opcode ID: 0468a9dc17b0035bca8867333e572073bfe1070e58766fe67de336255e867be7
Instruction ID: a10ecdda85be35b6f40d01eb2cd1a9cfa3fbe53b9839d8784e9fa3ad9974621b
Opcode Fuzzy Hash: 0468a9dc17b0035bca8867333e572073bfe1070e58766fe67de336255e867be7
Instruction Fuzzy Hash: E4818C716007059FDBA4CF29C980AAAB7F2BF48318F544A6DD9C687A45DB70F941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D1A96 Relevance: 2.5, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E010D1A96(int _a4, char _a7) {
				void* _t5;
				char* _t7;

				_t5 = malloc(_a4); // executed
				if(_t5 == 0) {
					_push(0x110d020);
					_t7 =  &_a7;
					_push(_t7);
					L01103CAC();
					return _t7;
				}
				return _t5;
			}

0x010d1a9c
0x010d1aa5
0x010d1aaa
0x010d1ab2
0x010d1ab5
0x010d1ab6
0x00000000
0x010d1ab6
0x010d1abc

APIs

malloc.MSVCRT ref: 010D1A9C
_CxxThrowException.MSVCRT(?,0110D020), ref: 010D1AB6

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: b6c4b5ba8e653f445b8f6863e677ec247e8c06e8e81e81552386b0f5b813a260
Instruction ID: a5b521e5c1579ee31d59594abf2f2dd8a4c112f5dc7ccd7bf88d3d1b06f1f3a8
Opcode Fuzzy Hash: b6c4b5ba8e653f445b8f6863e677ec247e8c06e8e81e81552386b0f5b813a260
Instruction Fuzzy Hash: 21D0A73140834C7ECF067FE6A80059B3F6C5D00464B00D056F86CCE105D671C3828750

Uniqueness

Uniqueness Score: -1.00%

Function 010E74E7 Relevance: 2.1, APIs: 1, Instructions: 610
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E010E74E7(signed int __ecx, intOrPtr __edx) {
				void* __ebx;
				signed int _t319;
				intOrPtr _t321;
				signed int _t328;
				signed int** _t341;
				signed int _t347;
				signed int _t350;
				signed int _t355;
				void* _t356;
				signed int _t359;
				short* _t362;
				signed int _t366;
				void* _t374;
				signed int _t375;
				signed int _t381;
				void* _t382;
				void* _t385;
				signed int _t402;
				signed char _t405;
				void* _t411;
				signed int _t412;
				void* _t413;
				signed int _t420;
				signed int _t429;
				intOrPtr _t437;
				signed int _t443;
				signed int _t444;
				intOrPtr _t478;
				signed int _t489;
				void* _t490;
				void* _t521;
				signed int* _t544;
				signed int _t554;
				signed int _t558;
				signed int _t560;
				intOrPtr _t561;
				signed int** _t562;
				intOrPtr _t563;
				signed int _t564;
				signed int _t565;
				void* _t566;

				E011039E0(E011057EA, _t566);
				_t558 = __ecx;
				 *((intOrPtr*)(_t566 - 0x2c)) = __edx;
				 *(_t566 - 0x1c) = __ecx;
				if( *(_t566 + 0x18) == 0 && E010D3C37(__ecx) != 0) {
					 *(_t566 + 0x18) = 1;
				}
				_t554 =  *(_t566 + 0x14);
				_t319 = E010E6F68(_t554,  *((intOrPtr*)(_t566 + 0xc)));
				if(_t319 != 0) {
					L113:
					 *[fs:0x0] =  *((intOrPtr*)(_t566 - 0xc));
					return _t319;
				}
				if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0x10)) + 4)) != 0 ||  *(_t566 + 0x18) != 0 || E010E81D1(_t558) == 0) {
					_t321 =  *((intOrPtr*)(_t566 + 0xc));
					__eflags =  *(_t321 + 4);
					if( *(_t321 + 4) != 0) {
						L100:
						_t279 = _t566 - 0xa4;
						 *_t279 =  *(_t566 - 0xa4) | 0xffffffff;
						__eflags =  *_t279;
						 *(_t566 - 4) = 0xc;
						E010D28E9(_t566 - 0xa0);
						 *(_t566 - 4) = 0xd;
						E010D6272(_t566 - 0xa4,  *((intOrPtr*)(_t566 + 0xc)));
						 *(_t566 - 0x24) = 0;
						E010D5C60(_t566 - 0x7c);
						E010D28E9(_t566 - 0x54);
						while(1) {
							_push(_t566 + 0x17);
							 *(_t566 - 4) = 0xe;
							_t328 = E010D62DA(_t566 - 0x7c);
							__eflags = _t328;
							if(_t328 == 0) {
								break;
							}
							__eflags =  *(_t566 + 0x17);
							if( *(_t566 + 0x17) == 0) {
								L109:
								E010D1ABD(E010D1ABD(_t328,  *((intOrPtr*)(_t566 - 0x54))),  *((intOrPtr*)(_t566 - 0xa0)));
								E010D58AD(_t566 - 0xa4);
								goto L110;
							}
							__eflags =  *(_t554 + 0x98);
							if(__eflags == 0) {
								L106:
								_push( *(_t566 + 0x18));
								_push(_t554);
								_push( *((intOrPtr*)(_t566 + 0x10)));
								_push( *((intOrPtr*)(_t566 + 0xc)));
								_push( *((intOrPtr*)(_t566 + 8)));
								_push( *((intOrPtr*)(_t566 - 0x2c)));
								_t328 = E010E7F7E(_t566 - 0x7c, _t558, __eflags);
								__eflags = _t328;
								if(_t328 != 0) {
									L111:
									_t560 = _t328;
									E010D1ABD(E010D1ABD(_t328,  *((intOrPtr*)(_t566 - 0x54))),  *((intOrPtr*)(_t566 - 0xa0)));
									E010D58AD(_t566 - 0xa4);
									goto L112;
								}
								 *(_t566 - 4) = 0xd;
								E010D1ABD(_t328,  *((intOrPtr*)(_t566 - 0x54)));
								 *(_t566 - 0x24) =  *(_t566 - 0x24) + 1;
								E010D5C60(_t566 - 0x7c);
								E010D28E9(_t566 - 0x54);
								continue;
							}
							__eflags = ( *(_t566 - 0x24) & 0x00000fff) - 0xfff;
							if(__eflags != 0) {
								goto L106;
							}
							_t328 = E010E6F68(_t554,  *((intOrPtr*)(_t566 + 0xc)));
							__eflags = _t328;
							if(__eflags != 0) {
								goto L111;
							}
							goto L106;
						}
						_t328 = E010E6F4F(_t554,  *((intOrPtr*)(_t566 + 0xc)));
						__eflags = _t328;
						if(_t328 != 0) {
							goto L111;
						}
						goto L109;
					}
					__eflags =  *(_t558 + 0x20);
					if( *(_t558 + 0x20) <= 0) {
						goto L100;
					}
					 *(_t566 + 0x14) = 0;
					while(1) {
						_t341 =  *( *((intOrPtr*)(_t558 + 0x1c)) +  *(_t566 + 0x14) * 4);
						_t544 = _t341[1];
						__eflags = _t544 - 1;
						if(_t544 < 1) {
							break;
						}
						_t489 =  *( *_t341);
						 *(_t566 - 0x28) = _t489;
						__eflags =  *((intOrPtr*)(_t489 + 4)) - 2;
						if( *((intOrPtr*)(_t489 + 4)) != 2) {
							break;
						}
						_t490 =  *_t489;
						__eflags =  *((short*)(_t490 + 2)) - 0x3a;
						if( *((short*)(_t490 + 2)) != 0x3a) {
							break;
						}
						__eflags = _t544 - 1;
						if(_t544 != 1) {
							L86:
							_t359 = E010D3E8C(_t490);
							__eflags = _t359;
							if(_t359 != 0) {
								L89:
								 *(_t566 + 0x14) =  *(_t566 + 0x14) + 1;
								__eflags =  *(_t566 + 0x14) -  *(_t558 + 0x20);
								if( *(_t566 + 0x14) <  *(_t558 + 0x20)) {
									continue;
								}
								break;
							}
							_t362 =  *( *(_t566 - 0x28));
							__eflags =  *_t362 - 0x2a;
							if( *_t362 == 0x2a) {
								goto L89;
							}
							__eflags =  *_t362 - 0x3f;
							if( *_t362 != 0x3f) {
								break;
							}
							goto L89;
						}
						__eflags = _t341[3];
						if(_t341[3] != 0) {
							break;
						}
						__eflags = _t341[3];
						if(_t341[3] == 0) {
							break;
						}
						goto L86;
					}
					__eflags =  *(_t566 + 0x14) -  *(_t558 + 0x20);
					if(__eflags != 0) {
						goto L100;
					}
					 *((intOrPtr*)(_t566 - 0x18)) = 0;
					 *(_t566 - 0x14) = 0;
					 *((intOrPtr*)(_t566 - 0x10)) = 0;
					 *(_t566 - 4) = 9;
					E010D6306(_t566 - 0x18, __eflags);
					__eflags =  *(_t566 - 0x14);
					 *(_t566 + 0x14) = 0;
					if(__eflags <= 0) {
						L96:
						 *(_t566 - 4) =  *(_t566 - 4) | 0xffffffff;
						E010E8B2E(0, _t566 - 0x18);
						goto L110;
					} else {
						goto L92;
					}
					while(1) {
						L92:
						E010D29BC(_t566 - 0x44, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t566 - 0x18)) +  *(_t566 + 0x14) * 4)));
						_t347 =  *(_t566 - 0x40);
						_t478 =  *((intOrPtr*)(_t566 - 0x44));
						__eflags = _t347 - 3;
						 *(_t566 - 4) = 0xa;
						if(_t347 < 3) {
							break;
						}
						__eflags =  *((short*)(_t478 + _t347 * 2 - 2)) - 0x5c;
						if( *((short*)(_t478 + _t347 * 2 - 2)) != 0x5c) {
							break;
						}
						_t350 = _t347 - 1;
						 *(_t566 - 0x40) = _t350;
						 *((short*)(_t478 + _t350 * 2)) = 0;
						E010D5C60(_t566 - 0xdc);
						E010D28E9(_t566 - 0xb4);
						 *(_t566 - 4) = 0xb;
						 *(_t566 - 0xbc) = 0x10;
						E010D2A8C(_t566 - 0xb4, _t566 - 0x44);
						_push( *(_t566 + 0x18));
						_push(_t554);
						_push( *((intOrPtr*)(_t566 + 0x10)));
						_push( *((intOrPtr*)(_t566 + 0xc)));
						_push( *((intOrPtr*)(_t566 + 8)));
						_push( *((intOrPtr*)(_t566 - 0x2c)));
						_t355 = E010E7F7E(_t566 - 0xdc, _t558, __eflags);
						__eflags = _t355;
						 *(_t566 - 0x28) = _t355;
						_push( *((intOrPtr*)(_t566 - 0xb4)));
						if(_t355 != 0) {
							_t347 = E010D1ABD(_t355);
							_t560 =  *(_t566 - 0x28);
							_t478 =  *((intOrPtr*)(_t566 - 0x44));
							L98:
							E010D1ABD(_t347, _t478);
							 *(_t566 - 4) =  *(_t566 - 4) | 0xffffffff;
							E010E8B2E(0, _t566 - 0x18);
							goto L112;
						}
						_t356 = E010D1ABD(_t355);
						 *(_t566 - 4) = 9;
						E010D1ABD(_t356,  *((intOrPtr*)(_t566 - 0x44)));
						 *(_t566 + 0x14) =  *(_t566 + 0x14) + 1;
						__eflags =  *(_t566 + 0x14) -  *(_t566 - 0x14);
						if(__eflags < 0) {
							continue;
						}
						goto L96;
					}
					_t560 = 0x80004005;
					goto L98;
				} else {
					 *((intOrPtr*)(_t566 - 0x38)) = 0;
					 *((intOrPtr*)(_t566 - 0x34)) = 0;
					 *((intOrPtr*)(_t566 - 0x30)) = 0;
					_t364 =  *(_t558 + 0x20);
					 *(_t566 - 4) = 0;
					 *(_t566 - 0x20) = 0;
					if( *(_t558 + 0x20) <= 0) {
						L48:
						 *(_t566 - 0x20) = 0;
						if( *((intOrPtr*)(_t558 + 0x14)) <= 0) {
							L66:
							E010D1ABD(_t364,  *((intOrPtr*)(_t566 - 0x38)));
							L110:
							_t319 = 0;
							goto L113;
						} else {
							goto L49;
						}
						do {
							L49:
							_t366 =  *(_t566 - 0x20);
							if(_t366 >=  *((intOrPtr*)(_t566 - 0x34)) ||  *((intOrPtr*)(_t366 +  *((intOrPtr*)(_t566 - 0x38)))) != 0) {
								_t561 =  *((intOrPtr*)( *((intOrPtr*)( *(_t566 - 0x1c) + 0x10)) +  *(_t566 - 0x20) * 4));
								_t556 = _t561 + 4;
								E010D288E(_t566 - 0x18,  *((intOrPtr*)(_t566 + 0xc)), _t561 + 4);
								 *(_t566 - 4) = 6;
								E010D5C60(_t566 - 0x7c);
								E010D28E9(_t566 - 0x54);
								 *(_t566 - 4) = 7;
								if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0xc)) + 4)) == 0) {
									if( *((intOrPtr*)(_t561 + 8)) != 0) {
										__eflags = E010D3E8C( *_t556);
										if(__eflags != 0) {
											E010D1089(_t566 - 0x18, 0x5c);
										}
									} else {
										E010D29EA(_t566 - 0x18, 0x5c);
									}
								}
								if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0xc)) + 4)) != 0) {
									L61:
									_t374 = E010E820A( *((intOrPtr*)(_t566 + 0xc)), _t556, _t599);
									_t600 = _t374;
									if(_t374 == 0) {
										_t375 = E010D5D00(_t566 - 0x7c, __eflags,  *((intOrPtr*)(_t566 - 0x18)));
										__eflags = _t375;
										if(_t375 != 0) {
											__eflags =  *(_t566 - 0x5c) >> 0x00000004 & 0x00000001;
											if(__eflags != 0) {
												goto L63;
											}
											_t381 = E010E6F2A( *(_t566 + 0x14), _t566 - 0x18, 0x80004005);
											L72:
											__eflags = _t381;
											if(_t381 != 0) {
												_t560 = _t381;
												goto L75;
											}
											goto L64;
										}
										_t381 = E010D3C62(_t561);
										__eflags = _t381;
										if(_t381 == 0) {
											goto L64;
										}
										_t381 = E010E6F4F( *(_t566 + 0x14), _t566 - 0x18);
										goto L72;
									}
									goto L62;
								} else {
									_t599 =  *((intOrPtr*)(_t561 + 8));
									if( *((intOrPtr*)(_t561 + 8)) == 0) {
										L62:
										 *(_t566 - 0x5c) = 0x10;
										E010D2A8C(_t566 - 0x54, _t556);
										L63:
										 *((intOrPtr*)(_t566 - 0x88)) = 0;
										 *((intOrPtr*)(_t566 - 0x84)) = 0;
										 *((intOrPtr*)(_t566 - 0x80)) = 0;
										_push(0);
										_push( *(_t566 + 0x14));
										 *(_t566 - 4) = 8;
										_push(_t566 - 0x88);
										_push( *((intOrPtr*)(_t566 + 0xc)));
										_push(_t566 - 0x54);
										_push( *((intOrPtr*)(_t566 + 8)));
										_t560 = E010E7CF7(_t561,  *((intOrPtr*)(_t566 - 0x2c)), _t600);
										 *(_t566 - 4) = 7;
										_t381 = E010E8B2E(0, _t566 - 0x88);
										if(_t560 != 0) {
											L75:
											_t382 = E010D1ABD(_t381,  *((intOrPtr*)(_t566 - 0x54)));
											_push( *((intOrPtr*)(_t566 - 0x18)));
											L76:
											E010D1ABD(E010D1ABD(_t382),  *((intOrPtr*)(_t566 - 0x38)));
											L112:
											_t319 = _t560;
											goto L113;
										}
										L64:
										_t385 = E010D1ABD(_t381,  *((intOrPtr*)(_t566 - 0x54)));
										 *(_t566 - 4) = 0;
										E010D1ABD(_t385,  *((intOrPtr*)(_t566 - 0x18)));
										goto L65;
									}
									goto L61;
								}
							}
							L65:
							 *(_t566 - 0x20) =  *(_t566 - 0x20) + 1;
							_t364 =  *(_t566 - 0x1c);
						} while ( *(_t566 - 0x20) <  *((intOrPtr*)( *(_t566 - 0x1c) + 0x14)));
						goto L66;
					} else {
						goto L8;
					}
					do {
						L8:
						_t562 =  *( *((intOrPtr*)( *(_t566 - 0x1c) + 0x1c)) +  *(_t566 - 0x20) * 4);
						 *(_t566 - 0x24) =  *( *_t562);
						E010D288E(_t566 - 0x18,  *((intOrPtr*)(_t566 + 0xc)),  *( *_t562));
						 *(_t566 - 4) = 1;
						 *(_t566 + 0x1b) = 1;
						if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0xc)) + 4)) == 0 && _t562[3] == 0) {
							_t443 =  *(_t566 - 0x24);
							_t581 =  *((intOrPtr*)(_t443 + 4));
							if( *((intOrPtr*)(_t443 + 4)) != 0) {
								_t444 = E010E7CCF(_t562);
								__eflags = _t444;
								if(_t444 != 0) {
									 *(_t566 + 0x1b) = 0;
									E010D1089(_t566 - 0x18, 0x5c);
								}
							} else {
								 *(_t566 + 0x1b) = 0;
								E010D29EA(_t566 - 0x18, 0x5c);
							}
						}
						E010D5C60(_t566 - 0x7c);
						E010D28E9(_t566 - 0x54);
						 *(_t566 - 4) = 2;
						if(E010E820A( *((intOrPtr*)(_t566 + 0xc)),  *(_t566 - 0x24), _t581) == 0) {
							_t402 = E010D5D00(_t566 - 0x7c, __eflags,  *((intOrPtr*)(_t566 - 0x18))); // executed
							__eflags = _t402;
							if(_t402 != 0) {
								goto L16;
							}
							_t412 = E010E6F4F(_t554, _t566 - 0x18);
							goto L21;
						} else {
							 *(_t566 - 0x5c) = 0x10;
							E010D2A8C(_t566 - 0x54,  *(_t566 - 0x24));
							L16:
							_t405 =  *(_t566 - 0x5c) >> 0x00000004 & 0x00000001;
							 *(_t566 + 0x13) = _t405;
							if(_t405 == 0) {
								__eflags = _t562[3];
								if(_t562[3] != 0) {
									L25:
									E010F801B(_t566 - 0x88);
									_push(_t566 - 0x54);
									 *(_t566 - 4) = 3;
									_t411 = E010D3D85( *(_t566 - 0x1c), 0, _t566 - 0x88, E010D150C(_t566 - 0x88) & 0xffffff00 |  *(_t566 + 0x13) == 0x00000000);
									 *(_t566 - 4) = 2;
									_t521 = _t566 - 0x88;
									if(_t411 != 0) {
										L45:
										_t412 = E010E8B2E(0, _t521);
										goto L46;
									}
									E010E8B2E(0, _t521);
									 *(_t566 - 0x28) =  *(_t566 - 0x28) | 0xffffffff;
									if( *((intOrPtr*)(_t554 + 0x95)) == 0) {
										L28:
										_push(_t566 - 0x7c);
										_push( *(_t566 - 0x28));
										_push( *((intOrPtr*)(_t566 + 8)));
										_push( *((intOrPtr*)(_t566 - 0x2c)));
										E010E6DFC(_t554, _t588);
										_t563 =  *((intOrPtr*)( *((intOrPtr*)(_t554 + 0x24)) +  *(_t554 + 0x28) * 4 - 4));
										_t412 = E010E7314(_t554, _t563, _t566 - 0x7c,  *((intOrPtr*)(_t566 + 0xc)));
										if(_t412 != 0) {
											L54:
											_t560 = _t412;
											L56:
											_t382 = E010D1ABD(_t412,  *((intOrPtr*)(_t566 - 0x54)));
											_push( *((intOrPtr*)(_t566 - 0x18)));
											goto L76;
										}
										if( *((intOrPtr*)(_t563 + 0x30)) == 0) {
											__eflags =  *(_t566 + 0x1b);
											if( *(_t566 + 0x1b) == 0) {
												L37:
												__eflags =  *(_t566 + 0x13);
												if( *(_t566 + 0x13) == 0) {
													goto L46;
												}
												 *((intOrPtr*)(_t566 - 0x44)) = 0;
												 *(_t566 - 0x40) = 0;
												 *((intOrPtr*)(_t566 - 0x3c)) = 0;
												 *(_t566 - 4) = 5;
												_t420 = E010D3AA1( *(_t566 - 0x1c),  *(_t566 - 0x24));
												_t564 = _t420;
												__eflags = _t564;
												if(_t564 < 0) {
													_push( *(_t566 - 0x24));
													_t565 =  *(_t566 - 0x1c);
													E010D150C(_t566 - 0x44);
													L44:
													_push(1);
													_push(_t554);
													_push(_t566 - 0x44);
													_push( *((intOrPtr*)(_t566 + 0xc)));
													_push(_t566 - 0x54);
													_push( *((intOrPtr*)(_t566 + 8)));
													_t560 = E010E7CF7(_t565,  *((intOrPtr*)(_t566 - 0x2c)), __eflags);
													 *(_t566 - 4) = 2;
													__eflags = _t560;
													_t521 = _t566 - 0x44;
													if(_t560 != 0) {
														L55:
														_t412 = E010E8B2E(0, _t521);
														goto L56;
													}
													goto L45;
												}
												__eflags =  *((intOrPtr*)(_t566 - 0x34)) - _t564;
												if(__eflags > 0) {
													L42:
													 *((char*)(_t564 +  *((intOrPtr*)(_t566 - 0x38)))) = 0;
													_t565 =  *( *((intOrPtr*)( *(_t566 - 0x1c) + 0x10)) + _t564 * 4);
													goto L44;
												}
												_t429 = _t420 -  *((intOrPtr*)(_t566 - 0x34)) + 1;
												__eflags = _t429;
												 *(_t566 + 0x18) = _t429;
												do {
													E010E0E6F(_t566 - 0x38);
													 *((char*)( *((intOrPtr*)(_t566 - 0x34)) +  *((intOrPtr*)(_t566 - 0x38)))) = 1;
													 *((intOrPtr*)(_t566 - 0x34)) =  *((intOrPtr*)(_t566 - 0x34)) + 1;
													_t119 = _t566 + 0x18;
													 *_t119 =  *(_t566 + 0x18) - 1;
													__eflags =  *_t119;
												} while (__eflags != 0);
												goto L42;
											}
											__eflags =  *(_t554 + 0x31);
											if( *(_t554 + 0x31) == 0) {
												goto L37;
											}
											 *((intOrPtr*)(_t566 - 0x94)) = 0;
											 *((intOrPtr*)(_t566 - 0x90)) = 0;
											 *((intOrPtr*)(_t566 - 0x8c)) = 0;
											_push(_t566 - 0x54);
											 *(_t566 - 4) = 4;
											E010D150C(_t566 - 0x94);
											_push(_t554);
											_push(1);
											_push(_t566 - 0x94);
											_push(_t566 - 0x18);
											_push( *((intOrPtr*)(_t566 + 8)));
											_push( *((intOrPtr*)(_t566 - 0x2c)));
											_t560 = E010E7D91(_t566 - 0x7c,  *(_t566 - 0x1c), __eflags);
											 *(_t566 - 4) = 2;
											__eflags = _t560;
											_t521 = _t566 - 0x94;
											if(_t560 != 0) {
												goto L55;
											}
											_t412 = E010E8B2E(0, _t521);
											goto L37;
										}
										_t437 =  *((intOrPtr*)(_t566 - 0x7c));
										if( *((intOrPtr*)(_t566 - 0x58)) == 0) {
											 *((intOrPtr*)(_t554 + 0x50)) =  *((intOrPtr*)(_t554 + 0x50)) - _t437;
											_t412 =  *(_t566 - 0x78);
											asm("sbb [edi+0x54], eax");
										} else {
											 *((intOrPtr*)(_t554 + 0x58)) =  *((intOrPtr*)(_t554 + 0x58)) - _t437;
											_t412 =  *(_t566 - 0x78);
											asm("sbb [edi+0x5c], eax");
										}
										goto L46;
									}
									_t412 = E010E7202(_t554, _t566 - 0x18, _t566 - 0x28);
									_t588 = _t412;
									if(_t412 != 0) {
										goto L54;
									}
									goto L28;
								}
								L24:
								_t412 = E010E6F2A(_t554, _t566 - 0x18, 0x80004005);
								L21:
								__eflags = _t412;
								if(_t412 != 0) {
									goto L54;
								}
								goto L46;
							}
							if(_t562[3] == 0) {
								goto L24;
							}
							goto L25;
						}
						L46:
						_t413 = E010D1ABD(_t412,  *((intOrPtr*)(_t566 - 0x54)));
						 *(_t566 - 4) = 0;
						E010D1ABD(_t413,  *((intOrPtr*)(_t566 - 0x18)));
						 *(_t566 - 0x20) =  *(_t566 - 0x20) + 1;
						_t364 =  *(_t566 - 0x1c);
					} while ( *(_t566 - 0x20) <  *((intOrPtr*)(_t364 + 0x20)));
					_t558 = _t364;
					goto L48;
				}
			}

0x010e74ec
0x010e74fb
0x010e7501
0x010e7504
0x010e7507
0x010e7512
0x010e7512
0x010e7516
0x010e751e
0x010e7525
0x010e7cbe
0x010e7cc4
0x010e7ccc
0x010e7ccc
0x010e7531
0x010e7a08
0x010e7a0b
0x010e7a0e
0x010e7ba0
0x010e7ba0
0x010e7ba0
0x010e7ba0
0x010e7bad
0x010e7bb4
0x010e7bc2
0x010e7bc9
0x010e7bd1
0x010e7bd4
0x010e7bdc
0x010e7be1
0x010e7bea
0x010e7bef
0x010e7bf3
0x010e7bf8
0x010e7bfa
0x00000000
0x00000000
0x010e7bfc
0x010e7bff
0x010e7c76
0x010e7c85
0x010e7c91
0x00000000
0x010e7c91
0x010e7c01
0x010e7c07
0x010e7c25
0x010e7c25
0x010e7c2d
0x010e7c2e
0x010e7c31
0x010e7c34
0x010e7c37
0x010e7c3a
0x010e7c3f
0x010e7c41
0x010e7c9a
0x010e7c9d
0x010e7caa
0x010e7cb7
0x00000000
0x010e7cb7
0x010e7c46
0x010e7c4a
0x010e7c4f
0x010e7c56
0x010e7c5e
0x00000000
0x010e7c5e
0x010e7c13
0x010e7c15
0x00000000
0x00000000
0x010e7c1c
0x010e7c21
0x010e7c23
0x00000000
0x00000000
0x00000000
0x010e7c23
0x010e7c6d
0x010e7c72
0x010e7c74
0x00000000
0x00000000
0x00000000
0x010e7c74
0x010e7a17
0x010e7a19
0x00000000
0x00000000
0x010e7a1f
0x010e7a22
0x010e7a28
0x010e7a2b
0x010e7a2e
0x010e7a31
0x00000000
0x00000000
0x010e7a35
0x010e7a37
0x010e7a3a
0x010e7a3e
0x00000000
0x00000000
0x010e7a40
0x010e7a42
0x010e7a47
0x00000000
0x00000000
0x010e7a49
0x010e7a4c
0x010e7a58
0x010e7a58
0x010e7a5d
0x010e7a5f
0x010e7a72
0x010e7a72
0x010e7a78
0x010e7a7b
0x00000000
0x00000000
0x00000000
0x010e7a7b
0x010e7a64
0x010e7a66
0x010e7a6a
0x00000000
0x00000000
0x010e7a6c
0x010e7a70
0x00000000
0x00000000
0x00000000
0x010e7a70
0x010e7a4e
0x010e7a51
0x00000000
0x00000000
0x010e7a53
0x010e7a56
0x00000000
0x00000000
0x00000000
0x010e7a56
0x010e7a80
0x010e7a83
0x00000000
0x00000000
0x010e7a89
0x010e7a8c
0x010e7a8f
0x010e7a95
0x010e7a9c
0x010e7aa1
0x010e7aa4
0x010e7aa7
0x010e7b64
0x010e7b64
0x010e7b6b
0x00000000
0x00000000
0x00000000
0x00000000
0x010e7aad
0x010e7aad
0x010e7ab9
0x010e7abe
0x010e7ac1
0x010e7ac4
0x010e7ac7
0x010e7acb
0x00000000
0x00000000
0x010e7ad1
0x010e7ad7
0x00000000
0x00000000
0x010e7add
0x010e7ade
0x010e7ae1
0x010e7aeb
0x010e7af6
0x010e7b05
0x010e7b09
0x010e7b13
0x010e7b20
0x010e7b23
0x010e7b24
0x010e7b27
0x010e7b2a
0x010e7b2d
0x010e7b30
0x010e7b35
0x010e7b37
0x010e7b3a
0x010e7b40
0x010e7b75
0x010e7b7a
0x010e7b7e
0x010e7b81
0x010e7b82
0x010e7b87
0x010e7b8f
0x00000000
0x010e7b8f
0x010e7b42
0x010e7b4a
0x010e7b4e
0x010e7b53
0x010e7b59
0x010e7b5e
0x00000000
0x00000000
0x00000000
0x010e7b5e
0x010e7b99
0x00000000
0x010e754f
0x010e754f
0x010e7552
0x010e7555
0x010e7558
0x010e755b
0x010e7560
0x010e7563
0x010e784d
0x010e7850
0x010e7853
0x010e7988
0x010e798b
0x010e7c96
0x010e7c96
0x00000000
0x00000000
0x00000000
0x00000000
0x010e7859
0x010e7859
0x010e7859
0x010e785f
0x010e7879
0x010e787f
0x010e7883
0x010e788b
0x010e788f
0x010e7897
0x010e789f
0x010e78a6
0x010e78ab
0x010e78d9
0x010e78db
0x010e78e2
0x010e78e2
0x010e78ad
0x010e78b2
0x010e78b2
0x010e78ab
0x010e78ed
0x010e78f4
0x010e78f9
0x010e78fe
0x010e7900
0x010e799c
0x010e79a1
0x010e79a3
0x010e79c4
0x010e79c6
0x00000000
0x00000000
0x010e79d8
0x010e79dd
0x010e79dd
0x010e79df
0x010e79e6
0x00000000
0x010e79e6
0x00000000
0x010e79e1
0x010e79a7
0x010e79ac
0x010e79ae
0x00000000
0x00000000
0x010e79b7
0x00000000
0x010e79b7
0x00000000
0x010e78ef
0x010e78ef
0x010e78f2
0x010e7906
0x010e790a
0x010e7911
0x010e7916
0x010e7916
0x010e791c
0x010e7922
0x010e7925
0x010e792c
0x010e7934
0x010e7938
0x010e793c
0x010e793f
0x010e7940
0x010e794e
0x010e7950
0x010e7954
0x010e795b
0x010e79e8
0x010e79eb
0x010e79f0
0x010e79f3
0x010e79fb
0x010e7cbc
0x010e7cbc
0x00000000
0x010e7cbc
0x010e7961
0x010e7964
0x010e796c
0x010e796f
0x00000000
0x010e7975
0x00000000
0x010e78f2
0x010e78ed
0x010e7976
0x010e7976
0x010e7979
0x010e797f
0x00000000
0x00000000
0x00000000
0x00000000
0x010e7569
0x010e7569
0x010e7575
0x010e7580
0x010e7583
0x010e758b
0x010e758f
0x010e7596
0x010e759d
0x010e75a0
0x010e75a3
0x010e75b6
0x010e75bb
0x010e75bd
0x010e75c4
0x010e75c7
0x010e75c7
0x010e75a5
0x010e75aa
0x010e75ad
0x010e75ad
0x010e75a3
0x010e75cf
0x010e75d7
0x010e75e2
0x010e75ed
0x010e761b
0x010e7620
0x010e7622
0x00000000
0x00000000
0x010e762a
0x00000000
0x010e75ef
0x010e75f5
0x010e75fc
0x010e7601
0x010e7607
0x010e7609
0x010e760c
0x010e763c
0x010e763f
0x010e7653
0x010e7659
0x010e7667
0x010e7668
0x010e7683
0x010e768a
0x010e768e
0x010e7694
0x010e781f
0x010e781f
0x00000000
0x010e781f
0x010e769a
0x010e769f
0x010e76a9
0x010e76c2
0x010e76c7
0x010e76c8
0x010e76cb
0x010e76ce
0x010e76d1
0x010e76df
0x010e76ea
0x010e76f1
0x010e78b9
0x010e78b9
0x010e78c2
0x010e78c5
0x010e78ca
0x00000000
0x010e78ca
0x010e76fa
0x010e7720
0x010e7723
0x010e7787
0x010e7787
0x010e778a
0x00000000
0x00000000
0x010e7790
0x010e7793
0x010e7796
0x010e779f
0x010e77a3
0x010e77a8
0x010e77aa
0x010e77ac
0x010e77e5
0x010e77e8
0x010e77ee
0x010e77f3
0x010e77f3
0x010e77f8
0x010e77f9
0x010e77fa
0x010e7805
0x010e7806
0x010e780e
0x010e7810
0x010e7814
0x010e7816
0x010e7819
0x010e78bd
0x010e78bd
0x00000000
0x010e78bd
0x00000000
0x010e7819
0x010e77ae
0x010e77b1
0x010e77d4
0x010e77d7
0x010e77e0
0x00000000
0x010e77e0
0x010e77b6
0x010e77b6
0x010e77b7
0x010e77ba
0x010e77bd
0x010e77c8
0x010e77cc
0x010e77cf
0x010e77cf
0x010e77cf
0x010e77cf
0x00000000
0x010e77ba
0x010e7725
0x010e7728
0x00000000
0x00000000
0x010e772a
0x010e7730
0x010e7736
0x010e7745
0x010e7746
0x010e774a
0x010e7758
0x010e7759
0x010e775b
0x010e775f
0x010e7763
0x010e7766
0x010e776e
0x010e7770
0x010e7774
0x010e7776
0x010e777c
0x00000000
0x00000000
0x010e7782
0x00000000
0x010e7782
0x010e76ff
0x010e7702
0x010e7712
0x010e7715
0x010e7718
0x010e7704
0x010e7704
0x010e7707
0x010e770a
0x010e770a
0x00000000
0x010e7702
0x010e76b5
0x010e76ba
0x010e76bc
0x00000000
0x00000000
0x00000000
0x010e76bc
0x010e7641
0x010e764c
0x010e762f
0x010e762f
0x010e7631
0x00000000
0x00000000
0x00000000
0x010e7637
0x010e7611
0x00000000
0x00000000
0x00000000
0x010e7613
0x010e7824
0x010e7827
0x010e782f
0x010e7832
0x010e7837
0x010e783a
0x010e7842
0x010e784b
0x00000000
0x010e784b

APIs

__EH_prolog.LIBCMT ref: 010E74EC

Part of subcall function 010D5D00: __EH_prolog.LIBCMT ref: 010D5D05

Part of subcall function 010E7F7E: __EH_prolog.LIBCMT ref: 010E7F83

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$free
String ID:
API String ID: 2654054672-0
Opcode ID: 469c61649d4d98189439857ead453eee35462f6e568f70b4a81f0cbda8a0b4ad
Instruction ID: 156394884594a140ba32c7a188e2228c8b3e63780694b6464934a97ebb98d491
Opcode Fuzzy Hash: 469c61649d4d98189439857ead453eee35462f6e568f70b4a81f0cbda8a0b4ad
Instruction Fuzzy Hash: C3427B70D0024ADFCF25EFA9C984AEDBBF1BF18304F14809AE99567251DB319A45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010DD8E1 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E010DD8E1(intOrPtr __ecx, void* __eflags) {
				intOrPtr* _t65;
				intOrPtr* _t66;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr _t71;
				char _t73;
				intOrPtr _t86;
				intOrPtr _t93;
				void* _t95;
				void* _t98;

				_t98 = __eflags;
				E011039E0(E01104D3D, _t95);
				_push(__ecx);
				_push(__ecx);
				_t93 = __ecx;
				 *((intOrPtr*)(_t95 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x1108e88;
				 *((intOrPtr*)(__ecx + 4)) = 0x1108e70;
				 *((intOrPtr*)(__ecx + 8)) = 0x1108e60;
				 *((intOrPtr*)(__ecx + 0xc)) = 0x1108e50;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(_t95 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				E010DDAAC(__ecx + 0x18);
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				 *((intOrPtr*)(__ecx + 0x34)) = 0;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				 *((char*)(_t95 - 4)) = 5;
				E010D28E9(__ecx + 0x3c);
				 *((char*)(_t95 - 4)) = 6;
				E010D28E9(__ecx + 0x48);
				 *((intOrPtr*)(__ecx + 0x60)) = 0;
				 *((intOrPtr*)(__ecx + 0x68)) = 0;
				 *((char*)(_t95 - 4)) = 9;
				E010DDA55(__ecx + 0x6c, _t98);
				 *((char*)(_t95 - 4)) = 0xa;
				E010D28E9(__ecx + 0xac);
				 *((char*)(__ecx + 0xc2)) = 1;
				 *((char*)(__ecx + 0xc3)) = 1;
				 *((char*)(__ecx + 0xc4)) = 1;
				 *((intOrPtr*)(__ecx + 0x100)) = 0;
				 *((intOrPtr*)(__ecx + 0x108)) = 0;
				_t65 = __ecx + 0x110;
				 *_t65 = 0;
				 *((intOrPtr*)(_t65 + 4)) = 0;
				 *((intOrPtr*)(_t65 + 8)) = 0;
				_t90 = __ecx + 0x128;
				 *((char*)(__ecx + 0x126)) = 0;
				 *((intOrPtr*)(__ecx + 0x128)) = 0;
				_t66 = __ecx + 0x144;
				 *_t66 = 0;
				 *((intOrPtr*)(_t66 + 4)) = 0;
				 *((intOrPtr*)(_t66 + 8)) = 0;
				_t67 = __ecx + 0x180;
				 *_t67 = 0;
				 *((intOrPtr*)(_t67 + 4)) = 0;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *((intOrPtr*)(_t67 + 0xc)) = 0;
				 *((intOrPtr*)(_t67 + 0x10)) = 0;
				 *((intOrPtr*)(_t67 + 0x14)) = 0;
				 *((char*)(_t95 - 4)) = 0x11;
				E010D28E9(__ecx + 0x198);
				_t69 = __ecx + 0x1a4;
				 *_t69 = 0;
				 *((intOrPtr*)(_t69 + 4)) = 0;
				 *((intOrPtr*)(_t69 + 8)) = 0;
				_push(0x38);
				 *((char*)(_t95 - 4)) = 0x13;
				 *((intOrPtr*)(__ecx)) = 0x1108e30;
				 *((intOrPtr*)(__ecx + 4)) = 0x1108e18;
				 *((intOrPtr*)(__ecx + 8)) = 0x1108e08;
				 *((intOrPtr*)(__ecx + 0xc)) = 0x1108df8;
				_t86 = E010D1A96();
				 *((intOrPtr*)(_t95 - 0x14)) = _t86;
				_t99 = _t86;
				 *((char*)(_t95 - 4)) = 0x14;
				if(_t86 == 0) {
					_t71 = 0;
					__eflags = 0;
				} else {
					_t71 = E010DAC3D(_t86);
				}
				 *((char*)(_t95 - 4)) = 0x13;
				 *((intOrPtr*)(_t93 + 0x154)) = _t71;
				E010E0E48(_t90, _t71); // executed
				_t73 = E010DD4F9(_t99); // executed
				 *((char*)(_t93 + 0x150)) = _t73;
				 *[fs:0x0] =  *((intOrPtr*)(_t95 - 0xc));
				return _t93;
			}

0x010dd8e1
0x010dd8e6
0x010dd8eb
0x010dd8ec
0x010dd8ef
0x010dd8f4
0x010dd8f7
0x010dd8fd
0x010dd904
0x010dd90b
0x010dd912
0x010dd918
0x010dd91b
0x010dd91e
0x010dd923
0x010dd926
0x010dd929
0x010dd92c
0x010dd92f
0x010dd935
0x010dd939
0x010dd941
0x010dd945
0x010dd94a
0x010dd94d
0x010dd953
0x010dd957
0x010dd962
0x010dd966
0x010dd96b
0x010dd972
0x010dd979
0x010dd980
0x010dd986
0x010dd98c
0x010dd992
0x010dd994
0x010dd997
0x010dd99a
0x010dd9a0
0x010dd9a6
0x010dd9a8
0x010dd9ae
0x010dd9b0
0x010dd9b3
0x010dd9b6
0x010dd9bc
0x010dd9be
0x010dd9c1
0x010dd9c4
0x010dd9c7
0x010dd9ca
0x010dd9d3
0x010dd9d7
0x010dd9dc
0x010dd9e2
0x010dd9e4
0x010dd9e7
0x010dd9ea
0x010dd9ec
0x010dd9f0
0x010dd9f6
0x010dd9fd
0x010dda04
0x010dda11
0x010dda13
0x010dda16
0x010dda18
0x010dda1c
0x010dda25
0x010dda25
0x010dda1e
0x010dda1e
0x010dda1e
0x010dda2a
0x010dda2e
0x010dda34
0x010dda39
0x010dda41
0x010dda4c
0x010dda54

APIs

__EH_prolog.LIBCMT ref: 010DD8E6

Part of subcall function 010DDA55: __EH_prolog.LIBCMT ref: 010DDA5A

Part of subcall function 010D1A96: malloc.MSVCRT ref: 010D1A9C
Part of subcall function 010D1A96: _CxxThrowException.MSVCRT(?,0110D020), ref: 010D1AB6

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrowmalloc
String ID:
API String ID: 3744649731-0
Opcode ID: 304336058ac729e13f92d20b3cf3c055da0a13e242dfed25505ef110abc0544c
Instruction ID: c1e52f0e854ef3c1b9d52e62ade535ddd122ee98ee9996e80414f477db0064a0
Opcode Fuzzy Hash: 304336058ac729e13f92d20b3cf3c055da0a13e242dfed25505ef110abc0544c
Instruction Fuzzy Hash: 0F4109B1805B44CFD325DFAAC1846CAFBE0BF19304F5488AEC09A57751D7B0AA44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010FFE07 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E010FFE07(intOrPtr __ecx) {
				intOrPtr* _t67;
				char* _t69;
				char* _t70;
				char* _t71;
				char* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t95;
				void* _t100;

				E011039E0(E0110768B, _t100);
				_push(__ecx);
				_push(__ecx);
				 *((intOrPtr*)(_t100 - 0x14)) = __ecx;
				_t94 = __ecx + 0xc;
				 *((char*)(__ecx + 1)) = 0;
				 *((char*)(__ecx + 2)) = 0;
				 *((char*)(__ecx + 6)) = 0;
				 *((char*)(__ecx + 7)) = 0;
				 *((intOrPtr*)(_t100 - 0x10)) = __ecx + 0xc;
				E010F801B(__ecx + 0xc);
				 *((intOrPtr*)(_t100 - 4)) = 0;
				E010F801B(_t94 + 0xc);
				_t95 = 1;
				 *((intOrPtr*)(_t100 - 4)) = _t95;
				E010D28E9(__ecx + 0x28);
				 *((char*)(_t100 - 4)) = 2;
				E010D28E9(__ecx + 0x38);
				 *((intOrPtr*)(__ecx + 0x48)) = 0;
				 *((intOrPtr*)(__ecx + 0x4c)) = 0;
				 *((intOrPtr*)(__ecx + 0x50)) = 0;
				 *((char*)(_t100 - 4)) = 4;
				 *((intOrPtr*)(_t100 - 0x10)) = __ecx + 0x58;
				E010F801B(__ecx + 0x58);
				 *((char*)(_t100 - 4)) = 5;
				E010F801B( *((intOrPtr*)(_t100 - 0x10)) + 0xc);
				 *((char*)(_t100 - 4)) = 6;
				E010D28E9(__ecx + 0x70);
				_t67 = __ecx + 0x7c;
				 *_t67 = 0;
				 *((intOrPtr*)(_t67 + 4)) = 0;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *((char*)(_t100 - 4)) = 8;
				E010FFD97(__ecx + 0x88);
				_t69 = __ecx + 0xac;
				 *((char*)(_t100 - 4)) = 9;
				 *_t69 = 0;
				 *((char*)(_t69 + 1)) = 0;
				_t70 = __ecx + 0xae;
				 *_t70 = 0;
				 *((char*)(_t70 + 1)) = 0;
				_t71 = __ecx + 0xb0;
				 *_t71 = 0;
				 *((char*)(_t71 + 1)) = 0;
				_t72 = __ecx + 0xb2;
				 *_t72 = 0;
				 *((char*)(_t72 + 1)) = 0;
				E010FFF47(__ecx + 0xb8, 0); // executed
				_t74 = __ecx + 0x1d0;
				 *_t74 = 0;
				 *((intOrPtr*)(_t74 + 4)) = 0;
				 *((intOrPtr*)(_t74 + 8)) = 0;
				 *((char*)(_t74 + 0xc)) = 0;
				 *((char*)(_t74 + 0xd)) = 0;
				 *((char*)(_t74 + 0xe)) = 0;
				 *((intOrPtr*)(_t74 + 0x10)) = 0;
				 *((char*)(_t100 - 4)) = 0xb;
				E010D28E9(__ecx + 0x1e4);
				_t76 = __ecx + 0x1f0;
				 *_t76 = 0;
				 *((intOrPtr*)(_t76 + 4)) = 0;
				 *((intOrPtr*)(_t76 + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0x1fc)) = _t95;
				 *((intOrPtr*)(__ecx + 0x204)) = _t95;
				 *((intOrPtr*)(__ecx + 0x200)) = 2;
				 *((intOrPtr*)(__ecx + 0x208)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t100 - 0xc));
				return __ecx;
			}

0x010ffe0c
0x010ffe11
0x010ffe12
0x010ffe1a
0x010ffe1d
0x010ffe20
0x010ffe25
0x010ffe28
0x010ffe2b
0x010ffe2e
0x010ffe31
0x010ffe39
0x010ffe3c
0x010ffe46
0x010ffe47
0x010ffe4a
0x010ffe52
0x010ffe56
0x010ffe5b
0x010ffe5e
0x010ffe61
0x010ffe67
0x010ffe6b
0x010ffe6e
0x010ffe76
0x010ffe7d
0x010ffe85
0x010ffe89
0x010ffe8e
0x010ffe91
0x010ffe93
0x010ffe96
0x010ffe9f
0x010ffea3
0x010ffea8
0x010ffeb4
0x010ffeb8
0x010ffeba
0x010ffebd
0x010ffec3
0x010ffec5
0x010ffec8
0x010ffece
0x010ffed0
0x010ffed3
0x010ffed9
0x010ffedb
0x010ffede
0x010ffee3
0x010ffee9
0x010ffeeb
0x010ffeee
0x010ffef1
0x010ffef4
0x010ffef7
0x010ffefa
0x010fff03
0x010fff07
0x010fff0f
0x010fff15
0x010fff17
0x010fff1a
0x010fff1d
0x010fff23
0x010fff29
0x010fff33
0x010fff3e
0x010fff46

APIs

__EH_prolog.LIBCMT ref: 010FFE0C

Part of subcall function 010FFD97: __EH_prolog.LIBCMT ref: 010FFD9C

Part of subcall function 010FFF47: __EH_prolog.LIBCMT ref: 010FFF4C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2e88dec0a3a68e4636b0b0f5ef6219aaeca2b6334262bcd8f31e6d9a9f06f338
Instruction ID: 87724873e5391a97d87445edfd9f986895ad701ad489cc116896efc952b79668
Opcode Fuzzy Hash: 2e88dec0a3a68e4636b0b0f5ef6219aaeca2b6334262bcd8f31e6d9a9f06f338
Instruction Fuzzy Hash: B5411C71845785CEC312DF69C099ADAFFE4BF25310F85C89EC49A57752D770A608CB22

Uniqueness

Uniqueness Score: -1.00%

Function 010E7410 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E010E7410(intOrPtr* __ecx, intOrPtr __edx) {
				void* __ebx;
				void* _t40;
				signed int _t43;
				void* _t44;
				signed int _t47;
				signed int _t49;
				intOrPtr* _t50;
				intOrPtr _t56;
				intOrPtr _t69;
				void* _t70;
				void* _t71;

				_t50 = __ecx;
				E011039E0(E01105754, _t71);
				_push(_t47);
				 *((intOrPtr*)(_t71 - 0x1c)) = __edx;
				 *((intOrPtr*)(_t71 - 0x18)) = __ecx;
				 *(_t71 - 0x10) = 0;
				if( *((intOrPtr*)(__ecx + 4)) <= 0) {
					L12:
					E010E70C8( *((intOrPtr*)(_t71 + 0xc)));
					E010E8272( *((intOrPtr*)(_t71 + 0xc)));
					_t40 = 0;
					L13:
					 *[fs:0x0] =  *((intOrPtr*)(_t71 - 0xc));
					return _t40;
				}
				_t49 = _t47 | 0xffffffff;
				while(1) {
					_t69 =  *((intOrPtr*)( *_t50 +  *(_t71 - 0x10) * 4));
					if( *((intOrPtr*)(_t69 + 4)) != 0) {
						_push(_t69);
						_push(_t49);
						 *(_t71 - 0x14) = E010E70EA( *((intOrPtr*)(_t71 + 0xc)), _t71, _t49);
					} else {
						 *(_t71 - 0x14) = _t49;
					}
					_t43 = _t49;
					if( *((intOrPtr*)(_t71 - 0x1c)) != 2) {
						_t56 =  *((intOrPtr*)(_t71 + 8));
						if( *((intOrPtr*)(_t56 + 4)) != 0) {
							_push(_t56);
							_push(_t49);
							_t43 = E010E70EA( *((intOrPtr*)(_t71 + 0xc)), _t71, _t49);
						}
					} else {
						_t43 =  *(_t71 - 0x14);
					}
					 *((intOrPtr*)(_t71 - 0x28)) = 0;
					 *((intOrPtr*)(_t71 - 0x24)) = 0;
					 *((intOrPtr*)(_t71 - 0x20)) = 0;
					 *(_t71 - 4) = 0;
					_t25 = _t69 + 0xc; // 0xc, executed
					_t44 = E010E74E7(_t25,  *(_t71 - 0x14), _t43, _t69, _t71 - 0x28,  *((intOrPtr*)(_t71 + 0xc)), 0); // executed
					_t70 = _t44;
					 *(_t71 - 4) = _t49;
					E010E8B2E(_t49, _t71 - 0x28);
					if(_t70 != 0) {
						break;
					}
					 *(_t71 - 0x10) =  *(_t71 - 0x10) + 1;
					if( *(_t71 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t71 - 0x18)) + 4))) {
						_t50 =  *((intOrPtr*)(_t71 - 0x18));
						continue;
					}
					goto L12;
				}
				_t40 = _t70;
				goto L13;
			}

0x010e7410
0x010e7415
0x010e741d
0x010e7425
0x010e7428
0x010e742b
0x010e742e
0x010e74c0
0x010e74c3
0x010e74cb
0x010e74d0
0x010e74d2
0x010e74d8
0x010e74e0
0x010e74e0
0x010e7434
0x010e743c
0x010e7441
0x010e7447
0x010e7451
0x010e7452
0x010e7459
0x010e7449
0x010e7449
0x010e7449
0x010e7460
0x010e7462
0x010e7469
0x010e746f
0x010e7471
0x010e7475
0x010e7477
0x010e7477
0x010e7464
0x010e7464
0x010e7464
0x010e747c
0x010e747f
0x010e7482
0x010e748f
0x010e7495
0x010e7498
0x010e74a0
0x010e74a2
0x010e74a5
0x010e74ac
0x00000000
0x00000000
0x010e74ae
0x010e74ba
0x010e7439
0x00000000
0x010e7439
0x00000000
0x010e74ba
0x010e74e3
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010E7415

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 230a72f5812ba1eb133a9ac30425e7b3a6537ee162e9109c7003d8d82a724879
Instruction ID: a2c33776d105c33fce42a760f0f5d9776cb36b0cda77c887aed4e59ce022dd7d
Opcode Fuzzy Hash: 230a72f5812ba1eb133a9ac30425e7b3a6537ee162e9109c7003d8d82a724879
Instruction Fuzzy Hash: 89312AB0D0020AEFCB15DF9AC8948EEBFF5FF98364B10815EE45667251DB309A00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010ECB62 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E010ECB62(intOrPtr* __ecx) {
				intOrPtr _t34;
				signed int _t40;
				intOrPtr _t46;
				signed int _t56;
				intOrPtr* _t61;
				void* _t63;

				E011039E0(E0110608E, _t63);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x18)) = __ecx;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *(_t63 - 4) = 0;
				_t56 =  *( *((intOrPtr*)(_t63 + 8)) + 4);
				 *(_t63 - 0x14) = _t56;
				if(_t56 != 0) {
					_t40 = 0x3fffffff;
					if(_t56 <= 0x3fffffff) {
						_t40 = _t56;
					}
					_push(_t40 << 2);
					 *_t61 = E010D1A96();
					 *(_t61 + 8) = _t56;
				}
				 *(_t63 - 0x10) = 0;
				if(_t56 > 0) {
					do {
						_push(0x18); // executed
						_t34 = E010D1A96(); // executed
						_t46 = _t34;
						 *((intOrPtr*)(_t63 - 0x1c)) = _t46;
						_t72 = _t46;
						 *(_t63 - 4) = 1;
						if(_t46 == 0) {
							_t46 = 0;
							__eflags = 0;
						} else {
							E010D29BC(_t46, _t72,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t63 + 8)))) +  *(_t63 - 0x10) * 4)));
							_t16 = _t46 + 0xc; // 0xc
							 *(_t63 - 4) = 2;
							E010D29BC(_t16, _t72,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t63 + 8)))) +  *(_t63 - 0x10) * 4)) + 0xc);
							_t56 =  *(_t63 - 0x14);
						}
						 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
						 *((intOrPtr*)( *_t61 +  *(_t61 + 4) * 4)) = _t46;
						 *(_t61 + 4) =  *(_t61 + 4) + 1;
						 *(_t63 - 0x10) =  *(_t63 - 0x10) + 1;
					} while ( *(_t63 - 0x10) < _t56);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t61;
			}

0x010ecb67
0x010ecb71
0x010ecb76
0x010ecb79
0x010ecb7b
0x010ecb7e
0x010ecb84
0x010ecb87
0x010ecb8c
0x010ecb8f
0x010ecb91
0x010ecb98
0x010ecb9a
0x010ecb9a
0x010ecb9f
0x010ecba6
0x010ecba8
0x010ecba8
0x010ecbad
0x010ecbb0
0x010ecbb2
0x010ecbb2
0x010ecbb4
0x010ecbb9
0x010ecbbc
0x010ecbbf
0x010ecbc1
0x010ecbc5
0x010ecbef
0x010ecbef
0x010ecbc7
0x010ecbd5
0x010ecbdd
0x010ecbe1
0x010ecbe5
0x010ecbea
0x010ecbea
0x010ecbf6
0x010ecbfa
0x010ecbfd
0x010ecc00
0x010ecc03
0x010ecbb2
0x010ecc10
0x010ecc18

APIs

__EH_prolog.LIBCMT ref: 010ECB67

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 46588be827c9cf215e831b9f30227c4798041205b9352797a1736b506b3272b4
Instruction ID: 03695d4f03be75e7b0bd112fe1758073e39138f30093afe849e4abd11c2d407a
Opcode Fuzzy Hash: 46588be827c9cf215e831b9f30227c4798041205b9352797a1736b506b3272b4
Instruction Fuzzy Hash: 83217871A002068FDB10DF9DC5805AEFBF1FB98340F20846EE599A7380CBB19A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010ECA8D Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E010ECA8D(intOrPtr __ecx, void* __eflags) {
				intOrPtr* _t60;
				void* _t63;

				E011039E0(E0110604A, _t63);
				_push(__ecx);
				_t60 =  *((intOrPtr*)(_t63 + 8));
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) =  *_t60;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t60 + 4));
				 *((intOrPtr*)(__ecx + 8)) =  *((intOrPtr*)(_t60 + 8));
				E010D29BC(__ecx + 0xc, __eflags, _t60 + 0xc);
				 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
				E010ECB62(__ecx + 0x18, _t60 + 0x18); // executed
				 *((intOrPtr*)(__ecx + 0x24)) =  *((intOrPtr*)(_t60 + 0x24));
				 *((char*)(__ecx + 0x28)) =  *((intOrPtr*)(_t60 + 0x28));
				 *((char*)(__ecx + 0x29)) =  *((intOrPtr*)(_t60 + 0x29));
				 *((intOrPtr*)(__ecx + 0x2c)) =  *((intOrPtr*)(_t60 + 0x2c));
				 *(_t63 - 4) = 1;
				E010ECC1B(__ecx + 0x30, _t60 + 0x30);
				 *((intOrPtr*)(__ecx + 0x3c)) =  *((intOrPtr*)(_t60 + 0x3c));
				 *((intOrPtr*)(__ecx + 0x40)) =  *((intOrPtr*)(_t60 + 0x44 - 4));
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return __ecx;
			}

0x010eca92
0x010eca97
0x010eca9a
0x010ecaa0
0x010ecaa8
0x010ecaad
0x010ecab3
0x010ecaba
0x010ecabf
0x010ecaca
0x010ecad5
0x010ecadb
0x010ecae1
0x010ecae7
0x010ecaee
0x010ecaf2
0x010ecafd
0x010ecb06
0x010ecb09
0x010ecb0a
0x010ecb10
0x010ecb11
0x010ecb15
0x010ecb1d

APIs

__EH_prolog.LIBCMT ref: 010ECA92

Part of subcall function 010ECB62: __EH_prolog.LIBCMT ref: 010ECB67

Part of subcall function 010ECC1B: __EH_prolog.LIBCMT ref: 010ECC20

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2c386cceeb1ae7d80db46652b6f5fcd34b479ba7df01c527df3c918ec9ae3e9b
Instruction ID: ae2c6fce45384a8dfcdbf2a9f22a5bd0d32203cd6e5e19218c9e3d93f8a9023b
Opcode Fuzzy Hash: 2c386cceeb1ae7d80db46652b6f5fcd34b479ba7df01c527df3c918ec9ae3e9b
Instruction Fuzzy Hash: BF11F6B56006449FCB55CF69C1C0A96BBF4FF19214B0485AEE88ADB706D7B1EA05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 010E711F Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E010E711F(intOrPtr __ecx) {
				intOrPtr* _t40;
				char _t41;
				intOrPtr _t50;
				void* _t52;

				E011039E0(E01105726, _t52);
				_push(__ecx);
				_t50 = __ecx;
				 *((intOrPtr*)(_t52 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(_t52 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((char*)(__ecx + 0x30)) = 0;
				 *((char*)(__ecx + 0x31)) = 0;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				 *((intOrPtr*)(__ecx + 0x40)) = 0;
				 *((intOrPtr*)(__ecx + 0x48)) = 0;
				 *((intOrPtr*)(__ecx + 0x50)) = 0;
				 *((intOrPtr*)(__ecx + 0x58)) = 0;
				 *((intOrPtr*)(__ecx + 0x60)) = 0;
				 *((char*)(_t52 - 4)) = 3;
				 *((intOrPtr*)(__ecx + 0x3c)) = 0;
				 *((intOrPtr*)(__ecx + 0x44)) = 0;
				 *((intOrPtr*)(__ecx + 0x4c)) = 0;
				 *((intOrPtr*)(__ecx + 0x54)) = 0;
				 *((intOrPtr*)(__ecx + 0x5c)) = 0;
				 *((intOrPtr*)(__ecx + 0x64)) = 0;
				E010E71C5(__ecx + 0x68);
				_t40 = __ecx + 0x8c;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((char*)(_t52 - 4)) = 5;
				 *((char*)(__ecx + 0x95)) = 0;
				 *((intOrPtr*)(__ecx + 0x98)) = 0;
				_t41 = E010DD4F9(0); // executed
				 *((char*)(_t50 + 0x94)) = _t41;
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t50;
			}

0x010e7124
0x010e7129
0x010e712c
0x010e7130
0x010e7133
0x010e7135
0x010e7138
0x010e713b
0x010e713e
0x010e7141
0x010e7144
0x010e7147
0x010e714a
0x010e714d
0x010e7150
0x010e7153
0x010e7156
0x010e7159
0x010e715c
0x010e715f
0x010e7162
0x010e7165
0x010e7168
0x010e716b
0x010e716e
0x010e7174
0x010e7178
0x010e717b
0x010e717e
0x010e7181
0x010e7184
0x010e7187
0x010e718a
0x010e718f
0x010e7195
0x010e7197
0x010e719a
0x010e719e
0x010e71a4
0x010e71aa
0x010e71b2
0x010e71bc
0x010e71c4

APIs

__EH_prolog.LIBCMT ref: 010E7124

Part of subcall function 010DD4F9: __EH_prolog.LIBCMT ref: 010DD4FE
Part of subcall function 010DD4F9: GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD510
Part of subcall function 010DD4F9: OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD527
Part of subcall function 010DD4F9: LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 010DD549
Part of subcall function 010DD4F9: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD55E
Part of subcall function 010DD4F9: GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD568

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 1532160333-0
Opcode ID: 68b38c868b27d1dc1ce117079007c71f778debae6989edb2200a20470b8c9ce4
Instruction ID: 9d6e9950997362afe8575f01503a15a38b5ea8cdb784ae0583a3420189d53929
Opcode Fuzzy Hash: 68b38c868b27d1dc1ce117079007c71f778debae6989edb2200a20470b8c9ce4
Instruction Fuzzy Hash: 772125B1805B94CFC325CF6B86C068AFBF0BB19604B908A6EC1DE93B11C7B4A548CF55

Uniqueness

Uniqueness Score: -1.00%

Function 010E894E Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E010E894E(void* __ecx, void* __edx) {
				void* _t16;
				void* _t20;
				void* _t40;
				void* _t42;

				_t16 = E011039E0(E01105998, _t42);
				_t40 = __edx;
				if( *((intOrPtr*)(__edx + 4)) != 0) {
					_t16 = E010D393B(__edx);
					if(_t16 == 0) {
						_t2 = _t42 - 0x50; // -80
						E010D5C60(_t2);
						_t3 = _t42 - 0x28; // -40
						E010D28E9(_t3);
						 *(_t42 - 4) =  *(_t42 - 4) & 0x00000000;
						_t6 = _t42 - 0x18; // -24
						E010D288E(_t6, __ecx, _t40);
						 *(_t42 - 4) = 1;
						_t20 = E010D7168( *((intOrPtr*)(_t42 - 0x18)));
						_t49 = _t20;
						_push( *((intOrPtr*)(_t42 - 0x18)));
						if(_t20 == 0) {
							_t10 = _t42 - 0x50; // -80, executed
							_t20 = E010D5D00(_t10, _t49); // executed
							if(_t20 != 0) {
								_t11 = _t42 - 0x28; // -40
								_t20 = E010D2A8C(_t40, _t11);
							}
							_push( *((intOrPtr*)(_t42 - 0x18)));
						}
						_t16 = E010D1ABD(E010D1ABD(_t20),  *((intOrPtr*)(_t42 - 0x28)));
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t42 - 0xc));
				return _t16;
			}

0x010e8953
0x010e895c
0x010e8965
0x010e8969
0x010e8970
0x010e8972
0x010e8975
0x010e897a
0x010e897d
0x010e8982
0x010e8989
0x010e898c
0x010e8994
0x010e8998
0x010e899d
0x010e899f
0x010e89a2
0x010e89a4
0x010e89a7
0x010e89ae
0x010e89b0
0x010e89b6
0x010e89b6
0x010e89bb
0x010e89bb
0x010e89c6
0x010e89cc
0x010e8970
0x010e89d2
0x010e89da

APIs

__EH_prolog.LIBCMT ref: 010E8953

Part of subcall function 010D5D00: __EH_prolog.LIBCMT ref: 010D5D05

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b6f70efcb482dcee76a29075d453ea98e09ecb57b172510b8616973cc2834e05
Instruction ID: 77e6dcdd1a248dac049fe8478351c30c5b868d35a735132a6c2d5095d57b150e
Opcode Fuzzy Hash: b6f70efcb482dcee76a29075d453ea98e09ecb57b172510b8616973cc2834e05
Instruction Fuzzy Hash: 5601B171D002069ECF2AFBA8D904AEDFBF5AF64314F04405AE88173290DFB14945CA61

Uniqueness

Uniqueness Score: -1.00%

Function 010EE91D Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E010EE91D(void* __ecx) {
				void* _t17;
				intOrPtr _t20;
				void* _t22;
				signed int _t32;
				void* _t38;
				intOrPtr _t40;

				E011039E0(_t17, _t38);
				_push(__ecx);
				_t20 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x28)) +  *(_t38 + 8) * 4));
				 *((intOrPtr*)(_t38 - 0x10)) = _t40;
				_t32 =  *(_t20 + 0x3c);
				if(_t32 >= 0) {
					_push( *((intOrPtr*)(_t38 + 0xc)));
					_push(0x110c498);
					_push(_t20 + 0x44); // executed
					_t22 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0xc)) + _t32 * 4)) + 0x10))();
				} else {
					 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
					E010E0E48( *((intOrPtr*)(_t38 + 0xc)),  *((intOrPtr*)(_t20 + 4))());
					_t22 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t22;
			}

0x010ee91d
0x010ee922
0x010ee92b
0x010ee92f
0x010ee932
0x010ee937
0x010ee95d
0x010ee966
0x010ee96b
0x010ee96c
0x010ee939
0x010ee939
0x010ee944
0x010ee949
0x010ee949
0x010ee974
0x010ee97d

APIs

__EH_prolog.LIBCMT ref: 010EE91D

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dcb1e229b165e580b32ed217b1aa0b7fabb70501760f8beb27643f9143942168
Instruction ID: 7dd08bc5eab4580d67d79fd762e7b61e2f82242468e76ed05a7bdc33fae0be89
Opcode Fuzzy Hash: dcb1e229b165e580b32ed217b1aa0b7fabb70501760f8beb27643f9143942168
Instruction Fuzzy Hash: 51F06D76A14206AFC744DF99C444E9A73FAFF98318F10C559E4199B241C7B1E902CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D6177 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D6177(void* __ecx, void* __eflags) {
				void* _t20;
				void* _t31;
				void* _t36;

				_t36 = __eflags;
				E011039E0(E01104620, _t31);
				E010D5C60(_t31 - 0x44);
				E010D28E9(_t31 - 0x1c);
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				_t15 = E010D5D00(_t31 - 0x44, _t36, __ecx); // executed
				if(_t15 == 0) {
					L2:
					_t20 = 0;
				} else {
					_t20 = 1;
					_t15 =  *(_t31 - 0x24) >> 4;
					if((0x00000001 &  *(_t31 - 0x24) >> 0x00000004) != 0) {
						goto L2;
					}
				}
				E010D1ABD(_t15,  *((intOrPtr*)(_t31 - 0x1c)));
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0xc));
				return _t20;
			}

0x010d6177
0x010d617c
0x010d618b
0x010d6193
0x010d6198
0x010d61a0
0x010d61a7
0x010d61b5
0x010d61b5
0x010d61a9
0x010d61ac
0x010d61ae
0x010d61b3
0x00000000
0x00000000
0x010d61b3
0x010d61ba
0x010d61c7
0x010d61cf

APIs

__EH_prolog.LIBCMT ref: 010D617C

Part of subcall function 010D5D00: __EH_prolog.LIBCMT ref: 010D5D05

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4b35cc8904cce35611c4a29370b905f9e54eb5d1b21a1cb89f3e7685b34fa670
Instruction ID: b8887de1f01b32cd587c1decb4b3aee2b2a0de1edd099038720880cb067a0940
Opcode Fuzzy Hash: 4b35cc8904cce35611c4a29370b905f9e54eb5d1b21a1cb89f3e7685b34fa670
Instruction Fuzzy Hash: E9F0A032D412099ACB15EF68EE40BECB3B4EF36245F540155E892737D1DBB25E09CA50

Uniqueness

Uniqueness Score: -1.00%

Function 010ECA16 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E010ECA16(void* __ecx) {
				signed int _t10;
				void* _t11;
				intOrPtr _t14;
				void* _t18;
				void* _t20;

				E011039E0(E0110602A, _t20);
				_push(__ecx);
				_t18 = __ecx;
				_push(0x54);
				_t14 = E010D1A96();
				 *((intOrPtr*)(_t20 - 0x10)) = _t14;
				_t10 = 0;
				_t23 = _t14;
				 *(_t20 - 4) = 0;
				if(_t14 != 0) {
					_t10 = E010ECA8D(_t14, _t23,  *((intOrPtr*)(_t20 + 8))); // executed
				}
				 *(_t20 - 4) =  *(_t20 - 4) | 0xffffffff;
				_t11 = E010D1553(_t18, _t10);
				 *[fs:0x0] =  *((intOrPtr*)(_t20 - 0xc));
				return _t11;
			}

0x010eca1b
0x010eca20
0x010eca22
0x010eca24
0x010eca2c
0x010eca2e
0x010eca31
0x010eca33
0x010eca35
0x010eca38
0x010eca3d
0x010eca3d
0x010eca42
0x010eca49
0x010eca52
0x010eca5a

APIs

__EH_prolog.LIBCMT ref: 010ECA1B

Part of subcall function 010D1A96: malloc.MSVCRT ref: 010D1A9C
Part of subcall function 010D1A96: _CxxThrowException.MSVCRT(?,0110D020), ref: 010D1AB6

Part of subcall function 010ECA8D: __EH_prolog.LIBCMT ref: 010ECA92

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrowmalloc
String ID:
API String ID: 3744649731-0
Opcode ID: a37100fdb835df67e0ea21573cd324607d4fd0b32333b3b436f32b9a9ff02d8b
Instruction ID: 8eec88fd77b9e7a574ae1cd9ac9cfdbc3d9476ffcc7cce33792ab150e7302486
Opcode Fuzzy Hash: a37100fdb835df67e0ea21573cd324607d4fd0b32333b3b436f32b9a9ff02d8b
Instruction Fuzzy Hash: 3FE09271E00217EFDB0DEF6C89056ED7AE5AF14314F00822ED026E22C0EFF04E008650

Uniqueness

Uniqueness Score: -1.00%

Function 010D69E0 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E010D69E0(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				long _t12;
				signed int _t14;
				void** _t16;

				_t16 = __ecx;
				_push(__ecx);
				_t12 =  *0x1114090; // 0x400000
				if(_a8 > _t12) {
					_a8 = _t12;
				}
				_v8 = _v8 & 0x00000000;
				_t14 = WriteFile( *_t16, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t14 & 0xffffff00 | _t14 != 0x00000000;
			}

0x010d69e0
0x010d69e3
0x010d69e4
0x010d69ec
0x010d69ee
0x010d69ee
0x010d69f7
0x010d6a03
0x010d6a11
0x010d6a17

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 010D6A03

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: abf6146af7aed5a42f4a9e9719cb4acc12cff641887aa67268086e6b9cdc903e
Instruction ID: af6bbb5a0f3299627c4ff0226a9a008ca0dd802ae2502f612c42dcdd5b10d5f2
Opcode Fuzzy Hash: abf6146af7aed5a42f4a9e9719cb4acc12cff641887aa67268086e6b9cdc903e
Instruction Fuzzy Hash: F0E0C275A00208EBCB15CFA5D801B8EBBBAAB08754F20C169F9199A254D775AA50DF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D68D4 Relevance: 1.5, APIs: 1, Instructions: 18
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010D68D4(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				signed int _t11;

				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t11 = ReadFile( *__ecx, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t11 & 0xffffff00 | _t11 != 0x00000000;
			}

0x010d68d7
0x010d68de
0x010d68ea
0x010d68f8
0x010d68fe

APIs

ReadFile.KERNELBASE(000000FF,?,?,00000000,00000000,000000FF,?,010D6616,00000000,00004000,00000000,000000FF,?,?,?), ref: 010D68EA

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7ab0fc0cae1d3aa36b1fb32665b38b07dc748c384379288d7f284605188a9df4
Instruction ID: 2804e9af239455623368590e0fb4ced3d236fcc55e660ddf76a4facc9a6633db
Opcode Fuzzy Hash: 7ab0fc0cae1d3aa36b1fb32665b38b07dc748c384379288d7f284605188a9df4
Instruction Fuzzy Hash: A9E0EC75600208FBCB15CF90CC01F8E7BBABB49754F208058E91596154C375AA54EB50

Uniqueness

Uniqueness Score: -1.00%

Function 010DD597 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010DD597(void** __ecx) {
				void* _t3;
				signed int _t4;
				signed int _t5;
				signed int* _t8;

				_t8 = __ecx;
				_t3 =  *__ecx;
				if(_t3 != 0) {
					_t4 = FindCloseChangeNotification(_t3); // executed
					_t5 = _t4 & 0xffffff00 | _t4 != 0x00000000;
					if(_t5 != 0) {
						 *_t8 =  *_t8 & 0x00000000;
						return _t5;
					}
					return _t5;
				} else {
					return 1;
				}
			}

0x010dd598
0x010dd59a
0x010dd59e
0x010dd5a5
0x010dd5ad
0x010dd5b2
0x010dd5b4
0x00000000
0x010dd5b4
0x010dd5b8
0x010dd5a0
0x010dd5a3
0x010dd5a3

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,010DD520,?,00000000,?,?,00000000,00000000,777989A0), ref: 010DD5A5

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0615c2b75b090f3d08df697227c27d148683d8f17806a350ca487979099d3e2b
Instruction ID: ed7ef73cd7c8c36ef8476cbb73a2f3eae9a004c78a4c09e78fc59633f7fa56df
Opcode Fuzzy Hash: 0615c2b75b090f3d08df697227c27d148683d8f17806a350ca487979099d3e2b
Instruction Fuzzy Hash: 40D0123192432287EFB19E6DB4047D633DD6F50225B16449AF8D4CB2C9D765D8C29B50

Uniqueness

Uniqueness Score: -1.00%

Function 010D6497 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D6497(void** __ecx) {
				void* _t1;
				int _t3;
				signed int* _t6;

				_t6 = __ecx;
				_t1 =  *__ecx;
				if(_t1 == 0xffffffff) {
					L4:
					return 1;
				} else {
					_t3 = FindCloseChangeNotification(_t1); // executed
					if(_t3 != 0) {
						 *_t6 =  *_t6 | 0xffffffff;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x010d6498
0x010d649a
0x010d649f
0x010d64b3
0x010d64b6
0x010d64a1
0x010d64a2
0x010d64aa
0x010d64b0
0x00000000
0x010d64ac
0x010d64af
0x010d64af
0x010d64aa

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,010D63FA,000000FF,00000009,00000001), ref: 010D64A2

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 178dba388bf4e4ab97c7b37e104136675b451706ced6c70f7918fcc564224d39
Instruction ID: 62da400f88caa93164b68428091fb378f2eeeaef451544a887a66f62e7d587b6
Opcode Fuzzy Hash: 178dba388bf4e4ab97c7b37e104136675b451706ced6c70f7918fcc564224d39
Instruction Fuzzy Hash: A0D01231514621469AB55D3DF8455C237D95B02334321479AF8F1C32D5D766C8C34650

Uniqueness

Uniqueness Score: -1.00%

Function 010D4A07 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4A07(struct HINSTANCE__** __ecx) {
				struct HINSTANCE__* _t1;
				int _t3;
				signed int* _t6;

				_t6 = __ecx;
				_t1 =  *__ecx;
				if(_t1 == 0) {
					L4:
					return 1;
				} else {
					_t3 = FreeLibrary(_t1); // executed
					if(_t3 != 0) {
						 *_t6 =  *_t6 & 0x00000000;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x010d4a08
0x010d4a0a
0x010d4a0e
0x010d4a22
0x010d4a25
0x010d4a10
0x010d4a11
0x010d4a19
0x010d4a1f
0x00000000
0x010d4a1b
0x010d4a1e
0x010d4a1e
0x010d4a19

APIs

FreeLibrary.KERNELBASE(00000000,00000004,010D4A59,?,010EBBA3,00000000,00000000,?,00000000,00000000,?,?,010EBEF5,00000000,00000000,?), ref: 010D4A11

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 43f0d7e8fe17b1454f629a94db57ffd5c33b5b3a8a8ca41a7a678a449de377ff
Instruction ID: c0090337ab50154905ec98ea6059ecdc58142f0fa4126eebfc599070fd60dc52
Opcode Fuzzy Hash: 43f0d7e8fe17b1454f629a94db57ffd5c33b5b3a8a8ca41a7a678a449de377ff
Instruction Fuzzy Hash: 42D0123261432147DFB05D2DB4447D323DC9F05721F015499F590D3505E6B0CCC35798

Uniqueness

Uniqueness Score: -1.00%

Function 010D4A51 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4A51(struct HINSTANCE__** __ecx, void* __eflags, WCHAR* _a4) {
				void* _t4;
				struct HINSTANCE__* _t5;
				struct HINSTANCE__** _t10;

				_t10 = __ecx;
				_t4 = E010D4A07(__ecx);
				if(_t4 != 0) {
					_t5 = LoadLibraryW(_a4); // executed
					 *_t10 = _t5;
					return 0 | _t5 != 0x00000000;
				}
				return _t4;
			}

0x010d4a52
0x010d4a54
0x010d4a5b
0x010d4a61
0x010d4a69
0x00000000
0x010d4a70
0x010d4a73

APIs

Part of subcall function 010D4A07: FreeLibrary.KERNELBASE(00000000,00000004,010D4A59,?,010EBBA3,00000000,00000000,?,00000000,00000000,?,?,010EBEF5,00000000,00000000,?), ref: 010D4A11

LoadLibraryW.KERNELBASE(00000000,?,010EBBA3,00000000,00000000,?,00000000,00000000,?,?,010EBEF5,00000000,00000000,?), ref: 010D4A61

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 36bb61e2da1b421e6415891e4e870a3708356a3024b369e77e8d8a0840e3ca8f
Instruction ID: 528c9f360d29ea74b7fd7c619631d30f7df0a1fa25eae1530db099e99cb81a1e
Opcode Fuzzy Hash: 36bb61e2da1b421e6415891e4e870a3708356a3024b369e77e8d8a0840e3ca8f
Instruction Fuzzy Hash: A7C0127240431247CB256F3CA4004DB6BD55F15350705887A65C5D3554DF71C8D5DB55

Uniqueness

Uniqueness Score: -1.00%

Function 010D69B3 Relevance: 1.5, APIs: 1, Instructions: 9
timeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E010D69B3(void** __ecx, FILETIME* _a4, FILETIME* _a8, FILETIME* _a12) {
				signed int _t4;

				_t4 = SetFileTime( *__ecx, _a4, _a8, _a12); // executed
				asm("sbb eax, eax");
				return  ~( ~_t4);
			}

0x010d69c1
0x010d69c9
0x010d69cd

APIs

SetFileTime.KERNELBASE(?,?,?,?,010DFEB2,00000000,00000000,00000000), ref: 010D69C1

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 8707e2632cc03e12a797d9676074bdc67d1c913df2eba6dab1f3d4dd55719b53
Instruction ID: 0ad40857fc68dee4912b2e61e5e3d29b6c0fa0eb28b41a939c22d20267051bc7
Opcode Fuzzy Hash: 8707e2632cc03e12a797d9676074bdc67d1c913df2eba6dab1f3d4dd55719b53
Instruction Fuzzy Hash: DAC04C36558106FF8F124F70C804D1ABBA2BB95311F10D918B265C5475D7328024EB02

Uniqueness

Uniqueness Score: -1.00%

Function 010D6A5F Relevance: 1.5, APIs: 1, Instructions: 6
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E010D6A5F(void** __ecx) {
				signed int _t1;

				_t1 = SetEndOfFile( *__ecx); // executed
				asm("sbb eax, eax");
				return  ~( ~_t1);
			}

0x010d6a61
0x010d6a69
0x010d6a6d

APIs

SetEndOfFile.KERNELBASE(?,010D6AA4,?,?,?), ref: 010D6A61

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: fecb6ad067637128b5481a6ac9dd78e6d6cc5b14b1e7618a5a5d5142898ff94d
Instruction ID: c8607b15cc1378d6df04632eaee646356db60832ff68bf36fcdfda7b8b5a0b7a
Opcode Fuzzy Hash: fecb6ad067637128b5481a6ac9dd78e6d6cc5b14b1e7618a5a5d5142898ff94d
Instruction Fuzzy Hash: FEA00170AA901A9A8F265A34D8098247AA1AB5270672057B4A016C94A8DA624498AA01

Uniqueness

Uniqueness Score: -1.00%

Function 010FA336 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FA336(intOrPtr* __ecx) {
				int _t1;

				 *__ecx = 0x110aa18; // executed
				_t1 = SetConsoleCtrlHandler(E010FA2FA, 0); // executed
				return _t1;
			}

0x010fa33d
0x010fa343
0x010fa349

APIs

SetConsoleCtrlHandler.KERNELBASE(Function_0002A2FA,00000000,010FA322), ref: 010FA343

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ConsoleCtrlHandler
String ID:
API String ID: 1513847179-0
Opcode ID: 1804aaf7f060017e192504b031bb28a5d5595d949f6b9ead80fe347a8a46f6e0
Instruction ID: b87b2a5d107bfa53e80250a1cdc34db808e30ad86342817e8b956ca699504079
Opcode Fuzzy Hash: 1804aaf7f060017e192504b031bb28a5d5595d949f6b9ead80fe347a8a46f6e0
Instruction Fuzzy Hash: CFB01274F81300DADE1A4B5C5E0670035209B44700F10805891012E1C4C6F510818710

Uniqueness

Uniqueness Score: -1.00%

Function 010ECCB3 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E010ECCB3(void** __ecx) {
				unsigned int _t7;
				signed int _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t15;
				void* _t23;
				void** _t25;

				_t25 = __ecx;
				_t7 =  *(__ecx + 8);
				if( *((intOrPtr*)(__ecx + 4)) == _t7) {
					_t15 = (_t7 >> 2) + _t7 + 1;
					_t8 = 0x5d1745d;
					if(_t15 <= 0x5d1745d) {
						_t8 = _t15;
					}
					_push(_t8 * 0x2c); // executed
					_t10 = E010D1A96(); // executed
					_t23 = _t10;
					_t11 = _t25[1];
					if(_t11 != 0) {
						_t11 = memcpy(_t23,  *_t25, _t11 * 0x2c);
					}
					_t12 = E010D1ABD(_t11,  *_t25);
					 *_t25 = _t23;
					_t25[2] = _t15;
					return _t12;
				}
				return _t7;
			}

0x010eccb4
0x010eccb6
0x010eccbc
0x010eccc5
0x010eccc9
0x010eccd0
0x010eccd2
0x010eccd2
0x010eccd7
0x010eccd8
0x010eccdd
0x010eccdf
0x010ecce5
0x010eccee
0x010eccf3
0x010eccf8
0x010eccfe
0x010ecd00
0x00000000
0x010ecd04
0x010ecd06

APIs

memcpy.MSVCRT ref: 010ECCEE

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ca5e173376c15d21bd8f7e61b5a4c36472b3a6621385084ada06a4c97b4d14bf
Instruction ID: b862a7171986c9cd5e0ccd3a244f3e41508ddca4c00d9b38462e111c26503394
Opcode Fuzzy Hash: ca5e173376c15d21bd8f7e61b5a4c36472b3a6621385084ada06a4c97b4d14bf
Instruction Fuzzy Hash: 28F082717082025FAB34AF2DADC1867FBEDEF48614314453EE8C9C7650EA32D8858B11

Uniqueness

Uniqueness Score: -1.00%

Function 01102CCD Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E01102CCD(void** __ecx) {
				unsigned int _t7;
				signed int _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t15;
				void* _t23;
				void** _t25;

				_t25 = __ecx;
				_t7 =  *(__ecx + 8);
				if( *((intOrPtr*)(__ecx + 4)) == _t7) {
					_t15 = (_t7 >> 2) + _t7 + 1;
					_t8 = 0x3fffffff;
					if(_t15 <= 0x3fffffff) {
						_t8 = _t15;
					}
					_push(_t8 << 2); // executed
					_t10 = E010D1A96(); // executed
					_t23 = _t10;
					_t11 = _t25[1];
					if(_t11 != 0) {
						_t11 = memcpy(_t23,  *_t25, _t11 << 2);
					}
					_t12 = E010D1ABD(_t11,  *_t25);
					 *_t25 = _t23;
					_t25[2] = _t15;
					return _t12;
				}
				return _t7;
			}

0x01102cce
0x01102cd0
0x01102cd6
0x01102cdf
0x01102ce3
0x01102cea
0x01102cec
0x01102cec
0x01102cf1
0x01102cf2
0x01102cf7
0x01102cf9
0x01102cff
0x01102d08
0x01102d0d
0x01102d12
0x01102d18
0x01102d1a
0x00000000
0x01102d1e
0x01102d20

APIs

memcpy.MSVCRT ref: 01102D08

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 88255c2899e80aaee28af4e1276e3466935beabd509042203ca44ae3b5b0d35f
Instruction ID: f6f5b5bd84f2f7e518b58913790745e795b0b8dc77c4113a382844b74343fd68
Opcode Fuzzy Hash: 88255c2899e80aaee28af4e1276e3466935beabd509042203ca44ae3b5b0d35f
Instruction Fuzzy Hash: 11F082726042025FA7359E1DA880C66B3D9EF443643248A2EF8A9C3A90EB719C418B51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01100A10 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 173
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E01100A10() {
				int _v8;
				int _v12;
				struct HINSTANCE__* _v16;
				long _v20;
				int _v24;
				char _v28;
				struct _FILETIME _v36;
				struct _FILETIME _v44;
				void* _v48;
				struct _FILETIME _v52;
				intOrPtr _v56;
				char _v60;
				long _v68;
				intOrPtr _v72;
				struct _FILETIME _v84;
				intOrPtr _v88;
				intOrPtr _v116;
				void _v124;
				void* __ebp;
				int _t47;
				struct HINSTANCE__* _t51;
				struct _IO_FILE** _t72;
				void* _t74;
				struct _IO_FILE** _t76;
				struct HINSTANCE__* _t81;
				struct _IO_FILE** _t99;
				void* _t104;
				_Unknown_base(*)()* _t113;
				intOrPtr* _t120;
				intOrPtr _t123;

				_t47 = GetProcessTimes(GetCurrentProcess(),  &_v52,  &_v84,  &_v36,  &_v44);
				if(_t47 != 0) {
					E010D877D(_t47,  &_v60);
					memset( &_v124, 0, 0x28);
					_v8 = 0;
					_v12 = 0;
					_v28 = 0;
					_v24 = 0;
					_t51 = GetModuleHandleW(L"kernel32.dll");
					_v16 = _t51;
					_t113 = GetProcAddress(_t51, "K32GetProcessMemoryInfo");
					if(_t113 != 0) {
						L4:
						_v8 =  *_t113(GetCurrentProcess(),  &_v124, 0x28);
						L5:
						_t120 = GetProcAddress(_v16, "QueryProcessCycleTime");
						_t132 = _t120;
						if(_t120 != 0) {
							_v12 =  *_t120(GetCurrentProcess(),  &_v28);
						}
						_v20 = _v36.dwLowDateTime;
						_v16 = _v36.dwHighDateTime;
						_v68 = _v44.dwLowDateTime;
						_t123 = _v44.dwHighDateTime;
						_v72 = _v56;
						_t111 = 0;
						_t87 = _v72;
						_t116 = _v60 - _v52.dwLowDateTime;
						asm("sbb ebx, ecx");
						E01100C38(0, _t132, _v20, _v16, _v60 - _v52.dwLowDateTime, _v72);
						_t133 = _v12;
						if(_v12 != 0) {
							_t72 =  *0x11146fc; // 0x1114440
							fputs(" ",  *_t72);
							_t74 = E01103B80(_v28, _v24, 0xf4240, 0);
							_push(0);
							_push(_t74);
							_t111 = 0x20;
							_t104 = 0x16;
							E01100BE8(_t104, 0x20, _t133);
							_t76 =  *0x11146fc; // 0x1114440
							fputs(" MCycles",  *_t76);
						}
						E01100C38(_t111, _t133, _v68, _t123, _t116, _t87);
						asm("adc esi, [ebp-0xc]");
						E01100C38(_t111, _t133, _v68 + _v20, _t123, _t116, _t87);
						_t134 = _v8;
						if(_v8 != 0) {
							_push(0);
							_push(_v88);
							E01100D5C("Virtual ", _t134);
						}
						E01100C38(_t111, _t134, _t116, _t87, _t116, _t87);
						_t135 = _v8;
						if(_v8 != 0) {
							_push(0);
							_push(_v116);
							E01100D5C("Physical", _t135);
						}
						_t99 =  *0x11146fc; // 0x1114440
						return E010D1CAE(_t99);
					}
					_t81 = LoadLibraryW(L"Psapi.dll");
					if(_t81 == 0) {
						goto L5;
					}
					_t113 = GetProcAddress(_t81, "GetProcessMemoryInfo");
					if(_t113 == 0) {
						goto L5;
					}
					goto L4;
				}
				return _t47;
			}

0x01100a2d
0x01100a35
0x01100a41
0x01100a4f
0x01100a57
0x01100a5a
0x01100a5d
0x01100a65
0x01100a68
0x01100a74
0x01100a7f
0x01100a83
0x01100aa2
0x01100ab1
0x01100ab4
0x01100abe
0x01100ac0
0x01100ac2
0x01100ad1
0x01100ad1
0x01100ae5
0x01100aeb
0x01100afa
0x01100afd
0x01100b0d
0x01100b15
0x01100b17
0x01100b19
0x01100b1b
0x01100b2a
0x01100b2f
0x01100b33
0x01100b35
0x01100b41
0x01100b56
0x01100b5b
0x01100b5c
0x01100b5f
0x01100b61
0x01100b62
0x01100b67
0x01100b73
0x01100b7a
0x01100b86
0x01100b98
0x01100b9d
0x01100ba4
0x01100ba7
0x01100ba9
0x01100baf
0x01100bb2
0x01100bb2
0x01100bc0
0x01100bc5
0x01100bc8
0x01100bca
0x01100bd0
0x01100bd3
0x01100bd3
0x01100bd8
0x00000000
0x01100be5
0x01100a8a
0x01100a92
0x00000000
0x00000000
0x01100a9c
0x01100aa0
0x00000000
0x00000000
0x00000000
0x01100aa0
0x01100be7

APIs

GetCurrentProcess.KERNEL32(0110C698,?,00000000,?), ref: 01100A26
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,010FFAE7,00000000), ref: 01100A2D

Part of subcall function 010D877D: GetSystemTimeAsFileTime.KERNEL32(?,01100A46,00000000,00000000,777989A0), ref: 010D877E

memset.MSVCRT ref: 01100A4F
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,00000000,777989A0), ref: 01100A68
GetProcAddress.KERNEL32(00000000,K32GetProcessMemoryInfo), ref: 01100A7D
LoadLibraryW.KERNEL32(Psapi.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,010FFAE7,00000000), ref: 01100A8A
GetProcAddress.KERNEL32(00000000,GetProcessMemoryInfo), ref: 01100A9A
GetCurrentProcess.KERNEL32(?,00000028,?,?,?,?,?,?,?,?,?,?,?,?,?,010FFAE7), ref: 01100AA8
GetProcAddress.KERNEL32(?,QueryProcessCycleTime), ref: 01100ABC
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,010FFAE7,00000000), ref: 01100AC8
fputs.MSVCRT ref: 01100B41
__aulldiv.LIBCMT ref: 01100B56
fputs.MSVCRT ref: 01100B73

Strings

GetProcessMemoryInfo, xrefs: 01100A94
Global , xrefs: 01100BBB
Virtual , xrefs: 01100BAA
kernel32.dll, xrefs: 01100A60
Physical, xrefs: 01100BCB
Process, xrefs: 01100B8E
User , xrefs: 01100B7E
MCycles, xrefs: 01100B6E
QueryProcessCycleTime, xrefs: 01100AB4
K32GetProcessMemoryInfo, xrefs: 01100A77
F}w, xrefs: 01100B3A, 01100B6C
Psapi.dll, xrefs: 01100A85
Kernel , xrefs: 01100B1D

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Process$AddressCurrentProc$Timefputs$FileHandleLibraryLoadModuleSystemTimes__aulldivmemset
String ID: F}w$ MCycles$GetProcessMemoryInfo$Global $K32GetProcessMemoryInfo$Kernel $Physical$Process$Psapi.dll$QueryProcessCycleTime$User $Virtual $kernel32.dll
API String ID: 2419529047-467025383
Opcode ID: ca5e9192a9127ead0c251378e342e388073b613d29eb3285894d1c00d406ddaa
Instruction ID: 0ff1c376fde3362a54e7f7bf3cd5bda8799817354838547279008a5b891d10fd
Opcode Fuzzy Hash: ca5e9192a9127ead0c251378e342e388073b613d29eb3285894d1c00d406ddaa
Instruction Fuzzy Hash: 5E514F71E10219EFDB1AEFE5DC84E9EBBB9FF4C644B10856AF611B3184DBB059408B60

Uniqueness

Uniqueness Score: -1.00%

Function 010D7DF4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 76
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E010D7DF4(WCHAR* __ecx, signed int* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				signed int _v5;
				WCHAR* _v12;
				long _v16;
				long _v20;
				long _v24;
				long _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				char _v52;
				_Unknown_base(*)()* _t37;
				signed int _t43;
				void* _t49;
				intOrPtr* _t54;
				signed int _t60;
				intOrPtr* _t61;
				signed int* _t62;

				_v5 = _v5 & 0x00000000;
				_t62 = __edx;
				_v12 = __ecx;
				_t37 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetDiskFreeSpaceExW");
				_t61 = _a8;
				_t54 = _a4;
				if(_t37 != 0) {
					_t49 =  *_t37(_v12,  &_v52,  &_v36,  &_v44);
					 *_t54 = _v36;
					 *(_t54 + 4) = _v32;
					 *_t61 = _v44;
					_v5 = _t49 != 0;
					 *(_t61 + 4) = _v40;
				}
				if(GetDiskFreeSpaceW(_v12,  &_v16,  &_v20,  &_v28,  &_v24) != 0) {
					_t43 = _v16;
					_t60 = _t43 * _v20 >> 0x20;
					 *_t62 = _t43 * _v20;
					_t62[1] = _t60;
					if(_v5 == 0) {
						 *_t54 = E01103D00(_v24, 0,  *_t62, _t60);
						 *(_t54 + 4) = _t60;
						 *_t61 = E01103D00(_v28, 0,  *_t62, _t62[1]);
						 *(_t61 + 4) = _t60;
					}
					return 1;
				} else {
					return 0;
				}
			}

0x010d7dfa
0x010d7e06
0x010d7e08
0x010d7e17
0x010d7e1d
0x010d7e20
0x010d7e25
0x010d7e36
0x010d7e3d
0x010d7e42
0x010d7e48
0x010d7e4d
0x010d7e51
0x010d7e51
0x010d7e6f
0x010d7e75
0x010d7e78
0x010d7e7f
0x010d7e81
0x010d7e84
0x010d7e93
0x010d7e95
0x010d7ea7
0x010d7ea9
0x010d7ea9
0x00000000
0x010d7e71
0x00000000
0x010d7e71

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,74651190,000000FF,00000000,?,?,?,?,?,?,?,?,?,010D6787,00000001), ref: 010D7E10
GetProcAddress.KERNEL32(00000000), ref: 010D7E17
GetDiskFreeSpaceW.KERNEL32(00000001,010D6787,?,?,?,?,?,?,?,?,?,?,?,?,010D6787,00000001), ref: 010D7E67

Strings

GetDiskFreeSpaceExW, xrefs: 010D7E01
Net, xrefs: 010D7E17
kernel32.dll, xrefs: 010D7E0B

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExW$kernel32.dll$Net
API String ID: 1197914913-2965126902
Opcode ID: f8592728ac631dce4ceac57ed8595d63a3e4376f14939d797dbfa75072e9adff
Instruction ID: 1e5652613f457e37990f863fc3121220c7f188157d0d06ba688a76417ad7c364
Opcode Fuzzy Hash: f8592728ac631dce4ceac57ed8595d63a3e4376f14939d797dbfa75072e9adff
Instruction Fuzzy Hash: F32115B2D04209AFDB16DFA8C845BEEBBF8FF48304F10806AE555A7250E770A945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010D66D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D66D0(void** __ecx, void* __edi, long _a4) {
				char _v5;
				short _v10;
				long _v12;
				short _v14;
				char _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void _v48;
				char _v56;
				char _v64;
				void* _v84;
				void* _v88;
				void _v96;
				void* _v108;
				void* _v112;
				void _v136;
				void* _t71;
				void* _t78;
				long _t101;
				signed int _t103;
				void** _t108;

				_t108 = __ecx;
				_t71 =  *__ecx;
				__ecx[2] = 0;
				__ecx[1] = 0;
				__ecx[3] = 0;
				if(_t71 == 0xffffffff || __ecx[1] == 0) {
					L23:
					return _t71;
				} else {
					_v5 = 1;
					_t71 = DeviceIoControl(_t71, 0x74004, 0, 0,  &_v96, 0x20,  &_v12, 0);
					if(_t71 != 0) {
						_t108[2] = _v88;
						_t108[3] = _v84;
						_t71 = _a4;
						_t101 = 0x5c;
						_t108[1] = 1;
						_v5 = 0;
						if( *_t71 == _t101 &&  *((intOrPtr*)(_t71 + 2)) == _t101 &&  *((short*)(_t71 + 4)) == 0x2e &&  *((intOrPtr*)(_t71 + 6)) == _t101 &&  *((short*)(_t71 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t71 + 0xc)) == 0) {
							_v12 = _t101;
							_v16 =  *((intOrPtr*)(_t71 + 8));
							_v14 = 0x3a;
							_v10 = 0;
							_t71 = E010D7DF4( &_v16,  &_v64,  &_v24,  &_v56);
							if(_t71 == 0) {
								_v5 = 1;
							} else {
								_t108[2] = _v24;
								_t71 = _v20;
								_t108[3] = _t71;
							}
						}
					}
					if(_t108[1] == 0) {
						_t78 = DeviceIoControl( *_t108, 0x700a0, 0, 0,  &_v136, 0x28,  &_a4, 0) & 0xffffff00 | _t77 != 0x00000000;
						_t108[1] = _t78;
						if(_t78 == 0) {
							_t71 = DeviceIoControl( *_t108, 0x70000, 0, 0,  &_v48, 0x18,  &_a4, 0) & 0xffffff00 | _t81 != 0x00000000;
							_t108[1] = _t71;
							if(_t71 == 0) {
								_t71 = DeviceIoControl( *_t108, 0x2404c, 0, 0,  &_v48, 0x18,  &_a4, 0) & 0xffffff00 | _t87 != 0x00000000;
								_t108[1] = _t71;
							}
							if(_t108[1] != 0) {
								_t82 = _v28;
								_t103 = _v28 * _v32 >> 0x20;
								_t71 = E01103D00(E01103D00(_t82 * _v32, _t103, _v36, 0), _t103, _v48, _v44);
								_t108[2] = _t71;
								_t108[3] = _t103;
							}
						} else {
							_t108[2] = _v112;
							_t71 = _v108;
							_t108[3] = _t71;
						}
					}
					if(_v5 == 0 || _t108[1] == 0) {
						goto L23;
					} else {
						_t71 = _t108[2] | _t108[3];
						if(_t71 == 0) {
							goto L23;
						}
						E010D65C4(_t108);
						return E010D65B1();
					}
				}
			}

0x010d66db
0x010d66df
0x010d66e1
0x010d66e7
0x010d66ea
0x010d66ed
0x010d6866
0x010d6866
0x010d66fc
0x010d6716
0x010d671a
0x010d671e
0x010d6725
0x010d672b
0x010d672e
0x010d6731
0x010d6732
0x010d6739
0x010d673c
0x010d6762
0x010d6766
0x010d6778
0x010d677e
0x010d6782
0x010d6789
0x010d6799
0x010d678b
0x010d678e
0x010d6791
0x010d6794
0x010d6794
0x010d6789
0x010d673c
0x010d67a0
0x010d67c1
0x010d67c6
0x010d67c9
0x010d67f1
0x010d67f6
0x010d67f9
0x010d6813
0x010d6816
0x010d6816
0x010d681c
0x010d681e
0x010d6822
0x010d6837
0x010d683c
0x010d683f
0x010d683f
0x010d67cb
0x010d67ce
0x010d67d1
0x010d67d4
0x010d67d4
0x010d67c9
0x010d6846
0x00000000
0x010d684d
0x010d6850
0x010d6853
0x00000000
0x00000000
0x010d6857
0x00000000
0x010d685e
0x010d6846

APIs

DeviceIoControl.KERNEL32 ref: 010D671A
DeviceIoControl.KERNEL32 ref: 010D67BD
DeviceIoControl.KERNEL32 ref: 010D67ED
DeviceIoControl.KERNEL32 ref: 010D680F

Part of subcall function 010D7DF4: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,74651190,000000FF,00000000,?,?,?,?,?,?,?,?,?,010D6787,00000001), ref: 010D7E10
Part of subcall function 010D7DF4: GetProcAddress.KERNEL32(00000000), ref: 010D7E17
Part of subcall function 010D7DF4: GetDiskFreeSpaceW.KERNEL32(00000001,010D6787,?,?,?,?,?,?,?,?,?,?,?,?,010D6787,00000001), ref: 010D7E67

Strings

:, xrefs: 010D6778

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ControlDevice$AddressDiskFreeHandleModuleProcSpace
String ID: :
API String ID: 4250411929-336475711
Opcode ID: 769d25c721ad67067b3b6c40689b28b0356cac17cb9d8796d1826fd7dc70a3e0
Instruction ID: 4705ae58ad6dc5b416c3c28da1ff0eee82fe35bca8270abe3764e9980227f689
Opcode Fuzzy Hash: 769d25c721ad67067b3b6c40689b28b0356cac17cb9d8796d1826fd7dc70a3e0
Instruction Fuzzy Hash: 6251B5B5900749AEEB21DFE8C881EEFBBFCEF04310F05C55AE19597241E672A944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010D176C Relevance: 6.3, APIs: 4, Instructions: 259
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E010D176C(void* __ecx, intOrPtr __edx) {
				signed int _t96;
				char _t99;
				signed int _t103;
				signed int _t105;
				signed int* _t111;
				signed int _t114;
				intOrPtr _t115;
				signed short* _t120;
				signed int _t124;
				unsigned int _t128;
				signed int _t130;
				char _t134;
				signed int* _t136;
				signed int** _t150;
				signed int** _t158;
				intOrPtr _t169;
				signed int _t174;
				signed int* _t179;
				signed int* _t180;
				void* _t188;
				void* _t189;
				signed int* _t191;
				signed int _t194;
				signed int _t195;
				void* _t196;

				E011039E0(E01104194, _t196);
				 *(_t196 - 0x50) =  *(_t196 - 0x50) | 0xffffffff;
				_t191 =  *(_t196 + 0xc);
				 *((intOrPtr*)(_t196 - 0x10)) = __edx;
				 *_t191 = 0;
				 *((intOrPtr*)(_t196 - 4)) = 0;
				if(E010D68C6(__ecx) != 0) {
					_t96 = E010D64B7(_t196 - 0x50, _t196 - 0x1c);
					__eflags = _t96;
					if(_t96 == 0) {
						goto L1;
					} else {
						__eflags =  *(_t196 - 0x18);
						if( *(_t196 - 0x18) > 0) {
							goto L2;
						} else {
							__eflags =  *(_t196 - 0x1c) - 0x7fffffe0;
							if( *(_t196 - 0x1c) >= 0x7fffffe0) {
								goto L2;
							} else {
								E010D28E9(_t196 - 0x28);
								 *((char*)(_t196 - 4)) = 1;
								__eflags =  *((intOrPtr*)(_t196 + 8)) - 0x4b0;
								if( *((intOrPtr*)(_t196 + 8)) == 0x4b0) {
									L24:
									_t174 =  *(_t196 - 0x1c);
									_t103 = _t174 & 0x00000001;
									__eflags = _t103;
									if(_t103 == 0) {
										_t136 = 0;
										__eflags = _t174;
										 *(_t196 + 0xc) = 0;
										if(_t174 != 0) {
											_t124 = _t103 | 0xffffffff;
											__eflags = _t174 - _t124;
											if(_t174 <= _t124) {
												_t124 = _t174;
											}
											_push(_t124);
											_t136 = E010D1A96();
											 *(_t196 + 0xc) = _t136;
										}
										 *((char*)(_t196 - 4)) = 2;
										_t105 = E010D6923(_t196 - 0x50, _t136,  *(_t196 - 0x1c), _t196 - 0x14);
										__eflags = _t105;
										if(_t105 != 0) {
											_t106 =  *(_t196 - 0x14);
											__eflags =  *(_t196 - 0x14) -  *(_t196 - 0x1c);
											if( *(_t196 - 0x14) !=  *(_t196 - 0x1c)) {
												goto L32;
											} else {
												__eflags = 0 -  *(_t196 - 0x18);
												if(0 !=  *(_t196 - 0x18)) {
													goto L32;
												} else {
													E010D6497(_t196 - 0x50);
													_t194 =  *(_t196 - 0x1c) >> 1;
													__eflags = _t194 -  *((intOrPtr*)(_t196 - 0x20));
													if(_t194 >  *((intOrPtr*)(_t196 - 0x20))) {
														E010D26A3(_t196 - 0x28, _t194);
													}
													_t150 =  *(_t196 - 0x28);
													__eflags =  *((intOrPtr*)(_t196 + 8)) - 0x4b0;
													 *(_t196 + 0xc) = _t150;
													if( *((intOrPtr*)(_t196 + 8)) != 0x4b0) {
														_t188 = 0;
														__eflags = _t194;
														if(_t194 <= 0) {
															goto L47;
														} else {
															_t106 = _t136;
															while(1) {
																_t179 =  *_t106;
																__eflags = _t179;
																if(_t179 == 0) {
																	goto L32;
																}
																_t188 = _t188 + 1;
																 *_t150 = _t179;
																_t106 =  &(_t106[0]);
																_t150 =  &(_t150[0]);
																__eflags = _t188 - _t194;
																if(_t188 < _t194) {
																	continue;
																} else {
																	goto L47;
																}
																goto L63;
															}
															goto L32;
														}
													} else {
														_t189 = 0;
														__eflags = _t194;
														if(_t194 <= 0) {
															L47:
															_t111 =  *(_t196 + 0xc);
															 *((char*)(_t196 - 4)) = 1;
															_push(_t136);
															_t67 = _t111 + _t194 * 2;
															 *_t67 =  *(_t111 + _t194 * 2) & 0x00000000;
															__eflags =  *_t67;
															 *(_t196 - 0x24) = _t194;
															goto L48;
														} else {
															_t180 = _t136;
															while(1) {
																_t106 =  *_t180;
																__eflags = _t106;
																if(_t106 == 0) {
																	goto L32;
																}
																_t189 = _t189 + 1;
																 *_t150 = _t106;
																_t180 =  &(_t180[0]);
																_t150 =  &(_t150[0]);
																__eflags = _t189 - _t194;
																if(_t189 < _t194) {
																	continue;
																} else {
																	goto L47;
																}
																goto L63;
															}
															goto L32;
														}
													}
												}
											}
										} else {
											 *_t191 = GetLastError();
											L32:
											_push(_t136);
											goto L20;
										}
									} else {
										E010D1ABD(_t103,  *(_t196 - 0x28));
										goto L21;
									}
								} else {
									__eflags =  *((intOrPtr*)(_t196 + 8)) - 0x4b1;
									if( *((intOrPtr*)(_t196 + 8)) == 0x4b1) {
										goto L24;
									} else {
										E010D232F(_t196 - 0x34);
										_t128 =  *(_t196 - 0x1c);
										 *((char*)(_t196 - 4)) = 3;
										__eflags = _t128 -  *((intOrPtr*)(_t196 - 0x2c));
										if(_t128 >  *((intOrPtr*)(_t196 - 0x2c))) {
											E010D2285(_t196 - 0x34, _t128);
										}
										_t130 = E010D6923(_t196 - 0x50,  *(_t196 - 0x34),  *(_t196 - 0x1c), _t196 + 0xc);
										__eflags = _t130;
										if(_t130 != 0) {
											_t106 =  *(_t196 + 0xc);
											__eflags =  *(_t196 + 0xc) -  *(_t196 - 0x1c);
											if( *(_t196 + 0xc) !=  *(_t196 - 0x1c)) {
												goto L19;
											} else {
												__eflags = 0 -  *(_t196 - 0x18);
												if(0 !=  *(_t196 - 0x18)) {
													goto L19;
												} else {
													E010D6497(_t196 - 0x50);
													_t106 =  *(_t196 - 0x34);
													 *( *(_t196 + 0xc) + _t106) =  *( *(_t196 + 0xc) + _t106) & 0x00000000;
													_t169 = 0;
													__eflags =  *_t106;
													if( *_t106 != 0) {
														do {
															_t169 = _t169 + 1;
															__eflags =  *((char*)(_t169 + _t106));
														} while ( *((char*)(_t169 + _t106)) != 0);
													}
													__eflags = _t169 -  *(_t196 + 0xc);
													 *((intOrPtr*)(_t196 - 0x30)) = _t169;
													if(_t169 !=  *(_t196 + 0xc)) {
														goto L19;
													} else {
														__eflags =  *((intOrPtr*)(_t196 + 8)) - 0xfde9;
														if( *((intOrPtr*)(_t196 + 8)) != 0xfde9) {
															_t111 = E010D3087(_t196 - 0x28, _t196 - 0x34,  *((intOrPtr*)(_t196 + 8)));
															goto L23;
														} else {
															_t111 = E010D33BD(_t196 - 0x34, _t196 - 0x28);
															__eflags = _t111;
															if(_t111 != 0) {
																L23:
																_push( *(_t196 - 0x34));
																 *((char*)(_t196 - 4)) = 1;
																L48:
																E010D1ABD(_t111);
																E010D28E9(_t196 - 0x40);
																_t114 =  *(_t196 - 0x24);
																_t195 = 0;
																__eflags = _t114;
																 *((char*)(_t196 - 4)) = 4;
																if(_t114 > 0) {
																	_t158 =  *(_t196 - 0x28);
																	while(1) {
																		__eflags =  *_t158 - 0xfeff;
																		if( *_t158 != 0xfeff) {
																			goto L52;
																		}
																		_t195 = _t195 + 1;
																		_t158 =  &(_t158[0]);
																		__eflags = _t195 - _t114;
																		if(_t195 < _t114) {
																			continue;
																		}
																		goto L52;
																	}
																}
																L52:
																__eflags = _t195 - _t114;
																if(__eflags >= 0) {
																	L60:
																	_t115 = E010D1A47( *((intOrPtr*)(_t196 - 0x10)), _t196 - 0x40, __eflags);
																	_t134 = 1;
																} else {
																	while(1) {
																		_t115 =  *((intOrPtr*)( *(_t196 - 0x28) + _t195 * 2));
																		__eflags = _t115 - 0xfeff;
																		if(_t115 == 0xfeff) {
																			break;
																		}
																		__eflags = _t115 - 0xfffe;
																		if(_t115 == 0xfffe) {
																			break;
																		} else {
																			__eflags = _t115 - 0xa;
																			if(__eflags == 0) {
																				L58:
																				E010D1A47( *((intOrPtr*)(_t196 - 0x10)), _t196 - 0x40, __eflags);
																				_t120 =  *(_t196 - 0x40);
																				 *(_t196 - 0x3c) =  *(_t196 - 0x3c) & 0x00000000;
																				 *_t120 =  *_t120 & 0x00000000;
																				__eflags =  *_t120;
																			} else {
																				__eflags = _t115 - 0xd;
																				if(__eflags == 0) {
																					goto L58;
																				} else {
																					E010D1089(_t196 - 0x40, _t115);
																				}
																			}
																			_t195 = _t195 + 1;
																			__eflags = _t195 -  *(_t196 - 0x24);
																			if(__eflags < 0) {
																				continue;
																			} else {
																				goto L60;
																			}
																		}
																		goto L61;
																	}
																	_t134 = 0;
																}
																L61:
																E010D1ABD(E010D1ABD(_t115,  *(_t196 - 0x40)),  *(_t196 - 0x28));
																goto L62;
															} else {
																goto L19;
															}
														}
													}
												}
											}
										} else {
											 *_t191 = GetLastError();
											L19:
											_push( *(_t196 - 0x34));
											L20:
											E010D1ABD(E010D1ABD(_t106),  *(_t196 - 0x28));
											L21:
											E010D6497(_t196 - 0x50);
											_t99 = 0;
										}
									}
								}
							}
						}
					}
				} else {
					L1:
					 *_t191 = GetLastError();
					L2:
					_t134 = 0;
					L62:
					E010D6497(_t196 - 0x50);
					_t99 = _t134;
				}
				L63:
				 *[fs:0x0] =  *((intOrPtr*)(_t196 - 0xc));
				return _t99;
			}

0x010d1771
0x010d1779
0x010d177f
0x010d1785
0x010d1788
0x010d178e
0x010d1798
0x010d17b0
0x010d17b5
0x010d17b7
0x00000000
0x010d17b9
0x010d17b9
0x010d17bc
0x00000000
0x010d17be
0x010d17be
0x010d17c5
0x00000000
0x010d17c7
0x010d17ca
0x010d17d4
0x010d17d8
0x010d17db
0x010d18b4
0x010d18b4
0x010d18be
0x010d18be
0x010d18c0
0x010d18cc
0x010d18ce
0x010d18d0
0x010d18d3
0x010d18d5
0x010d18d8
0x010d18da
0x010d18dc
0x010d18dc
0x010d18de
0x010d18e4
0x010d18e7
0x010d18e7
0x010d18f1
0x010d18f9
0x010d18fe
0x010d1900
0x010d1910
0x010d1915
0x010d1918
0x00000000
0x010d191a
0x010d191a
0x010d191d
0x00000000
0x010d191f
0x010d1922
0x010d192a
0x010d192c
0x010d192f
0x010d1935
0x010d1935
0x010d193a
0x010d193d
0x010d1940
0x010d1943
0x010d1963
0x010d1965
0x010d1967
0x00000000
0x010d1969
0x010d1969
0x010d196b
0x010d1970
0x010d1972
0x010d1975
0x00000000
0x00000000
0x010d1977
0x010d1979
0x010d197c
0x010d197e
0x010d197f
0x010d1981
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010d1981
0x00000000
0x010d196b
0x010d1945
0x010d1945
0x010d1947
0x010d1949
0x010d1983
0x010d1983
0x010d1986
0x010d198a
0x010d198b
0x010d198b
0x010d198b
0x010d1990
0x00000000
0x010d194b
0x010d194b
0x010d194d
0x010d194d
0x010d1950
0x010d1953
0x00000000
0x00000000
0x010d1955
0x010d1957
0x010d195a
0x010d195c
0x010d195d
0x010d195f
0x00000000
0x010d1961
0x00000000
0x010d1961
0x00000000
0x010d195f
0x00000000
0x010d194d
0x010d1949
0x010d1943
0x010d191d
0x010d1902
0x010d1908
0x010d190a
0x010d190a
0x00000000
0x010d190a
0x010d18c2
0x010d18c5
0x00000000
0x010d18c5
0x010d17e1
0x010d17e1
0x010d17e8
0x00000000
0x010d17ee
0x010d17f1
0x010d17f6
0x010d17f9
0x010d17fd
0x010d1800
0x010d1806
0x010d1806
0x010d1818
0x010d181d
0x010d181f
0x010d182b
0x010d1830
0x010d1833
0x00000000
0x010d1835
0x010d1835
0x010d1838
0x00000000
0x010d183a
0x010d183d
0x010d1842
0x010d1848
0x010d184c
0x010d184e
0x010d1850
0x010d1852
0x010d1852
0x010d1853
0x010d1853
0x010d1852
0x010d1859
0x010d185c
0x010d185f
0x00000000
0x010d1861
0x010d1861
0x010d1868
0x010d18a3
0x00000000
0x010d186a
0x010d1870
0x010d1875
0x010d1877
0x010d18a8
0x010d18a8
0x010d18ab
0x010d1993
0x010d1993
0x010d199c
0x010d19a1
0x010d19a4
0x010d19a6
0x010d19a8
0x010d19ac
0x010d19ae
0x010d19b1
0x010d19b1
0x010d19b6
0x00000000
0x00000000
0x010d19b8
0x010d19ba
0x010d19bb
0x010d19bd
0x00000000
0x00000000
0x00000000
0x010d19bd
0x010d19b1
0x010d19bf
0x010d19bf
0x010d19c1
0x010d1a09
0x010d1a0f
0x010d1a14
0x010d19c3
0x010d19c3
0x010d19c6
0x010d19ca
0x010d19ce
0x00000000
0x00000000
0x010d19d0
0x010d19d4
0x00000000
0x010d19d6
0x010d19d6
0x010d19da
0x010d19ed
0x010d19f3
0x010d19f8
0x010d19fb
0x010d19ff
0x010d19ff
0x010d19dc
0x010d19dc
0x010d19e0
0x00000000
0x010d19e2
0x010d19e6
0x010d19e6
0x010d19e0
0x010d1a03
0x010d1a04
0x010d1a07
0x00000000
0x00000000
0x00000000
0x00000000
0x010d1a07
0x00000000
0x010d19d4
0x010d1a43
0x010d1a43
0x010d1a16
0x010d1a21
0x00000000
0x00000000
0x00000000
0x00000000
0x010d1877
0x010d1868
0x010d185f
0x010d1838
0x010d1821
0x010d1827
0x010d1879
0x010d1879
0x010d187c
0x010d1884
0x010d188a
0x010d188e
0x010d1893
0x010d1893
0x010d181f
0x010d17e8
0x010d17db
0x010d17c5
0x010d17bc
0x010d179a
0x010d179a
0x010d17a0
0x010d17a2
0x010d17a2
0x010d1a28
0x010d1a2b
0x010d1a30
0x010d1a30
0x010d1a32
0x010d1a38
0x010d1a40

APIs

__EH_prolog.LIBCMT ref: 010D1771
GetLastError.KERNEL32(00000000,?,00000001,00000000), ref: 010D179A

Part of subcall function 010D6497: FindCloseChangeNotification.KERNELBASE(00000000,?,010D63FA,000000FF,00000009,00000001), ref: 010D64A2

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

GetLastError.KERNEL32(?,7FFFFFE0,?,00000000,?,00000001,00000000), ref: 010D1821

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorLast$ChangeCloseFindH_prologNotificationfree
String ID:
API String ID: 1885295778-0
Opcode ID: 755cd232f7c62a74590782fee3133c2fe412f7b9f2853f41c9a031dbc36f3812
Instruction ID: 94e3e4b3ba4458302c88a58c7d246c04ac90a2c0f658fe8a93c347ebe36274ae
Opcode Fuzzy Hash: 755cd232f7c62a74590782fee3133c2fe412f7b9f2853f41c9a031dbc36f3812
Instruction Fuzzy Hash: 1E91AB31D0434ADADF15EFA8C881AEDBBF1BF14314F1480A9E8D26B251DF715A46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010D6306 Relevance: 4.6, APIs: 3, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E010D6306(intOrPtr __ecx, void* __eflags) {
				signed int _t30;
				long _t31;
				intOrPtr _t36;
				long _t45;
				long _t47;
				intOrPtr _t48;
				long _t62;
				WCHAR* _t65;
				void* _t66;

				E011039E0(E01104664, _t66);
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				E010EC900(__ecx);
				_t45 = GetLogicalDriveStringsW(0, 0);
				 *(_t66 - 0x14) = _t45;
				if(_t45 == 0) {
					L13:
					_t30 = 0;
				} else {
					_t31 = 0x7fffffff;
					if(_t45 <= 0x7fffffff) {
						_t31 = _t45;
					}
					_push(_t31 + _t31);
					_t65 = E010D1A96();
					 *(_t66 - 0x20) = _t65;
					 *(_t66 - 4) =  *(_t66 - 4) & 0x00000000;
					_t47 = GetLogicalDriveStringsW(_t45, _t65);
					_t62 = 0;
					 *((intOrPtr*)(_t66 - 0x10)) = _t47;
					if(_t47 == 0 || _t47 >  *(_t66 - 0x14)) {
						E010D1ABD(_t34, _t65);
						goto L13;
					} else {
						_t36 = E010D28E9(_t66 - 0x2c);
						 *(_t66 - 4) = 1;
						 *(_t66 - 0x14) = 0;
						if(_t47 > 0) {
							_t36 = 0;
							_t48 = 2;
							do {
								if( *((short*)(_t65 + _t48 - 2)) == 0) {
									E010D2A28(_t66 - 0x2c, _t36 + _t65);
									_t15 = _t62 + 1; // 0x1
									 *(_t66 - 0x14) = _t15;
									_push(_t66 - 0x2c);
									 *((intOrPtr*)(_t66 - 0x1c)) = _t48;
									E010D150C( *((intOrPtr*)(_t66 - 0x18)));
									_t36 = _t48;
								}
								_t62 = _t62 + 1;
								_t48 = _t48 + 2;
							} while (_t62 <  *((intOrPtr*)(_t66 - 0x10)));
							_t47 =  *((intOrPtr*)(_t66 - 0x10));
						}
						_t30 = E010D1ABD(E010D1ABD(_t36,  *((intOrPtr*)(_t66 - 0x2c))), _t65) & 0xffffff00 |  *(_t66 - 0x14) == _t47;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t66 - 0xc));
				return _t30;
			}

0x010d630b
0x010d6316
0x010d6319
0x010d632a
0x010d632e
0x010d6331
0x010d63d4
0x010d63d4
0x010d6337
0x010d6337
0x010d633e
0x010d6340
0x010d6340
0x010d6344
0x010d634a
0x010d634d
0x010d6350
0x010d6358
0x010d635a
0x010d635e
0x010d6361
0x010d63ce
0x00000000
0x010d6368
0x010d636b
0x010d6372
0x010d6376
0x010d6379
0x010d637d
0x010d637f
0x010d6380
0x010d6386
0x010d638e
0x010d6396
0x010d6399
0x010d639f
0x010d63a0
0x010d63a3
0x010d63a8
0x010d63a8
0x010d63aa
0x010d63ac
0x010d63ad
0x010d63b2
0x010d63b2
0x010d63c8
0x010d63c8
0x010d6361
0x010d63dc
0x010d63e4

APIs

__EH_prolog.LIBCMT ref: 010D630B
GetLogicalDriveStringsW.KERNEL32(00000000,00000000,?,?,00000000), ref: 010D6328
GetLogicalDriveStringsW.KERNEL32(00000000,00000000,?,00000000), ref: 010D6356

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: DriveLogicalStrings$H_prologfree
String ID:
API String ID: 396970233-0
Opcode ID: 4c193589d692b52ed3929b9ae89ce6594fb1a0ce4409b3fd77be1ed7b0c5c055
Instruction ID: 467285029311c1caa0f6b5c05739dd38cab77647ac5d9299405e348e6f423f64
Opcode Fuzzy Hash: 4c193589d692b52ed3929b9ae89ce6594fb1a0ce4409b3fd77be1ed7b0c5c055
Instruction Fuzzy Hash: CF21A372E0430A9BDB14EFE99981AEEF7F8EF54214F10812AE191B3180DFB559048B61

Uniqueness

Uniqueness Score: -1.00%

Function 010D8623 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D8623() {
				char _v12;
				struct _SYSTEM_INFO _v48;

				if(E010D8610( &_v12) == 0) {
					L3:
					GetSystemInfo( &_v48);
					return _v48.dwNumberOfProcessors;
				} else {
					_t10 = _v12;
					if(_v12 == 0) {
						goto L3;
					} else {
						return E010D85F8(_t10);
					}
				}
			}

0x010d8633
0x010d8643
0x010d8647
0x010d8651
0x010d8635
0x010d8635
0x010d863a
0x00000000
0x010d863c
0x010d8642
0x010d8642
0x010d863a

APIs

Part of subcall function 010D8610: GetCurrentProcess.KERNEL32(?,?,010D8631), ref: 010D8615
Part of subcall function 010D8610: GetProcessAffinityMask.KERNEL32(00000000), ref: 010D861C

GetSystemInfo.KERNEL32(?), ref: 010D8647

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Process$AffinityCurrentInfoMaskSystem
String ID:
API String ID: 3251479945-0
Opcode ID: bac17b573ab2433e1e04a1ab21a13f54c0f87cc83e2e40f6e353eea719cb3d02
Instruction ID: dfb788d9e84826a72df10fbe41a434a7f50c2a9248f02a3e1639ddb27314c7df
Opcode Fuzzy Hash: bac17b573ab2433e1e04a1ab21a13f54c0f87cc83e2e40f6e353eea719cb3d02
Instruction Fuzzy Hash: C2D05B30E0430E9BDF08EBBDD545DDD7BB85E58514F4480A5C641E2144EBB0D5858751

Uniqueness

Uniqueness Score: -1.00%

Function 011015C3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011015C3() {
				struct _OSVERSIONINFOW _v280;
				void* _t7;

				_v280.dwOSVersionInfoSize = 0x114;
				if(GetVersionExW( &_v280) == 0 || _v280.dwPlatformId != 2) {
					return 0;
				} else {
					_t7 = 1;
					return _t7;
				}
			}

0x011015d2
0x011015e5
0x011015f8
0x011015f0
0x011015f2
0x011015f4
0x011015f4

APIs

GetVersionExW.KERNEL32(?), ref: 011015DD

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: f415320b5f2c5d18821b63e722e74654e808f1a0c494d8603cac627e034ab8c3
Instruction ID: 0238efc19b73298249e2825b1b91de9c052c0b51e267e76c5ffc5d0c24253e72
Opcode Fuzzy Hash: f415320b5f2c5d18821b63e722e74654e808f1a0c494d8603cac627e034ab8c3
Instruction Fuzzy Hash: F4D05EB0E1020C97EF3A9A249A0B7C677F85700B48F0400E49616E51C0EBF8D68889B1

Uniqueness

Uniqueness Score: -1.00%

Function 010D877D Relevance: 1.5, APIs: 1, Instructions: 3
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D877D(void* __eax, struct _FILETIME* __ecx) {
				void* _t1;

				_t1 = __eax;
				GetSystemTimeAsFileTime(__ecx);
				return _t1;
			}

0x010d877d
0x010d877e
0x010d8784

APIs

GetSystemTimeAsFileTime.KERNEL32(?,01100A46,00000000,00000000,777989A0), ref: 010D877E

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 97e9bde21cdbfc862de7f370e523143e7b64182452544ee8bf12c1ba917fe4f1
Instruction ID: 194884e636d33f722f422e06bc7bdf0c897a10f4162021c810f32807da4aec1a
Opcode Fuzzy Hash: 97e9bde21cdbfc862de7f370e523143e7b64182452544ee8bf12c1ba917fe4f1
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 010D765C Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D765C(intOrPtr* __ecx, intOrPtr* __edx, void* __ebp, char _a4) {

				if(E010D768B(__ecx, __edx) == 0) {
					L5:
					return 0;
				}
				if( *((intOrPtr*)(__edx + 4)) != 0) {
					L4:
					return 1;
				}
				if(_a4 != 0) {
					goto L5;
				}
				E010D2A28(__edx, __ecx);
				goto L4;
			}

0x010d7669
0x010d7684
0x00000000
0x010d7684
0x010d766f
0x010d7680
0x00000000
0x010d7680
0x010d7676
0x00000000
0x00000000
0x010d767b
0x00000000

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dcb2675df9b73bfee58f556134304826c188a12d995c5211a709401821742ec5
Instruction ID: 1ec40537914858bdbef6c865e593fd273135eb4a2af8ffd87cb4045722d987aa
Opcode Fuzzy Hash: dcb2675df9b73bfee58f556134304826c188a12d995c5211a709401821742ec5
Instruction Fuzzy Hash: 51D05E2150831069DE71592E50007DFBBC48FFB62CE06A8EBD1D8532C2A5B484868A67

Uniqueness

Uniqueness Score: -1.00%

Function 01100733 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E01100733(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _t50;
				void* _t51;
				void* _t54;
				void* _t55;
				signed char* _t83;
				intOrPtr _t86;
				struct _IO_FILE** _t87;
				signed char _t91;
				intOrPtr _t133;
				signed int _t140;
				struct _IO_FILE** _t142;
				void* _t144;

				_t133 = __edx;
				E011039E0(E01107864, _t144);
				 *((intOrPtr*)(_t144 - 0x18)) = __ecx;
				_t91 = 0;
				_t142 =  *(_t144 + 0x10);
				 *((intOrPtr*)(_t144 - 0x10)) = __edx;
				 *((intOrPtr*)(_t144 - 0x14)) = 0;
				if( *((intOrPtr*)(__edx + 0xf8)) == 0) {
					L4:
					_t83 =  *(_t144 + 8);
					if( *((intOrPtr*)(_t144 - 0x18)) != _t91 ||  *_t83 != _t91 || _t83[8] != _t91 || _t83[0x14] != _t91) {
						__eflags = _t142 - _t91;
						if(_t142 == _t91) {
							L31:
							_t50 = 2;
							goto L32;
						}
						_t51 = E010D28E9(_t144 - 0x24);
						_t140 = 0;
						__eflags = _t83[8];
						 *(_t144 - 4) = 0;
						if(_t83[8] != 0) {
							E010D2CAD(_t144 - 0x24, _t83[4]);
							_t51 = E010D2BFE(_t144 - 0x24);
						}
						__eflags = _t83[0x14];
						if(__eflags <= 0) {
							L26:
							_t85 =  *_t83;
							__eflags =  *_t83;
							if(__eflags != 0) {
								_t54 = E010D4B4D(_t144 - 0x30, _t85, __eflags);
								 *(_t144 - 4) = 1;
								_t55 = E010D2C71(_t144 - 0x24, __eflags, _t54);
								_t39 = _t144 - 4;
								 *_t39 =  *(_t144 - 4) & 0x00000000;
								__eflags =  *_t39;
								E010D1ABD(_t55,  *((intOrPtr*)(_t144 - 0x30)));
								_t51 = E010D2BFE(_t144 - 0x24);
							}
							__eflags =  *(_t144 - 0x20);
							if( *(_t144 - 0x20) != 0) {
								_push( *((intOrPtr*)(_t144 - 0x24)));
								_push(L"\nError:\n");
								_t51 = E010D1CC1(E010D1CC1(_t142));
							}
							E010D1ABD(_t51,  *((intOrPtr*)(_t144 - 0x24)));
							goto L31;
						} else {
							do {
								E010D2C71(_t144 - 0x24, __eflags,  *((intOrPtr*)(_t83[0x10] + _t140 * 4)));
								_t51 = E010D2BFE(_t144 - 0x24);
								_t140 = _t140 + 1;
								__eflags = _t140 - _t83[0x14];
							} while (__eflags < 0);
							goto L26;
						}
					} else {
						_t86 =  *((intOrPtr*)(_t133 + 0xe0));
						if(_t86 != _t91) {
							__eflags = _t142 - _t91;
							if(_t142 != _t91) {
								E010D1CAE(_t142);
								fputs("WARNINGS for files:",  *_t142);
								E010D1CAE(_t142);
								E010D1CAE(_t142);
								E01100965( *((intOrPtr*)(_t144 - 0x10)) + 0xdc, _t142);
								fputs("WARNING: Cannot open ",  *_t142);
								fputs(" file",  *(E010D1F1E(_t142, _t86)));
								__eflags = _t86 - 1;
								if(_t86 > 1) {
									fputc(0x73,  *_t142);
								}
								E010D1CAE(_t142);
							}
							 *((intOrPtr*)(_t144 - 0x14)) = 1;
						} else {
							if( *((char*)(_t144 + 0x14)) != 0 &&  *((intOrPtr*)(_t133 + 0xf8)) == _t91) {
								_t87 =  *(_t144 + 0xc);
								if(_t87 != _t91) {
									if(_t142 != _t91) {
										E010D1C9F(_t142);
									}
									fputs( *0x110b788,  *_t87);
									E010D1CAE(_t87);
								}
							}
						}
						_t50 =  *((intOrPtr*)(_t144 - 0x14));
						L32:
						 *[fs:0x0] =  *((intOrPtr*)(_t144 - 0xc));
						return _t50;
					}
				}
				if(_t142 != 0) {
					E010D1CAE(_t142);
					fputs("Scan WARNINGS for files and folders:",  *_t142);
					E010D1CAE(_t142);
					E010D1CAE(_t142);
					E01100965( *((intOrPtr*)(_t144 - 0x10)) + 0xf4, _t142);
					fputs("Scan WARNINGS: ",  *_t142);
					E010D1F1E(_t142,  *((intOrPtr*)( *((intOrPtr*)(_t144 - 0x10)) + 0xf8)));
					E010D1CAE(_t142);
					_t133 =  *((intOrPtr*)(_t144 - 0x10));
					_t91 = 0;
				}
				 *((intOrPtr*)(_t144 - 0x14)) = 1;
				goto L4;
			}

0x01100733
0x01100738
0x01100746
0x0110074a
0x0110074d
0x01100759
0x0110075c
0x0110075f
0x011007c1
0x011007c4
0x011007c7
0x011008ab
0x011008ad
0x01100951
0x01100953
0x00000000
0x01100953
0x011008b6
0x011008bb
0x011008bd
0x011008c0
0x011008c3
0x011008cb
0x011008d3
0x011008d3
0x011008d8
0x011008dc
0x011008fa
0x011008fa
0x011008fc
0x011008fe
0x01100905
0x0110090e
0x01100912
0x01100917
0x01100917
0x01100917
0x0110091e
0x01100927
0x01100927
0x0110092c
0x01100930
0x01100932
0x01100937
0x01100943
0x01100943
0x0110094b
0x00000000
0x011008de
0x011008de
0x011008e7
0x011008ef
0x011008f4
0x011008f5
0x011008f5
0x00000000
0x011008de
0x011007e7
0x011007e7
0x011007ef
0x01100832
0x01100834
0x01100838
0x01100844
0x0110084a
0x01100851
0x01100861
0x0110086d
0x01100880
0x01100883
0x01100887
0x0110088d
0x01100894
0x01100897
0x01100897
0x0110089c
0x011007f1
0x011007f5
0x01100807
0x0110080c
0x01100814
0x01100818
0x01100818
0x01100825
0x0110082b
0x0110082b
0x0110080c
0x011007f5
0x011008a3
0x01100954
0x0110095a
0x01100962
0x01100962
0x011007c7
0x01100763
0x01100767
0x01100773
0x01100779
0x01100780
0x01100790
0x011007a2
0x011007a9
0x011007b0
0x011007b5
0x011007b8
0x011007b8
0x011007ba
0x00000000

APIs

__EH_prolog.LIBCMT ref: 01100738
fputs.MSVCRT ref: 011007A2

Part of subcall function 010D1F1E: fputs.MSVCRT ref: 010D1F38

fputs.MSVCRT ref: 01100773

Part of subcall function 01100965: __EH_prolog.LIBCMT ref: 0110096A
Part of subcall function 01100965: fputs.MSVCRT ref: 01100993
Part of subcall function 01100965: fputs.MSVCRT ref: 011009D7

fputs.MSVCRT ref: 01100825
fputs.MSVCRT ref: 01100844
fputs.MSVCRT ref: 0110086D
fputs.MSVCRT ref: 01100880
fputc.MSVCRT ref: 0110088D

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Strings

file, xrefs: 0110087B
WARNINGS for files:, xrefs: 0110083F
Scan WARNINGS for files and folders:, xrefs: 0110076E
F}w, xrefs: 01100749
Scan WARNINGS: , xrefs: 0110079D
Error:, xrefs: 01100937
@F}w, xrefs: 01100750
WARNING: Cannot open , xrefs: 01100868

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfputc
String ID: Error:$ F}w$ file$@F}w$Scan WARNINGS for files and folders:$Scan WARNINGS: $WARNING: Cannot open $WARNINGS for files:
API String ID: 3294964263-413392305
Opcode ID: 9f9d5ef3ddfa4ecb0b8432921368769480fd03484a0329f3a1344ab9baf7009b
Instruction ID: 43283971af3eba4acdd27101ba79d2bcba53ac63ca0f7b541c53e66fff962f85
Opcode Fuzzy Hash: 9f9d5ef3ddfa4ecb0b8432921368769480fd03484a0329f3a1344ab9baf7009b
Instruction Fuzzy Hash: BD517231E0421A9BDF2EEF94D991BEDB7A1FF98200F14006EE545661C1DFB15E84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010FCD30 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 240
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E010FCD30(struct _IO_FILE** __ecx, intOrPtr __edx) {
				short _t102;
				signed int _t108;
				signed int _t109;
				char* _t111;
				signed int _t115;
				signed int _t116;
				intOrPtr _t128;
				intOrPtr _t130;
				intOrPtr _t136;
				char* _t140;
				void* _t142;
				struct _IO_FILE** _t147;
				signed int _t159;
				void* _t199;
				void* _t200;
				void* _t204;
				signed int _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				intOrPtr* _t211;
				intOrPtr* _t212;
				short _t213;
				void* _t214;

				E011039E0(E01107234, _t214);
				 *(_t214 - 0x14) =  *(_t214 - 0x14) & 0x00000000;
				 *((intOrPtr*)(_t214 - 0x20)) = __edx;
				_t147 = __ecx;
				if( *((intOrPtr*)( *((intOrPtr*)(_t214 + 8)) + 4)) <= 0) {
					L29:
					_t102 = 0;
					L30:
					 *[fs:0x0] =  *((intOrPtr*)(_t214 - 0xc));
					return _t102;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t211 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t214 + 8)))) +  *(_t214 - 0x14) * 4));
					_t204 = _t211 + 0x10;
					fputs("--\n",  *_t147);
					_push(0);
					_push( *((intOrPtr*)(_t211 + 0x70)));
					E010FD06E(_t147, "Path");
					_t108 =  *(_t204 + 0xc);
					if(_t108 >= 0) {
						if(_t108 !=  *(_t211 + 0x94)) {
							__eflags = _t108;
							if(_t108 >= 0) {
								_t140 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t214 - 0x20)) + 0x28)) + _t108 * 4)) + 0xc));
							} else {
								_t140 = "#";
							}
							E010D292C(_t214 - 0x40, _t140);
							 *(_t214 - 4) =  *(_t214 - 4) & 0x00000000;
							_t142 = E010FD2F3(_t147, _t214 - 0x40, 1);
							_t23 = _t214 - 4;
							 *_t23 =  *(_t214 - 4) | 0xffffffff;
							__eflags =  *_t23;
							E010D1ABD(_t142,  *((intOrPtr*)(_t214 - 0x40)));
						} else {
							fputs("Warning: The archive is open with offset",  *_t147);
							E010D1CAE(_t147);
						}
					}
					_t109 =  *(_t211 + 0x94);
					if(_t109 >= 0) {
						_t111 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t214 - 0x20)) + 0x28)) + _t109 * 4)) + 0xc));
					} else {
						_t111 = "#";
					}
					_push(0);
					_push(_t111);
					E010FD06E(_t147, "Type");
					E010FD34F(_t147, _t204);
					_t159 =  *(_t211 + 0xd4);
					_t115 =  *((intOrPtr*)(_t211 + 0xd0)) +  *((intOrPtr*)(_t211 + 0xa8));
					asm("adc ecx, [esi+0xac]");
					if((_t115 | _t159) != 0) {
						_push(_t159);
						_push(_t115);
						_t200 = 0x24;
						E010FD04C(_t147, _t200);
					}
					_t212 =  *_t211;
					_push(0);
					_push(0x2c);
					_t102 = E010FD292(_t147, _t212);
					if(_t102 != 0) {
						goto L30;
					}
					_t116 =  *(_t204 + 0x10);
					_t205 =  *(_t204 + 0x14);
					if((_t116 | _t205) != 0) {
						_push(_t205);
						_push(_t116);
						_t199 = 0x57;
						E010FCFE8(_t147, _t199);
					}
					_t102 =  *((intOrPtr*)( *_t212 + 0x2c))(_t212, _t214 - 0x24);
					_t206 = 0;
					if(_t102 != 0) {
						goto L30;
					} else {
						if( *((intOrPtr*)(_t214 - 0x24)) <= 0) {
							L21:
							_t207 =  *((intOrPtr*)(_t214 + 8));
							if( *(_t214 - 0x14) ==  *((intOrPtr*)(_t207 + 4)) - 1) {
								L28:
								 *(_t214 - 0x14) =  *(_t214 - 0x14) + 1;
								if( *(_t214 - 0x14) <  *((intOrPtr*)(_t207 + 4))) {
									continue;
								}
								goto L29;
							}
							fputs("----\n",  *_t147);
							_push(_t214 - 0x2c);
							_push(_t212);
							if( *((intOrPtr*)( *_t212 + 0x24))() != 0) {
								goto L28;
							}
							_t208 = 0;
							 *(_t214 - 0x18) =  *( *((intOrPtr*)( *_t207 + 4 +  *(_t214 - 0x14) * 4)) + 0x98);
							if( *((intOrPtr*)(_t214 - 0x2c)) <= 0) {
								L27:
								_t207 =  *((intOrPtr*)(_t214 + 8));
								goto L28;
							} else {
								goto L24;
							}
							while(1) {
								L24:
								 *(_t214 - 0x1c) =  *(_t214 - 0x1c) & 0x00000000;
								 *(_t214 - 4) = 2;
								_t128 =  *((intOrPtr*)( *_t212 + 0x28))(_t212, _t208, _t214 - 0x1c, _t214 - 0x28, _t214 - 0x10);
								if(_t128 != 0) {
									break;
								}
								 *((short*)(_t214 - 0x50)) = 0;
								 *((short*)(_t214 - 0x4e)) = 0;
								 *((intOrPtr*)(_t214 - 0x48)) = 0;
								 *(_t214 - 4) = 3;
								_t130 =  *((intOrPtr*)( *_t212 + 0x18))(_t212,  *(_t214 - 0x18),  *((intOrPtr*)(_t214 - 0x28)), _t214 - 0x50);
								_t235 = _t130;
								 *((intOrPtr*)(_t214 - 0x34)) = _t130;
								if(_t130 != 0) {
									E010D8173(_t214 - 0x50);
									_t213 =  *((intOrPtr*)(_t214 - 0x34));
									L34:
									_push( *(_t214 - 0x1c));
									L35:
									__imp__#6();
									_t102 = _t213;
									goto L30;
								}
								E010FD1D4(_t147,  *((intOrPtr*)(_t214 - 0x28)), _t235);
								E010D8173(_t214 - 0x50);
								 *(_t214 - 4) =  *(_t214 - 4) | 0xffffffff;
								__imp__#6( *(_t214 - 0x1c),  *(_t214 - 0x1c), _t214 - 0x50);
								_t208 = _t208 + 1;
								if(_t208 <  *((intOrPtr*)(_t214 - 0x2c))) {
									continue;
								}
								goto L27;
							}
							_t213 = _t128;
							goto L34;
						} else {
							goto L18;
						}
						while(1) {
							L18:
							 *(_t214 - 0x18) =  *(_t214 - 0x18) & 0x00000000;
							 *(_t214 - 4) = 1;
							_t136 =  *((intOrPtr*)( *_t212 + 0x30))(_t212, _t206, _t214 - 0x18, _t214 - 0x30, _t214 - 0xe);
							if(_t136 != 0) {
								break;
							}
							_push( *(_t214 - 0x18));
							_push( *((intOrPtr*)(_t214 - 0x30)));
							_t136 = E010FD292(_t147, _t212);
							if(_t136 != 0) {
								break;
							}
							 *(_t214 - 4) =  *(_t214 - 4) | 0xffffffff;
							__imp__#6( *(_t214 - 0x18));
							_t206 = _t206 + 1;
							if(_t206 <  *((intOrPtr*)(_t214 - 0x24))) {
								continue;
							}
							goto L21;
						}
						_push( *(_t214 - 0x18));
						_t213 = _t136;
						goto L35;
					}
				}
				goto L30;
			}

0x010fcd35
0x010fcd40
0x010fcd4b
0x010fcd4e
0x010fcd50
0x010fcfb2
0x010fcfb2
0x010fcfb4
0x010fcfba
0x010fcfc2
0x00000000
0x00000000
0x00000000
0x010fcd56
0x010fcd56
0x010fcd65
0x010fcd68
0x010fcd6b
0x010fcd7b
0x010fcd7d
0x010fcd80
0x010fcd85
0x010fcd8a
0x010fcd92
0x010fcdac
0x010fcdae
0x010fcdc0
0x010fcdb0
0x010fcdb0
0x010fcdb0
0x010fcdc7
0x010fcdcc
0x010fcdd7
0x010fcddc
0x010fcddc
0x010fcddc
0x010fcde3
0x010fcd94
0x010fcd9b
0x010fcda5
0x010fcda5
0x010fcd92
0x010fcde9
0x010fcdf1
0x010fce03
0x010fcdf3
0x010fcdf3
0x010fcdf3
0x010fce06
0x010fce08
0x010fce10
0x010fce19
0x010fce24
0x010fce2a
0x010fce30
0x010fce3a
0x010fce3c
0x010fce3d
0x010fce42
0x010fce43
0x010fce43
0x010fce48
0x010fce4a
0x010fce4c
0x010fce52
0x010fce59
0x00000000
0x00000000
0x010fce5f
0x010fce62
0x010fce69
0x010fce6b
0x010fce6c
0x010fce71
0x010fce72
0x010fce72
0x010fce7e
0x010fce81
0x010fce85
0x00000000
0x010fce8b
0x010fce8e
0x010fcee0
0x010fcee0
0x010fceea
0x010fcfa3
0x010fcfa3
0x010fcfac
0x00000000
0x00000000
0x00000000
0x010fcfac
0x010fcef7
0x010fcf04
0x010fcf05
0x010fcf0b
0x00000000
0x00000000
0x010fcf16
0x010fcf25
0x010fcf28
0x010fcfa0
0x010fcfa0
0x00000000
0x00000000
0x00000000
0x00000000
0x010fcf2a
0x010fcf2a
0x010fcf2a
0x010fcf3e
0x010fcf45
0x010fcf4c
0x00000000
0x00000000
0x010fcf4e
0x010fcf52
0x010fcf56
0x010fcf5f
0x010fcf6a
0x010fcf6d
0x010fcf6f
0x010fcf72
0x010fcfd3
0x010fcfd8
0x010fcfdb
0x010fcfdb
0x010fcfde
0x010fcfde
0x010fcfe4
0x00000000
0x010fcfe4
0x010fcf80
0x010fcf88
0x010fcf8d
0x010fcf94
0x010fcf9a
0x010fcf9e
0x00000000
0x00000000
0x00000000
0x010fcf9e
0x010fcfcc
0x00000000
0x00000000
0x00000000
0x00000000
0x010fce90
0x010fce90
0x010fce90
0x010fcea4
0x010fceab
0x010fceb0
0x00000000
0x00000000
0x010fceb6
0x010fcebd
0x010fcec0
0x010fcec7
0x00000000
0x00000000
0x010fced0
0x010fced4
0x010fceda
0x010fcede
0x00000000
0x00000000
0x00000000
0x010fcede
0x010fcfc5
0x010fcfc8
0x00000000
0x010fcfc8
0x010fce85
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010FCD35
fputs.MSVCRT ref: 010FCD6B

Part of subcall function 010FD06E: __EH_prolog.LIBCMT ref: 010FD073
Part of subcall function 010FD06E: fputs.MSVCRT ref: 010FD088
Part of subcall function 010FD06E: fputs.MSVCRT ref: 010FD091

fputs.MSVCRT ref: 010FCD9B

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

SysFreeString.OLEAUT32(00000000), ref: 010FCED4
fputs.MSVCRT ref: 010FCEF7
SysFreeString.OLEAUT32(00000000), ref: 010FCF94
SysFreeString.OLEAUT32(00000000), ref: 010FCFDE

Strings

Warning: The archive is open with offset, xrefs: 010FCD96
--, xrefs: 010FCD60
----, xrefs: 010FCEF2
Path, xrefs: 010FCD76
Type, xrefs: 010FCE09

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$FreeString$H_prolog$fputc
String ID: --$----$Path$Type$Warning: The archive is open with offset
API String ID: 2047134881-3797937567
Opcode ID: dda809b78e699ac895adf653eea6731dd9f9f1a2a15d827ce9e26382f85043c7
Instruction ID: b1d46ce97f0d7861c55c04fd03a2277217352783423489e19ca5377c223928d4
Opcode Fuzzy Hash: dda809b78e699ac895adf653eea6731dd9f9f1a2a15d827ce9e26382f85043c7
Instruction Fuzzy Hash: DE918E31A00209EFDB19DFA8C946EEEBBB5FF48310F10415DE656A7691DB70AD05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010DC838 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E010DC838(intOrPtr __ecx, void* __edx, void* __eflags) {
				signed int _t86;
				void* _t87;
				void* _t89;
				signed int _t98;
				long _t104;
				long _t109;
				signed int _t111;
				signed int _t139;
				intOrPtr* _t140;
				signed int _t143;
				char* _t144;
				void* _t146;
				void* _t147;

				E011039E0(E01104A60, _t147);
				 *((intOrPtr*)(_t147 - 0x18)) = __ecx;
				E010D29BC(_t147 - 0x28, __eflags, __edx);
				_t109 = 0;
				 *(_t147 - 4) = 0;
				_t143 = E010D1F93( *(_t147 - 0x28), 0x3a);
				if(_t143 >= 0) {
					_t78 = E010D1F93( *(_t147 - 0x28) + 2 + _t143 * 2, 0x3a);
					__eflags = _t78;
					if(_t78 < 0) {
						goto L1;
					}
					_t10 = _t143 + 1; // 0x1
					_t139 = _t78 + _t10;
					__eflags = _t139;
					if(_t139 < 0) {
						goto L1;
					}
					E010D292C(_t147 - 0x40,  *(_t147 - 0x28) + 2 + _t139 * 2);
					__eflags = _t139 -  *(_t147 - 0x24);
					if(_t139 <  *(_t147 - 0x24)) {
						 *(_t147 - 0x24) = _t139;
						( *(_t147 - 0x28))[_t139] = 0;
					}
					_t86 = E010DB942( *(_t147 - 0x28) + 2 + _t143 * 2, _t147 - 0x14);
					__eflags = _t86;
					if(_t86 == 0) {
						L29:
						_t144 = "Unsupported Map data size";
						goto L30;
					} else {
						__eflags =  *(_t147 - 0x14) - 2;
						if( *(_t147 - 0x14) < 2) {
							goto L29;
						}
						__eflags =  *(_t147 - 0x14) - 0x80000000;
						if( *(_t147 - 0x14) > 0x80000000) {
							goto L29;
						}
						__eflags =  *(_t147 - 0x14) & 0x00000001;
						if(( *(_t147 - 0x14) & 0x00000001) != 0) {
							goto L29;
						}
						__eflags = _t143 -  *(_t147 - 0x24);
						if(_t143 <  *(_t147 - 0x24)) {
							 *(_t147 - 0x24) = _t143;
							( *(_t147 - 0x28))[_t143] = _t109;
						}
						 *(_t147 - 0x10) = _t109;
						_t87 = OpenFileMappingW(4, _t109,  *(_t147 - 0x28));
						__eflags = _t87 - _t109;
						 *(_t147 - 0x10) = _t87;
						if(_t87 != _t109) {
							L15:
							_t146 = MapViewOfFile( *(_t147 - 0x10), 4, _t109, _t109,  *(_t147 - 0x14));
							__eflags = _t146 - _t109;
							if(_t146 != _t109) {
								 *(_t147 - 0x1c) = _t146;
								 *(_t147 - 4) = 3;
								_t89 = E010D28E9(_t147 - 0x34);
								__eflags =  *_t146 - _t109;
								 *(_t147 - 4) = 4;
								if( *_t146 == _t109) {
									_t91 =  *(_t147 - 0x14) >> 1;
									__eflags = _t91 - 1;
									if(_t91 <= 1) {
										L26:
										__eflags =  *(_t147 - 0x30) - _t109;
										_push( *(_t147 - 0x34));
										if( *(_t147 - 0x30) == _t109) {
											E010D1ABD(_t91);
											UnmapViewOfFile(_t146);
											 *(_t147 - 4) = 1;
											E010DCA53(_t147 - 0x10);
											_t144 = 0;
										} else {
											E010D1ABD(_t91);
											UnmapViewOfFile(_t146);
											 *(_t147 - 4) = 1;
											E010DCA53(_t147 - 0x10);
											_t144 = "Map data error";
										}
										goto L30;
									}
									_t53 = _t146 + 2; // 0x2
									_t140 = _t53;
									_t54 = _t91 - 1; // 0x0
									_t111 = _t54;
									do {
										_t98 =  *_t140;
										__eflags = _t98;
										if(_t98 != 0) {
											_t91 = E010D1089(_t147 - 0x34, _t98);
										} else {
											E010DC2ED( *((intOrPtr*)(_t147 - 0x18)), _t147 - 0x34,  *((intOrPtr*)(_t147 + 8)),  *((intOrPtr*)(_t147 + 0xc)),  *((intOrPtr*)(_t147 + 0x10)));
											_t91 =  *(_t147 - 0x34);
											 *(_t147 - 0x30) =  *(_t147 - 0x30) & 0x00000000;
											 *( *(_t147 - 0x34)) =  *( *(_t147 - 0x34)) & 0x00000000;
										}
										_t140 = _t140 + 2;
										_t111 = _t111 - 1;
										__eflags = _t111;
									} while (_t111 != 0);
									_t109 = 0;
									__eflags = 0;
									goto L26;
								}
								E010D1ABD(_t89,  *(_t147 - 0x34));
								UnmapViewOfFile(_t146);
								 *(_t147 - 4) = 1;
								E010DCA53(_t147 - 0x10);
								_t144 = "Unsupported Map data";
								goto L30;
							}
							 *(_t147 - 4) = 1;
							E010DCA53(_t147 - 0x10);
							_t144 = "MapViewOfFile error";
							goto L30;
						} else {
							_t104 = GetLastError();
							__eflags = _t104 - _t109;
							if(_t104 == _t109) {
								goto L15;
							}
							 *(_t147 - 4) = 1;
							E010DCA53(_t147 - 0x10);
							_t144 = "Can not open mapping";
							L30:
							_t70 = _t147 - 4;
							 *_t70 =  *(_t147 - 4) & 0x00000000;
							__eflags =  *_t70;
							_t78 = E010DCA7B();
							L31:
							E010D1ABD(_t78,  *(_t147 - 0x28));
							 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
							return _t144;
						}
					}
				}
				L1:
				_t144 =  *0x1108678; // 0x11086fc
				goto L31;
			}

0x010dc83d
0x010dc847
0x010dc84f
0x010dc857
0x010dc85d
0x010dc865
0x010dc869
0x010dc881
0x010dc886
0x010dc888
0x00000000
0x00000000
0x010dc88a
0x010dc88a
0x010dc88e
0x010dc890
0x00000000
0x00000000
0x010dc89d
0x010dc8a2
0x010dc8a5
0x010dc8aa
0x010dc8ad
0x010dc8ad
0x010dc8bb
0x010dc8c0
0x010dc8c2
0x010dca26
0x010dca26
0x00000000
0x010dc8c8
0x010dc8c8
0x010dc8cc
0x00000000
0x00000000
0x010dc8d2
0x010dc8d9
0x00000000
0x00000000
0x010dc8df
0x010dc8e3
0x00000000
0x00000000
0x010dc8e9
0x010dc8ec
0x010dc8f1
0x010dc8f4
0x010dc8f4
0x010dc8f8
0x010dc901
0x010dc907
0x010dc909
0x010dc90c
0x010dc92e
0x010dc93e
0x010dc940
0x010dc942
0x010dc95a
0x010dc960
0x010dc964
0x010dc969
0x010dc96c
0x010dc970
0x010dc99b
0x010dc99d
0x010dc9a0
0x010dc9e1
0x010dc9e1
0x010dc9e4
0x010dc9e7
0x010dca09
0x010dca10
0x010dca19
0x010dca1d
0x010dca22
0x010dc9e9
0x010dc9e9
0x010dc9f0
0x010dc9f9
0x010dc9fd
0x010dca02
0x010dca02
0x00000000
0x010dc9e7
0x010dc9a2
0x010dc9a2
0x010dc9a5
0x010dc9a5
0x010dc9a8
0x010dc9a8
0x010dc9ab
0x010dc9ae
0x010dc9d5
0x010dc9b0
0x010dc9bf
0x010dc9c4
0x010dc9c7
0x010dc9cb
0x010dc9cb
0x010dc9db
0x010dc9dc
0x010dc9dc
0x010dc9dc
0x010dc9df
0x010dc9df
0x00000000
0x010dc9df
0x010dc975
0x010dc97c
0x010dc985
0x010dc989
0x010dc98e
0x00000000
0x010dc98e
0x010dc947
0x010dc94b
0x010dc950
0x00000000
0x010dc90e
0x010dc90e
0x010dc914
0x010dc916
0x00000000
0x00000000
0x010dc91b
0x010dc91f
0x010dc924
0x010dca2b
0x010dca2b
0x010dca2b
0x010dca2b
0x010dca32
0x010dca37
0x010dca3a
0x010dca48
0x010dca50
0x010dca50
0x010dc90c
0x010dc8c2
0x010dc86b
0x010dc86b
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010DC83D
OpenFileMappingW.KERNEL32(00000004,00000000,?,?,?,00000000,?), ref: 010DC901
GetLastError.KERNEL32(?,00000000,?), ref: 010DC90E

Strings

Can not open mapping, xrefs: 010DC924
Unsupported Map data, xrefs: 010DC98E
Unsupported Map data size, xrefs: 010DCA26
Map data error, xrefs: 010DCA02
MapViewOfFile error, xrefs: 010DC950

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFileH_prologLastMappingOpen
String ID: Can not open mapping$Map data error$MapViewOfFile error$Unsupported Map data$Unsupported Map data size
API String ID: 2221086200-220075109
Opcode ID: 1f50f2614c2c6348c978edc874087b711aba609613c28b697b19d1f491d9315f
Instruction ID: 87ce83b3171e7ff7fac43a68efdd3c11ebfb56933c1e5f59fe12714ba4a7f0ed
Opcode Fuzzy Hash: 1f50f2614c2c6348c978edc874087b711aba609613c28b697b19d1f491d9315f
Instruction Fuzzy Hash: 8F51BE71C0535ADEEB16EBA8C684AEDBBB0FF14318F10406DE59277240CBB05E45CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 010FA9BE Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E010FA9BE(struct _IO_FILE** __ecx, void* __edx) {
				signed int _t19;
				void* _t32;
				signed int* _t33;
				struct _IO_FILE** _t48;
				void* _t53;
				void* _t55;
				void* _t57;

				_t45 = __edx;
				E011039E0(E011070B4, _t53);
				_t48 = __ecx;
				_t32 = __edx;
				fputs( *0x110aa98,  *__ecx);
				fputs("Path:     ",  *_t48);
				_t57 = _t55 - 0x4c + 0x10;
				_push(_t32);
				E010D1E60(_t48, _t45);
				_t19 = E010D1CAE(_t48);
				_t33 =  *(_t53 + 0xc);
				if(_t33 != 0) {
					_t19 =  *_t33 & _t33[1];
					if(_t19 != 0xffffffff) {
						E010D232F(_t53 - 0x18);
						 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
						E010FA4C9(_t53 - 0x18,  *_t33, _t33[1]);
						fputs( *0x110aa98,  *_t48);
						fputs("Size:     ",  *_t48);
						fputs( *(_t53 - 0x18),  *_t48);
						_t57 = _t57 + 0x18;
						_t19 = E010D1ABD(E010D1CAE(_t48),  *(_t53 - 0x18));
					}
				}
				_t38 =  *((intOrPtr*)(_t53 + 8));
				if( *((intOrPtr*)(_t53 + 8)) != 0) {
					_t19 = E010D826A(_t38, _t53 - 0x58, 0);
					if(_t19 != 0) {
						fputs( *0x110aa98,  *_t48);
						fputs("Modified: ",  *_t48);
						fputs(_t53 - 0x58,  *_t48);
						_t19 = E010D1CAE(_t48);
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t19;
			}

0x010fa9be
0x010fa9c3
0x010fa9d4
0x010fa9d6
0x010fa9e0
0x010fa9e9
0x010fa9eb
0x010fa9f0
0x010fa9f1
0x010fa9f8
0x010fa9fd
0x010faa02
0x010faa06
0x010faa0c
0x010faa11
0x010faa19
0x010faa22
0x010faa2f
0x010faa38
0x010faa3f
0x010faa41
0x010faa4e
0x010faa53
0x010faa0c
0x010faa54
0x010faa59
0x010faa60
0x010faa67
0x010faa71
0x010faa7a
0x010faa82
0x010faa89
0x010faa89
0x010faa67
0x010faa94
0x010faa9c

APIs

__EH_prolog.LIBCMT ref: 010FA9C3
fputs.MSVCRT ref: 010FA9E0
fputs.MSVCRT ref: 010FA9E9

Part of subcall function 010D1E60: __EH_prolog.LIBCMT ref: 010D1E65

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

fputs.MSVCRT ref: 010FAA2F
fputs.MSVCRT ref: 010FAA38
fputs.MSVCRT ref: 010FAA3F

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

fputs.MSVCRT ref: 010FAA71
fputs.MSVCRT ref: 010FAA7A
fputs.MSVCRT ref: 010FAA82

Strings

Modified: , xrefs: 010FAA75
Size: , xrefs: 010FAA33
Path: , xrefs: 010FA9E4

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog$fputcfree
String ID: Modified: $Path: $Size:
API String ID: 2632947726-3207571042
Opcode ID: bf81fecdccbe59fbf003b5f47e35411ef2b2b9235ac25ef1b7f374c1396b8369
Instruction ID: c2f81990bc35befd3a330f21d4547ab135448d0972d3cb2cc299a43482bb9014
Opcode Fuzzy Hash: bf81fecdccbe59fbf003b5f47e35411ef2b2b9235ac25ef1b7f374c1396b8369
Instruction Fuzzy Hash: DD21CF30E0021AEBCF1BABA5CD81AAEBF23EF44310F04401AE558571A4EB7548A4DF91

Uniqueness

Uniqueness Score: -1.00%

Function 010FC520 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 323
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E010FC520(intOrPtr* __ecx) {
				signed int _t131;
				signed int _t136;
				intOrPtr* _t137;
				intOrPtr _t138;
				int _t143;
				int _t156;
				signed int _t162;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr* _t169;
				intOrPtr* _t173;
				signed int _t181;
				signed int _t198;
				char* _t200;
				void* _t201;
				char* _t202;
				signed int _t204;
				signed int _t208;
				signed short _t214;
				struct _IO_FILE** _t219;
				intOrPtr _t253;
				intOrPtr* _t266;
				intOrPtr _t267;
				intOrPtr _t268;
				char* _t269;
				intOrPtr _t270;
				char** _t271;
				intOrPtr* _t274;
				void* _t276;

				E011039E0(E011071F4, _t276);
				 *(_t276 - 0x10) =  *(_t276 - 0x10) & 0x00000000;
				 *(_t276 - 0x1c) =  *(_t276 - 0x1c) & 0x00000000;
				_t274 = __ecx;
				_t198 =  *((intOrPtr*)(__ecx + 0x10));
				 *((char*)(_t276 - 0x14)) = _t198;
				if( *((intOrPtr*)(__ecx + 4)) <= 0) {
					L68:
					E010D1CAE(0x1114440);
					_t131 = 0;
					L69:
					 *[fs:0x0] =  *((intOrPtr*)(_t276 - 0xc));
					return _t131;
				} else {
					goto L1;
				}
				do {
					L1:
					_t266 =  *((intOrPtr*)( *_t274 +  *(_t276 - 0x1c) * 4));
					if(_t198 != 0) {
						__eflags =  *(_t266 + 0x18);
						if( *(_t266 + 0x18) == 0) {
							_push( *((intOrPtr*)(_t266 + 8)));
							E010D1CC1(0x1114440);
						} else {
							fputs( *(_t266 + 0x14),  *0x1114440);
						}
					} else {
						E010FC9A5(_t276 +  *(_t276 - 0x10) - 0xc4,  *((intOrPtr*)(_t266 + 0x28)));
						 *(_t276 - 0x10) =  *(_t276 - 0x10) +  *((intOrPtr*)(_t266 + 0x28));
					}
					_t253 =  *_t266;
					if(_t253 != 3) {
						__eflags =  *((char*)(_t266 + 4));
						 *((intOrPtr*)(_t276 - 0x30)) =  *((intOrPtr*)(_t266 + 0x2c));
						if( *((char*)(_t266 + 4)) == 0) {
							_t214 = 0;
							 *((short*)(_t276 - 0x2c)) = 0;
							 *((short*)(_t276 - 0x2a)) = 0;
							 *(_t276 - 0x24) = 0;
							 *(_t276 - 4) = 1;
							_t136 = _t253 - 7;
							__eflags = _t136;
							if(_t136 == 0) {
								_t137 =  *((intOrPtr*)(_t276 + 0xc));
								__eflags =  *((char*)(_t137 + 8));
								if( *((char*)(_t137 + 8)) == 0) {
									L39:
									_t138 =  *_t266;
									__eflags = _t138 - 9;
									if(_t138 != 9) {
										L45:
										__eflags = _t214;
										if(_t214 != 0) {
											__eflags = _t214 - 0x40;
											if(_t214 != 0x40) {
												__eflags = _t214 - 8;
												if(_t214 != 8) {
													E010F37E5(_t276 - 0x104, _t276 - 0x2c, _t138, 0);
													__eflags =  *((char*)(_t276 - 0x14));
													if( *((char*)(_t276 - 0x14)) == 0) {
														_t200 = _t276 +  *(_t276 - 0x10) - 0xc4;
														E010FCA20(_t200,  *((intOrPtr*)(_t266 + 0x24)),  *((intOrPtr*)(_t276 - 0x30)), _t276 - 0x104);
														_t143 = strlen(_t200);
														L62:
														_t115 = _t276 - 0x10;
														 *_t115 =  *(_t276 - 0x10) + _t143;
														__eflags =  *_t115;
														L63:
														_t117 = _t276 - 4;
														 *_t117 =  *(_t276 - 4) | 0xffffffff;
														__eflags =  *_t117;
														E010D8173(_t276 - 0x2c);
														L64:
														_t198 =  *((intOrPtr*)(_t276 - 0x14));
														__eflags = _t198;
														if(_t198 == 0) {
															goto L67;
														}
														_t219 = 0x1114440;
														goto L66;
													}
													fputs(_t276 - 0x104,  *0x1114440);
													L52:
													goto L63;
												}
												_t201 = _t274 + 0x2c;
												E010D2B37(_t138, _t201,  *(_t276 - 0x24));
												E010D1DE0(0x1114440, _t201);
												__eflags =  *((char*)(_t276 - 0x14));
												_push(_t274 + 0x20);
												_push(_t201);
												if( *((char*)(_t276 - 0x14)) == 0) {
													E010FC9D1( *((intOrPtr*)(_t266 + 0x24)),  *((intOrPtr*)(_t276 - 0x30)));
												} else {
													E010D1D87(0x1114440);
												}
												goto L63;
											}
											_t202 = _t276 +  *(_t276 - 0x10) - 0xc4;
											E010FCA8D(_t202, _t276 - 0x24);
											__eflags =  *((char*)(_t276 - 0x14));
											if( *((char*)(_t276 - 0x14)) == 0) {
												_t156 = strlen(_t202);
												_t267 =  *((intOrPtr*)(_t266 + 0x2c));
												 *(_t276 - 0x10) =  *(_t276 - 0x10) + _t156;
												__eflags = _t156 - _t267;
												if(_t156 >= _t267) {
													goto L63;
												}
												_t268 = _t267 - _t156;
												L48:
												E010FC9A5(_t276 +  *(_t276 - 0x10) - 0xc4, _t268);
												 *(_t276 - 0x10) =  *(_t276 - 0x10) + _t268;
												goto L63;
											}
											fputs(_t202,  *0x1114440);
											goto L52;
										}
										__eflags =  *((intOrPtr*)(_t276 - 0x14)) - _t214;
										if( *((intOrPtr*)(_t276 - 0x14)) != _t214) {
											goto L63;
										}
										_t268 =  *((intOrPtr*)(_t276 - 0x30));
										goto L48;
									}
									__eflags = _t214;
									if(_t214 == 0) {
										L42:
										_t269 = _t276 +  *(_t276 - 0x10) - 0xc4;
										asm("sbb ecx, ecx");
										E010FC929( ~_t214 &  *(_t276 - 0x24),  *((intOrPtr*)(_t274 + 0x38)),  *((intOrPtr*)(_t276 - 0x14)), _t269);
										__eflags =  *((char*)(_t276 - 0x14));
										if( *((char*)(_t276 - 0x14)) == 0) {
											_t143 = strlen(_t269);
											goto L62;
										}
										fputs(_t269,  *0x1114440);
										goto L52;
									}
									__eflags = _t214 - 0x13;
									if(_t214 != 0x13) {
										goto L45;
									}
									goto L42;
								}
								_push( *((intOrPtr*)(_t137 + 4)));
								_push( *_t137);
								L37:
								E010D80CE(_t276 - 0x2c);
								L38:
								_t214 =  *((intOrPtr*)(_t276 - 0x2c));
								goto L39;
							}
							_t162 = _t136 - 1;
							__eflags = _t162;
							if(_t162 == 0) {
								_t163 =  *((intOrPtr*)(_t276 + 0xc));
								__eflags =  *((char*)(_t163 + 0x18));
								if( *((char*)(_t163 + 0x18)) == 0) {
									goto L39;
								}
								_push( *((intOrPtr*)(_t163 + 0x14)));
								_push( *((intOrPtr*)(_t163 + 0x10)));
								goto L37;
							}
							__eflags = _t162 == 4;
							if(_t162 == 4) {
								_t165 =  *((intOrPtr*)(_t276 + 0xc));
								__eflags =  *((char*)(_t165 + 0x28));
								if( *((char*)(_t165 + 0x28)) == 0) {
									goto L39;
								}
								E010D80F5(_t276 - 0x2c, _t165 + 0x20);
								goto L38;
							}
							_t169 =  *((intOrPtr*)( *((intOrPtr*)(_t274 + 0xc))));
							_t204 =  *((intOrPtr*)( *_t169 + 0x18))(_t169,  *((intOrPtr*)(_t276 + 8)), _t253, _t276 - 0x2c);
							__eflags = _t204;
							if(_t204 != 0) {
								E010D8173(_t276 - 0x2c);
								_t131 = _t204;
								goto L69;
							}
							goto L38;
						}
						_t173 =  *((intOrPtr*)( *((intOrPtr*)(_t274 + 0xc)) + 8));
						_t131 =  *((intOrPtr*)( *_t173 + 0x10))(_t173,  *((intOrPtr*)(_t276 + 8)), _t253, _t276 - 0x34, _t276 - 0x18, _t276 - 0x38);
						__eflags = _t131;
						if(_t131 != 0) {
							goto L69;
						}
						_t261 =  *(_t276 - 0x18);
						__eflags =  *(_t276 - 0x18);
						if( *(_t276 - 0x18) == 0) {
							goto L64;
						}
						_t270 =  *_t266;
						_t208 = 1;
						__eflags = _t270 - 0x3e;
						if(_t270 != 0x3e) {
							__eflags = _t270 - 0x59;
							if(_t270 != 0x59) {
								L22:
								__eflags =  *((intOrPtr*)(_t276 - 0x38)) - 1;
								if( *((intOrPtr*)(_t276 - 0x38)) != 1) {
									L70:
									_t131 = 0x80004005;
									goto L69;
								}
								__eflags =  *(_t276 - 0x18) - 0x40;
								if( *(_t276 - 0x18) <= 0x40) {
									E010FCAA7(_t276 - 0x188,  *((intOrPtr*)(_t276 - 0x34)),  *(_t276 - 0x18));
									fputs(_t276 - 0x188,  *0x1114440);
									L17:
									goto L64;
								}
								fputs("data:",  *0x1114440);
								E010D1F1E(0x1114440,  *(_t276 - 0x18));
								goto L64;
							}
							E010D28E9(_t276 - 0x44);
							 *(_t276 - 4) =  *(_t276 - 4) & 0x00000000;
							_push(_t276 - 0x44);
							_t181 = E010F3D0B( *((intOrPtr*)(_t276 - 0x34)),  *(_t276 - 0x18), __eflags);
							__eflags = _t181;
							if(_t181 != 0) {
								_t208 = 0;
								__eflags = 0;
								_t181 = E010D1D87(0x1114440, _t276 - 0x44, _t274 + 0x20);
							}
							 *(_t276 - 4) =  *(_t276 - 4) | 0xffffffff;
							E010D1ABD(_t181,  *((intOrPtr*)(_t276 - 0x44)));
							__eflags = _t208;
							if(_t208 == 0) {
								goto L64;
							} else {
								goto L22;
							}
						}
						__eflags =  *((intOrPtr*)(_t276 - 0x38)) - 1;
						if( *((intOrPtr*)(_t276 - 0x38)) != 1) {
							goto L70;
						}
						_t271 = _t274 + 0x20;
						E010F392B( *((intOrPtr*)(_t276 - 0x34)), _t261, _t271);
						fputs( *_t271,  *0x1114440);
						goto L17;
					} else {
						if(_t198 == 0) {
							fputs(_t276 - 0xc4,  *0x1114440);
						}
						E010D1E25(0x1114440, _t274 + 0x14, _t274 + 0x2c, _t274 + 0x20);
						if(_t198 != 0) {
							_t219 = 0x1114440;
							L66:
							E010D1CAE(_t219);
						}
					}
					L67:
					 *(_t276 - 0x1c) =  *(_t276 - 0x1c) + 1;
				} while ( *(_t276 - 0x1c) <  *((intOrPtr*)(_t274 + 4)));
				goto L68;
			}

0x010fc525
0x010fc530
0x010fc534
0x010fc53a
0x010fc540
0x010fc545
0x010fc548
0x010fc8f9
0x010fc8fe
0x010fc903
0x010fc905
0x010fc90b
0x010fc913
0x00000000
0x00000000
0x00000000
0x010fc54e
0x010fc54e
0x010fc555
0x010fc558
0x010fc574
0x010fc578
0x010fc58e
0x010fc596
0x010fc57a
0x010fc584
0x010fc58b
0x010fc55a
0x010fc567
0x010fc56f
0x010fc56f
0x010fc59b
0x010fc5a0
0x010fc5e5
0x010fc5e9
0x010fc5ec
0x010fc6fa
0x010fc6fc
0x010fc700
0x010fc704
0x010fc709
0x010fc710
0x010fc710
0x010fc713
0x010fc764
0x010fc767
0x010fc76b
0x010fc77e
0x010fc77e
0x010fc780
0x010fc783
0x010fc7c3
0x010fc7c3
0x010fc7c6
0x010fc7ed
0x010fc7f1
0x010fc83a
0x010fc83e
0x010fc888
0x010fc88d
0x010fc891
0x010fc8ab
0x010fc8be
0x010fc8c4
0x010fc8c4
0x010fc8c9
0x010fc8c9
0x010fc8c9
0x010fc8cd
0x010fc8cd
0x010fc8cd
0x010fc8cd
0x010fc8d4
0x010fc8d9
0x010fc8d9
0x010fc8dc
0x010fc8de
0x00000000
0x00000000
0x010fc8e0
0x00000000
0x010fc8e0
0x010fc814
0x010fc814
0x00000000
0x010fc81b
0x010fc843
0x010fc848
0x010fc853
0x010fc858
0x010fc85f
0x010fc860
0x010fc861
0x010fc875
0x010fc863
0x010fc868
0x010fc868
0x00000000
0x010fc861
0x010fc7f9
0x010fc802
0x010fc807
0x010fc80b
0x010fc822
0x010fc827
0x010fc82a
0x010fc82d
0x010fc830
0x00000000
0x00000000
0x010fc836
0x010fc7d4
0x010fc7e0
0x010fc7e5
0x00000000
0x010fc7e5
0x010fc814
0x00000000
0x010fc814
0x010fc7c8
0x010fc7cb
0x00000000
0x00000000
0x010fc7d1
0x00000000
0x010fc7d1
0x010fc785
0x010fc788
0x010fc790
0x010fc799
0x010fc7a4
0x010fc7a9
0x010fc7ae
0x010fc7b2
0x010fc8c4
0x00000000
0x010fc8c4
0x010fc814
0x00000000
0x010fc814
0x010fc78a
0x010fc78e
0x00000000
0x00000000
0x00000000
0x010fc78e
0x010fc76d
0x010fc770
0x010fc772
0x010fc775
0x010fc77a
0x010fc77a
0x00000000
0x010fc77a
0x010fc715
0x010fc715
0x010fc716
0x010fc753
0x010fc756
0x010fc75a
0x00000000
0x00000000
0x010fc75c
0x010fc75f
0x00000000
0x010fc75f
0x010fc718
0x010fc71b
0x010fc73c
0x010fc73f
0x010fc743
0x00000000
0x00000000
0x010fc74c
0x00000000
0x010fc74c
0x010fc725
0x010fc730
0x010fc732
0x010fc734
0x010fc920
0x010fc925
0x00000000
0x010fc925
0x00000000
0x010fc73a
0x010fc5fc
0x010fc60b
0x010fc60e
0x010fc610
0x00000000
0x00000000
0x010fc616
0x010fc619
0x010fc61b
0x00000000
0x00000000
0x010fc621
0x010fc623
0x010fc625
0x010fc628
0x010fc655
0x010fc658
0x010fc6a2
0x010fc6a2
0x010fc6a6
0x010fc916
0x010fc916
0x00000000
0x010fc916
0x010fc6ac
0x010fc6b0
0x010fc6e3
0x010fc648
0x010fc648
0x00000000
0x010fc64f
0x010fc6bd
0x010fc6cd
0x00000000
0x010fc6cd
0x010fc65d
0x010fc668
0x010fc66f
0x010fc670
0x010fc675
0x010fc677
0x010fc686
0x010fc686
0x010fc688
0x010fc688
0x010fc690
0x010fc694
0x010fc699
0x010fc69c
0x00000000
0x00000000
0x00000000
0x00000000
0x010fc69c
0x010fc62a
0x010fc62e
0x00000000
0x00000000
0x010fc637
0x010fc63b
0x010fc648
0x00000000
0x010fc5a2
0x010fc5a4
0x010fc5b3
0x010fc5ba
0x010fc5ce
0x010fc5d5
0x010fc5db
0x010fc8e5
0x010fc8e5
0x010fc8e5
0x010fc5d5
0x010fc8ea
0x010fc8ea
0x010fc8f0
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010FC525
fputs.MSVCRT ref: 010FC584
fputs.MSVCRT ref: 010FC5B3
fputs.MSVCRT ref: 010FC648
fputs.MSVCRT ref: 010FC6BD
fputs.MSVCRT ref: 010FC814

Strings

@, xrefs: 010FC6AC
F}w, xrefs: 010FC591, 010FC5BE, 010FC67C, 010FC6C8, 010FC84E, 010FC863, 010FC8E0, 010FC8F9
data:, xrefs: 010FC6B8

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: F}w$@$data:
API String ID: 2614055831-1767649993
Opcode ID: 71a93386374b5ae65b6426e04337a91836fdd87e64f06b67ac85a9f089e2b697
Instruction ID: 6fa901ed294de1571e004b88dc453827d083875c5b97beffaa7450def1945bf4
Opcode Fuzzy Hash: 71a93386374b5ae65b6426e04337a91836fdd87e64f06b67ac85a9f089e2b697
Instruction Fuzzy Hash: 04C1D271A0420EAFEF15DFA8DA86EEDB7B5FF08314F14445DE292A3950D730A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010EB2E8 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E010EB2E8(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v32;
				char _v48;
				char _v51;
				char _v52;
				signed int _v56;
				void _v60;
				void _v104;
				void* __edi;
				void* __ebp;
				struct HINSTANCE__* _t63;
				_Unknown_base(*)()* _t64;
				void* _t66;
				intOrPtr _t68;
				signed int _t70;
				signed int _t71;
				_Unknown_base(*)()* _t72;
				void* _t84;
				struct HINSTANCE__** _t86;
				struct HINSTANCE__** _t87;
				struct HINSTANCE__* _t88;
				signed int _t94;
				signed int _t97;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t106;
				intOrPtr* _t116;
				intOrPtr* _t118;
				void* _t121;

				_t106 = __ecx;
				_v12 = __ecx;
				_t86 =  *( *((intOrPtr*)(__ecx + 0xc)) +  *(__ecx + 0x10) * 4 - 4);
				_t86[6] = GetProcAddress( *_t86, "CreateDecoder");
				_t86[7] = GetProcAddress( *_t86, "CreateEncoder");
				_t63 = GetProcAddress( *_t86, "GetMethodProperty");
				_t86[5] = _t63;
				if(_t63 == 0) {
					L10:
					_t64 = GetProcAddress( *_t86, "GetHashers");
					if(_t64 == 0) {
						L16:
						return 0;
					}
					_t87 =  &(_t86[9]);
					_t66 =  *_t64(_t87);
					if(_t66 == 0) {
						_t88 =  *_t87;
						if(_t88 == 0) {
							goto L16;
						}
						_t68 =  *((intOrPtr*)(_t88->i + 0xc))(_t88);
						_v16 = _v16 & 0x00000000;
						_v12 = _t68;
						if(_t68 <= 0) {
							goto L16;
						}
						_t47 = _t106 + 0x40; // 0x40
						_t116 = _t47;
						do {
							E010ECD07(_t116);
							_t94 =  *(_t116 + 4);
							_t103 =  *_t116;
							_t70 = _v16;
							 *((intOrPtr*)(_t103 + _t94 * 8)) =  *((intOrPtr*)(_t106 + 0x10)) - 1;
							 *((intOrPtr*)(_t103 + 4 + _t94 * 8)) = _t70;
							 *(_t116 + 4) =  *(_t116 + 4) + 1;
							_t71 = _t70 + 1;
							_v16 = _t71;
						} while (_t71 < _v12);
						goto L16;
					}
				} else {
					_v16 = 1;
					_t72 = GetProcAddress( *_t86, "GetNumberOfMethods");
					if(_t72 == 0) {
						L3:
						_v8 = _v8 & 0x00000000;
						if(_v16 <= 0) {
							goto L10;
						} else {
							while(1) {
								_v60 =  *((intOrPtr*)(_t106 + 0x10)) - 1;
								_push( &_v52);
								_push( &_v48);
								_push(3);
								_v56 = _v8;
								_t66 = E010EB452(_t86[5], _v8, _t106);
								if(_t66 != 0) {
									goto L17;
								}
								_push( &_v51);
								_push( &_v32);
								_push(2);
								_t66 = E010EB452(_t86[5], _v8, _t106);
								if(_t66 == 0) {
									_t97 = 0xb;
									_t31 = memcpy( &_v104,  &_v60, _t97 << 2) + 0x34; // 0x34
									_t118 = _t31;
									E010ECCB3(_t118);
									_t100 = 0xb;
									_t84 = memcpy( *(_t118 + 4) * 0x2c +  *_t118,  &_v104, _t100 << 2);
									_t121 = _t121 + 0x18;
									 *((intOrPtr*)(_t84 + 4)) =  *((intOrPtr*)(_t84 + 4)) + 1;
									_v8 = _v8 + 1;
									if(_v8 < _v16) {
										_t106 = _v12;
										continue;
									} else {
										_t106 = _v12;
										goto L10;
									}
								}
								goto L17;
							}
						}
					} else {
						_t66 =  *_t72( &_v16);
						if(_t66 == 0) {
							goto L3;
						}
					}
				}
				L17:
				return _t66;
			}

0x010eb2f1
0x010eb304
0x010eb307
0x010eb314
0x010eb320
0x010eb325
0x010eb329
0x010eb32c
0x010eb3f4
0x010eb3fb
0x010eb3ff
0x010eb44b
0x00000000
0x010eb44b
0x010eb401
0x010eb405
0x010eb409
0x010eb40b
0x010eb40f
0x00000000
0x00000000
0x010eb414
0x010eb417
0x010eb41b
0x010eb420
0x00000000
0x00000000
0x010eb422
0x010eb422
0x010eb425
0x010eb42b
0x010eb430
0x010eb433
0x010eb435
0x010eb438
0x010eb43b
0x010eb43f
0x010eb442
0x010eb446
0x010eb446
0x00000000
0x010eb425
0x010eb332
0x010eb337
0x010eb340
0x010eb344
0x010eb354
0x010eb354
0x010eb35c
0x00000000
0x010eb362
0x010eb367
0x010eb371
0x010eb377
0x010eb37b
0x010eb37c
0x010eb37e
0x010eb381
0x010eb388
0x00000000
0x00000000
0x010eb397
0x010eb39b
0x010eb39c
0x010eb39e
0x010eb3a5
0x010eb3b0
0x010eb3b9
0x010eb3b9
0x010eb3be
0x010eb3d0
0x010eb3d7
0x010eb3d7
0x010eb3d9
0x010eb3dc
0x010eb3e5
0x010eb364
0x00000000
0x010eb3eb
0x010eb3f1
0x00000000
0x010eb3f1
0x010eb3e5
0x00000000
0x010eb3a5
0x010eb367
0x010eb346
0x010eb34a
0x010eb34e
0x00000000
0x00000000
0x010eb34e
0x010eb344
0x010eb451
0x010eb451

APIs

GetProcAddress.KERNEL32(00000004,CreateDecoder), ref: 010EB30D
GetProcAddress.KERNEL32(00000004,CreateEncoder), ref: 010EB319
GetProcAddress.KERNEL32(00000004,GetMethodProperty), ref: 010EB325
GetProcAddress.KERNEL32(00000004,GetNumberOfMethods), ref: 010EB340
GetProcAddress.KERNEL32(00000004,GetHashers), ref: 010EB3FB

Strings

CreateEncoder, xrefs: 010EB30F
Net, xrefs: 010EB3EB
GetMethodProperty, xrefs: 010EB31B
CreateDecoder, xrefs: 010EB2F9
GetNumberOfMethods, xrefs: 010EB332
GetHashers, xrefs: 010EB3F4

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods$Net
API String ID: 190572456-4292736817
Opcode ID: c728a3e7ae11741b10b033586fe63163a1816c1b4938ce23b094b61b1cc59830
Instruction ID: d0446f076a03164311ee4602a7c4d422e6719b7cf96b44aee8fa433e573d6e17
Opcode Fuzzy Hash: c728a3e7ae11741b10b033586fe63163a1816c1b4938ce23b094b61b1cc59830
Instruction Fuzzy Hash: 6B415A72E00209AFDF15DFA6C984AAEBBF5FF44304F1040A6E951AB241DB70EA15CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01100C38 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01100C38(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				intOrPtr _v8;
				void* __ecx;
				struct _IO_FILE** _t34;
				struct _IO_FILE** _t42;
				struct _IO_FILE** _t45;
				signed int _t52;
				char* _t56;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t73;
				intOrPtr _t75;
				struct _IO_FILE** _t81;
				intOrPtr _t86;
				void* _t90;
				void* _t91;
				void* _t93;

				_t90 = __eflags;
				_t69 = __edx;
				_push(_t56);
				_push(_t56);
				_t81 =  *0x11146fc; // 0x1114440
				E010D1CAE(_t81);
				fputs(_t56,  *_t81);
				fputs(" Time =",  *_t81);
				_t82 = E01103B80(_a4, _a8, 0x989680, 0);
				_t58 = 6;
				E01100BE8(_t58, 0x20, _t90, _t31, _t69);
				_t34 =  *0x11146fc; // 0x1114440
				fputc(0x2e,  *_t34);
				_t73 = 0x30;
				_t61 = 3;
				E01100BE8(_t61, 0x30, _t90, (_a4 - _t82 * 0x989680) / 0x2710, 0);
				_t91 = _a8 - 0x1000000;
				if(_t91 >= 0) {
					if(_t91 > 0) {
						L3:
						_t75 = _a8;
						_t67 = 1;
						_a4 = E01103C70(_a4, _t67, _t75);
						_a8 = _t75;
						_t73 = _a16;
						_t68 = 1;
						_t52 = E01103C70(_a12, _t68, _t73);
						_t93 = _a8 - 0x1000000;
						_a12 = _t52;
						_a16 = _t73;
					} else {
						L2:
						if(_a4 > 0) {
							do {
								goto L3;
							} while (_t93 > 0);
							if(_t93 >= 0) {
								goto L2;
							}
						}
					}
				}
				_t86 = 0;
				_t94 = _a12 | _a16;
				_v8 = 0;
				if((_a12 | _a16) != 0) {
					_t86 = E01103B80(E01103D00(_a4, _a8, 0x64, 0), _t73, _a12, _a16);
					_v8 = _t73;
				}
				_t42 =  *0x11146fc; // 0x1114440
				fputs(" =",  *_t42);
				_t64 = 5;
				E01100BE8(_t64, 0x20, _t94, _t86, _v8);
				_t45 =  *0x11146fc; // 0x1114440
				return fputc(0x25,  *_t45);
			}

0x01100c38
0x01100c38
0x01100c3b
0x01100c3c
0x01100c3f
0x01100c4a
0x01100c58
0x01100c61
0x01100c78
0x01100c80
0x01100c83
0x01100c88
0x01100c97
0x01100cae
0x01100cb3
0x01100cb7
0x01100cc1
0x01100cc4
0x01100cc6
0x01100cce
0x01100cd1
0x01100cd6
0x01100cdc
0x01100ce4
0x01100ce7
0x01100cea
0x01100ceb
0x01100cf0
0x01100cf3
0x01100cf6
0x01100cc8
0x01100cc8
0x01100ccc
0x01100cce
0x00000000
0x00000000
0x01100cfb
0x00000000
0x00000000
0x01100cfb
0x01100ccc
0x01100cc6
0x01100d00
0x01100d02
0x01100d05
0x01100d08
0x01100d25
0x01100d27
0x01100d27
0x01100d2a
0x01100d36
0x01100d3e
0x01100d43
0x01100d48
0x01100d59

APIs

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

fputs.MSVCRT ref: 01100C58
fputs.MSVCRT ref: 01100C61
__aulldiv.LIBCMT ref: 01100C73

Part of subcall function 01100BE8: fputs.MSVCRT ref: 01100C29

fputc.MSVCRT ref: 01100C97
__aulldiv.LIBCMT ref: 01100D20
fputs.MSVCRT ref: 01100D36
fputc.MSVCRT ref: 01100D51

Strings

F}w, xrefs: 01100C4F, 01100C5A, 01100C93, 01100D2F, 01100D4D
Time =, xrefs: 01100C5C
Kernel , xrefs: 01100C3B, 01100C3C, 01100C51

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc$__aulldiv
String ID: F}w$ Time =$Kernel
API String ID: 3602660170-3348612682
Opcode ID: 98adabbf872adf732cd477ee21f524bb0df0e7091eb358414bf396e5289f670b
Instruction ID: 13b872b24c46fd54b0b22a9b4814a2f139e6d811f8474c9e9e3189fc078fcd91
Opcode Fuzzy Hash: 98adabbf872adf732cd477ee21f524bb0df0e7091eb358414bf396e5289f670b
Instruction Fuzzy Hash: 3A31C032A00209BFEB1ADF98DC01F9E77A5EF48764F10802AF9149B2D0DBB19D50CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01100D5C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E01100D5C(char* __ecx, void* __eflags) {
				void* __ebx;
				void* _t17;
				struct _IO_FILE** _t19;
				int _t22;
				void* _t23;
				struct _IO_FILE** _t24;
				char* _t26;
				void* _t29;
				void* _t30;
				intOrPtr _t39;
				struct _IO_FILE** _t42;
				intOrPtr _t43;
				void* _t48;
				void* _t54;

				_t54 = __eflags;
				E011039E0(E0110788C, _t48);
				_t42 =  *0x11146fc; // 0x1114440
				_t26 = __ecx;
				fputs("    ",  *_t42);
				fputs(_t26,  *_t42);
				fputs(" Memory =",  *_t42);
				_t39 =  *((intOrPtr*)(_t48 + 0xc));
				_t43 = 0;
				asm("adc edx, edi");
				_t29 = 0x14;
				_t17 = E01103C70( *((intOrPtr*)(_t48 + 8)) + 0xfffff, _t29, _t39);
				_push(_t39);
				_push(_t17);
				_t30 = 7;
				E01100BE8(_t30, 0x20, _t54);
				_t19 =  *0x11146fc; // 0x1114440
				fputs(" MB",  *_t19);
				E010D232F(_t48 - 0x18);
				 *((intOrPtr*)(_t48 - 4)) = _t43;
				_t22 = E010E2E4D(_t26, _t48 - 0x18);
				if( *((intOrPtr*)(_t48 - 0x14)) != _t43) {
					_t24 =  *0x11146fc; // 0x1114440
					_t22 = fputs( *(_t48 - 0x18),  *_t24);
				}
				_t23 = E010D1ABD(_t22,  *(_t48 - 0x18));
				 *[fs:0x0] =  *((intOrPtr*)(_t48 - 0xc));
				return _t23;
			}

0x01100d5c
0x01100d61
0x01100d72
0x01100d78
0x01100d81
0x01100d86
0x01100d8f
0x01100d94
0x01100da1
0x01100da4
0x01100da6
0x01100da7
0x01100dac
0x01100dad
0x01100db2
0x01100db3
0x01100db8
0x01100dc4
0x01100dcb
0x01100dd3
0x01100dd6
0x01100dde
0x01100de0
0x01100dea
0x01100ded
0x01100df1
0x01100dfd
0x01100e05

APIs

__EH_prolog.LIBCMT ref: 01100D61
fputs.MSVCRT ref: 01100D81
fputs.MSVCRT ref: 01100D86
fputs.MSVCRT ref: 01100D8F

Part of subcall function 01100BE8: fputs.MSVCRT ref: 01100C29

fputs.MSVCRT ref: 01100DC4
fputs.MSVCRT ref: 01100DEA

Strings

Memory =, xrefs: 01100D8A
F}w, xrefs: 01100D7A, 01100D83, 01100D88, 01100DBD, 01100DE5
, xrefs: 01100D7C
MB, xrefs: 01100DBF

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: $ F}w$ MB$ Memory =
API String ID: 2614055831-1186621970
Opcode ID: 6ffb585b85374658c0cc1d1c9c88990a6a68e7dad15dd845acda1513b2e4121e
Instruction ID: 3d3ddbc803ce75b023173efffe05863514e5db21803365af6dafdccde13f57d0
Opcode Fuzzy Hash: 6ffb585b85374658c0cc1d1c9c88990a6a68e7dad15dd845acda1513b2e4121e
Instruction Fuzzy Hash: 4911E372E00206EFC71AAB94DC42EAEBB75FF58724F10402BF500922D4EBB16890CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010FD2F3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E010FD2F3(struct _IO_FILE** __ecx, intOrPtr* __edx, char _a4) {
				void* __ebp;
				intOrPtr* _t14;
				struct _IO_FILE** _t15;
				char* _t18;

				_t14 = __edx;
				_t15 = __ecx;
				_t18 = "WARNING";
				if(_a4 == 0) {
					_t18 = 0x110a408;
				}
				fputs("Open ",  *_t15);
				fputs(_t18,  *_t15);
				fputs(": Can not open the file as [",  *_t15);
				_push( *_t14);
				_t16 = E010D1CC1(_t15);
				fputs("] archive",  *_t5);
				return E010D1CAE(_t16);
			}

0x010fd2f3
0x010fd2fc
0x010fd2fe
0x010fd303
0x010fd305
0x010fd305
0x010fd319
0x010fd31e
0x010fd327
0x010fd32e
0x010fd334
0x010fd33d
0x010fd34c

APIs

fputs.MSVCRT ref: 010FD319
fputs.MSVCRT ref: 010FD31E
fputs.MSVCRT ref: 010FD327
fputs.MSVCRT ref: 010FD33D

Strings

] archive, xrefs: 010FD338
: Can not open the file as [, xrefs: 010FD322
WARNING, xrefs: 010FD2FE
Open , xrefs: 010FD314
ERROR, xrefs: 010FD305, 010FD31D

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
API String ID: 1795875747-2741933734
Opcode ID: 534dab50c6b223871ea9fd9e316e12fd3ba6a76aebdbcc1a56ea4393f62449c5
Instruction ID: 78b98137402c548a89921429ac666ae1018ef8c9eb52419cc817cef2382cfaa7
Opcode Fuzzy Hash: 534dab50c6b223871ea9fd9e316e12fd3ba6a76aebdbcc1a56ea4393f62449c5
Instruction Fuzzy Hash: 3BF02732F0431D3BC60A26966C84E1FBF5ADFC4260B24402BF90443281EFB21C609FA4

Uniqueness

Uniqueness Score: -1.00%

Function 010FB2C4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 252
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E010FB2C4(void* __ecx) {
				void* __edi;
				struct _IO_FILE** _t107;
				void* _t108;
				void* _t123;
				signed int _t161;
				signed int _t163;
				void* _t164;
				struct _IO_FILE** _t165;
				struct _IO_FILE** _t166;
				intOrPtr _t214;
				void* _t216;
				intOrPtr _t219;
				void* _t220;
				intOrPtr* _t221;
				void* _t223;
				void* _t225;

				E011039E0(E01107148, _t225);
				_t223 = __ecx;
				_t161 = 0;
				_push(_t216);
				if( *((intOrPtr*)(__ecx + 0xbc)) != 0) {
					E0110183F(__ecx + 0x18, _t216, 1);
					if( *((intOrPtr*)(_t223 + 0xbc)) != 0) {
						 *((intOrPtr*)(_t223 + 0x28)) = 0;
						 *((intOrPtr*)(_t223 + 0x2c)) = 0;
						 *((intOrPtr*)(_t223 + 0x34)) = 0;
						 *( *(_t223 + 0x30)) =  *( *(_t223 + 0x30)) & 0;
						 *((intOrPtr*)(_t223 + 0x40)) = 0;
						 *((short*)( *((intOrPtr*)(_t223 + 0x3c)))) = 0;
					}
				}
				E010FA997(_t223);
				 *(_t225 - 0x10) = _t161;
				if( *((intOrPtr*)( *((intOrPtr*)(_t225 + 0xc)) + 4)) <= _t161) {
					L44:
					if( *((intOrPtr*)(_t225 + 0x14)) != _t161) {
						 *((intOrPtr*)(_t223 + 0x130)) =  *((intOrPtr*)(_t223 + 0x130)) + 1;
						_t169 =  *(_t223 + 0xc8);
						asm("adc [eax+0x4], ebx");
						__eflags =  *(_t223 + 0xc8) - _t161;
						if( *(_t223 + 0xc8) != _t161) {
							E010D1C9F(_t169);
						}
						_t107 =  *(_t223 + 0xcc);
						__eflags = _t107 - _t161;
						if(_t107 == _t161) {
							L58:
							_t108 = E010FA3B2();
							goto L59;
						} else {
							fputs( *0x110aa1c,  *_t107);
							_push( *((intOrPtr*)(_t225 + 0x10)));
							E010D1E60( *(_t223 + 0xcc), _t212);
							E010D1CAE( *(_t223 + 0xcc));
							_t108 = E010FD3B2( *(_t223 + 0xcc),  *((intOrPtr*)(_t225 + 8)), _t225,  *((intOrPtr*)(_t225 + 0xc)));
							__eflags = _t108 - _t161;
							if(_t108 != _t161) {
								L59:
								 *[fs:0x0] =  *((intOrPtr*)(_t225 - 0xc));
								return _t108;
							}
							_t214 =  *((intOrPtr*)(_t225 + 0x14));
							__eflags = _t214 - 1;
							if(_t214 != 1) {
								__eflags = _t214 - 0x8007000e;
								if(__eflags != 0) {
									_push( *((intOrPtr*)(E010D4B4D(_t225 - 0x24, _t214, __eflags))));
									 *(_t225 - 4) = _t161;
									E010D1ABD(E010D1CC1( *(_t223 + 0xcc)),  *((intOrPtr*)(_t225 - 0x24)));
								} else {
									fputs("Can\'t allocate required memory",  *( *(_t223 + 0xcc)));
								}
								E010D1CAE( *(_t223 + 0xcc));
							}
							E010D1C9F( *(_t223 + 0xcc));
							goto L58;
						}
					}
					_t182 =  *(_t223 + 0xc8);
					if( *(_t223 + 0xc8) == _t161) {
						goto L58;
					}
					_t108 = E010FCD30(_t182,  *((intOrPtr*)(_t225 + 8)),  *((intOrPtr*)(_t225 + 0xc)));
					if(_t108 != _t161) {
						goto L59;
					}
					E010D1CAE( *(_t223 + 0xc8));
					goto L58;
				} else {
					goto L4;
				}
				do {
					L4:
					_t219 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t225 + 0xc)))) +  *(_t225 - 0x10) * 4));
					 *((intOrPtr*)(_t225 - 0x14)) = _t219;
					_t220 = _t219 + 0x10;
					_t163 =  *(_t220 + 4);
					if( *((char*)(_t220 + 1)) != 0) {
						_t163 = _t163 | 0x00000020;
					}
					if(_t163 != 0 ||  *((intOrPtr*)(_t220 + 0x1c)) != _t163) {
						_t185 =  *(_t223 + 0xcc);
						if( *(_t223 + 0xcc) != 0) {
							E010D1CAE(_t185);
							if( *(_t225 - 0x10) != 0) {
								E010D1E52( *((intOrPtr*)(_t225 - 0x14)) + 0x70);
								E010D1CAE( *(_t223 + 0xcc));
							}
						}
						if(_t163 != 0) {
							_t208 =  *(_t223 + 0xcc);
							if( *(_t223 + 0xcc) != 0) {
								_t212 = "ERRORS:";
								E010FB09C(_t208, "ERRORS:", _t163);
							}
							 *((intOrPtr*)(_t223 + 0x148)) =  *((intOrPtr*)(_t223 + 0x148)) + 1;
							 *((char*)(_t223 + 0x120)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						if( *((intOrPtr*)(_t220 + 0x1c)) != 0) {
							_t166 =  *(_t223 + 0xcc);
							if(_t166 != 0) {
								 *((intOrPtr*)(_t225 - 0x18)) =  *((intOrPtr*)(_t220 + 0x18));
								fputs("ERRORS:",  *_t166);
								E010D1CAE(_t166);
								_push( *((intOrPtr*)(_t225 - 0x18)));
								E010D1CAE(E010D1CC1(_t166));
							}
							 *((intOrPtr*)(_t223 + 0x148)) =  *((intOrPtr*)(_t223 + 0x148)) + 1;
							 *((char*)(_t223 + 0x120)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						_t186 =  *(_t223 + 0xcc);
						if( *(_t223 + 0xcc) != 0) {
							E010D1CAE(_t186);
							E010D1C9F( *(_t223 + 0xcc));
						}
					}
					_t123 = E010FB66A(_t220);
					_t164 = _t123;
					if(_t164 != 0 ||  *((intOrPtr*)(_t220 + 0x28)) != _t123) {
						_t188 =  *(_t223 + 0xc8);
						if( *(_t223 + 0xc8) != 0) {
							E010D1CAE(_t188);
							if( *(_t225 - 0x10) != 0) {
								E010D1E52( *((intOrPtr*)(_t225 - 0x14)) + 0x70);
								E010D1CAE( *(_t223 + 0xc8));
							}
						}
						if(_t164 != 0) {
							_t199 =  *(_t223 + 0xc8);
							if( *(_t223 + 0xc8) != 0) {
								_t212 = "WARNINGS:";
								E010FB09C(_t199, "WARNINGS:", _t164);
							}
							 *((intOrPtr*)(_t223 + 0x150)) =  *((intOrPtr*)(_t223 + 0x150)) + 1;
							 *((char*)(_t223 + 0x121)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						if( *((intOrPtr*)(_t220 + 0x28)) != 0) {
							_t165 =  *(_t223 + 0xc8);
							if(_t165 != 0) {
								 *((intOrPtr*)(_t225 - 0x18)) =  *((intOrPtr*)(_t220 + 0x24));
								fputs("WARNINGS:",  *_t165);
								E010D1CAE(_t165);
								_push( *((intOrPtr*)(_t225 - 0x18)));
								E010D1CAE(E010D1CC1(_t165));
							}
							 *((intOrPtr*)(_t223 + 0x150)) =  *((intOrPtr*)(_t223 + 0x150)) + 1;
							 *((char*)(_t223 + 0x121)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						_t189 =  *(_t223 + 0xc8);
						if( *(_t223 + 0xc8) != 0) {
							E010D1CAE(_t189);
							if( *((char*)(_t223 + 0x168)) != 0) {
								E010D1C9F( *(_t223 + 0xc8));
							}
						}
					}
					if( *((intOrPtr*)(_t220 + 0xc)) >= 0) {
						_t191 =  *(_t223 + 0xc8);
						_t221 = _t223 + 0xc8;
						_t258 =  *(_t223 + 0xc8);
						if( *(_t223 + 0xc8) != 0) {
							_push( *((intOrPtr*)(_t225 - 0x14)));
							_t212 =  *((intOrPtr*)(_t225 + 8));
							E010FB1E7(_t191,  *((intOrPtr*)(_t225 + 8)), _t258);
							if( *((char*)(_t223 + 0x168)) != 0) {
								E010D1C9F( *_t221);
							}
						}
						 *((char*)(_t223 + 0x121)) = 1;
					}
					 *(_t225 - 0x10) =  *(_t225 - 0x10) + 1;
				} while ( *(_t225 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t225 + 0xc)) + 4)));
				_t161 = 0;
				goto L44;
			}

0x010fb2c9
0x010fb2d3
0x010fb2d5
0x010fb2d7
0x010fb2de
0x010fb2e5
0x010fb2f0
0x010fb2f2
0x010fb2f5
0x010fb2fb
0x010fb2fe
0x010fb303
0x010fb306
0x010fb306
0x010fb2f0
0x010fb30b
0x010fb313
0x010fb319
0x010fb558
0x010fb55b
0x010fb58e
0x010fb595
0x010fb5a1
0x010fb5a4
0x010fb5a6
0x010fb5a8
0x010fb5a8
0x010fb5ad
0x010fb5b3
0x010fb5b5
0x010fb654
0x010fb654
0x00000000
0x010fb5bb
0x010fb5c9
0x010fb5cd
0x010fb5d6
0x010fb5e1
0x010fb5f2
0x010fb5f7
0x010fb5f9
0x010fb659
0x010fb65f
0x010fb667
0x010fb667
0x010fb5fb
0x010fb5fe
0x010fb601
0x010fb603
0x010fb609
0x010fb625
0x010fb62d
0x010fb638
0x010fb60b
0x010fb618
0x010fb61a
0x010fb644
0x010fb644
0x010fb64f
0x00000000
0x010fb64f
0x010fb5b5
0x010fb55d
0x010fb565
0x00000000
0x00000000
0x010fb571
0x010fb578
0x00000000
0x00000000
0x010fb584
0x00000000
0x00000000
0x00000000
0x00000000
0x010fb31f
0x010fb31f
0x010fb327
0x010fb32a
0x010fb32d
0x010fb334
0x010fb337
0x010fb339
0x010fb339
0x010fb33e
0x010fb349
0x010fb351
0x010fb353
0x010fb35c
0x010fb36b
0x010fb376
0x010fb376
0x010fb35c
0x010fb37d
0x010fb37f
0x010fb387
0x010fb38a
0x010fb38f
0x010fb38f
0x010fb394
0x010fb3a1
0x010fb3a8
0x010fb3a8
0x010fb3b0
0x010fb3b2
0x010fb3ba
0x010fb3c1
0x010fb3c9
0x010fb3d3
0x010fb3d8
0x010fb3e4
0x010fb3e4
0x010fb3e9
0x010fb3f6
0x010fb3fd
0x010fb3fd
0x010fb401
0x010fb409
0x010fb40b
0x010fb416
0x010fb416
0x010fb409
0x010fb41d
0x010fb422
0x010fb426
0x010fb431
0x010fb439
0x010fb43b
0x010fb444
0x010fb453
0x010fb45e
0x010fb45e
0x010fb444
0x010fb465
0x010fb467
0x010fb46f
0x010fb472
0x010fb477
0x010fb477
0x010fb47c
0x010fb489
0x010fb490
0x010fb490
0x010fb498
0x010fb49a
0x010fb4a2
0x010fb4a9
0x010fb4b1
0x010fb4bb
0x010fb4c0
0x010fb4cc
0x010fb4cc
0x010fb4d1
0x010fb4de
0x010fb4e5
0x010fb4e5
0x010fb4e9
0x010fb4f1
0x010fb4f3
0x010fb4ff
0x010fb507
0x010fb507
0x010fb4ff
0x010fb4f1
0x010fb510
0x010fb512
0x010fb518
0x010fb51e
0x010fb520
0x010fb522
0x010fb525
0x010fb528
0x010fb534
0x010fb538
0x010fb538
0x010fb534
0x010fb53d
0x010fb53d
0x010fb544
0x010fb54d
0x010fb556
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010FB2C9
fputs.MSVCRT ref: 010FB3C9

Part of subcall function 0110183F: fputs.MSVCRT ref: 011018A8

fputs.MSVCRT ref: 010FB4B1
fputs.MSVCRT ref: 010FB5C9
fputs.MSVCRT ref: 010FB618

Part of subcall function 010D1C9F: fflush.MSVCRT ref: 010D1CA1

Part of subcall function 010D4B4D: __EH_prolog.LIBCMT ref: 010D4B52

Part of subcall function 010D1CC1: __EH_prolog.LIBCMT ref: 010D1CC6
Part of subcall function 010D1CC1: fputs.MSVCRT ref: 010D1D39

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Strings

Can't allocate required memory, xrefs: 010FB613
WARNINGS:, xrefs: 010FB472, 010FB4AC
ERRORS:, xrefs: 010FB38A, 010FB3C4

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog$fflushfree
String ID: Can't allocate required memory$ERRORS:$WARNINGS:
API String ID: 1750297421-1898165966
Opcode ID: 249a6d1f9626e65a8135b420e821fe5049176b2f03467a5fc7981e84c8cc65a5
Instruction ID: 3af0eae5613d3a983adfdd71aaa5801d37218bef19b18a12351ff353d1a42308
Opcode Fuzzy Hash: 249a6d1f9626e65a8135b420e821fe5049176b2f03467a5fc7981e84c8cc65a5
Instruction Fuzzy Hash: C8B15A30A01706CFEB65EF68C895BEABBE2BF54304F14856DD69A47A90CB74A844CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010FB6CD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E010FB6CD(void* __ecx) {
				void* __edi;
				intOrPtr* _t65;
				intOrPtr _t76;
				struct _IO_FILE** _t91;
				struct _CRITICAL_SECTION* _t97;
				struct _IO_FILE** _t99;
				struct _IO_FILE** _t102;
				void* _t104;
				intOrPtr _t105;
				void* _t107;

				E011039E0(E01107164, _t107);
				_t97 = 0x11146e0;
				_t104 = __ecx;
				 *(_t107 - 0x10) = 0x11146e0;
				EnterCriticalSection(0x11146e0);
				 *((intOrPtr*)(_t107 - 4)) = 0;
				if( *((intOrPtr*)(_t104 + 0xbc)) != 0) {
					E0110183F(_t104 + 0x18, 0x11146e0, 1);
					 *((intOrPtr*)(_t104 + 0x34)) = 0;
					 *((char*)( *((intOrPtr*)(_t104 + 0x30)))) = 0;
					 *((intOrPtr*)(_t104 + 0x40)) = 0;
					 *((short*)( *((intOrPtr*)(_t104 + 0x3c)))) = 0;
				}
				_t75 =  *(_t104 + 0xc8);
				if( *(_t104 + 0xc8) != 0) {
					E010D1C9F(_t75);
				}
				_t76 =  *((intOrPtr*)(_t107 + 8));
				if(_t76 != 0) {
					 *((intOrPtr*)(_t104 + 0x138)) =  *((intOrPtr*)(_t104 + 0x138)) + 1;
					asm("adc [eax+0x4], ebx");
					__eflags = _t76 - 0x80004004;
					if(_t76 == 0x80004004) {
						L27:
						_t105 = _t76;
					} else {
						__eflags = _t76 - 0x70;
						if(_t76 == 0x70) {
							goto L27;
						} else {
							_t99 =  *(_t104 + 0xcc);
							__eflags = _t99;
							if(_t99 != 0) {
								E010D1CAE(_t99);
								fputs( *0x110aa1c,  *_t99);
								_t95 =  *((intOrPtr*)(_t107 + 8));
								__eflags =  *((intOrPtr*)(_t107 + 8)) - 0x8007000e;
								if(__eflags != 0) {
									_push( *((intOrPtr*)(E010D4B4D(_t107 - 0x1c, _t95, __eflags))));
									 *((char*)(_t107 - 4)) = 1;
									E010D1ABD(E010D1CC1( *(_t104 + 0xcc)),  *((intOrPtr*)(_t107 - 0x1c)));
								} else {
									fputs( *0x110aa2c,  *( *(_t104 + 0xcc)));
								}
								E010D1CAE( *(_t104 + 0xcc));
								_t85 =  *(_t104 + 0xcc);
								goto L25;
							}
							goto L26;
						}
					}
				} else {
					if(( *(_t104 + 0x160) |  *(_t104 + 0x164)) != 0 ||  *((intOrPtr*)(_t104 + 0x120)) != 0) {
						 *((intOrPtr*)(_t104 + 0x138)) =  *((intOrPtr*)(_t104 + 0x138)) + 1;
						_t87 =  *(_t104 + 0xc8);
						asm("adc [eax+0x4], ebx");
						__eflags =  *(_t104 + 0xc8);
						if( *(_t104 + 0xc8) != 0) {
							E010D1CAE(_t87);
							__eflags =  *(_t104 + 0x160) |  *(_t104 + 0x164);
							if(( *(_t104 + 0x160) |  *(_t104 + 0x164)) != 0) {
								_t101 =  *(_t104 + 0xc8);
								fputs("Sub items Errors: ",  *( *(_t104 + 0xc8)));
								_t91 = E010D1F47(_t101,  *(_t104 + 0x160),  *(_t104 + 0x164));
								goto L14;
							}
						}
					} else {
						_t65 = _t104 + 0x140;
						if( *((intOrPtr*)(_t104 + 0x121)) == 0) {
							_t65 = _t104 + 0x128;
						}
						 *_t65 =  *_t65 + 1;
						_t102 =  *(_t104 + 0xc8);
						asm("adc [eax+0x4], ebx");
						if(_t102 != 0) {
							fputs( *0x110aa38,  *_t102);
							_t91 = _t102;
							L14:
							E010D1CAE(_t91);
						}
					}
					_t85 =  *(_t104 + 0xc8);
					if( *(_t104 + 0xc8) != 0 &&  *((intOrPtr*)(_t104 + 0x168)) != 0) {
						L25:
						E010D1C9F(_t85);
					}
					L26:
					_t105 = E010FA3B2();
					_t97 = 0x11146e0;
				}
				LeaveCriticalSection(_t97);
				 *[fs:0x0] =  *((intOrPtr*)(_t107 - 0xc));
				return _t105;
			}

0x010fb6d2
0x010fb6dd
0x010fb6e2
0x010fb6e5
0x010fb6e8
0x010fb6f6
0x010fb6f9
0x010fb700
0x010fb708
0x010fb70b
0x010fb710
0x010fb713
0x010fb713
0x010fb716
0x010fb71e
0x010fb720
0x010fb720
0x010fb725
0x010fb72a
0x010fb7f9
0x010fb806
0x010fb809
0x010fb80f
0x010fb8a5
0x010fb8a5
0x010fb815
0x010fb815
0x010fb818
0x00000000
0x010fb81e
0x010fb81e
0x010fb824
0x010fb826
0x010fb82a
0x010fb83d
0x010fb83f
0x010fb843
0x010fb84a
0x010fb867
0x010fb86f
0x010fb87b
0x010fb84c
0x010fb85a
0x010fb85c
0x010fb887
0x010fb88c
0x00000000
0x010fb88c
0x00000000
0x010fb826
0x010fb818
0x010fb730
0x010fb73c
0x010fb77e
0x010fb785
0x010fb791
0x010fb794
0x010fb796
0x010fb798
0x010fb7a3
0x010fb7a9
0x010fb7ab
0x010fb7b8
0x010fb7d3
0x00000000
0x010fb7d3
0x010fb7a9
0x010fb746
0x010fb74c
0x010fb752
0x010fb754
0x010fb754
0x010fb75a
0x010fb75d
0x010fb763
0x010fb768
0x010fb772
0x010fb77a
0x010fb7d5
0x010fb7d5
0x010fb7d5
0x010fb768
0x010fb7da
0x010fb7e2
0x010fb892
0x010fb892
0x010fb892
0x010fb897
0x010fb89c
0x010fb89e
0x010fb89e
0x010fb8a8
0x010fb8b6
0x010fb8be

APIs

__EH_prolog.LIBCMT ref: 010FB6D2
EnterCriticalSection.KERNEL32(011146E0), ref: 010FB6E8
fputs.MSVCRT ref: 010FB772
LeaveCriticalSection.KERNEL32(011146E0), ref: 010FB8A8

Part of subcall function 0110183F: fputs.MSVCRT ref: 011018A8

fputs.MSVCRT ref: 010FB7B8

Part of subcall function 010D1F47: fputs.MSVCRT ref: 010D1F64

fputs.MSVCRT ref: 010FB83D
fputs.MSVCRT ref: 010FB85A

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Strings

Sub items Errors: , xrefs: 010FB7B3

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$CriticalSection$EnterH_prologLeavefputc
String ID: Sub items Errors:
API String ID: 2670240366-2637271492
Opcode ID: 44150263bdfa24e22175d9ecc429e307759c4ca5e9304a70a36c4fb54d13e6cc
Instruction ID: 1537bea69cd1ce9cdf5302583674f60ac65d319e25ed11ca6fef87e86359f702
Opcode Fuzzy Hash: 44150263bdfa24e22175d9ecc429e307759c4ca5e9304a70a36c4fb54d13e6cc
Instruction Fuzzy Hash: 5E519031900745DFE76ADF68D881AEABBE2FF94314F18446ED29A47A50CB717880CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D56B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D56B4(intOrPtr __ecx, void* __edx, signed short** _a4, signed char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v28;
				void* __ebp;
				signed int _t21;
				signed int _t22;
				signed int _t23;
				signed char _t26;
				long _t28;
				signed int _t34;
				signed char _t35;
				void* _t40;
				void* _t42;
				void* _t49;
				unsigned int _t53;
				signed short** _t54;
				unsigned int _t59;
				void* _t60;

				_t42 = __edx;
				_v12 = __ecx;
				_t21 = GetCurrentThreadId();
				_t22 = GetTickCount();
				_t23 = GetCurrentProcessId();
				_t54 = _a4;
				_t59 = (_t21 << 0x00000002 ^ _t22) << 0x0000000c ^ _t23;
				_v8 = _v8 & 0x00000000;
				do {
					E010D2A28(_t54, _v12);
					if(_t42 == 0) {
						L12:
						_t69 = _a8;
						_t42 = 1;
						if(_a8 != 0) {
							E010D2CAD(_t54, ".tmp");
						}
						if(E010D6229( *_t54, _t69) == 0) {
							__eflags = _a8;
							if(_a8 == 0) {
								_t26 = E010D5008( *_t54);
							} else {
								_t26 = E010D699C( *_t54, 0);
							}
							__eflags = _t26;
							if(_t26 != 0) {
								return 1;
							} else {
								_t28 = GetLastError();
								__eflags = _t28 - 0x50;
								if(_t28 == 0x50) {
									goto L22;
								}
								__eflags = _t28 - 0xb7;
								if(_t28 != 0xb7) {
									break;
								}
								goto L22;
							}
						} else {
							SetLastError(0xb7);
							goto L22;
						}
					}
					_t53 = _t59;
					_t49 = 0;
					do {
						_t34 = _t53 & 0x0000000f;
						_t53 = _t53 >> 4;
						if(_t34 >= 0xa) {
							_t35 = _t34 + 0x37;
							__eflags = _t35;
						} else {
							_t35 = _t34 + 0x30;
						}
						 *(_t60 + _t49 - 0x18) = _t35;
						_t49 = _t49 + 1;
					} while (_t49 < 8);
					 *(_t60 + _t49 - 0x18) =  *(_t60 + _t49 - 0x18) & 0x00000000;
					if(_a8 != 0) {
						E010D1089(_t54, 0x2e);
					}
					E010D2CAD(_t54,  &_v28);
					_t40 = GetTickCount() + 2;
					if(_t40 == 0) {
						_t40 = 1;
					}
					_t59 = _t59 + _t40;
					goto L12;
					L22:
					_v8 = _v8 + 1;
				} while (_v8 < 0x64);
				_t54[1] = _t54[1] & 0x00000000;
				 *( *_t54) =  *( *_t54) & 0x00000000;
				return 0;
			}

0x010d56bd
0x010d56bf
0x010d56c2
0x010d56cd
0x010d56d8
0x010d56de
0x010d56e1
0x010d56e3
0x010d56e7
0x010d56ec
0x010d56f3
0x010d5746
0x010d5746
0x010d574a
0x010d574c
0x010d5755
0x010d5755
0x010d5763
0x010d5775
0x010d5777
0x010d5787
0x010d5779
0x010d577e
0x010d577e
0x010d578c
0x010d578e
0x00000000
0x010d5790
0x010d5790
0x010d5796
0x010d5799
0x00000000
0x00000000
0x010d579b
0x010d57a0
0x00000000
0x00000000
0x00000000
0x010d57a0
0x010d5765
0x010d576a
0x00000000
0x010d576a
0x010d5763
0x010d56f5
0x010d56f7
0x010d56f9
0x010d56fb
0x010d56fe
0x010d5704
0x010d570b
0x010d570b
0x010d5706
0x010d5706
0x010d5706
0x010d570e
0x010d5712
0x010d5713
0x010d5718
0x010d5721
0x010d5727
0x010d5727
0x010d5732
0x010d573e
0x010d573f
0x010d5743
0x010d5743
0x010d5744
0x00000000
0x010d57a2
0x010d57a2
0x010d57a5
0x010d57b1
0x010d57b5
0x00000000

APIs

GetCurrentThreadId.KERNEL32 ref: 010D56C2
GetTickCount.KERNEL32 ref: 010D56CD
GetCurrentProcessId.KERNEL32 ref: 010D56D8
GetTickCount.KERNEL32 ref: 010D5737
SetLastError.KERNEL32(000000B7,?), ref: 010D576A
GetLastError.KERNEL32(?), ref: 010D5790

Part of subcall function 010D5008: __EH_prolog.LIBCMT ref: 010D500D
Part of subcall function 010D5008: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000001), ref: 010D502F

Strings

d, xrefs: 010D57A5
.tmp, xrefs: 010D574E

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryH_prologProcessThread
String ID: .tmp$d
API String ID: 43677640-2797371523
Opcode ID: 3ac71c3cdb44f9e264ee67a3aecebbf029f415ee982bf665b2d514931b69581f
Instruction ID: 36955ac71757184c4b80b199fd056b71b098549fea056f4a386cf54993378024
Opcode Fuzzy Hash: 3ac71c3cdb44f9e264ee67a3aecebbf029f415ee982bf665b2d514931b69581f
Instruction Fuzzy Hash: D9313931E00304DBDB29AB74EC487FD7BB1BF65311F254069ED869B281DB758881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010D8652 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E010D8652(intOrPtr* __ecx) {
				struct _MEMORYSTATUS _v36;
				signed int _v56;
				intOrPtr _v60;
				signed int _v88;
				intOrPtr _v92;
				char _v100;
				_Unknown_base(*)()* _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				signed int _t28;
				intOrPtr* _t29;
				void* _t32;

				_t29 = __ecx;
				 *__ecx = 0x80000000;
				 *(__ecx + 4) =  *(__ecx + 4) & 0x00000000;
				_v100 = 0x40;
				_t20 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GlobalMemoryStatusEx");
				if(_t20 == 0) {
					L8:
					_v36.dwLength = 0x20;
					GlobalMemoryStatus( &_v36);
					_t22 = _v36.dwTotalVirtual;
					if(_t22 >= _v36.dwTotalPhys) {
						_t22 = _v36.dwTotalPhys;
					}
					 *_t29 = _t22;
					 *(_t29 + 4) =  *(_t29 + 4) & 0x00000000;
				} else {
					_push( &_v100);
					if( *_t20() == 0) {
						goto L8;
					} else {
						_t28 = _v56;
						_t25 = _v92;
						_t32 = _t28 - _v88;
						if(_t32 > 0 || _t32 >= 0 && _v60 >= _t25) {
							_t28 = _v88;
						} else {
							_t25 = _v60;
						}
						 *_t29 = _t25;
						 *(_t29 + 4) = _t28;
					}
				}
				return 1;
			}

0x010d8659
0x010d8665
0x010d866b
0x010d866f
0x010d867d
0x010d8685
0x010d86b2
0x010d86b5
0x010d86bd
0x010d86c3
0x010d86c9
0x010d86cb
0x010d86cb
0x010d86ce
0x010d86d0
0x010d8687
0x010d868a
0x010d868f
0x00000000
0x010d8691
0x010d8691
0x010d8694
0x010d8697
0x010d869a
0x010d86a8
0x010d86a3
0x010d86a3
0x010d86a3
0x010d86ab
0x010d86ad
0x010d86ad
0x010d868f
0x010d86d8

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 010D8676
GetProcAddress.KERNEL32(00000000), ref: 010D867D
GlobalMemoryStatus.KERNEL32 ref: 010D86BD

Strings

Net, xrefs: 010D867D
@, xrefs: 010D866F
GlobalMemoryStatusEx, xrefs: 010D865B
kernel32.dll, xrefs: 010D8660
, xrefs: 010D86B5

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: $@$GlobalMemoryStatusEx$kernel32.dll$Net
API String ID: 2450578220-3380815682
Opcode ID: 37737141e057a907600dfcc7316cf618a24f71a9b8e0e1de1923c508c08588e5
Instruction ID: dac684bea5627b25bed97becb2eb29c43abfbd29e108aff660bf01d85e497423
Opcode Fuzzy Hash: 37737141e057a907600dfcc7316cf618a24f71a9b8e0e1de1923c508c08588e5
Instruction Fuzzy Hash: B4113970E053099FDB28DF94C999BADBBF8BF08725F008419E592A7244D7B4A884CB54

Uniqueness

Uniqueness Score: -1.00%

Function 010FA845 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E010FA845(void* __ecx) {
				void* _t29;
				signed int _t31;
				struct _IO_FILE** _t56;
				intOrPtr _t60;
				void* _t61;
				void* _t63;

				E011039E0(E011070A0, _t63);
				_push(__ecx);
				 *(_t63 - 0x10) = 0x11146e0;
				EnterCriticalSection(0x11146e0);
				 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
				_t29 = E010FA3B2();
				if(_t29 == 0) {
					_t60 =  *((intOrPtr*)(_t63 + 8));
					E010FA997(_t60);
					_t56 =  *(_t60 + 0xc8);
					if(_t56 != 0) {
						E010D1CAE(_t56);
						fputs("Would you like to replace the existing file:\n",  *_t56);
						E010FA9BE( *(_t60 + 0xc8),  *((intOrPtr*)(_t63 + 0xc)),  *((intOrPtr*)(_t63 + 0x10)),  *((intOrPtr*)(_t63 + 0x14)));
						fputs("with the file from archive:\n",  *( *(_t60 + 0xc8)));
						E010FA9BE( *(_t60 + 0xc8),  *((intOrPtr*)(_t63 + 0x18)),  *((intOrPtr*)(_t63 + 0x1c)),  *((intOrPtr*)(_t63 + 0x20)));
					}
					_t31 = E01102D21( *(_t60 + 0xc8));
					if(_t31 > 7) {
						L16:
						_t61 = 0x80004005;
						goto L17;
					} else {
						switch( *((intOrPtr*)(_t31 * 4 +  &M010FA977))) {
							case 0:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) =  *( *(__ebp + 0x24)) & 0x00000000;
								goto L12;
							case 1:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 2;
								goto L12;
							case 2:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 1;
								goto L12;
							case 3:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 3;
								goto L12;
							case 4:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 4;
								L12:
								__ecx =  *((intOrPtr*)(__esi + 0xc8));
								if(__ecx != 0) {
									__eax = E010D1CAE(__ecx);
									if( *((char*)(__esi + 0x168)) != 0) {
										__ecx =  *((intOrPtr*)(__esi + 0xc8));
										__eax = E010D1C9F( *((intOrPtr*)(__esi + 0xc8)));
									}
								}
								__eax = E010FA3B2();
								goto L1;
							case 5:
								_t61 = 0x80004004;
								L17:
								LeaveCriticalSection(0x11146e0);
								 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
								return _t61;
							case 6:
								goto L16;
						}
					}
				}
				L1:
				_t61 = _t29;
				goto L17;
			}

0x010fa84a
0x010fa84f
0x010fa858
0x010fa85b
0x010fa861
0x010fa865
0x010fa86c
0x010fa875
0x010fa87b
0x010fa880
0x010fa888
0x010fa88c
0x010fa89e
0x010fa8b1
0x010fa8c3
0x010fa8d6
0x010fa8d6
0x010fa8e1
0x010fa8ea
0x010fa959
0x010fa959
0x00000000
0x010fa8ec
0x010fa8ec
0x00000000
0x010fa91b
0x010fa91e
0x00000000
0x00000000
0x010fa8fa
0x010fa8fd
0x00000000
0x00000000
0x010fa910
0x010fa913
0x00000000
0x00000000
0x010fa905
0x010fa908
0x00000000
0x00000000
0x010fa923
0x010fa926
0x010fa92c
0x010fa92c
0x010fa934
0x010fa936
0x010fa942
0x010fa944
0x010fa94a
0x010fa94a
0x010fa942
0x010fa94f
0x00000000
0x00000000
0x010fa8f3
0x010fa95e
0x010fa95f
0x010fa96c
0x010fa974
0x00000000
0x00000000
0x00000000
0x010fa8ec
0x010fa8ea
0x010fa86e
0x010fa86e
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010FA84A
EnterCriticalSection.KERNEL32(011146E0), ref: 010FA85B
fputs.MSVCRT ref: 010FA89E
fputs.MSVCRT ref: 010FA8C3
LeaveCriticalSection.KERNEL32(011146E0), ref: 010FA95F

Strings

Would you like to replace the existing file:, xrefs: 010FA899
with the file from archive:, xrefs: 010FA8BE

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSectionfputs$EnterH_prologLeave
String ID: Would you like to replace the existing file:$with the file from archive:
API String ID: 3914623533-686978020
Opcode ID: 22daee6772cd8ca2e5149bd47c6552f47f66d85564eb8269dc09f76fb1b2a1c6
Instruction ID: 78edce40e151c16f57f4f1b395c7717df353fe1358df0e6f677574931403d0e8
Opcode Fuzzy Hash: 22daee6772cd8ca2e5149bd47c6552f47f66d85564eb8269dc09f76fb1b2a1c6
Instruction Fuzzy Hash: D0317A39B04205EFEB16DF64D842BAE77E1EF48310F02416DEA9E57680CB70AC41CB65

Uniqueness

Uniqueness Score: -1.00%

Function 010D5A14 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D5A14() {
				CHAR* _t7;

				_t7 = "kernel32.dll";
				 *0x1114454 = GetProcAddress(GetModuleHandleA(_t7), "FindFirstStreamW");
				 *0x1114450 = GetProcAddress(GetModuleHandleA(_t7), "FindNextStreamW");
				return 0x111444c;
			}

0x010d5a2d
0x010d5a4b
0x010d5a55
0x010d5a60

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,FindFirstStreamW), ref: 010D5A3A
GetProcAddress.KERNEL32(00000000), ref: 010D5A43
GetModuleHandleA.KERNEL32(kernel32.dll,FindNextStreamW), ref: 010D5A50
GetProcAddress.KERNEL32(00000000), ref: 010D5A53

Strings

FindFirstStreamW, xrefs: 010D5A32
kernel32.dll, xrefs: 010D5A2D, 010D5A39, 010D5A4A
FindNextStreamW, xrefs: 010D5A45

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
API String ID: 1646373207-4044117955
Opcode ID: ee6f733536077331b4da35159d4397ad8e3bfecfe792352570485da1ded8d38c
Instruction ID: 5d6a1bd8e859f56492fd92bc25162e5fe103d1298045ec5cf65511de0b42e78e
Opcode Fuzzy Hash: ee6f733536077331b4da35159d4397ad8e3bfecfe792352570485da1ded8d38c
Instruction Fuzzy Hash: 94E020B2F483186BC5186AEE7D44C1BFB9CDB955503010037F510F7D05C7F058008B90

Uniqueness

Uniqueness Score: -1.00%

Function 010F834E Relevance: 11.4, APIs: 9, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E010F834E(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t20;
				signed int _t21;
				void* _t24;
				signed int _t25;
				signed int _t28;
				intOrPtr _t29;
				signed int* _t30;

				_t30 = _a12;
				_t29 = _a8;
				 *_t30 =  *_t30 & 0x00000000;
				_t24 = 0x10;
				_push(_t24);
				_push(0x110cdf8);
				_push(_t29);
				L01103D72();
				if(_t20 != 0) {
					_push(_t24);
					_push(0x110c458);
					_push(_t29);
					L01103D72();
					if(_t20 == 0) {
						goto L1;
					}
					_push(_t24);
					_push(0x110c448);
					_push(_t29);
					L01103D72();
					if(_t20 != 0) {
						_push(_t24);
						_push(0x110c4d8);
						_push(_t29);
						L01103D72();
						if(_t20 != 0) {
							_push(_t24);
							_push(0x110c488);
							_push(_t29);
							L01103D72();
							if(_t20 != 0) {
								_push(_t24);
								_push(0x110c478);
								_push(_t29);
								L01103D72();
								if(_t20 != 0) {
									_push(_t24);
									_push(0x110c3f8);
									_push(_t29);
									L01103D72();
									if(_t20 != 0) {
										_push(_t24);
										_push(0x110c408);
										_push(_t29);
										L01103D72();
										if(_t20 != 0) {
											_push(_t24);
											_push(0x110c3e8);
											_push(_t29);
											L01103D72();
											if(_t20 != 0) {
												return 0x80004002;
											}
											_t21 = _a4;
											_t25 = _t21;
											_t28 = _t21 + 0x1c;
											L17:
											asm("sbb ecx, ecx");
											 *_t30 =  ~_t25 & _t28;
											L18:
											 *((intOrPtr*)(_t21 + 0x24)) =  *((intOrPtr*)(_t21 + 0x24)) + 1;
											return 0;
										}
										_t21 = _a4;
										_t25 = _t21;
										_t28 = _t21 + 0x18;
										goto L17;
									}
									_t21 = _a4;
									_t25 = _t21;
									_t28 = _t21 + 0x14;
									goto L17;
								}
								_t21 = _a4;
								_t25 = _t21;
								_t28 = _t21 + 0x10;
								goto L17;
							}
							_t21 = _a4;
							_t25 = _t21;
							_t28 = _t21 + 0xc;
							goto L17;
						}
						_t21 = _a4;
						_t25 = _t21;
						_t28 = _t21 + 8;
						goto L17;
					}
					_t21 = _a4;
					_t25 = _t21;
					_t28 = _t21 + 4;
					goto L17;
				}
				L1:
				_t21 = _a4;
				 *_t30 = _t21;
				goto L18;
			}

0x010f8353
0x010f8357
0x010f835c
0x010f835f
0x010f8360
0x010f8361
0x010f8366
0x010f8367
0x010f8371
0x010f837d
0x010f837e
0x010f8383
0x010f8384
0x010f838e
0x00000000
0x00000000
0x010f8390
0x010f8391
0x010f8396
0x010f8397
0x010f83a1
0x010f83b0
0x010f83b1
0x010f83b6
0x010f83b7
0x010f83c1
0x010f83d0
0x010f83d1
0x010f83d6
0x010f83d7
0x010f83e1
0x010f83ed
0x010f83ee
0x010f83f3
0x010f83f4
0x010f83fe
0x010f840a
0x010f840b
0x010f8410
0x010f8411
0x010f841b
0x010f8427
0x010f8428
0x010f842d
0x010f842e
0x010f8438
0x010f8444
0x010f8445
0x010f844a
0x010f844b
0x010f8455
0x00000000
0x010f846e
0x010f8457
0x010f845a
0x010f845c
0x010f845f
0x010f8461
0x010f8465
0x010f8467
0x010f8467
0x00000000
0x010f846a
0x010f843a
0x010f843d
0x010f843f
0x00000000
0x010f843f
0x010f841d
0x010f8420
0x010f8422
0x00000000
0x010f8422
0x010f8400
0x010f8403
0x010f8405
0x00000000
0x010f8405
0x010f83e3
0x010f83e6
0x010f83e8
0x00000000
0x010f83e8
0x010f83c3
0x010f83c6
0x010f83c8
0x00000000
0x010f83c8
0x010f83a3
0x010f83a6
0x010f83a8
0x00000000
0x010f83a8
0x010f8373
0x010f8373
0x010f8376
0x00000000

APIs

memcmp.MSVCRT ref: 010F8367
memcmp.MSVCRT ref: 010F8384
memcmp.MSVCRT ref: 010F8397

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: cb3965fb92731edac7f760bf83cd3539e7b4f1c3dab5592b99a003157dc754a6
Instruction ID: 1da430318629c1ab24d93f1e6842d6c4580dc5deb62c5789a87a974b5260237f
Opcode Fuzzy Hash: cb3965fb92731edac7f760bf83cd3539e7b4f1c3dab5592b99a003157dc754a6
Instruction Fuzzy Hash: CA31E671A402057FD71B9E14CC82FBE33A8BA61644B04C65DFE85DA696FBA0ED0087D1

Uniqueness

Uniqueness Score: -1.00%

Function 010D125E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E010D125E(intOrPtr __ecx) {
				char _t72;
				signed int _t80;
				void* _t81;
				signed int _t83;
				signed int _t90;
				signed int* _t95;
				intOrPtr _t103;
				void* _t108;
				void* _t109;
				signed int _t114;
				char* _t117;
				signed int _t118;
				signed int _t119;
				signed int _t122;
				signed int _t126;
				char* _t127;
				void* _t128;

				E011039E0(E01104138, _t128);
				_t95 =  *(_t128 + 8);
				_t122 = 0;
				 *((intOrPtr*)(_t128 - 0x10)) = __ecx;
				if(_t95[1] == 0 ||  *( *_t95) != 0x2d) {
					L33:
					_t72 = 0;
					goto L34;
				} else {
					 *(_t128 - 0x18) =  *(_t128 - 0x18) | 0xffffffff;
					 *(_t128 + 8) = 0;
					if( *((intOrPtr*)(_t128 + 0x10)) <= 0) {
						L12:
						_push("Unknown switch:");
						goto L32;
					} else {
						 *((intOrPtr*)(_t128 - 0x14)) =  *((intOrPtr*)(_t128 + 0xc));
						do {
							_t126 = 0;
							_t117 =  *((intOrPtr*)( *((intOrPtr*)(_t128 - 0x14))));
							if( *_t117 == 0) {
								goto L6;
							} else {
								goto L5;
							}
							do {
								L5:
								_t126 = _t126 + 1;
							} while ( *((char*)(_t126 + _t117)) != 0);
							L6:
							if(_t126 >  *(_t128 - 0x18)) {
								_t14 = _t126 + 1; // 0x100
								if(_t14 <= _t95[1]) {
									_t15 =  *_t95 + 2; // 0x101
									if(E010D215C(_t15, _t117) != 0) {
										_t122 =  *(_t128 + 8);
										 *(_t128 - 0x18) = _t126;
									}
								}
							}
							 *(_t128 + 8) =  *(_t128 + 8) + 1;
							 *((intOrPtr*)(_t128 - 0x14)) =  *((intOrPtr*)(_t128 - 0x14)) + 0xc;
						} while ( *(_t128 + 8) <  *((intOrPtr*)(_t128 + 0x10)));
						_t118 =  *(_t128 - 0x18);
						if(_t118 >= 0) {
							_t119 = _t118 + 1;
							_t127 =  *((intOrPtr*)( *((intOrPtr*)(_t128 - 0x10)))) + (_t122 + _t122 * 4) * 4;
							_t103 =  *((intOrPtr*)(_t128 + 0xc));
							_t80 = _t122 + _t122 * 2;
							_t81 = _t103 + _t80 * 4;
							if( *((char*)(_t103 + 5 + _t80 * 4)) != 0 ||  *_t127 == 0) {
								 *_t127 = 1;
								 *((intOrPtr*)(_t128 + 0x10)) = _t95[1] - _t119;
								if( *((intOrPtr*)(_t128 + 0x10)) >= ( *(_t81 + 6) & 0x000000ff)) {
									 *(_t127 + 1) =  *(_t127 + 1) & 0x00000000;
									 *(_t127 + 4) =  *(_t127 + 4) | 0xffffffff;
									_t108 = ( *(_t81 + 4) & 0x000000ff) - 1;
									if(_t108 == 0) {
										if( *((intOrPtr*)(_t128 + 0x10)) != 1) {
											L30:
											if(_t119 == _t95[1]) {
												L26:
												_t72 = 1;
												L34:
												 *[fs:0x0] =  *((intOrPtr*)(_t128 - 0xc));
												return _t72;
											}
											_push("Too long switch:");
											goto L32;
										}
										_t83 =  *_t95 & 0xffffff00 |  *((short*)( *_t95 + _t119 * 2)) == 0x0000002d;
										 *(_t127 + 1) = _t83;
										if(_t83 != 0) {
											goto L26;
										}
										L24:
										_push("Incorrect switch postfix:");
										goto L32;
									}
									_t109 = _t108 - 1;
									if(_t109 == 0) {
										E010D292C(_t128 - 0x24,  *_t95 + _t119 * 2);
										 *(_t128 - 4) =  *(_t128 - 4) & 0x00000000;
										_push(_t128 - 0x24);
										_t58 = _t127 + 8; // 0x107
										E010D1ABD(E010D150C(_t58),  *((intOrPtr*)(_t128 - 0x24)));
										goto L26;
									}
									if(_t109 != 1 ||  *((intOrPtr*)(_t128 + 0x10)) != 1) {
										goto L30;
									} else {
										_t114 =  *_t95;
										_t120 =  *((intOrPtr*)(_t114 + _t119 * 2));
										if( *((intOrPtr*)(_t114 + _t119 * 2)) > 0x7f) {
											goto L24;
										}
										_t90 = E010D1F73(_t81,  *((intOrPtr*)(_t81 + 8)), _t120);
										 *(_t127 + 4) = _t90;
										if(_t90 >= 0) {
											goto L26;
										}
										goto L24;
									}
								}
								_push("Too short switch:");
								goto L32;
							} else {
								_push("Multiple instances for switch:");
								L32:
								_t68 =  *((intOrPtr*)(_t128 - 0x10)) + 0x14; // 0x15
								E010D23B0(_t68);
								goto L33;
							}
						}
						goto L12;
					}
				}
			}

0x010d1263
0x010d126c
0x010d1271
0x010d1273
0x010d1279
0x010d13d2
0x010d13d2
0x00000000
0x010d128b
0x010d128b
0x010d1292
0x010d1295
0x010d12e9
0x010d12e9
0x00000000
0x010d1297
0x010d129a
0x010d129d
0x010d12a0
0x010d12a2
0x010d12a7
0x00000000
0x00000000
0x00000000
0x00000000
0x010d12a9
0x010d12a9
0x010d12a9
0x010d12aa
0x010d12b0
0x010d12b3
0x010d12b8
0x010d12bd
0x010d12c1
0x010d12cb
0x010d12cd
0x010d12d0
0x010d12d0
0x010d12cb
0x010d12bd
0x010d12d3
0x010d12d6
0x010d12dd
0x010d12e2
0x010d12e7
0x010d12f9
0x010d12fc
0x010d12ff
0x010d1302
0x010d130a
0x010d130d
0x010d131e
0x010d1326
0x010d1330
0x010d133c
0x010d1340
0x010d1348
0x010d1349
0x010d13a8
0x010d13bd
0x010d13c0
0x010d13a0
0x010d13a0
0x010d13d4
0x010d13da
0x010d13e2
0x010d13e2
0x010d13c2
0x00000000
0x010d13c2
0x010d13b1
0x010d13b6
0x010d13b9
0x00000000
0x00000000
0x010d1372
0x010d1372
0x00000000
0x010d1372
0x010d134b
0x010d134c
0x010d1382
0x010d1387
0x010d138e
0x010d138f
0x010d139a
0x00000000
0x010d139f
0x010d134f
0x00000000
0x010d1357
0x010d1357
0x010d1359
0x010d1361
0x00000000
0x00000000
0x010d1366
0x010d136d
0x010d1370
0x00000000
0x00000000
0x00000000
0x010d1370
0x010d134f
0x010d1332
0x00000000
0x010d1314
0x010d1314
0x010d13c7
0x010d13ca
0x010d13cd
0x00000000
0x010d13cd
0x010d130d
0x00000000
0x010d12e7
0x010d1295

APIs

__EH_prolog.LIBCMT ref: 010D1263

Strings

Too long switch:, xrefs: 010D13C2
Multiple instances for switch:, xrefs: 010D1314
Too short switch:, xrefs: 010D1332
Unknown switch:, xrefs: 010D12E9
Incorrect switch postfix:, xrefs: 010D1372

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
API String ID: 3519838083-2104980125
Opcode ID: 05f10884e4bc39a97f1f63ef8e27689360ad73e9752bcd36e64d62f77ab1df21
Instruction ID: 50a29792d6e123698b1b960072eecfce9585723aed2c92f49459865e2c906cf5
Opcode Fuzzy Hash: 05f10884e4bc39a97f1f63ef8e27689360ad73e9752bcd36e64d62f77ab1df21
Instruction Fuzzy Hash: 6B517C70A0434ADFCF15CF58C580AADBBF1BF11304F14819AD4959BA92DF71EA41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010DC531 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E010DC531(void* __ecx, intOrPtr __edx, void* __eflags) {
				void* __ebx;
				void* _t59;
				void* _t62;
				void* _t75;
				void* _t76;
				void* _t83;
				signed int _t109;
				signed int _t112;
				void* _t115;

				E011039E0(E01104A18, _t115);
				_t112 = 0;
				 *((intOrPtr*)(_t115 - 0x10)) = __edx;
				_t83 = __ecx;
				 *((intOrPtr*)(_t115 - 0x1c)) = 0;
				 *(_t115 - 0x18) = 0;
				 *((intOrPtr*)(_t115 - 0x14)) = 0;
				_t109 =  *(_t115 + 8);
				 *(_t115 - 4) = 0;
				_t59 = E010D6177(_t109, __eflags);
				_t121 = _t59;
				if(_t59 == 0) {
					_push(_t109);
					_push( *0x1108664);
					E010E8A22(_t115 - 0x28, _t121);
					_push(0x110ded0);
					_push(_t115 - 0x28);
					L01103CAC();
				}
				_push(_t115 + 8);
				_push( *((intOrPtr*)(_t115 + 0x18)));
				 *(_t115 + 8) = _t112;
				if(E010D176C(_t109, _t115 - 0x1c) == 0) {
					_t123 =  *(_t115 + 8) - _t112;
					if( *(_t115 + 8) != _t112) {
						E010D28E9(_t115 - 0x28);
						 *(_t115 - 4) = 1;
						E010D2B8A(_t115 - 0x28, "The file operation error for listfile");
						E010D2BFE(_t115 - 0x28);
						_t75 = E010D4B4D(_t115 - 0x34,  *(_t115 + 8), _t123);
						 *(_t115 - 4) = 2;
						_t76 = E010D2C71(_t115 - 0x28, _t123, _t75);
						 *(_t115 - 4) = 1;
						E010D1ABD(_t76,  *((intOrPtr*)(_t115 - 0x34)));
						_push(_t109);
						_push( *((intOrPtr*)(_t115 - 0x28)));
						E010E8A6E(_t115 - 0x34, _t123);
						_push(0x110ded0);
						_push(_t115 - 0x34);
						L01103CAC();
					}
					_push(_t109);
					_push( *0x1108668);
					E010E8A22(_t115 - 0x34, _t123);
					_push(0x110ded0);
					_push(_t115 - 0x34);
					L01103CAC();
				}
				if(_t83 == _t112) {
					__eflags =  *(_t115 - 0x18) - _t112;
					if( *(_t115 - 0x18) > _t112) {
						do {
							E010DC2ED( *((intOrPtr*)(_t115 - 0x10)),  *((intOrPtr*)( *((intOrPtr*)(_t115 - 0x1c)) + _t112 * 4)),  *((intOrPtr*)(_t115 + 0xc)),  *((intOrPtr*)(_t115 + 0x10)),  *((intOrPtr*)(_t115 + 0x14)));
							_t112 = _t112 + 1;
							__eflags = _t112 -  *(_t115 - 0x18);
						} while (_t112 <  *(_t115 - 0x18));
					}
				} else {
					_t125 =  *(_t115 - 0x18) & 0x00000001;
					if(( *(_t115 - 0x18) & 0x00000001) != 0) {
						_push(_t109);
						_push( *0x1108668);
						E010E8A22(_t115 - 0x34, _t125);
						_push(0x110ded0);
						_push(_t115 - 0x34);
						L01103CAC();
					}
					_t126 =  *(_t115 - 0x18) - _t112;
					if( *(_t115 - 0x18) > _t112) {
						do {
							_push( *((intOrPtr*)(_t115 + 0x14)));
							_push( *((intOrPtr*)(_t115 + 0x10)));
							_push( *((intOrPtr*)( *((intOrPtr*)(_t115 - 0x1c)) + 4 + _t112 * 4)));
							E010DC472(_t83,  *((intOrPtr*)( *((intOrPtr*)(_t115 - 0x1c)) + _t112 * 4)), _t126);
							_t112 = _t112 + 2;
						} while (_t112 <  *(_t115 - 0x18));
					}
				}
				 *(_t115 - 4) =  *(_t115 - 4) | 0xffffffff;
				_t62 = E010E8B2E(_t83, _t115 - 0x1c);
				 *[fs:0x0] =  *((intOrPtr*)(_t115 - 0xc));
				return _t62;
			}

0x010dc536
0x010dc540
0x010dc543
0x010dc546
0x010dc548
0x010dc54b
0x010dc54e
0x010dc551
0x010dc554
0x010dc559
0x010dc55e
0x010dc560
0x010dc562
0x010dc566
0x010dc56c
0x010dc574
0x010dc579
0x010dc57a
0x010dc57a
0x010dc585
0x010dc588
0x010dc58b
0x010dc595
0x010dc59b
0x010dc59e
0x010dc5a3
0x010dc5b0
0x010dc5b4
0x010dc5bc
0x010dc5c7
0x010dc5d0
0x010dc5d4
0x010dc5d9
0x010dc5e0
0x010dc5e6
0x010dc5ea
0x010dc5ed
0x010dc5f5
0x010dc5fa
0x010dc5fb
0x010dc5fb
0x010dc600
0x010dc604
0x010dc60a
0x010dc612
0x010dc617
0x010dc618
0x010dc618
0x010dc61f
0x010dc66c
0x010dc66f
0x010dc671
0x010dc683
0x010dc688
0x010dc689
0x010dc689
0x010dc671
0x010dc621
0x010dc621
0x010dc625
0x010dc627
0x010dc62b
0x010dc631
0x010dc639
0x010dc63e
0x010dc63f
0x010dc63f
0x010dc644
0x010dc647
0x010dc649
0x010dc649
0x010dc64f
0x010dc659
0x010dc65e
0x010dc664
0x010dc665
0x010dc66a
0x010dc647
0x010dc68e
0x010dc695
0x010dc6a0
0x010dc6a8

APIs

__EH_prolog.LIBCMT ref: 010DC536

Part of subcall function 010D6177: __EH_prolog.LIBCMT ref: 010D617C

_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DC57A
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DC5FB
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DC618
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DC63F

Part of subcall function 010E8A22: __EH_prolog.LIBCMT ref: 010E8A27

Strings

The file operation error for listfile, xrefs: 010DC5A8

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog
String ID: The file operation error for listfile
API String ID: 206451386-4247703111
Opcode ID: d80ff75332a7c3a7c663a6a266613d9d867d5186dddf0568fc8215292472f7fd
Instruction ID: d4afd7f1eca42c0163e5c286bbf9aeee1cc0704f5982275e2ae370de3d6de9b3
Opcode Fuzzy Hash: d80ff75332a7c3a7c663a6a266613d9d867d5186dddf0568fc8215292472f7fd
Instruction Fuzzy Hash: 0F416F71D00219AFCF1AEFD4DA409EEBBB5BF28314F144059E951B3190DB705A45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D4F0C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E010D4F0C(intOrPtr __ecx, intOrPtr __edx) {
				_Unknown_base(*)()* _t31;
				signed int _t32;
				void* _t43;
				void* _t62;
				void* _t65;
				void* _t67;

				E011039E0(E0110449C, _t67);
				 *((intOrPtr*)(_t67 - 0x10)) = __edx;
				 *((intOrPtr*)(_t67 - 0x14)) = __ecx;
				_t31 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "CreateHardLinkW");
				 *(_t67 - 0x18) = _t31;
				if(_t31 == 0) {
					L14:
					_t32 = 0;
				} else {
					_t65 = E010D7553( *((intOrPtr*)(_t67 - 0x14)));
					_t62 = E010D7553( *((intOrPtr*)(_t67 - 0x10)));
					if(_t65 == 1 || _t62 == 1) {
						L5:
						if(_t65 != 0 || _t62 != 0) {
							E010D28E9(_t67 - 0x30);
							 *(_t67 - 4) =  *(_t67 - 4) & 0x00000000;
							E010D28E9(_t67 - 0x24);
							 *(_t67 - 4) = 1;
							if(_t65 != 1 && _t62 != 1) {
								_push(1);
								_pop(0);
							}
							if(E010D7BC8( *((intOrPtr*)(_t67 - 0x14)),  *((intOrPtr*)(_t67 - 0x10)), _t67 - 0x30, _t67 - 0x24, 0) == 0) {
								E010D1ABD(E010D1ABD(_t40,  *((intOrPtr*)(_t67 - 0x24))),  *((intOrPtr*)(_t67 - 0x30)));
								goto L14;
							} else {
								_t43 =  *(_t67 - 0x18)( *((intOrPtr*)(_t67 - 0x30)),  *((intOrPtr*)(_t67 - 0x24)), 0);
								_t32 = E010D1ABD(E010D1ABD(_t43,  *((intOrPtr*)(_t67 - 0x24))),  *((intOrPtr*)(_t67 - 0x30))) & 0xffffff00 | _t43 != 0x00000000;
							}
						} else {
							goto L14;
						}
					} else {
						_push(0);
						_push( *((intOrPtr*)(_t67 - 0x10)));
						_push( *((intOrPtr*)(_t67 - 0x14)));
						if( *(_t67 - 0x18)() == 0) {
							goto L5;
						} else {
							_t32 = 1;
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return _t32;
			}

0x010d4f11
0x010d4f20
0x010d4f23
0x010d4f32
0x010d4f3a
0x010d4f3d
0x010d4ff8
0x010d4ff8
0x010d4f43
0x010d4f4e
0x010d4f58
0x010d4f5a
0x010d4f77
0x010d4f79
0x010d4f82
0x010d4f87
0x010d4f8e
0x010d4f96
0x010d4f9a
0x010d4fa1
0x010d4fa3
0x010d4fa3
0x010d4fbe
0x010d4ff1
0x00000000
0x010d4fc0
0x010d4fc8
0x010d4fe1
0x010d4fe1
0x00000000
0x00000000
0x00000000
0x010d4f61
0x010d4f61
0x010d4f63
0x010d4f66
0x010d4f6e
0x00000000
0x010d4f70
0x010d4f70
0x010d4f70
0x010d4f6e
0x010d4f5a
0x010d4fff
0x010d5007

APIs

__EH_prolog.LIBCMT ref: 010D4F11
GetModuleHandleW.KERNEL32(kernel32.dll,CreateHardLinkW), ref: 010D4F2B
GetProcAddress.KERNEL32(00000000), ref: 010D4F32

Strings

Net, xrefs: 010D4F32
CreateHardLinkW, xrefs: 010D4F1B
kernel32.dll, xrefs: 010D4F26

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressH_prologHandleModuleProc
String ID: CreateHardLinkW$kernel32.dll$Net
API String ID: 786088110-3157449041
Opcode ID: 3f34dbceb9d803d5e9899173d8616a390db8bf3b8b8c63a49fce7786d711c6a9
Instruction ID: 0fff1a34616603f7e1bfd0a2eb210ff0c8b60d7f30e8947e2f7d379b9d2860b1
Opcode Fuzzy Hash: 3f34dbceb9d803d5e9899173d8616a390db8bf3b8b8c63a49fce7786d711c6a9
Instruction Fuzzy Hash: 7C21C332D04316ABDF25EFA8CD49BEEBBB5AF54204F1000A5F581F25A0CBB19D04DB61

Uniqueness

Uniqueness Score: -1.00%

Function 010FAE11 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E010FAE11() {
				void* _t39;
				intOrPtr _t54;
				struct _CRITICAL_SECTION* _t74;
				intOrPtr _t78;
				void* _t81;

				E011039E0(E011070F8, _t81);
				_t74 = 0x11146e0;
				 *(_t81 - 0x10) = 0x11146e0;
				EnterCriticalSection(0x11146e0);
				 *((intOrPtr*)(_t81 - 4)) = 0;
				if( *((intOrPtr*)(_t81 + 0xc)) != 0) {
					_t78 =  *((intOrPtr*)(_t81 + 8));
					 *((intOrPtr*)(_t78 + 0x160)) =  *((intOrPtr*)(_t78 + 0x160)) + 1;
					asm("adc [eax+0x4], ebx");
					 *((intOrPtr*)(_t78 + 0x158)) =  *((intOrPtr*)(_t78 + 0x158)) + 1;
					asm("adc [eax+0x4], ebx");
					if( *(_t78 + 0xcc) != 0) {
						E010FA997(_t78);
						E010D232F(_t81 - 0x1c);
						 *((char*)(_t81 - 4)) = 1;
						E010FAD37( *((intOrPtr*)(_t81 + 0xc)),  *((intOrPtr*)(_t81 + 0x10)), _t81 - 0x1c);
						fputs( *(_t81 - 0x1c),  *( *(_t78 + 0xcc)));
						if( *((intOrPtr*)(_t78 + 0x110)) != 0) {
							fputs(" : ",  *( *(_t78 + 0xcc)));
							E010D1E52(_t78 + 0x10c);
						}
						E010D1CAE( *(_t78 + 0xcc));
						E010D1ABD(E010D1C9F( *(_t78 + 0xcc)),  *(_t81 - 0x1c));
						_t74 = 0x11146e0;
					}
				} else {
					_t54 =  *((intOrPtr*)(_t81 + 8));
					if( *((intOrPtr*)(_t54 + 0xbc)) != 0) {
						 *((intOrPtr*)(_t54 + 0x34)) = 0;
						 *((char*)( *((intOrPtr*)(_t54 + 0x30)))) = 0;
						 *((intOrPtr*)(_t54 + 0x40)) = 0;
						 *((short*)( *((intOrPtr*)(_t54 + 0x3c)))) = 0;
						 *((intOrPtr*)(_t54 + 0x28)) =  *((intOrPtr*)(_t54 + 0x28)) + 1;
						asm("adc [eax+0x2c], ebx");
					}
				}
				_t39 = E010FA3B2();
				LeaveCriticalSection(_t74);
				 *[fs:0x0] =  *((intOrPtr*)(_t81 - 0xc));
				return _t39;
			}

0x010fae16
0x010fae21
0x010fae27
0x010fae2a
0x010fae35
0x010fae38
0x010fae66
0x010fae69
0x010fae76
0x010fae79
0x010fae86
0x010fae8f
0x010fae97
0x010fae9f
0x010faead
0x010faeb2
0x010faec8
0x010faed2
0x010faee1
0x010faef2
0x010faef2
0x010faefd
0x010faf10
0x010faf16
0x010faf16
0x010fae3a
0x010fae3a
0x010fae43
0x010fae4c
0x010fae4f
0x010fae54
0x010fae57
0x010fae5a
0x010fae5e
0x010fae5e
0x010fae43
0x010faf1b
0x010faf23
0x010faf31
0x010faf39

APIs

__EH_prolog.LIBCMT ref: 010FAE16
EnterCriticalSection.KERNEL32(011146E0), ref: 010FAE2A
fputs.MSVCRT ref: 010FAEC8
fputs.MSVCRT ref: 010FAEE1
LeaveCriticalSection.KERNEL32(011146E0), ref: 010FAF23

Strings

: , xrefs: 010FAEDC

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSectionfputs$EnterH_prologLeave
String ID: :
API String ID: 3914623533-3653984579
Opcode ID: 814cce437e12b529f6e3ad7e92ce461ffac45f9101804c7dcad6733144fb536b
Instruction ID: 8cd44bb89c648dad1dd06ca7e6f03e13158f994c716367b342c8f8d33860bea0
Opcode Fuzzy Hash: 814cce437e12b529f6e3ad7e92ce461ffac45f9101804c7dcad6733144fb536b
Instruction Fuzzy Hash: DF318C71A00705CFDB15EF69D880EDAB7B1FF44314F50856EE96A9B651CB70A805CF20

Uniqueness

Uniqueness Score: -1.00%

Function 010FB1E7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E010FB1E7(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				signed int _t30;
				char* _t32;
				char* _t36;
				void* _t41;
				struct _IO_FILE** _t45;
				void* _t66;
				intOrPtr _t69;
				signed int _t70;
				void* _t73;

				E011039E0(E01107134, _t73);
				_t69 =  *((intOrPtr*)(_t73 + 8));
				_t45 = __ecx;
				_t66 = __edx;
				fputs("WARNING:\n",  *__ecx);
				E010D1E52(_t69 + 0x70);
				E010D28E9(_t73 - 0x18);
				_t30 =  *(_t69 + 0x1c);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				if( *(_t69 + 0x94) != _t30) {
					if(_t30 >= 0) {
						_t32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x28)) + _t30 * 4)) + 0xc));
					} else {
						_t32 = "#";
					}
					E010FB1AC(_t73 - 0x18, "Can not open the file", _t32);
					_t70 =  *(_t69 + 0x94);
					if(_t70 >= 0) {
						_t36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x28)) + _t70 * 4)) + 0xc));
					} else {
						_t36 = "#";
					}
					E010FB1AC(_t73 - 0x18, "The file is open", _t36);
				} else {
					E010D2BFE(_t73 - 0x18);
					E010D2CAD(_t73 - 0x18, "The archive is open with offset");
				}
				_push( *((intOrPtr*)(_t73 - 0x18)));
				E010D1CAE(E010D1CC1(_t45));
				_t41 = E010D1ABD(E010D1CAE(_t38),  *((intOrPtr*)(_t73 - 0x18)));
				 *[fs:0x0] =  *((intOrPtr*)(_t73 - 0xc));
				return _t41;
			}

0x010fb1ec
0x010fb1f6
0x010fb1f9
0x010fb1fc
0x010fb205
0x010fb213
0x010fb21b
0x010fb220
0x010fb223
0x010fb22d
0x010fb248
0x010fb257
0x010fb24a
0x010fb24a
0x010fb24a
0x010fb263
0x010fb268
0x010fb270
0x010fb27f
0x010fb272
0x010fb272
0x010fb272
0x010fb28b
0x010fb22f
0x010fb232
0x010fb23f
0x010fb23f
0x010fb290
0x010fb29e
0x010fb2ad
0x010fb2b9
0x010fb2c1

APIs

__EH_prolog.LIBCMT ref: 010FB1EC
fputs.MSVCRT ref: 010FB205

Strings

The archive is open with offset, xrefs: 010FB23A
Can not open the file, xrefs: 010FB25B
WARNING:, xrefs: 010FB200
The file is open, xrefs: 010FB283

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfputs
String ID: Can not open the file$The archive is open with offset$The file is open$WARNING:
API String ID: 1798449854-3393983761
Opcode ID: 67c5505f2518c4d5d433e71415232471edc6199d3260fb5f5f0f055b9cc78f73
Instruction ID: 94400671eebfc1b4d8e4a86ced0af965cb1277efcfadfa0e7e136e4138482d16
Opcode Fuzzy Hash: 67c5505f2518c4d5d433e71415232471edc6199d3260fb5f5f0f055b9cc78f73
Instruction Fuzzy Hash: D921A731A00616DFCB5AEBA4D5429EEB7A5FF54310F00405DE686A7A81DB70AC028B80

Uniqueness

Uniqueness Score: -1.00%

Function 01102E70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E01102E70(void* __ebx, struct _IO_FILE** __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v5;
				long _v12;
				struct _IO_FILE** _v16;
				intOrPtr _v20;
				void* __ebp;
				void* _t16;
				void* _t29;
				signed int _t30;
				void* _t41;
				struct _IO_FILE** _t44;
				signed int _t52;

				_t29 = __ebx;
				_t44 = __ecx;
				_v20 = __edx;
				_v16 = __ecx;
				if(__ecx != 0) {
					fputs("\nEnter password (will not be echoed):",  *__ecx);
					E010D1C9F(_t44);
				}
				_push(_t29);
				_t16 = GetStdHandle(0xfffffff6);
				_v12 = _v12 & 0x00000000;
				_t41 = _t16;
				_t30 = 0;
				if(_t41 != 0xffffffff && _t41 != 0 && GetConsoleMode(_t41,  &_v12) != 0) {
					_t8 = SetConsoleMode(_t41, _v12 & 0x000000fb) != 0;
					_t52 = _t8;
					_t30 = 0 | _t8;
				}
				_push(_v20);
				_v5 = E010D1B89(0x1114430, _t52);
				if(_t30 != 0) {
					SetConsoleMode(_t41, _v12);
				}
				if(_v16 != 0) {
					E010D1CAE(_v16);
					E010D1C9F(_v16);
				}
				return _v5;
			}

0x01102e70
0x01102e77
0x01102e7c
0x01102e7f
0x01102e82
0x01102e8b
0x01102e95
0x01102e95
0x01102e9a
0x01102e9d
0x01102ea3
0x01102ead
0x01102eaf
0x01102eb4
0x01102ed4
0x01102ed4
0x01102ed4
0x01102ed4
0x01102ed7
0x01102ee6
0x01102eea
0x01102ef0
0x01102ef0
0x01102ef8
0x01102efd
0x01102f05
0x01102f05
0x01102f0e

APIs

fputs.MSVCRT ref: 01102E8B

Part of subcall function 010D1C9F: fflush.MSVCRT ref: 010D1CA1

GetStdHandle.KERNEL32(000000F6), ref: 01102E9D
GetConsoleMode.KERNEL32(00000000,00000000), ref: 01102EBF
SetConsoleMode.KERNEL32(00000000,00000000), ref: 01102ED0
SetConsoleMode.KERNEL32(00000000,00000000), ref: 01102EF0

Strings

Enter password (will not be echoed):, xrefs: 01102E86

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ConsoleMode$Handlefflushfputs
String ID: Enter password (will not be echoed):
API String ID: 108775803-3720017889
Opcode ID: 2fe328fc28c2a5643e8cf480834ccbef6865972245f15fa53607592d7cfed103
Instruction ID: b6c513721328248906c87eab65104db59797662dc8cb2bad281a799383f95bf5
Opcode Fuzzy Hash: 2fe328fc28c2a5643e8cf480834ccbef6865972245f15fa53607592d7cfed103
Instruction Fuzzy Hash: E011E931D443296BDB1BABA8D844AFEBFB9AF84660F148169E960631D4CFB04985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010E33F3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E010E33F3(signed char** __ecx, signed char** __edx, void* __eflags) {
				struct _SYSTEM_INFO _v40;
				char _v76;
				void* __ebp;
				_Unknown_base(*)()* _t14;
				signed char** _t24;
				signed char** _t25;
				void* _t26;

				_t26 = __eflags;
				_t25 = __ecx;
				_t24 = __edx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *( *__ecx) =  *( *__ecx) & 0x00000000;
				__edx[1] = __edx[1] & 0x00000000;
				 *( *__edx) =  *( *__edx) & 0x00000000;
				GetSystemInfo( &_v40);
				E010E3454(_t25,  &_v40, _t26);
				_t14 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetNativeSystemInfo");
				_t27 = _t14;
				if(_t14 != 0) {
					 *_t14( &_v76);
					return E010E3454(_t24,  &_v76, _t27);
				}
				return _t14;
			}

0x010e33f3
0x010e33fa
0x010e33fd
0x010e3401
0x010e3405
0x010e340a
0x010e340e
0x010e3415
0x010e3420
0x010e3436
0x010e343c
0x010e343e
0x010e3444
0x00000000
0x010e344b
0x010e3453

APIs

GetSystemInfo.KERNEL32(?), ref: 010E3415

Part of subcall function 010E3454: __EH_prolog.LIBCMT ref: 010E3459

GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 010E342F
GetProcAddress.KERNEL32(00000000), ref: 010E3436

Strings

kernel32.dll, xrefs: 010E342A
Net, xrefs: 010E3436
GetNativeSystemInfo, xrefs: 010E3425

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressH_prologHandleInfoModuleProcSystem
String ID: GetNativeSystemInfo$kernel32.dll$Net
API String ID: 2024292667-2143818815
Opcode ID: 8a0fff7ae28e98603e786a76bcc40aa6bc5c99026c50f4c588ec36b5b51e7c1b
Instruction ID: b31170b2224bc7616db4da7e7c89350ddcd23ca4b2ed0e390ed4a1fa778247bb
Opcode Fuzzy Hash: 8a0fff7ae28e98603e786a76bcc40aa6bc5c99026c50f4c588ec36b5b51e7c1b
Instruction Fuzzy Hash: 7EF0C272E142049FDB16EB65C848B9DBBE8AF84215F048558E0459B180DBF4A905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010FAA9F Relevance: 9.1, APIs: 6, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E010FAA9F(void* __ecx, void* __edx) {
				intOrPtr _t52;
				intOrPtr _t53;
				void* _t54;
				void* _t77;
				intOrPtr _t79;
				signed char* _t81;
				void* _t86;
				signed char** _t89;
				char** _t111;
				intOrPtr* _t112;
				intOrPtr _t115;
				void* _t118;

				E011039E0(E011070C8, _t118);
				_push(__ecx);
				 *(_t118 - 0x10) = 0x11146e0;
				EnterCriticalSection(0x11146e0);
				_t115 =  *((intOrPtr*)(_t118 + 8));
				_t81 = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				E010D2A28(_t115 + 0x10c,  *((intOrPtr*)(_t118 + 0xc)));
				_t52 =  *((intOrPtr*)(_t118 + 0x14));
				_t86 = 1;
				if(_t52 == 0) {
					_t53 =  *0x110aa24; // 0x11086f0
					L8:
					 *((intOrPtr*)(_t118 + 0x14)) = _t53;
					L9:
					if( *((intOrPtr*)(_t115 + 0x170)) < _t86 ||  *(_t115 + 0xc8) == _t81) {
						 *(_t118 + 0xb) =  *(_t118 + 0xb) & 0x00000000;
					} else {
						 *(_t118 + 0xb) = 1;
						E010FAC6E(_t115);
						_t111 = _t115 + 0xf4;
						E010D23B0(_t111,  *((intOrPtr*)(_t118 + 0x14)));
						if( *((intOrPtr*)(_t118 + 0xc)) != _t81) {
							E010D24BF();
						}
						fputs( *_t111,  *( *(_t115 + 0xc8)));
						_t112 = _t115 + 0x100;
						 *((intOrPtr*)(_t112 + 4)) = 0;
						 *((short*)( *_t112)) = 0;
						if( *((intOrPtr*)(_t118 + 0xc)) != 0) {
							E010D2A28(_t112,  *((intOrPtr*)(_t118 + 0xc)));
							E010D1DE0( *(_t115 + 0xc8), _t112);
						}
						E010D1D87( *(_t115 + 0xc8), _t112, _t115 + 0xf4);
						if( *((intOrPtr*)(_t118 + 0x18)) != 0) {
							fputs(" <",  *( *(_t115 + 0xc8)));
							fputs(">",  *(E010D1F47( *(_t115 + 0xc8),  *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x18)))),  *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x18)) + 4)))));
						}
						E010D1CAE( *(_t115 + 0xc8));
						if( *((char*)(_t115 + 0x168)) != 0) {
							E010D1C9F( *(_t115 + 0xc8));
						}
						_t81 = 0;
					}
					if( *((intOrPtr*)(_t115 + 0xbc)) != _t81) {
						if( *((intOrPtr*)(_t115 + 0x16c)) >= 1) {
							_t110 = _t115 + 0x3c;
							_t89 = _t115 + 0x30;
							 *(_t115 + 0x40) = _t81;
							 *( *(_t115 + 0x3c)) = _t81;
							_t89[1] = _t81;
							 *( *_t89) =  *( *_t89) & 0x00000000;
							if( *((intOrPtr*)(_t115 + 0x16c)) > 1 ||  *(_t118 + 0xb) == 0) {
								E010D23B0(_t89,  *((intOrPtr*)(_t118 + 0x14)));
								if( *((intOrPtr*)(_t118 + 0xc)) != _t81) {
									E010D2A28(_t110,  *((intOrPtr*)(_t118 + 0xc)));
								}
							}
						}
						E0110196E(_t115 + 0x18);
					}
					_t54 = E010FA3B2();
					LeaveCriticalSection(0x11146e0);
					 *[fs:0x0] =  *((intOrPtr*)(_t118 - 0xc));
					return _t54;
				}
				_t77 = _t52 - 1;
				if(_t77 == 0) {
					_t53 =  *0x110aa20; // 0x110ad20
					goto L8;
				} else {
					if(_t77 == 1) {
						_t79 =  *0x110aa28; // 0x11095c8
						 *((intOrPtr*)(_t118 + 0x14)) = _t79;
					} else {
						 *((intOrPtr*)(_t118 + 0x14)) = "???";
					}
					_t86 = 2;
					goto L9;
				}
			}

0x010faaa4
0x010faaa9
0x010faab3
0x010faab6
0x010faabc
0x010faac2
0x010faaca
0x010faacd
0x010faad7
0x010faad9
0x010faada
0x010faaff
0x010fab04
0x010fab04
0x010fab07
0x010fab0d
0x010fac65
0x010fab1f
0x010fab21
0x010fab25
0x010fab2d
0x010fab35
0x010fab3d
0x010fab41
0x010fab41
0x010fab56
0x010fab59
0x010fab67
0x010fab6a
0x010fab6d
0x010fab74
0x010fab80
0x010fab80
0x010fab93
0x010fab9c
0x010fabab
0x010fabc5
0x010fabc8
0x010fabcf
0x010fabdb
0x010fabe3
0x010fabe3
0x010fabe8
0x010fabe8
0x010fabf0
0x010fabf9
0x010fabfe
0x010fac01
0x010fac04
0x010fac07
0x010fac0c
0x010fac0f
0x010fac19
0x010fac24
0x010fac2c
0x010fac33
0x010fac33
0x010fac2c
0x010fac19
0x010fac3b
0x010fac3b
0x010fac40
0x010fac4c
0x010fac5a
0x010fac62
0x010fac62
0x010faadc
0x010faadd
0x010faaf8
0x00000000
0x010faadf
0x010faae0
0x010faaee
0x010faaf3
0x010faae2
0x010faae2
0x010faae2
0x010faaeb
0x00000000
0x010faaeb

APIs

__EH_prolog.LIBCMT ref: 010FAAA4
EnterCriticalSection.KERNEL32(011146E0), ref: 010FAAB6
fputs.MSVCRT ref: 010FAB56
fputs.MSVCRT ref: 010FABAB
fputs.MSVCRT ref: 010FABC5
LeaveCriticalSection.KERNEL32(011146E0,?), ref: 010FAC4C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$CriticalSection$EnterH_prologLeave
String ID:
API String ID: 1850570545-0
Opcode ID: 01b4cd4597fd38e813118319507fa4bd74d8913980af87525aa10fee1fd650d2
Instruction ID: 198569dcca4360b40a88b66363246a7c1457579ca17f96ae410226aeb2240b31
Opcode Fuzzy Hash: 01b4cd4597fd38e813118319507fa4bd74d8913980af87525aa10fee1fd650d2
Instruction Fuzzy Hash: 1151943160070ADFDB2ADF64D981BEABBE1FF58310F00846EE69E57690CB74A944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010D51DF Relevance: 9.1, APIs: 6, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E010D51DF(WCHAR* __ecx) {
				long _t29;
				long _t32;
				signed char _t34;
				signed int _t35;
				long _t37;
				long _t41;
				long _t43;
				signed char _t48;
				long _t67;
				WCHAR* _t70;
				void* _t72;

				E011039E0(E011044F3, _t72);
				_t70 = __ecx;
				_t67 = E010D7553(__ecx);
				if(_t67 == 1) {
					L4:
					__eflags = _t67;
					if(_t67 == 0) {
						L16:
						_t29 = GetLastError();
						__eflags = _t29 - 0xb7;
						if(_t29 == 0xb7) {
							E010D5C60(_t72 - 0x88);
							E010D28E9(_t72 - 0x60);
							 *(_t72 - 4) = 2;
							_t32 = E010D5D00(_t72 - 0x88, __eflags, _t70);
							__eflags = _t32;
							if(_t32 != 0) {
								_t48 =  *(_t72 - 0x68) >> 0x00000004 & 0x00000001;
								__eflags = _t48;
							} else {
								_t48 = 0;
							}
							_push( *((intOrPtr*)(_t72 - 0x60)));
							L22:
							E010D1ABD(_t32);
							_t34 = _t48;
							L23:
							 *[fs:0x0] =  *((intOrPtr*)(_t72 - 0xc));
							return _t34;
						}
						_t34 = 0;
						goto L23;
					}
					_t35 = E010D28E9(_t72 - 0x18);
					 *(_t72 - 4) =  *(_t72 - 4) & 0x00000000;
					__eflags = _t67 - 1;
					_t37 = E010D765C(_t70, _t72 - 0x18, _t72, _t35 & 0xffffff00 | _t67 != 0x00000001);
					__eflags = _t37;
					if(_t37 == 0) {
						_t17 = _t72 - 4;
						 *_t17 =  *(_t72 - 4) | 0xffffffff;
						__eflags =  *_t17;
						E010D1ABD(_t37,  *(_t72 - 0x18));
						goto L16;
					}
					_t32 = CreateDirectoryW( *(_t72 - 0x18), 0);
					__eflags = _t32;
					if(_t32 == 0) {
						_t32 = GetLastError();
						__eflags = _t32 - 0xb7;
						if(_t32 == 0xb7) {
							E010D5C60(_t72 - 0x50);
							E010D28E9(_t72 - 0x28);
							 *(_t72 - 4) = 1;
							_t41 = E010D5D00(_t72 - 0x50, __eflags,  *(_t72 - 0x18));
							__eflags = _t41;
							if(_t41 != 0) {
								_t48 =  *(_t72 - 0x30) >> 0x00000004 & 0x00000001;
								__eflags = _t48;
							} else {
								_t48 = 0;
							}
							_t32 = E010D1ABD(_t41,  *((intOrPtr*)(_t72 - 0x28)));
						} else {
							_t48 = 0;
						}
					} else {
						_t48 = 1;
					}
					_push( *(_t72 - 0x18));
					goto L22;
				}
				if(CreateDirectoryW(__ecx, 0) == 0) {
					_t43 = GetLastError();
					__eflags = _t43 - 0xb7;
					if(_t43 == 0xb7) {
						goto L16;
					}
					goto L4;
				}
				_t34 = 1;
				goto L23;
			}

0x010d51e4
0x010d51ef
0x010d51fc
0x010d5201
0x010d5224
0x010d5224
0x010d5226
0x010d52b8
0x010d52b8
0x010d52ba
0x010d52bf
0x010d52cb
0x010d52d3
0x010d52df
0x010d52e6
0x010d52eb
0x010d52ed
0x010d52f9
0x010d52f9
0x010d52ef
0x010d52ef
0x010d52ef
0x010d52fc
0x010d52ff
0x010d52ff
0x010d5305
0x010d5307
0x010d530d
0x010d5315
0x010d5315
0x010d52c1
0x00000000
0x010d52c1
0x010d522f
0x010d5234
0x010d5238
0x010d5244
0x010d5249
0x010d524b
0x010d52ae
0x010d52ae
0x010d52ae
0x010d52b2
0x00000000
0x010d52b7
0x010d5252
0x010d5258
0x010d525a
0x010d5260
0x010d5262
0x010d5267
0x010d5270
0x010d5278
0x010d5283
0x010d5287
0x010d528c
0x010d528e
0x010d529a
0x010d529a
0x010d5290
0x010d5290
0x010d5290
0x010d52a0
0x010d5269
0x010d5269
0x010d5269
0x010d525c
0x010d525c
0x010d525c
0x010d52a6
0x00000000
0x010d52a6
0x010d520e
0x010d5217
0x010d5219
0x010d521e
0x00000000
0x00000000
0x00000000
0x010d521e
0x010d5210
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010D51E4
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000), ref: 010D5206
GetLastError.KERNEL32(?,00000000,00000000,?,00000000), ref: 010D5217
CreateDirectoryW.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 010D5252
GetLastError.KERNEL32 ref: 010D5260
GetLastError.KERNEL32(00000000,?,00000000), ref: 010D52B8

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorLast$CreateDirectory$H_prolog
String ID:
API String ID: 798237638-0
Opcode ID: a63613fe25bbe3501447899f1aeadc357c3f591538b323dc11b3c8e911284ed4
Instruction ID: 08ad00f9d815b9a8a4de8f42c7e68f654fa3c884688387a3959be4fa4e1174e5
Opcode Fuzzy Hash: a63613fe25bbe3501447899f1aeadc357c3f591538b323dc11b3c8e911284ed4
Instruction Fuzzy Hash: 9531B331904309DADF55ABA8CC85BFDBBB1AF22214F040154F99663191DFB54949DEA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D5AE3 Relevance: 9.1, APIs: 6, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E010D5AE3(intOrPtr* __ecx, void* __eflags) {
				long _t21;
				signed int _t25;
				void* _t34;
				intOrPtr* _t48;
				void* _t50;
				intOrPtr _t57;

				E011039E0(E011045AC, _t50);
				_t48 = __ecx;
				if(E010D58AD(__ecx) == 0) {
					L12:
					_t21 = 0;
				} else {
					_t57 =  *0x1114454; // 0x775d42f0
					if(_t57 != 0) {
						SetLastError(0);
						_t34 = E010D7553( *((intOrPtr*)(_t50 + 8)));
						if(_t34 != 1) {
							 *_t48 =  *0x1114454( *((intOrPtr*)(_t50 + 8)), 0, _t50 - 0x270, 0);
						}
						if( *_t48 != 0xffffffff) {
							L13:
							E010D5BC6(_t50 - 0x270,  *((intOrPtr*)(_t50 + 0xc)));
							_t21 = 1;
						} else {
							if(GetLastError() == 0x26) {
								goto L12;
							} else {
								if(_t34 != 0) {
									_t25 = E010D28E9(_t50 - 0x18);
									 *(_t50 - 4) = 0;
									if(E010D765C( *((intOrPtr*)(_t50 + 8)), _t50 - 0x18, _t50, _t25 & 0xffffff00 | _t34 != 0x00000001) != 0) {
										 *_t48 =  *0x1114454( *((intOrPtr*)(_t50 - 0x18)), 0, _t50 - 0x270, 0);
									}
									 *(_t50 - 4) =  *(_t50 - 4) | 0xffffffff;
									E010D1ABD(_t27,  *((intOrPtr*)(_t50 - 0x18)));
								}
								if( *_t48 != 0xffffffff) {
									goto L13;
								} else {
									goto L12;
								}
							}
						}
					} else {
						SetLastError(0x78);
						goto L12;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t21;
			}

0x010d5ae8
0x010d5af6
0x010d5aff
0x010d5ba1
0x010d5ba1
0x010d5b05
0x010d5b07
0x010d5b0d
0x010d5b1d
0x010d5b2b
0x010d5b30
0x010d5b44
0x010d5b44
0x010d5b49
0x010d5ba5
0x010d5bae
0x010d5bb3
0x010d5b4b
0x010d5b54
0x00000000
0x010d5b56
0x010d5b58
0x010d5b5d
0x010d5b6f
0x010d5b79
0x010d5b8d
0x010d5b8d
0x010d5b92
0x010d5b96
0x010d5b9b
0x010d5b9f
0x00000000
0x00000000
0x00000000
0x00000000
0x010d5b9f
0x010d5b54
0x010d5b0f
0x010d5b11
0x00000000
0x010d5b11
0x010d5b0d
0x010d5bbb
0x010d5bc3

APIs

__EH_prolog.LIBCMT ref: 010D5AE8

Part of subcall function 010D58AD: FindClose.KERNEL32(00000000,?,010D58E5), ref: 010D58B8

SetLastError.KERNEL32(00000078,00000000,?,?), ref: 010D5B11
SetLastError.KERNEL32(00000000,00000000,?,?), ref: 010D5B1D
FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 010D5B3E
GetLastError.KERNEL32(?,?), ref: 010D5B4B
FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 010D5B87

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFindLast$FirstStream$CloseH_prolog
String ID:
API String ID: 1050961465-0
Opcode ID: 8b0f4a6239f3342a6c1326161b6d9656dd5e58b59001eb9b10e402d9ccfa2936
Instruction ID: 1378f4716eb5e8e826236a4c5fc3ed2add1db77d7712a8308301cb9d6d3890b0
Opcode Fuzzy Hash: 8b0f4a6239f3342a6c1326161b6d9656dd5e58b59001eb9b10e402d9ccfa2936
Instruction Fuzzy Hash: 5821B030900305DFCF65AF68DD899BEBBB9FF91724F1002A9E9E156180D7B14985DF60

Uniqueness

Uniqueness Score: -1.00%

Function 01101C5E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E01101C5E(void* __ebx, void* __ecx, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* __edi;
				void* __ebp;
				struct _IO_FILE** _t67;
				struct _IO_FILE** _t72;
				void* _t78;
				void* _t107;
				signed int _t108;
				void* _t109;
				struct _IO_FILE** _t111;
				struct _IO_FILE** _t112;
				void* _t114;
				struct _IO_FILE** _t115;
				intOrPtr _t154;
				void* _t155;
				intOrPtr* _t156;
				void* _t157;
				void* _t158;

				_t107 = __ebx;
				_t157 = __ecx;
				_t114 = __ecx + 8;
				if( *((intOrPtr*)(__ecx + 0xac)) != 0) {
					E0110183F(_t114, 0, 1);
				}
				_v8 = 0;
				if( *((intOrPtr*)(_a8 + 4)) <= 0) {
					L39:
					_t115 =  *(_t157 + 0xb8);
					if(_a16 != 0) {
						__eflags = _t115;
						if(_t115 != 0) {
							E010D1C9F(_t115);
						}
						_t67 =  *(_t157 + 0xbc);
						__eflags = _t67;
						if(_t67 == 0) {
							L48:
							return 0;
						} else {
							fputs( *0x110cb98,  *_t67);
							_push(_a12);
							E010D1E60( *(_t157 + 0xbc), _t150);
							E010D1CAE( *(_t157 + 0xbc));
							_t72 = E010FD3B2( *(_t157 + 0xbc), _a4, _t158, _a8);
							__eflags = _t72;
							if(_t72 != 0) {
								L49:
								return _t72;
							}
							E010D1C9F( *(_t157 + 0xbc));
							goto L48;
						}
					}
					if(_t115 == 0) {
						goto L48;
					}
					_t72 = E010FCD30(_t115, _a4, _a8);
					if(_t72 != 0) {
						goto L49;
					}
					E010D1CAE( *(_t157 + 0xb8));
					goto L48;
				} else {
					_push(_t107);
					do {
						_t154 =  *((intOrPtr*)( *_a8 + _v8 * 4));
						_v12 = _t154;
						_t155 = _t154 + 0x10;
						_t108 =  *(_t155 + 4);
						if( *((char*)(_t155 + 1)) != 0) {
							_t108 = _t108 | 0x00000020;
						}
						if(_t108 != 0 ||  *((intOrPtr*)(_t155 + 0x1c)) != _t108) {
							_t124 =  *(_t157 + 0xbc);
							if( *(_t157 + 0xbc) != 0) {
								E010D1CAE(_t124);
								if(_v8 != 0) {
									_push( *((intOrPtr*)(_v12 + 0x70)));
									E010D1CAE(E010D1CC1( *(_t157 + 0xbc)));
								}
							}
							if(_t108 != 0) {
								_t147 =  *(_t157 + 0xbc);
								if( *(_t157 + 0xbc) != 0) {
									_t150 = "ERRORS:";
									E010FB09C(_t147, "ERRORS:", _t108);
								}
							}
							if( *((intOrPtr*)(_t155 + 0x1c)) != 0) {
								_t112 =  *(_t157 + 0xbc);
								if(_t112 != 0) {
									_v16 =  *((intOrPtr*)(_t155 + 0x18));
									fputs("ERRORS:",  *_t112);
									E010D1CAE(_t112);
									_push(_v16);
									E010D1CAE(E010D1CC1(_t112));
								}
							}
							_t125 =  *(_t157 + 0xbc);
							if( *(_t157 + 0xbc) != 0) {
								E010D1CAE(_t125);
								E010D1C9F( *(_t157 + 0xbc));
							}
						}
						_t78 = E010FB66A(_t155);
						_t109 = _t78;
						if(_t109 != 0 ||  *((intOrPtr*)(_t155 + 0x28)) != _t78) {
							_t127 =  *(_t157 + 0xb8);
							if( *(_t157 + 0xb8) != 0) {
								E010D1CAE(_t127);
								if(_v8 != 0) {
									_push( *((intOrPtr*)(_v12 + 0x70)));
									E010D1CAE(E010D1CC1( *(_t157 + 0xb8)));
								}
							}
							if(_t109 != 0) {
								_t138 =  *(_t157 + 0xb8);
								if( *(_t157 + 0xb8) != 0) {
									_t150 = "WARNINGS:";
									E010FB09C(_t138, "WARNINGS:", _t109);
								}
							}
							if( *((intOrPtr*)(_t155 + 0x28)) != 0) {
								_t111 =  *(_t157 + 0xb8);
								if(_t111 != 0) {
									_v16 =  *((intOrPtr*)(_t155 + 0x24));
									fputs("WARNINGS:",  *_t111);
									E010D1CAE(_t111);
									_push(_v16);
									E010D1CAE(E010D1CC1(_t111));
								}
							}
							_t128 =  *(_t157 + 0xb8);
							if( *(_t157 + 0xb8) != 0) {
								E010D1CAE(_t128);
								if( *((char*)(_t157 + 0xc1)) != 0) {
									E010D1C9F( *(_t157 + 0xb8));
								}
							}
						}
						if( *((intOrPtr*)(_t155 + 0xc)) >= 0) {
							_t130 =  *(_t157 + 0xb8);
							_t156 = _t157 + 0xb8;
							_t183 =  *(_t157 + 0xb8);
							if( *(_t157 + 0xb8) != 0) {
								_t150 = _a4;
								E010FB1E7(_t130, _a4, _t183, _v12);
								if( *((char*)(_t157 + 0xc1)) != 0) {
									E010D1C9F( *_t156);
								}
							}
						}
						_v8 = _v8 + 1;
					} while (_v8 <  *((intOrPtr*)(_a8 + 4)));
					goto L39;
				}
			}

0x01101c5e
0x01101c65
0x01101c70
0x01101c73
0x01101c77
0x01101c77
0x01101c7f
0x01101c85
0x01101e53
0x01101e57
0x01101e5d
0x01101e7f
0x01101e81
0x01101e83
0x01101e83
0x01101e88
0x01101e8e
0x01101e90
0x01101edb
0x00000000
0x01101e92
0x01101e9a
0x01101ea2
0x01101eab
0x01101eb6
0x01101ec7
0x01101ecc
0x01101ece
0x01101ee0
0x01101ee0
0x01101ee0
0x01101ed6
0x00000000
0x01101ed6
0x01101e90
0x01101e61
0x00000000
0x00000000
0x01101e69
0x01101e70
0x00000000
0x00000000
0x01101e78
0x00000000
0x01101c8b
0x01101c8b
0x01101c8c
0x01101c94
0x01101c97
0x01101c9a
0x01101ca1
0x01101ca4
0x01101ca6
0x01101ca6
0x01101cab
0x01101cb6
0x01101cbe
0x01101cc0
0x01101cc9
0x01101cd4
0x01101cde
0x01101cde
0x01101cc9
0x01101ce5
0x01101ce7
0x01101cef
0x01101cf2
0x01101cf7
0x01101cf7
0x01101cef
0x01101d00
0x01101d02
0x01101d0a
0x01101d11
0x01101d19
0x01101d23
0x01101d28
0x01101d34
0x01101d34
0x01101d0a
0x01101d39
0x01101d41
0x01101d43
0x01101d4e
0x01101d4e
0x01101d41
0x01101d55
0x01101d5a
0x01101d5e
0x01101d69
0x01101d71
0x01101d73
0x01101d7c
0x01101d87
0x01101d91
0x01101d91
0x01101d7c
0x01101d98
0x01101d9a
0x01101da2
0x01101da5
0x01101daa
0x01101daa
0x01101da2
0x01101db3
0x01101db5
0x01101dbd
0x01101dc4
0x01101dcc
0x01101dd6
0x01101ddb
0x01101de7
0x01101de7
0x01101dbd
0x01101dec
0x01101df4
0x01101df6
0x01101e02
0x01101e0a
0x01101e0a
0x01101e02
0x01101df4
0x01101e13
0x01101e15
0x01101e1b
0x01101e21
0x01101e23
0x01101e28
0x01101e2b
0x01101e37
0x01101e3b
0x01101e3b
0x01101e37
0x01101e23
0x01101e40
0x01101e49
0x00000000
0x01101e52

APIs

fputs.MSVCRT ref: 01101D19

Part of subcall function 0110183F: fputs.MSVCRT ref: 011018A8

fputs.MSVCRT ref: 01101E9A

Part of subcall function 010D1C9F: fflush.MSVCRT ref: 010D1CA1

fputs.MSVCRT ref: 01101DCC

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Part of subcall function 010D1CC1: __EH_prolog.LIBCMT ref: 010D1CC6
Part of subcall function 010D1CC1: fputs.MSVCRT ref: 010D1D39

Strings

WARNINGS:, xrefs: 01101DA5, 01101DC7
ERRORS:, xrefs: 01101CF2, 01101D14

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfflushfputc
String ID: ERRORS:$WARNINGS:
API String ID: 1876658717-3472301450
Opcode ID: b64707c12de793832f603b772eafc4f8b9798498b18b712cd92cb44f02fc45f2
Instruction ID: 3baf0562fab6db40ac835c3a82c01e0764a124f6ca83676a583e3b94bf6935c8
Opcode Fuzzy Hash: b64707c12de793832f603b772eafc4f8b9798498b18b712cd92cb44f02fc45f2
Instruction Fuzzy Hash: B5712034A0070AAFEB2EEF65C594BAE7BA3BF54300F04842DD95A47690CFB4E940DB51

Uniqueness

Uniqueness Score: -1.00%

Function 010F3D0B Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E010F3D0B(signed int* __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t51;
				signed int _t54;
				signed int _t62;
				signed int _t66;
				signed char _t70;
				void* _t75;
				void* _t76;
				void* _t78;
				signed int* _t84;
				signed char _t85;
				signed int* _t87;
				void* _t112;
				signed int _t115;
				signed int _t119;
				signed int _t121;
				signed int _t122;
				void* _t123;

				E011039E0(E011067B8, _t123);
				_t115 =  *(_t123 + 8);
				_t84 = __ecx;
				 *((intOrPtr*)(_t123 - 0x10)) = __edx;
				 *((intOrPtr*)(_t115 + 4)) = 0;
				 *((short*)( *_t115)) = 0;
				E010DFB2F(_t123 - 0x48, __eflags);
				 *(_t123 - 4) = 0;
				 *((intOrPtr*)(_t123 - 0x14)) = 0;
				if(E010D6C0B(_t123 - 0x48, __ecx,  *((intOrPtr*)(_t123 - 0x10)), _t123 - 0x14) == 0) {
					__eflags =  *((intOrPtr*)(_t123 - 0x10)) - 8;
					if( *((intOrPtr*)(_t123 - 0x10)) >= 8) {
						_t119 = _t84[1] & 0x0000ffff;
						_t51 =  *_t84;
						 *(_t123 - 0x18) = _t119;
						 *(_t123 + 8) = _t51;
						__eflags = _t119 + 8 -  *((intOrPtr*)(_t123 - 0x10));
						if(_t119 + 8 >  *((intOrPtr*)(_t123 - 0x10))) {
							goto L6;
						}
						__eflags = _t84[1];
						if(_t84[1] != 0) {
							goto L6;
						}
						_push(_t51);
						_t112 = 0x12;
						_t54 = E010F3BDB(0x1109ef0, _t112);
						__eflags = _t54;
						if(_t54 < 0) {
							E010D2CAD(_t115, "REPARSE:");
							E010D16CE( *(_t123 + 8), _t123 - 0x28);
							_push(_t123 - 0x28);
						} else {
							_push( *((intOrPtr*)(0x1109ef4 + _t54 * 8)));
						}
						E010D2CAD(_t115);
						E010D2CAD(_t115, ":");
						E010D2D06(_t115, _t119);
						__eflags = _t119;
						if(_t119 == 0) {
							L23:
							_t85 = 1;
							L24:
							 *(_t123 - 4) =  *(_t123 - 4) | 0xffffffff;
							E010FC31B(_t123 - 0x48);
							 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0xc));
							return _t85;
						} else {
							E010D2BF6();
							 *(_t123 + 8) =  *(_t123 + 8) & 0x00000000;
							_t87 =  &(_t84[2]);
							__eflags = _t119;
							if(_t119 <= 0) {
								goto L23;
							} else {
								goto L14;
							}
							while(1) {
								L14:
								_t62 =  *(_t123 + 8);
								__eflags = _t62 - 8;
								if(_t62 >= 8) {
									break;
								}
								_t121 =  *(_t87 + _t62) & 0x000000ff;
								_t66 = _t121 >> 0x00000004 & 0x0000000f;
								__eflags = _t66 - 0xa;
								if(_t66 >= 0xa) {
									_t67 = _t66 + 0x37;
									__eflags = _t66 + 0x37;
								} else {
									_t67 = _t66 + 0x30;
								}
								E010D1089(_t115, _t67 & 0x000000ff);
								_t122 = _t121 & 0x0000000f;
								__eflags = _t122 - 0xa;
								_t70 = _t122 + 0x30;
								if(_t122 >= 0xa) {
									_t70 = _t122 + 0x37;
								}
								E010D1089(_t115, _t70 & 0x000000ff);
								 *(_t123 + 8) =  *(_t123 + 8) + 1;
								__eflags =  *(_t123 + 8) -  *(_t123 - 0x18);
								if( *(_t123 + 8) <  *(_t123 - 0x18)) {
									continue;
								} else {
									goto L23;
								}
							}
							E010D2CAD(_t115, "...");
							goto L23;
						}
					}
					L6:
					_t85 = 0;
					goto L24;
				}
				_t130 =  *((intOrPtr*)(_t123 - 0x48)) - 0xa000000c;
				if( *((intOrPtr*)(_t123 - 0x48)) != 0xa000000c) {
					E010D2CAD(_t115, "Junction: ");
				}
				_push(_t123 - 0x24);
				_t75 = E010D6DAA(_t123 - 0x48, _t130);
				 *(_t123 - 4) = 1;
				_t76 = E010D2C71(_t115, _t130, _t75);
				 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
				E010D1ABD(_t76,  *((intOrPtr*)(_t123 - 0x24)));
				_t78 = E010D6D46(_t123 - 0x48, _t130);
				_t131 = _t78;
				if(_t78 == 0) {
					E010D2CAD(_t115, " : ");
					E010D2C71(_t115, _t131, _t123 - 0x34);
				}
				goto L23;
			}

0x010f3d10
0x010f3d1b
0x010f3d1e
0x010f3d24
0x010f3d27
0x010f3d2d
0x010f3d30
0x010f3d3c
0x010f3d42
0x010f3d4d
0x010f3db5
0x010f3db9
0x010f3dc2
0x010f3dc6
0x010f3dc8
0x010f3dce
0x010f3dd1
0x010f3dd4
0x00000000
0x00000000
0x010f3dd6
0x010f3ddb
0x00000000
0x00000000
0x010f3ddd
0x010f3de0
0x010f3de6
0x010f3deb
0x010f3ded
0x010f3dff
0x010f3e0a
0x010f3e12
0x010f3def
0x010f3def
0x010f3def
0x010f3e15
0x010f3e21
0x010f3e29
0x010f3e2e
0x010f3e30
0x010f3ea4
0x010f3ea4
0x010f3ea6
0x010f3ea6
0x010f3ead
0x010f3eba
0x010f3ec2
0x010f3e32
0x010f3e34
0x010f3e39
0x010f3e3d
0x010f3e40
0x010f3e42
0x00000000
0x00000000
0x00000000
0x00000000
0x010f3e44
0x010f3e44
0x010f3e44
0x010f3e47
0x010f3e4a
0x00000000
0x00000000
0x010f3e4c
0x010f3e55
0x010f3e58
0x010f3e5b
0x010f3e62
0x010f3e62
0x010f3e5d
0x010f3e5d
0x010f3e5d
0x010f3e6c
0x010f3e71
0x010f3e74
0x010f3e77
0x010f3e7a
0x010f3e7c
0x010f3e7c
0x010f3e86
0x010f3e8b
0x010f3e91
0x010f3e94
0x00000000
0x010f3e96
0x00000000
0x010f3e96
0x010f3e94
0x010f3e9f
0x00000000
0x010f3e9f
0x010f3e30
0x010f3dbb
0x010f3dbb
0x00000000
0x010f3dbb
0x010f3d4f
0x010f3d56
0x010f3d5f
0x010f3d5f
0x010f3d6a
0x010f3d6b
0x010f3d73
0x010f3d77
0x010f3d7c
0x010f3d83
0x010f3d8c
0x010f3d91
0x010f3d93
0x010f3da0
0x010f3dab
0x010f3dab
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010F3D10

Part of subcall function 010DFB2F: __EH_prolog.LIBCMT ref: 010DFB34

Strings

: , xrefs: 010F3D99
REPARSE:, xrefs: 010F3DF8
Junction: , xrefs: 010F3D58
..., xrefs: 010F3E98

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: : $...$Junction: $REPARSE:
API String ID: 3519838083-1476144188
Opcode ID: 52ebb6250510d7e40a9013673f9a625d26fef885fb35ba0220789b65a63dadd1
Instruction ID: a8da1d9403c7d1f900e524ab53b4495be029610c86cce38e232ee29c771b9fb5
Opcode Fuzzy Hash: 52ebb6250510d7e40a9013673f9a625d26fef885fb35ba0220789b65a63dadd1
Instruction Fuzzy Hash: 2041F371E0021A9BCF15EF54C891AFDBBB5BFA4310F08400DE992AB6C1DB749E45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010E3454 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E010E3454(void* __ecx, signed short* __edx, void* __eflags) {
				void* __ebx;
				void* _t30;
				void* _t31;
				intOrPtr _t33;
				signed int _t42;
				void* _t43;
				void* _t54;
				void* _t62;
				signed int _t97;
				intOrPtr* _t102;
				signed int _t104;
				void* _t106;
				void* _t111;

				_t111 = __eflags;
				E011039E0(E01105334, _t106);
				_t102 = __edx;
				_t62 = __ecx;
				_t30 = E010E362A(_t106 - 0x20, 0x11091bc, 0xe,  *__edx & 0x0000ffff);
				 *(_t106 - 4) =  *(_t106 - 4) & 0x00000000;
				_t31 = E010D251D(_t62, _t111, _t30);
				 *(_t106 - 4) =  *(_t106 - 4) | 0xffffffff;
				E010D1ABD(_t31,  *((intOrPtr*)(_t106 - 0x20)));
				_t33 =  *_t102;
				if(_t33 != 0 ||  *((intOrPtr*)(_t102 + 0x18)) != 0x24a) {
					if(_t33 != 9 ||  *((intOrPtr*)(_t102 + 0x18)) != 0x21d8) {
						E010D24DB(_t62, " ");
						E010D254B(_t62,  *((intOrPtr*)(_t102 + 0x18)));
					}
				}
				E010D24DB(_t62, " ");
				asm("cdq");
				E010E2E26(_t62,  *(_t102 + 0x20) & 0x0000ffff, 0x11091bc);
				E010D24DB(_t62, ".");
				asm("cdq");
				E010E2E26(_t62,  *(_t102 + 0x22) & 0x0000ffff, 0x11091bc);
				_t97 =  *((intOrPtr*)(_t102 + 0x10)) + 1;
				_t42 = 0;
				asm("adc eax, eax");
				 *(_t106 - 0x10) = _t42;
				_t43 = 1;
				if(_t97 != E01103D40(_t43,  *((intOrPtr*)(_t102 + 0x14)), 0) ||  *(_t106 - 0x10) != 0) {
					if((_t97 |  *(_t106 - 0x10)) != 0 ||  *((intOrPtr*)(_t102 + 0x14)) != 0x40) {
						E010D24DB(_t62, " act:");
						E010E2E26(_t62,  *((intOrPtr*)(_t102 + 0x10)), 0);
					}
				}
				E010D24DB(_t62, " cpus:");
				E010D254B(_t62,  *((intOrPtr*)(_t102 + 0x14)));
				if( *((intOrPtr*)(_t102 + 4)) != 0x1000) {
					E010D24DB(_t62, " page:");
					E010E35FC(_t62,  *((intOrPtr*)(_t102 + 4)));
				}
				if( *((intOrPtr*)(_t102 + 0x1c)) != 0x10000) {
					E010D24DB(_t62, " gran:");
					E010E35FC(_t62,  *((intOrPtr*)(_t102 + 0x1c)));
				}
				E010D24DB(_t62, " ");
				_t50 =  *((intOrPtr*)(_t102 + 8));
				_t104 =  *((intOrPtr*)(_t102 + 0xc)) + 1;
				asm("adc edi, edi");
				if( *((intOrPtr*)(_t102 + 8)) == 0x10000) {
					__eflags = _t104 & 0x0000ffff;
					if((_t104 & 0x0000ffff) == 0) {
						_t104 = _t104 + 0x10000;
						asm("adc edi, edx");
					}
				} else {
					E010E2EA0(_t62, _t62, _t50, 0);
					E010D24DB(_t62, 0x11086f0);
				}
				_t54 = E010E2EA0(_t62, _t62, _t104, 0);
				 *[fs:0x0] =  *((intOrPtr*)(_t106 - 0xc));
				return _t54;
			}

0x010e3454
0x010e3459
0x010e3463
0x010e3466
0x010e3476
0x010e347b
0x010e3482
0x010e3487
0x010e348e
0x010e3493
0x010e349a
0x010e34a9
0x010e34bb
0x010e34c5
0x010e34c5
0x010e34a9
0x010e34d1
0x010e34da
0x010e34df
0x010e34eb
0x010e34f4
0x010e34f9
0x010e3506
0x010e3509
0x010e350a
0x010e350e
0x010e3511
0x010e351b
0x010e3525
0x010e3534
0x010e3540
0x010e3540
0x010e3525
0x010e354c
0x010e3556
0x010e3562
0x010e356b
0x010e3575
0x010e3575
0x010e3581
0x010e358a
0x010e3594
0x010e3594
0x010e35a0
0x010e35a5
0x010e35ad
0x010e35b5
0x010e35b9
0x010e35dc
0x010e35de
0x010e35e0
0x010e35e2
0x010e35e2
0x010e35bb
0x010e35c0
0x010e35cc
0x010e35cc
0x010e35e8
0x010e35f3
0x010e35fb

APIs

__EH_prolog.LIBCMT ref: 010E3459

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Strings

gran:, xrefs: 010E3583
cpus:, xrefs: 010E3545
act:, xrefs: 010E352D
page:, xrefs: 010E3564

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfree
String ID: act:$ cpus:$ gran:$ page:
API String ID: 1978129608-454015223
Opcode ID: 321e325011d584f94bfca8e17728982debce27699f98d8a119b177d237ec0c8b
Instruction ID: 5cd22daf29c8c6afa585c79b6e728544a07630e7987b3446fc866edc6acbc568
Opcode Fuzzy Hash: 321e325011d584f94bfca8e17728982debce27699f98d8a119b177d237ec0c8b
Instruction Fuzzy Hash: 9E4115B2B007069FDB29AE2A8C547BE76F6BB94714F00493DA4C75B7D2CFB49C848650

Uniqueness

Uniqueness Score: -1.00%

Function 010FBCE4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FBCE4(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, signed int _a16, char _a20) {
				signed int _v8;
				intOrPtr _v12;
				char _v47;
				char _v60;
				char _v252;
				int _t58;
				void* _t63;
				int _t65;
				char** _t76;
				void* _t89;
				signed int _t90;
				signed int _t91;
				void* _t104;
				intOrPtr* _t108;
				void* _t109;
				intOrPtr _t112;
				void* _t113;
				intOrPtr _t115;
				void* _t118;

				_t112 = __ecx;
				_v12 = __ecx;
				E010FBC65(__ecx + 8);
				_t108 = _a12;
				_t76 = __ecx + 0x124;
				_v8 = 0;
				_t76[1] = 0;
				 *( *(__ecx + 0x124)) =  *( *(__ecx + 0x124)) & 0;
				if( *((intOrPtr*)(_t108 + 4)) <= 0) {
					L7:
					if( *((char*)(_t112 + 0x132)) != 0) {
						E010D24BF();
						_t113 =  &_v60;
						if(_a20 == 0) {
							_t104 = 0xd;
							E010FBE50( &_v60, _t104);
						} else {
							_t113 =  &_v47;
							E010D15CA( &_v47, _a4, _a8);
							_t58 = strlen( &_v47);
							_t89 = 0xd;
							_t90 = _t89 - _t58;
							if(_t90 > 0) {
								_t113 =  &_v47 - _t90;
								if(_t90 > 0) {
									_t109 = _t113;
									_t91 = _t90 >> 2;
									memset(_t109 + _t91, memset(_t109, 0x20202020, _t91 << 2), (_t90 & 0x00000003) << 0);
								}
							}
						}
						E010D24DB(_t76, _t113);
						_t112 = _v12;
					}
					if( *((char*)(_t112 + 0x133)) != 0) {
						E010D24BF();
						E010D24BF();
					}
					return fputs( *_t76,  *( *(_t112 + 0xb8)));
				} else {
					goto L1;
				}
				do {
					L1:
					_t115 =  *((intOrPtr*)( *_t108 + _v8 * 4));
					_v252 = _v252 & 0x00000000;
					if(_a20 != 0) {
						E010EAE6D( &_v252, (_a16 << 6) + _t115 + 0x14,  *((intOrPtr*)(_t115 + 0x10)));
					}
					_t63 = E010FBB17( *((intOrPtr*)(_t115 + 0x10)));
					_t65 = strlen( &_v252);
					E010FBE50(_t118 + strlen( &_v252) - 0xf8, _t63 - _t65);
					if(_v8 != 0) {
						E010D24BF();
					}
					E010D24DB(_t76,  &_v252);
					_v8 = _v8 + 1;
				} while (_v8 <  *((intOrPtr*)(_t108 + 4)));
				_t112 = _v12;
				goto L7;
			}

0x010fbcef
0x010fbcf2
0x010fbcf8
0x010fbd03
0x010fbd06
0x010fbd0e
0x010fbd11
0x010fbd14
0x010fbd19
0x010fbdad
0x010fbdb4
0x010fbdb8
0x010fbdc1
0x010fbdc4
0x010fbe0f
0x010fbe10
0x010fbdc6
0x010fbdcc
0x010fbdd2
0x010fbddb
0x010fbde3
0x010fbde4
0x010fbde8
0x010fbded
0x010fbdf1
0x010fbdfa
0x010fbdfc
0x010fbe06
0x010fbe06
0x010fbdf1
0x010fbde8
0x010fbe18
0x010fbe1d
0x010fbe1d
0x010fbe27
0x010fbe2b
0x010fbe32
0x010fbe32
0x010fbe4d
0x00000000
0x00000000
0x00000000
0x010fbd1f
0x010fbd1f
0x010fbd24
0x010fbd27
0x010fbd32
0x010fbd47
0x010fbd47
0x010fbd4f
0x010fbd5d
0x010fbd7b
0x010fbd84
0x010fbd88
0x010fbd88
0x010fbd96
0x010fbd9b
0x010fbda1
0x010fbdaa
0x00000000

APIs

strlen.MSVCRT ref: 010FBD5D
strlen.MSVCRT ref: 010FBD6B
strlen.MSVCRT ref: 010FBDDB
fputs.MSVCRT ref: 010FBE41

Strings

, xrefs: 010FBDF5

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: strlen$fputs
String ID:
API String ID: 1552308726-399585960
Opcode ID: b3b7a39630aa987e822a6ee44ac8978e1cc495a8dc5d00296e0ea0444741f575
Instruction ID: 9274264129d4c6693cc654ae77a3f26a832870c5a7f8a7baf0eed55c2d6f316c
Opcode Fuzzy Hash: b3b7a39630aa987e822a6ee44ac8978e1cc495a8dc5d00296e0ea0444741f575
Instruction Fuzzy Hash: 6341D331A0020A9BDF25EF68C491BED7BF5AF14300F1144ADD656A7690DF74AE88CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01100965 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E01100965(intOrPtr* __ecx, struct _IO_FILE** __edx) {
				void* _t18;
				void* _t25;
				struct _IO_FILE** _t28;
				signed int _t45;
				intOrPtr* _t48;
				void* _t50;

				E011039E0(E01107878, _t50);
				_t48 = __ecx;
				_t45 = 0;
				_t28 = __edx;
				_t55 =  *((intOrPtr*)(__ecx + 4));
				if( *((intOrPtr*)(__ecx + 4)) > 0) {
					do {
						E010D1E52( *((intOrPtr*)( *__ecx + _t45 * 4)));
						fputs(" : ",  *__edx);
						_push( *((intOrPtr*)(E010D4B4D(_t50 - 0x18,  *((intOrPtr*)( *((intOrPtr*)(_t48 + 0xc)) + _t45 * 4)), _t55))));
						 *(_t50 - 4) =  *(_t50 - 4) & 0x00000000;
						_t25 = E010D1CAE(E010D1CC1(_t28));
						 *(_t50 - 4) =  *(_t50 - 4) | 0xffffffff;
						E010D1ABD(_t25,  *((intOrPtr*)(_t50 - 0x18)));
						_t45 = _t45 + 1;
					} while (_t45 <  *((intOrPtr*)(_t48 + 4)));
				}
				fputs("----------------",  *_t28);
				_t18 = E010D1CAE(_t28);
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t18;
			}

0x0110096a
0x01100975
0x01100977
0x01100979
0x0110097b
0x0110097e
0x01100980
0x01100987
0x01100993
0x011009a9
0x011009ab
0x011009b8
0x011009bd
0x011009c4
0x011009c9
0x011009cb
0x01100980
0x011009d7
0x011009e1
0x011009ec
0x011009f4

APIs

__EH_prolog.LIBCMT ref: 0110096A
fputs.MSVCRT ref: 01100993

Part of subcall function 010D4B4D: __EH_prolog.LIBCMT ref: 010D4B52

Part of subcall function 010D1CC1: __EH_prolog.LIBCMT ref: 010D1CC6
Part of subcall function 010D1CC1: fputs.MSVCRT ref: 010D1D39

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

fputs.MSVCRT ref: 011009D7

Strings

: , xrefs: 0110098E
----------------, xrefs: 011009D2

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfputs$fputcfree
String ID: : $----------------
API String ID: 1941438168-4071417161
Opcode ID: e9061da5aeab87d620efc2d6843890c20ec89f16fd01050133f4c7adfa64b71e
Instruction ID: aab3040cf797e0b55d8aeeb4f3f6d669dcb580b9eca8df77cc6b21e8ca8172a6
Opcode Fuzzy Hash: e9061da5aeab87d620efc2d6843890c20ec89f16fd01050133f4c7adfa64b71e
Instruction Fuzzy Hash: A001C431A04206DFCB1EAB68D841A9DBBA2FF94360F10413DE096972D0CFB1AC048B40

Uniqueness

Uniqueness Score: -1.00%

Function 011023CF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E011023CF(void* __ecx, void* __edx) {
				struct _IO_FILE** _t16;
				void* _t41;
				void* _t44;

				E011039E0(E01107AD0, _t44);
				_t41 = __ecx;
				_t16 =  *(__ecx + 0xb8);
				if(_t16 != 0) {
					fputs("Write SFX: ",  *_t16);
					_push( *((intOrPtr*)(_t44 + 8)));
					E010D1CC1( *(_t41 + 0xb8));
					E010D2351(_t44 - 0x18, " : ");
					 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
					E010FA4C9(_t44 - 0x18,  *((intOrPtr*)(_t44 + 0xc)),  *((intOrPtr*)(_t44 + 0x10)));
					fputs( *(_t44 - 0x18),  *( *(_t41 + 0xb8)));
					E010D1ABD(E010D1CAE( *(_t41 + 0xb8)),  *(_t44 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t44 - 0xc));
				return 0;
			}

0x011023d4
0x011023dd
0x011023df
0x011023e7
0x011023f7
0x011023fb
0x01102404
0x01102411
0x01102419
0x01102423
0x01102433
0x01102441
0x01102447
0x0110244e
0x01102456

APIs

__EH_prolog.LIBCMT ref: 011023D4
fputs.MSVCRT ref: 011023F7

Part of subcall function 010D1CC1: __EH_prolog.LIBCMT ref: 010D1CC6
Part of subcall function 010D1CC1: fputs.MSVCRT ref: 010D1D39

fputs.MSVCRT ref: 01102433

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Strings

: , xrefs: 01102409
Write SFX: , xrefs: 011023F2

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog$fputcfree
String ID: : $Write SFX:
API String ID: 2632947726-2530961540
Opcode ID: 445da4467a2511aea159f02e66ae9734990d2bfb600cd1daa7153a44b3287d8c
Instruction ID: a9c9283aec3356a223e8739e3114b661464ba423ead3452f7f563a88453db153
Opcode Fuzzy Hash: 445da4467a2511aea159f02e66ae9734990d2bfb600cd1daa7153a44b3287d8c
Instruction Fuzzy Hash: 80018832A04205DFCB0AAF55DC01BDDB7B5EF54210F00402DE555A21E0DFB16955DB91

Uniqueness

Uniqueness Score: -1.00%

Function 011005EE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E011005EE(char __edx) {
				char _v8;
				void* __ecx;
				int _t6;
				char* _t12;
				void* _t13;
				intOrPtr _t14;
				struct _IO_FILE** _t16;
				char _t22;
				void* _t23;
				struct _IO_FILE** _t28;
				void* _t29;
				struct _IO_FILE** _t30;

				_t22 = __edx;
				_push(_t16);
				_t28 =  *0x1114700; // 0x1114438
				_v8 = __edx;
				_t12 = _t16;
				if(_t28 != 0) {
					E010D1CAE(_t28);
					fputs("ERROR: ",  *_t28);
					fputs(_t12,  *_t28);
					_t16 = _t28;
					E010D1CAE(_t16);
					_t23 = _t23;
				}
				_t6 =  &_v8;
				L01103CAC();
				_t29 = _t6;
				_t13 = 0x1112678;
				_push(_t13);
				_push(_t29);
				_t30 = _t16;
				_push(_t23);
				_t14 = _t22;
				if(_t30 != 0) {
					_t6 = fputs( *0x110b780,  *_t30);
					if(_t14 != 0) {
						_t6 = fputs( *0x110b784,  *_t30);
					}
				}
				return _t6;
			}

0x011005ee
0x011005f1
0x011005f4
0x011005fa
0x011005ff
0x01100601
0x01100606
0x01100618
0x0110061d
0x01100622
0x01100624
0x01100629
0x01100629
0x01100635
0x01100639
0x0110063e
0x0110063f
0x01100640
0x01100641
0x01100642
0x01100644
0x01100647
0x01100649
0x01100659
0x0110065f
0x01100669
0x0110066c
0x0110065f
0x01100670

APIs

_CxxThrowException.MSVCRT(?,01112678), ref: 01100639

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

fputs.MSVCRT ref: 01100618
fputs.MSVCRT ref: 0110061D

Strings

@F}w, xrefs: 0110060B, 0110061A
ERROR: , xrefs: 01100613

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$ExceptionThrowfputc
String ID: @F}w$ERROR:
API String ID: 2339886702-942427430
Opcode ID: 8cbc1d11a170896dfea5bd8757c50a7d3a1574ec13b5b94b867c41b2aab52c71
Instruction ID: ded4cb7c95441c623a2085bacefc81aabe146fc08ed532f520a41ef6aeb281c8
Opcode Fuzzy Hash: 8cbc1d11a170896dfea5bd8757c50a7d3a1574ec13b5b94b867c41b2aab52c71
Instruction Fuzzy Hash: 22F0A771E0161DBFCB1AAB9ADE0089EB7ADEF98610711001AE540A3200DBB15E009BD0

Uniqueness

Uniqueness Score: -1.00%

Function 010D7F3B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E010D7F3B() {
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				char _v288;
				struct HINSTANCE__* _t6;
				_Unknown_base(*)()* _t8;
				void* _t12;

				_t6 = GetModuleHandleW(L"ntdll.dll");
				if(_t6 == 0) {
					L6:
					return 0;
				} else {
					_t8 = GetProcAddress(_t6, "RtlGetVersion");
					if(_t8 == 0) {
						goto L6;
					} else {
						 *_t8( &_v288);
						if(_v272 != 2 || _v280 + _v284 != 0xa || _v276 > 0x3fab) {
							goto L6;
						} else {
							_t12 = 1;
							return _t12;
						}
					}
				}
			}

0x010d7f49
0x010d7f51
0x010d7f99
0x010d7f9c
0x010d7f53
0x010d7f59
0x010d7f61
0x00000000
0x010d7f63
0x010d7f6a
0x010d7f73
0x00000000
0x010d7f94
0x010d7f96
0x010d7f98
0x010d7f98
0x010d7f73
0x010d7f61

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 010D7F49
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 010D7F59

Strings

RtlGetVersion, xrefs: 010D7F53
Net, xrefs: 010D7F59
ntdll.dll, xrefs: 010D7F44

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll$Net
API String ID: 1646373207-3435683380
Opcode ID: e5acd9ae3081d23c50d06af29b906350cccc3293840f442675a84bd4264bf130
Instruction ID: 81ab546043c3cdc27d46f493bf2668600b236707985a608a0e69b909f74df1fe
Opcode Fuzzy Hash: e5acd9ae3081d23c50d06af29b906350cccc3293840f442675a84bd4264bf130
Instruction Fuzzy Hash: 3DF08C70F083198EDB7A9B259C46BDE77A85B80709F0405E8A349E5081DBF4C9C18E91

Uniqueness

Uniqueness Score: -1.00%

Function 010E6AD8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E010E6AD8(void* __ecx) {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				void* _t7;

				_t7 = __ecx;
				_t1 = GetModuleHandleW(L"ntdll.dll");
				if(_t1 == 0) {
					L2:
					return 0;
				} else {
					_t3 = GetProcAddress(_t1, "RtlGetVersion");
					if(_t3 != 0) {
						 *_t3(_t7);
						_t5 = 1;
						return _t5;
					} else {
						goto L2;
					}
				}
			}

0x010e6ad9
0x010e6ae0
0x010e6ae8
0x010e6afa
0x010e6afd
0x010e6aea
0x010e6af0
0x010e6af8
0x010e6aff
0x010e6b03
0x010e6b05
0x00000000
0x00000000
0x00000000
0x010e6af8

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,010E3C27), ref: 010E6AE0
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 010E6AF0

Strings

RtlGetVersion, xrefs: 010E6AEA
Net, xrefs: 010E6AF0
ntdll.dll, xrefs: 010E6ADB

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll$Net
API String ID: 1646373207-3435683380
Opcode ID: 7dc936c7811be77a780cd30b4d1148382caa7d49887b765e5dd4a1ae0a1f23b0
Instruction ID: 8776b7a965a41299a68928e8aef10f9880fbcb865b83f43d6d66733eb67d6e04
Opcode Fuzzy Hash: 7dc936c7811be77a780cd30b4d1148382caa7d49887b765e5dd4a1ae0a1f23b0
Instruction Fuzzy Hash: EAD0A731F1C2106DF6F6667B7C0DBD617CC9F50511B080075F511C5044DBE0C8830961

Uniqueness

Uniqueness Score: -1.00%

Function 011033D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 15
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E011033D0() {
				signed int _t4;

				_t4 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLargePageMinimum");
				if(_t4 != 0) {
					_t4 =  *_t4();
					if(_t4 != 0) {
						_t1 = _t4 - 1; // -1
						if((_t4 & _t1) == 0) {
							 *0x1114720 = _t4;
							return _t4;
						}
					}
				}
				return _t4;
			}

0x011033e1
0x011033e9
0x011033eb
0x011033ef
0x011033f1
0x011033f6
0x011033f8
0x00000000
0x011033f8
0x011033f6
0x011033ef
0x011033fd

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLargePageMinimum,010DB835), ref: 011033DA
GetProcAddress.KERNEL32(00000000), ref: 011033E1

Strings

Net, xrefs: 011033E1
GetLargePageMinimum, xrefs: 011033D0
kernel32.dll, xrefs: 011033D5

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: GetLargePageMinimum$kernel32.dll$Net
API String ID: 1646373207-831249193
Opcode ID: 5b8fe1cd8bb9fea37f60feb9c12f68673d55b70abdf013697a9f13243b91028f
Instruction ID: a465a66d50e19b05bf5438fbe9188f416c5a3b54b1183ec2b556ed44b92047fa
Opcode Fuzzy Hash: 5b8fe1cd8bb9fea37f60feb9c12f68673d55b70abdf013697a9f13243b91028f
Instruction Fuzzy Hash: 29D09E70F587028E9A2F5B699C8D7197A58AD105413400168A561C5188DFF0D1418B65

Uniqueness

Uniqueness Score: -1.00%

Function 010F8DF0 Relevance: 7.8, APIs: 5, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E010F8DF0() {
				signed int _t163;
				signed int _t165;
				signed int _t166;
				intOrPtr* _t168;
				signed int _t170;
				intOrPtr _t185;
				signed int _t186;
				signed int _t191;
				intOrPtr _t199;
				signed int _t208;
				signed int _t211;
				signed int _t221;
				signed int _t226;
				signed int _t230;
				void* _t235;
				void* _t236;
				void* _t242;
				signed int _t245;
				signed int _t247;
				intOrPtr _t249;
				signed int _t257;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				signed int* _t301;
				signed int _t303;
				signed int _t304;
				signed int _t306;
				void* _t307;
				void* _t309;

				E011039E0(E01106F42, _t307);
				_t299 =  *(_t307 + 8);
				 *( *(_t307 + 0x10)) = 0;
				 *((intOrPtr*)(_t307 - 0x10)) = _t309 - 0x74;
				_t249 =  *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x90))));
				 *(_t307 - 4) = 0;
				_t163 =  *(_t307 + 0xc) +  *(_t307 + 0xc) * 4;
				_t242 = _t249 + _t163 * 4;
				if( *((char*)(_t249 + _t163 * 4)) != 0) {
					_t165 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x10))();
					__eflags = _t165;
					if(_t165 != 0) {
						goto L63;
					}
					_t166 = E010F91F7(_t299 - 4, _t242);
					__eflags =  *((char*)(_t242 + 3));
					 *(_t307 + 8) = _t166;
					if( *((char*)(_t242 + 3)) == 0) {
						_t168 = E010E709D( *((intOrPtr*)(_t299 + 0x7c)), _t307 - 0x28,  *(_t242 + 4));
						 *(_t307 - 4) = 4;
						_t170 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x18))( *_t168,  *(_t307 + 8), 0,  *(_t307 + 0x14));
						 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
						_t296 = _t170;
						E010D1ABD(_t170,  *((intOrPtr*)(_t307 - 0x28)));
						__eflags = _t296;
						if(_t296 == 0) {
							__eflags =  *(_t307 + 8);
							if( *(_t307 + 8) != 0) {
								L62:
								_t165 = 0;
								goto L63;
							}
							__eflags =  *((char*)(_t299 + 0xa2));
							if( *((char*)(_t299 + 0xa2)) == 0) {
								_push(0x58);
								_t257 = E010D1A96();
								 *(_t307 + 0x14) = _t257;
								__eflags = _t257;
								 *(_t307 - 4) = 5;
								if(_t257 == 0) {
									_t297 = 0;
									__eflags = 0;
								} else {
									_t297 = E010D929A(_t257);
								}
								 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
								 *(_t307 + 8) = _t297;
								__eflags = _t297;
								if(_t297 != 0) {
									 *((intOrPtr*)( *_t297 + 4))(_t297);
								}
								 *((char*)(_t297 + 0x48)) =  *((intOrPtr*)(_t299 + 0xa5));
								asm("sbb eax, eax");
								 *(_t307 - 4) = 6;
								 *(_t297 + 0x4c) =  ~(_t299 - 4) & _t299 + 0x0000001c;
								 *(_t297 + 0x50) =  *(_t307 + 0xc);
								E010E7072( *((intOrPtr*)(_t299 + 0x7c)), _t307 - 0x1c,  *(_t242 + 4));
								 *(_t307 - 4) = 7;
								E010D1553(_t299 + 0x3c,  *(_t307 + 0xc));
								_push(_t307 - 0x1c);
								E010D150C(_t299 + 0x48);
								_t185 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x7c)) + 0x24)) +  *(_t242 + 4) * 4));
								__eflags =  *(_t185 + 0x30);
								if(__eflags != 0) {
									L38:
									_push(0x2200000);
									_push(3);
									_push(1);
									_push(0);
									_push( *((intOrPtr*)(_t307 - 0x1c)));
									_t99 = _t297 + 0x18; // 0x18
									_t186 = E010D63E5(_t99, __eflags);
									__eflags = _t186;
									if(_t186 != 0) {
										goto L54;
									}
									_t303 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x1c))(_t307 - 0x1c, GetLastError());
									E010D1ABD(_t203,  *((intOrPtr*)(_t307 - 0x1c)));
									 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
									__eflags = _t297;
									if(_t297 != 0) {
										 *((intOrPtr*)( *_t297 + 8))(_t297);
									}
									goto L41;
								} else {
									__eflags =  *(_t185 + 0x38);
									if(__eflags == 0) {
										 *(_t307 + 0x14) =  *((intOrPtr*)(_t299 + 0xa0));
										_t208 = E010D68A5( *((intOrPtr*)(_t307 - 0x1c)),  *(_t307 + 0x14));
										__eflags = _t208;
										if(_t208 != 0) {
											L54:
											__eflags =  *((char*)(_t299 + 0xa5));
											if( *((char*)(_t299 + 0xa5)) != 0) {
												_t129 = _t297 + 0xc; // 0xc
												_t191 =  *((intOrPtr*)( *((intOrPtr*)(_t297 + 0xc)) + 0xc))(_t129, _t307 - 0x80);
												__eflags = _t191;
												if(_t191 == 0) {
													__eflags =  *((intOrPtr*)(_t307 - 0x60)) - 1;
													if( *((intOrPtr*)(_t307 - 0x60)) > 1) {
														 *((intOrPtr*)(_t307 - 0x40)) =  *((intOrPtr*)(_t307 - 0x78));
														 *((intOrPtr*)(_t307 - 0x3c)) =  *((intOrPtr*)(_t307 - 0x74));
														 *((intOrPtr*)(_t307 - 0x38)) =  *((intOrPtr*)(_t307 - 0x70));
														 *((intOrPtr*)(_t307 - 0x34)) =  *((intOrPtr*)(_t307 - 0x6c));
														 *(_t307 - 0x30) =  *(_t307 + 0xc);
														 *(_t307 + 0x14) =  *(_t299 + 0x2c);
														_t199 = E010F983A(_t299 + 0x28, _t307 - 0x40);
														__eflags =  *(_t307 + 0x14) -  *(_t299 + 0x2c);
														if( *(_t307 + 0x14) ==  *(_t299 + 0x2c)) {
															 *(_t299 + 0x34) =  *(_t307 + 0xc);
															 *((intOrPtr*)(_t299 + 0x38)) = _t199;
														}
													}
												}
											}
											_t301 = _t299 + 0xa8;
											 *(_t307 + 0xc) = _t301;
											__eflags =  *_t301;
											if( *_t301 != 0) {
												EnterCriticalSection(0x11146a8);
												 *((char*)( *(_t242 + 4) +  *( *(_t307 + 0xc)))) = 1;
												LeaveCriticalSection(0x11146a8);
											}
											 *( *(_t307 + 0x10)) = _t297;
											E010D1ABD( *(_t307 + 0x10),  *((intOrPtr*)(_t307 - 0x1c)));
											goto L62;
										}
										_t245 = GetLastError();
										_t211 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x1c))(_t307 - 0x1c, _t245);
										__eflags =  *((char*)(_t299 + 0xa1));
										 *(_t307 + 0xc) = _t211;
										if( *((char*)(_t299 + 0xa1)) == 0) {
											L51:
											E010D1ABD(_t211,  *((intOrPtr*)(_t307 - 0x1c)));
											 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
											__eflags = _t297;
											if(_t297 != 0) {
												 *((intOrPtr*)( *_t297 + 8))(_t297);
											}
											_t165 =  *(_t307 + 0xc);
											goto L63;
										}
										__eflags = _t211;
										if(_t211 == 0) {
											L46:
											__eflags = _t245;
											if(_t245 > 0) {
												_t245 = _t245 & 0x0000ffff | 0x80070000;
												__eflags = _t245;
											}
											E010D1ABD(_t211,  *((intOrPtr*)(_t307 - 0x1c)));
											 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
											__eflags = _t297;
											if(_t297 != 0) {
												 *((intOrPtr*)( *_t297 + 8))(_t297);
											}
											_t165 = _t245;
											goto L63;
										}
										__eflags = _t211 - 1;
										if(_t211 != 1) {
											goto L51;
										}
										goto L46;
									}
									goto L38;
								}
							}
							__eflags =  *(_t307 + 0x14);
							if( *(_t307 + 0x14) == 0) {
								L25:
								_push(8);
								_t221 = E010D1A96();
								__eflags = _t221;
								if(_t221 == 0) {
									_t304 = 0;
									__eflags = 0;
								} else {
									 *(_t221 + 4) =  *(_t221 + 4) & 0x00000000;
									 *_t221 = 0x1109848;
									_t304 = _t221;
								}
								__eflags = _t304;
								if(_t304 != 0) {
									 *((intOrPtr*)( *_t304 + 4))(_t304);
								}
								 *( *(_t307 + 0x10)) = _t304;
								goto L62;
							}
							__eflags =  *(_t307 + 0x14) - 1;
							if( *(_t307 + 0x14) != 1) {
								goto L62;
							}
							goto L25;
						}
						_t165 = _t296;
					} else {
						E010D28E9(_t307 - 0x28);
						_t226 =  *(_t242 + 8);
						 *(_t307 - 4) = 1;
						__eflags = _t226;
						if(_t226 < 0) {
							_t247 =  *(_t242 + 4);
							__eflags = _t247;
							if(_t247 >= 0) {
								_t235 = E010E709D( *((intOrPtr*)(_t299 + 0x7c)), _t307 - 0x1c, _t247);
								 *(_t307 - 4) = 2;
								_t236 = E010D2A8C(_t307 - 0x28, _t235);
								 *(_t307 - 4) = 1;
								E010D1ABD(_t236,  *((intOrPtr*)(_t307 - 0x1c)));
							}
						} else {
							E010D2A8C(_t307 - 0x28,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x8c)))) + _t226 * 4)) + 0x10);
						}
						_t228 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x18))( *((intOrPtr*)(_t307 - 0x28)),  *(_t307 + 8), 1,  *(_t307 + 0x14));
						__eflags = _t228;
						if(_t228 == 0) {
							__eflags =  *(_t307 + 8);
							if( *(_t307 + 8) == 0) {
								_push(0x20);
								_t230 = E010D1A96();
								__eflags = _t230;
								if(_t230 == 0) {
									_t306 = 0;
									__eflags = 0;
								} else {
									 *((intOrPtr*)(_t230 + 4)) = 0;
									 *((intOrPtr*)(_t230 + 0x1c)) = 0;
									 *_t230 = 0x110862c;
									_t306 = _t230;
								}
								__eflags = _t306;
								 *(_t307 + 0xc) = _t306;
								if(_t306 != 0) {
									 *((intOrPtr*)( *_t306 + 4))(_t306);
								}
								 *((intOrPtr*)(_t306 + 0x10)) = 0;
								_t43 = _t306 + 0x1c; // 0x1c
								 *(_t307 - 4) = 3;
								 *((intOrPtr*)(_t306 + 8)) = 0;
								 *((intOrPtr*)(_t306 + 0x18)) = 0;
								 *((intOrPtr*)(_t306 + 0x14)) = 0;
								E010E0E48(_t43, 0);
								_t228 =  *(_t307 + 0x10);
								 *( *(_t307 + 0x10)) = _t306;
							}
							_t303 = 0;
							__eflags = 0;
						} else {
							_t303 = _t228;
						}
						E010D1ABD(_t228,  *((intOrPtr*)(_t307 - 0x28)));
						L41:
						_t165 = _t303;
					}
					goto L63;
				} else {
					_t165 = 0x80004005;
					L63:
					 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0xc));
					return _t165;
				}
			}

0x010f8df5
0x010f8e02
0x010f8e08
0x010f8e13
0x010f8e16
0x010f8e18
0x010f8e1b
0x010f8e22
0x010f8e25
0x010f8e36
0x010f8e39
0x010f8e3b
0x00000000
0x00000000
0x010f8e45
0x010f8e4a
0x010f8e4e
0x010f8e51
0x010f8f37
0x010f8f44
0x010f8f50
0x010f8f56
0x010f8f5a
0x010f8f5c
0x010f8f61
0x010f8f64
0x010f8f6d
0x010f8f71
0x010f91d7
0x010f91d7
0x00000000
0x010f91d7
0x010f8f77
0x010f8f7e
0x010f8fc0
0x010f8fc8
0x010f8fca
0x010f8fcd
0x010f8fcf
0x010f8fd3
0x010f8fde
0x010f8fde
0x010f8fd5
0x010f8fda
0x010f8fda
0x010f8fe0
0x010f8fe4
0x010f8fe7
0x010f8fe9
0x010f8fee
0x010f8fee
0x010f8ffa
0x010f9002
0x010f9004
0x010f900a
0x010f9010
0x010f901d
0x010f9028
0x010f902c
0x010f9037
0x010f9038
0x010f9046
0x010f904b
0x010f904e
0x010f9055
0x010f9055
0x010f905a
0x010f905c
0x010f905e
0x010f905f
0x010f9062
0x010f9065
0x010f906a
0x010f906c
0x00000000
0x00000000
0x010f908b
0x010f908d
0x010f9092
0x010f9097
0x010f9099
0x010f909e
0x010f909e
0x00000000
0x010f9050
0x010f9050
0x010f9053
0x010f90b1
0x010f90ba
0x010f90bf
0x010f90c1
0x010f913a
0x010f913a
0x010f9141
0x010f9146
0x010f914e
0x010f9151
0x010f9153
0x010f9155
0x010f9159
0x010f9161
0x010f9167
0x010f916d
0x010f9173
0x010f9179
0x010f917f
0x010f9186
0x010f918e
0x010f9191
0x010f9196
0x010f9199
0x010f9199
0x010f9191
0x010f9159
0x010f9153
0x010f919c
0x010f91a2
0x010f91a5
0x010f91a8
0x010f91b0
0x010f91bf
0x010f91c3
0x010f91c3
0x010f91cf
0x010f91d1
0x00000000
0x010f91d6
0x010f90cc
0x010f90d5
0x010f90d8
0x010f90df
0x010f90e2
0x010f911b
0x010f911e
0x010f9123
0x010f9128
0x010f912a
0x010f912f
0x010f912f
0x010f9132
0x00000000
0x010f9132
0x010f90e4
0x010f90e6
0x010f90ed
0x010f90ed
0x010f90ef
0x010f90f7
0x010f90f7
0x010f90f7
0x010f9100
0x010f9105
0x010f910a
0x010f910c
0x010f9111
0x010f9111
0x010f9114
0x00000000
0x010f9114
0x010f90e8
0x010f90eb
0x00000000
0x00000000
0x00000000
0x010f90eb
0x00000000
0x010f9053
0x010f904e
0x010f8f80
0x010f8f84
0x010f8f90
0x010f8f90
0x010f8f92
0x010f8f97
0x010f8f9a
0x010f8faa
0x010f8faa
0x010f8f9c
0x010f8f9c
0x010f8fa0
0x010f8fa6
0x010f8fa6
0x010f8fac
0x010f8fae
0x010f8fb3
0x010f8fb3
0x010f8fb9
0x00000000
0x010f8fb9
0x010f8f86
0x010f8f8a
0x00000000
0x00000000
0x00000000
0x010f8f8a
0x010f8f66
0x010f8e57
0x010f8e5a
0x010f8e5f
0x010f8e62
0x010f8e66
0x010f8e68
0x010f8e83
0x010f8e86
0x010f8e88
0x010f8e92
0x010f8e9b
0x010f8e9f
0x010f8ea7
0x010f8eab
0x010f8eb0
0x010f8e6a
0x010f8e7c
0x010f8e7c
0x010f8ec3
0x010f8ec6
0x010f8ec8
0x010f8ece
0x010f8ed2
0x010f8ed4
0x010f8ed6
0x010f8edb
0x010f8ede
0x010f8ef0
0x010f8ef0
0x010f8ee0
0x010f8ee0
0x010f8ee3
0x010f8ee6
0x010f8eec
0x010f8eec
0x010f8ef2
0x010f8ef4
0x010f8ef7
0x010f8efc
0x010f8efc
0x010f8eff
0x010f8f03
0x010f8f06
0x010f8f0a
0x010f8f0d
0x010f8f10
0x010f8f13
0x010f8f18
0x010f8f1b
0x010f8f1b
0x010f8f1d
0x010f8f1d
0x010f8eca
0x010f8eca
0x010f8eca
0x010f8f22
0x010f90a1
0x010f90a1
0x010f90a1
0x00000000
0x010f8e27
0x010f8e27
0x010f91e6
0x010f91eb
0x010f91f4
0x010f91f4

APIs

__EH_prolog.LIBCMT ref: 010F8DF5

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: aac3acefa6d32f0ddccf398000188e254ba6a378cd523ccd0588b5c29b843e78
Instruction ID: d1241f467ed809b93ac5af7ddac85f8e98cb2ae5b5f7d48988dfc437b67dd2f2
Opcode Fuzzy Hash: aac3acefa6d32f0ddccf398000188e254ba6a378cd523ccd0588b5c29b843e78
Instruction Fuzzy Hash: 63E1AB34900306DFDB26DF68C484BAEBBF5BF49304F14849EFA959B651CB30A944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010D3F18 Relevance: 7.7, APIs: 5, Instructions: 226
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E010D3F18(intOrPtr __ecx) {
				void* __ebx;
				void* __edi;
				signed int _t116;
				void* _t132;
				void* _t144;
				signed int _t147;
				void* _t152;
				signed int _t156;
				intOrPtr* _t158;
				signed int _t165;
				char _t166;
				signed int _t168;
				intOrPtr _t170;
				signed int _t191;
				void* _t208;
				signed int _t211;
				void* _t213;
				wchar_t** _t214;
				void* _t216;

				E011039E0(E011042C5, _t216);
				 *((intOrPtr*)(_t216 - 0x20)) = __ecx;
				_t170 =  *((intOrPtr*)(_t216 + 0x10));
				_t165 = 0;
				_t221 =  *((intOrPtr*)(_t170 + 4));
				if( *((intOrPtr*)(_t170 + 4)) == 0) {
					_push(0x110d248);
					_push(_t216 + 0x18);
					 *((intOrPtr*)(_t216 + 0x18)) = "Empty file path";
					L01103CAC();
				}
				 *(_t216 - 0x18) = _t165;
				 *(_t216 - 0x14) = _t165;
				 *(_t216 - 0x10) = _t165;
				_t206 = _t216 - 0x18;
				 *(_t216 - 4) = _t165;
				E010D373A(_t170, _t216 - 0x18, _t221);
				_t116 =  *(_t216 - 0x14);
				 *(_t216 + 0x13) = 1;
				_t15 = _t116 * 4; // 0x0
				if( *((intOrPtr*)( *((intOrPtr*)( *(_t216 - 0x18) + _t15 - 4)) + 4)) == _t165) {
					 *(_t216 + 0x13) =  *(_t216 + 0x13) & 0x00000000;
					E010D44FC(_t216 - 0x18);
				}
				E010D28E9(_t216 - 0x48);
				 *(_t216 - 0x28) =  *(_t216 - 0x28) | 0xffffffff;
				_t208 = wcscmp;
				 *(_t216 - 4) = 1;
				if( *(_t216 - 0x14) >= 3) {
					_t158 =  *(_t216 - 0x18);
					if( *((intOrPtr*)( *_t158 + 4)) == _t165 &&  *((intOrPtr*)( *((intOrPtr*)(_t158 + 4)) + 4)) == _t165 && wcscmp( *( *(_t158 + 8)), "?") == 0) {
						 *(_t216 - 0x28) = 2;
					}
				}
				if( *((intOrPtr*)(_t216 + 8)) == 2) {
					L29:
					_t211 = E010D3E59( *((intOrPtr*)(_t216 - 0x20)), _t216 - 0x48);
					_t245 = _t211 - _t165;
					if(_t211 < _t165) {
						E010D29BC(_t216 - 0x94, _t245, _t216 - 0x48);
						 *(_t216 - 4) = 2;
						E010D41C4(_t216 - 0x88);
						_push(_t216 - 0x94);
						 *(_t216 - 4) = 3;
						_t211 = E010D46D8( *((intOrPtr*)(_t216 - 0x20)), _t208);
						 *(_t216 - 4) = 4;
						_t144 = E010D3BE9(_t216 - 0x88);
						 *(_t216 - 4) = 1;
						E010D1ABD(_t144,  *((intOrPtr*)(_t216 - 0x94)));
					}
					if( *((intOrPtr*)(_t216 + 8)) == 2 ||  *(_t216 - 0x14) != _t165 && ( *(_t216 - 0x14) != 1 ||  *((intOrPtr*)( *( *(_t216 - 0x18)) + 4)) != _t165)) {
						_t166 =  *((intOrPtr*)(_t216 + 0x14));
					} else {
						E010EC900(_t216 - 0x18);
						_push(E010D296F(_t216 - 0x54, "*"));
						 *(_t216 - 4) = 5;
						E010D1ABD(E010D150C(_t216 - 0x18),  *((intOrPtr*)(_t216 - 0x54)));
						 *(_t216 + 0x13) = 1;
						 *((char*)(_t216 + 0x18)) = 1;
						_t166 = 0;
					}
					 *((intOrPtr*)(_t216 - 0x38)) = 0;
					 *((intOrPtr*)(_t216 - 0x34)) = 0;
					 *((intOrPtr*)(_t216 - 0x30)) = 0;
					_push(_t216 - 0x18);
					 *(_t216 - 4) = 6;
					E010D4430(_t216 - 0x38);
					_push( *(_t216 - 0x28));
					 *((char*)(_t216 - 0x2b)) =  *(_t216 + 0x13);
					 *((char*)(_t216 - 0x29)) =  *((intOrPtr*)(_t216 + 0x18));
					 *((char*)(_t216 - 0x2a)) = 1;
					 *((char*)(_t216 - 0x2c)) = _t166;
					_push(_t216 - 0x38);
					_push( *((intOrPtr*)(_t216 + 0xc)));
					E010D3AF1( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t216 - 0x20)))) + _t211 * 4)) + 0xc, _t206);
					 *(_t216 - 4) = 1;
					E010D1ABD(E010E8B2E(_t166, _t216 - 0x38),  *((intOrPtr*)(_t216 - 0x48)));
					 *(_t216 - 4) =  *(_t216 - 4) | 0xffffffff;
					_t132 = E010E8B2E(_t166, _t216 - 0x18);
					 *[fs:0x0] =  *((intOrPtr*)(_t216 - 0xc));
					return _t132;
				} else {
					 *(_t216 - 0x28) =  *(_t216 - 0x28) | 0xffffffff;
					_t191 = E010D41F4(_t216 - 0x18);
					_t147 =  *(_t216 - 0x14);
					 *(_t216 - 0x3c) = _t191;
					 *(_t216 - 0x1c) = _t191;
					if( *((intOrPtr*)(_t216 + 8)) != 1 && _t191 != _t165 && _t147 > _t191) {
						_t40 = _t147 - 1; // 0x2
						_t206 = _t40;
						 *(_t216 - 0x1c) = _t40;
					}
					 *(_t216 - 0x24) =  *(_t216 - 0x24) | 0xffffffff;
					_t168 = _t191;
					if(_t191 >= _t147) {
						L23:
						_t208 = 0;
						if( *(_t216 - 0x1c) <= 0) {
							L28:
							_t165 = 0;
							goto L29;
						} else {
							goto L24;
						}
						do {
							L24:
							_t213 =  *( *(_t216 - 0x18));
							if( *((char*)(_t216 + 0x18)) != 0 && _t208 >=  *(_t216 - 0x3c)) {
								_t152 = E010D393B(_t213);
								_t242 = _t152;
								if(_t152 != 0) {
									goto L28;
								}
							}
							E010D2C71(_t216 - 0x48, _t242, _t213);
							E010D1089(_t216 - 0x48, 0x5c);
							E010D4522(_t216 - 0x18, 0);
							_t208 = _t208 + 1;
						} while (_t208 <  *(_t216 - 0x1c));
						goto L28;
					} else {
						do {
							_t214 =  *( *(_t216 - 0x18) + _t168 * 4);
							if(wcscmp( *_t214, L"..") == 0 || wcscmp( *_t214, ".") == 0) {
								 *(_t216 - 0x24) = _t168;
							}
							_t156 =  *(_t216 - 0x14);
							_t168 = _t168 + 1;
						} while (_t168 < _t156);
						if( *(_t216 - 0x24) >= 0) {
							_t50 = _t156 - 1; // 0x2
							if( *(_t216 - 0x24) != _t50) {
								_t156 = _t156 - 1;
							}
							 *(_t216 - 0x1c) = _t156;
						}
						goto L23;
					}
				}
			}

0x010d3f1d
0x010d3f28
0x010d3f2c
0x010d3f2f
0x010d3f31
0x010d3f34
0x010d3f39
0x010d3f3e
0x010d3f3f
0x010d3f46
0x010d3f46
0x010d3f4b
0x010d3f4e
0x010d3f51
0x010d3f54
0x010d3f57
0x010d3f5a
0x010d3f5f
0x010d3f65
0x010d3f69
0x010d3f70
0x010d3f72
0x010d3f79
0x010d3f79
0x010d3f83
0x010d3f88
0x010d3f90
0x010d3f96
0x010d3f9a
0x010d3f9c
0x010d3fa4
0x010d3fc1
0x010d3fc1
0x010d3fa4
0x010d3fcc
0x010d4091
0x010d409d
0x010d409f
0x010d40a1
0x010d40ad
0x010d40b8
0x010d40bc
0x010d40ca
0x010d40cb
0x010d40d4
0x010d40dc
0x010d40e0
0x010d40eb
0x010d40ef
0x010d40f4
0x010d40f9
0x010d4147
0x010d4110
0x010d4113
0x010d4125
0x010d4129
0x010d4135
0x010d413b
0x010d413f
0x010d4143
0x010d4143
0x010d414c
0x010d414f
0x010d4152
0x010d415b
0x010d415c
0x010d4160
0x010d4168
0x010d416b
0x010d4171
0x010d417a
0x010d4180
0x010d4183
0x010d4187
0x010d418d
0x010d4195
0x010d41a1
0x010d41a6
0x010d41ae
0x010d41b9
0x010d41c1
0x010d3fd2
0x010d3fd2
0x010d3fe2
0x010d3fe4
0x010d3fe7
0x010d3fea
0x010d3fed
0x010d3ff7
0x010d3ff7
0x010d3ffa
0x010d3ffa
0x010d3ffd
0x010d4003
0x010d4005
0x010d404a
0x010d404a
0x010d404f
0x010d408f
0x010d408f
0x00000000
0x00000000
0x00000000
0x00000000
0x010d4051
0x010d4051
0x010d4058
0x010d405a
0x010d4063
0x010d4068
0x010d406a
0x00000000
0x00000000
0x010d406a
0x010d4070
0x010d407a
0x010d4084
0x010d4089
0x010d408a
0x00000000
0x010d4007
0x010d4007
0x010d400f
0x010d401b
0x010d402d
0x010d402d
0x010d4030
0x010d4033
0x010d4034
0x010d403c
0x010d403e
0x010d4044
0x010d4046
0x010d4046
0x010d4047
0x010d4047
0x00000000
0x010d403c
0x010d4005

APIs

__EH_prolog.LIBCMT ref: 010D3F1D
_CxxThrowException.MSVCRT(00000002,0110D248), ref: 010D3F46
wcscmp.MSVCRT ref: 010D3FB9
wcscmp.MSVCRT ref: 010D4015
wcscmp.MSVCRT ref: 010D4025

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wcscmp$ExceptionH_prologThrow
String ID:
API String ID: 2750596395-0
Opcode ID: 88f15ebc1c93a374438df0e197a2b8f7cdb523003891004a961209570747a7f7
Instruction ID: 13afc22ee259d7115ac69259ae0ffbebb0eb6f4ef78cccc87b5fe0177c75a2a6
Opcode Fuzzy Hash: 88f15ebc1c93a374438df0e197a2b8f7cdb523003891004a961209570747a7f7
Instruction Fuzzy Hash: 85916971D0034ADFCF15EFA8C984AEDBFB0AF19314F1440A9E595A7281DB705A89CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010D313C Relevance: 7.6, APIs: 5, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E010D313C(signed int** __ecx, short** __edx, int _a4, void* _a8, signed int* _a12) {
				signed int _v5;
				void* _v12;
				int _v16;
				short* _v20;
				long _t35;
				int _t36;
				int _t46;
				char* _t53;
				int _t58;
				char** _t61;
				intOrPtr* _t62;

				_t61 = __ecx;
				_t35 = 0;
				_t62 = __edx;
				__ecx[1] = 0;
				 *( *__ecx) =  *( *__ecx) & 0;
				 *_a12 =  *_a12 & 0;
				_t58 = __edx[1];
				if(_t58 != 0) {
					_t36 = WideCharToMultiByte(_a4, 0,  *__edx, _t58, 0, 0, 0, 0);
					_v16 = _t36;
					if(_t36 != 0) {
						L4:
						_v12 = _v12 & 0x00000000;
						if(_a4 == 0xfde9 || _a4 == 0xfde8) {
							_v5 = 1;
						} else {
							_v5 = _v5 & 0x00000000;
						}
						if(_t36 > _t61[2]) {
							E010D2285(_t61, _t36);
						}
						_v20 =  *_t62;
						asm("sbb eax, eax");
						_t53 =  *_t61;
						asm("sbb eax, eax");
						_t46 = WideCharToMultiByte(_a4, 0, _v20,  *(_t62 + 4), _t53, _v16,  !( ~_v5) &  &_a8,  !( ~_v5) &  &_v12);
						if(_v5 == 0) {
							 *_a12 = _t53 & 0xffffff00 | _v12 != 0x00000000;
						}
						if(_t46 == 0) {
							_t46 =  &_a4;
							_push(0x110d0e8);
							_push(_t46);
							_a4 = 0x44e74;
							L01103CAC();
						}
						_t54 =  *_t61;
						_t61[1] = _t46;
						_t54[_t46] = ( *_t61)[_t46] & 0x00000000;
						return _t46;
					}
					_t35 = GetLastError();
					if(0 != 0) {
						_t36 =  &_a4;
						_push(0x110d0e8);
						_push(_t36);
						_a4 = 0x44e74;
						L01103CAC();
						goto L4;
					}
				}
				return _t35;
			}

0x010d3145
0x010d3147
0x010d3149
0x010d314d
0x010d3150
0x010d3155
0x010d3157
0x010d315c
0x010d3174
0x010d3178
0x010d317b
0x010d31a0
0x010d31a0
0x010d31ab
0x010d31bc
0x010d31b6
0x010d31b6
0x010d31b6
0x010d31c3
0x010d31c8
0x010d31c8
0x010d31d2
0x010d31da
0x010d31e3
0x010d31eb
0x010d3202
0x010d3208
0x010d3214
0x010d3214
0x010d3218
0x010d321a
0x010d321d
0x010d3222
0x010d3223
0x010d322a
0x010d322a
0x010d322f
0x010d3231
0x010d3234
0x00000000
0x010d3234
0x010d317d
0x010d3185
0x010d318b
0x010d318e
0x010d3193
0x010d3194
0x010d319b
0x00000000
0x010d319b
0x010d3185
0x010d323c

APIs

WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 010D3174
GetLastError.KERNEL32 ref: 010D317D
_CxxThrowException.MSVCRT(?,0110D0E8), ref: 010D319B
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,?,00000001,00000001), ref: 010D3202
_CxxThrowException.MSVCRT(0000FDE9,0110D0E8), ref: 010D322A

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: 36bb51739c77865220a39552356b559faa5a3d6130460797f4ff3053c26577e3
Instruction ID: 8d97bf412e55cc65f1eaa1cc298e7ca4876603c570d43df818de6cf1ca3638ef
Opcode Fuzzy Hash: 36bb51739c77865220a39552356b559faa5a3d6130460797f4ff3053c26577e3
Instruction Fuzzy Hash: 1E31A2B5904246BFEB11CFA8CC40BBEBBF9BF45344F108099E458DB141D7749945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010ED8B7 Relevance: 7.6, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E010ED8B7(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t14;
				signed int _t15;
				void* _t18;
				signed int _t19;
				signed int _t22;
				intOrPtr _t23;
				signed int* _t24;

				_t24 = _a12;
				_t23 = _a8;
				 *_t24 =  *_t24 & 0x00000000;
				_t18 = 0x10;
				_push(_t18);
				_push(0x110cdf8);
				_push(_t23);
				L01103D72();
				if(_t14 != 0) {
					_push(_t18);
					_push(0x110c3d8);
					_push(_t23);
					L01103D72();
					if(_t14 == 0) {
						goto L1;
					}
					_push(_t18);
					_push(0x110c358);
					_push(_t23);
					L01103D72();
					if(_t14 != 0) {
						_push(_t18);
						_push(0x110c568);
						_push(_t23);
						L01103D72();
						if(_t14 != 0) {
							_push(_t18);
							_push(0x110c368);
							_push(_t23);
							L01103D72();
							if(_t14 != 0) {
								_push(_t18);
								_push(0x110c388);
								_push(_t23);
								L01103D72();
								if(_t14 != 0) {
									return 0x80004002;
								}
								_t15 = _a4;
								_t19 = _t15;
								_t22 = _t15 + 0x10;
								L11:
								asm("sbb ecx, ecx");
								 *_t24 =  ~_t19 & _t22;
								L12:
								 *((intOrPtr*)(_t15 + 0x14)) =  *((intOrPtr*)(_t15 + 0x14)) + 1;
								return 0;
							}
							_t15 = _a4;
							_t19 = _t15;
							_t22 = _t15 + 0xc;
							goto L11;
						}
						_t15 = _a4;
						_t19 = _t15;
						_t22 = _t15 + 8;
						goto L11;
					}
					_t15 = _a4;
					_t19 = _t15;
					_t22 = _t15 + 4;
					goto L11;
				}
				L1:
				_t15 = _a4;
				 *_t24 = _t15;
				goto L12;
			}

0x010ed8bc
0x010ed8c0
0x010ed8c5
0x010ed8c8
0x010ed8c9
0x010ed8ca
0x010ed8cf
0x010ed8d0
0x010ed8da
0x010ed8e6
0x010ed8e7
0x010ed8ec
0x010ed8ed
0x010ed8f7
0x00000000
0x00000000
0x010ed8f9
0x010ed8fa
0x010ed8ff
0x010ed900
0x010ed90a
0x010ed916
0x010ed917
0x010ed91c
0x010ed91d
0x010ed927
0x010ed933
0x010ed934
0x010ed939
0x010ed93a
0x010ed944
0x010ed950
0x010ed951
0x010ed956
0x010ed957
0x010ed961
0x00000000
0x010ed97a
0x010ed963
0x010ed966
0x010ed968
0x010ed96b
0x010ed96d
0x010ed971
0x010ed973
0x010ed973
0x00000000
0x010ed976
0x010ed946
0x010ed949
0x010ed94b
0x00000000
0x010ed94b
0x010ed929
0x010ed92c
0x010ed92e
0x00000000
0x010ed92e
0x010ed90c
0x010ed90f
0x010ed911
0x00000000
0x010ed911
0x010ed8dc
0x010ed8dc
0x010ed8df
0x00000000

APIs

memcmp.MSVCRT ref: 010ED8D0
memcmp.MSVCRT ref: 010ED8ED
memcmp.MSVCRT ref: 010ED900

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d6fee22c7e8d024f0ccf2933a61f13afe4f83d7317ea007e287730a518a7994c
Instruction ID: 400eb70693815b2c39fc23fe3c7928655bd22367f8676b197c1e39204c218df5
Opcode Fuzzy Hash: d6fee22c7e8d024f0ccf2933a61f13afe4f83d7317ea007e287730a518a7994c
Instruction Fuzzy Hash: 5C210172A503057FD70B9E16DC81F7E33EDEB61698B004A68FC899B281F7A0DA0087D1

Uniqueness

Uniqueness Score: -1.00%

Function 010D4C4D Relevance: 7.6, APIs: 5, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4C4D(WCHAR* __ecx, FILETIME* __edx) {
				intOrPtr _t31;
				signed int _t35;
				void* _t39;
				signed int _t42;
				void* _t57;

				E011039E0(E0110443C, _t57);
				 *(_t57 - 0x10) =  *(_t57 - 0x10) | 0xffffffff;
				 *(_t57 - 0x1c) = __edx;
				 *(_t57 - 0x18) = __ecx;
				_t31 = E010D7553(__ecx);
				 *((intOrPtr*)(_t57 - 0x14)) = _t31;
				if(_t31 == 1) {
					L2:
					if( *((intOrPtr*)(_t57 - 0x14)) != 0) {
						_t35 = E010D28E9(_t57 - 0x28);
						 *(_t57 - 4) =  *(_t57 - 4) & 0x00000000;
						if(E010D765C( *(_t57 - 0x18), _t57 - 0x28, _t57, _t35 & 0xffffff00 |  *((intOrPtr*)(_t57 - 0x14)) != 0x00000001) != 0) {
							 *(_t57 - 0x10) = CreateFileW( *(_t57 - 0x28), 0x40000000, 3, 0, 3, 0x2000000, 0);
						}
						E010D1ABD(_t37,  *(_t57 - 0x28));
					}
					L6:
					_t42 = 0;
					if( *(_t57 - 0x10) != 0xffffffff) {
						_t42 = 0 | SetFileTime( *(_t57 - 0x10),  *(_t57 - 0x1c),  *(_t57 + 8),  *(_t57 + 0xc)) != 0x00000000;
						CloseHandle( *(_t57 - 0x10));
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t57 - 0xc));
					return _t42;
				}
				_t39 = CreateFileW( *(_t57 - 0x18), 0x40000000, 3, 0, 3, 0x2000000, 0);
				 *(_t57 - 0x10) = _t39;
				if(_t39 != 0xffffffff) {
					goto L6;
				}
				goto L2;
			}

0x010d4c52
0x010d4c5a
0x010d4c61
0x010d4c64
0x010d4c67
0x010d4c75
0x010d4c82
0x010d4c9b
0x010d4c9f
0x010d4ca4
0x010d4ca9
0x010d4cc2
0x010d4cd3
0x010d4cd3
0x010d4cd9
0x010d4cde
0x010d4cdf
0x010d4cdf
0x010d4ce5
0x010d4cfe
0x010d4d01
0x010d4d01
0x010d4d0f
0x010d4d17
0x010d4d17
0x010d4c91
0x010d4c96
0x010d4c99
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010D4C52
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 010D4C91
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,00000000), ref: 010D4CD1
SetFileTime.KERNEL32(000000FF,?,?,?), ref: 010D4CF3
CloseHandle.KERNEL32(000000FF), ref: 010D4D01

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$Create$CloseH_prologHandleTime
String ID:
API String ID: 213185242-0
Opcode ID: d13897a5208fea9b2c38e34a8ffd62a4e541ce57d152b7ed9737bcd6f71ca5de
Instruction ID: f563f1bfa95d8a854241df44fd6b31bb25175e1545f6d1e27577075926f81bec
Opcode Fuzzy Hash: d13897a5208fea9b2c38e34a8ffd62a4e541ce57d152b7ed9737bcd6f71ca5de
Instruction Fuzzy Hash: 9E214F31D0020AABEF259F98DC45BEEBBB9FF04724F104525E560B61E0D7B54A51DB50

Uniqueness

Uniqueness Score: -1.00%

Function 010FBF6A Relevance: 7.6, APIs: 5, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FBF6A(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				int _t30;
				void* _t39;
				void* _t41;
				void* _t54;
				struct _IO_FILE** _t58;
				void* _t63;

				E011039E0(E0110718C, _t63);
				_t58 = __ecx;
				_t41 = __edx;
				fputs( *(__edx + 4),  *__ecx);
				E010D232F(_t63 - 0x18);
				 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
				_t54 = 6;
				E010FBC7F(_t63 - 0x18, _t54 -  *((intOrPtr*)(_t41 + 8)));
				_t30 = fputs( *(_t63 - 0x18),  *_t58);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				E010D1ABD(_t30,  *(_t63 - 0x18));
				fputs( *(0x110af04 +  *(_t63 + 8) * 4),  *_t58);
				 *(_t63 - 0xd8) =  *(_t63 - 0xd8) & 0x00000000;
				E010EAE6D(_t63 - 0xd8, ( *(_t63 + 8) << 6) + _t41 + 0x14,  *((intOrPtr*)(_t41 + 0x10)));
				fputs(_t63 - 0xd8,  *_t58);
				_t39 = E010D1CAE(_t58);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

0x010fbf6f
0x010fbf83
0x010fbf85
0x010fbf8d
0x010fbf94
0x010fbf9c
0x010fbfa5
0x010fbfa8
0x010fbfb2
0x010fbfb7
0x010fbfbb
0x010fbfcc
0x010fbfd1
0x010fbfeb
0x010fbff9
0x010fbfff
0x010fc00a
0x010fc012

APIs

__EH_prolog.LIBCMT ref: 010FBF6F
fputs.MSVCRT ref: 010FBF8D
fputs.MSVCRT ref: 010FBFB2

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

fputs.MSVCRT ref: 010FBFCC
fputs.MSVCRT ref: 010FBFF9

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfputcfree
String ID:
API String ID: 3247574066-0
Opcode ID: 66e6e5554f22820b7f4c9a437044670390f7d609f096a035d18de138591b5d72
Instruction ID: 8ed3a98973503e2c9be3df0f511c1c73dddcca783554a83b0cd8d5a0ff14fcb3
Opcode Fuzzy Hash: 66e6e5554f22820b7f4c9a437044670390f7d609f096a035d18de138591b5d72
Instruction Fuzzy Hash: C7116032E00109DFCF16EFA8D881ADDBB75EF54350F10416AE615A7194DB719A64CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010DCAD7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E010DCAD7(void* __ebx, void* __ecx, signed int __edx, void* __edi) {
				void* __esi;
				void* _t76;
				void* _t77;
				char _t79;
				void* _t81;
				intOrPtr _t112;
				void* _t115;
				signed int _t116;
				signed int _t121;
				signed int _t128;
				signed int _t155;
				void* _t157;
				signed int _t159;
				void* _t160;
				signed int _t162;
				void* _t164;

				E011039E0(E01104A8D, _t164);
				_t115 = __ecx;
				 *(_t164 - 0x10) = __edx;
				if(_t115 == 0) {
					_t157 = 0x110a750;
					_t116 = 7;
				} else {
					_t116 = 7;
					if(_t115 == 0) {
						_t157 = 0x110a7d0;
					} else {
						_t157 = 0x110a770;
					}
				}
				_t112 =  *((intOrPtr*)(_t164 + 8));
				memcpy(_t164 - 0x30, _t157, _t116 << 2);
				 *((char*)(_t112 + 0x44)) = 1;
				E010DD302(_t112 + 0x38);
				E010D28E9(_t164 - 0xbc);
				 *(_t164 - 4) =  *(_t164 - 4) & 0x00000000;
				L20();
				_t158 = _t164 - 0x30;
				_t121 = 7;
				memcpy(_t164 - 0x58, _t164 - 0x30, _t121 << 2);
				_push(_t164 - 0xbc);
				 *(_t164 - 4) = 1;
				E010DD290(_t112 + 0x38, _t164 - 0x30 + _t121 + _t121, _t158);
				_t159 =  *(_t164 - 0x10);
				_t76 =  *_t159;
				if( *((char*)(_t76 + 0x1cc)) != 0) {
					_t20 = _t76 + 0x1d4; // 0x1d4
					_push(_t164 - 0x30);
					E010DCD40(_t112, _t20);
				}
				_t77 =  *_t159;
				if( *((char*)(_t77 + 0x154)) != 0) {
					_t107 =  *((intOrPtr*)( *((intOrPtr*)(_t77 + 0x15c))));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t77 + 0x15c)))) + 4)) != 0) {
						E010D2A8C(_t112 + 0xd4, _t107);
					} else {
						E010D565C(_t112 + 0xd4);
					}
				}
				_t79 =  *((intOrPtr*)( *_t159 + 0x21c));
				 *((char*)(_t112 + 0xa4)) = _t79;
				if(_t79 != 0) {
					E010D2A8C(_t112 + 0xa8,  *((intOrPtr*)( *((intOrPtr*)( *_t159 + 0x224)))));
				}
				_t160 =  *_t159;
				if( *((char*)(_t160 + 0x1e0)) == 0) {
					L18:
					 *(_t164 - 4) = 2;
					_t81 = E010D1ABD(E010DCCEC(_t164 - 0xb0),  *((intOrPtr*)(_t164 - 0xbc)));
					 *[fs:0x0] =  *((intOrPtr*)(_t164 - 0xc));
					return _t81;
				} else {
					_t155 = 0;
					if( *((intOrPtr*)(_t160 + 0x1ec)) <= 0) {
						goto L18;
					} else {
						while(E010F2C4D( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t160 + 0x1e8)) + _t155 * 4)))), _t164 - 0x14) != 0 && ( *(_t164 - 0x14) |  *(_t164 - 0x10)) != 0) {
							E010D9123(_t112 + 0x108,  *(_t164 - 0x14),  *(_t164 - 0x10));
							_t155 = _t155 + 1;
							if(_t155 <  *((intOrPtr*)(_t160 + 0x1ec))) {
								continue;
							} else {
								goto L18;
							}
							goto L21;
						}
						_t128 = _t164 - 0x3c;
						_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t160 + 0x1e8)) + _t155 * 4)))));
						_push("Incorrect volume size:");
						E010E8A22(_t128, __eflags);
						_push(0x110ded0);
						_push(_t164 - 0x3c);
						L01103CAC();
						E011039E0(E01104AD7, _t164);
						_push(_t128);
						_push(_t160);
						_t162 = _t128;
						 *(_t164 - 0x10) = _t162;
						E010D28E9(_t128);
						 *(_t164 - 4) =  *(_t164 - 4) & 0x00000000;
						E010D28E9(_t162 + 0xc);
						 *(_t164 - 4) = 1;
						E010D28E9(_t162 + 0x18);
						 *(_t164 - 4) = 2;
						E010D28E9(_t162 + 0x24);
						 *(_t164 - 4) = 3;
						E010D28E9(_t162 + 0x30);
						_t61 = _t162 + 0x3c;
						 *_t61 =  *(_t162 + 0x3c) & 0x00000000;
						__eflags =  *_t61;
						 *(_t164 - 4) = 4;
						E010D28E9(_t162 + 0x40);
						 *(_t164 - 4) = 5;
						E010D28E9(_t162 + 0x4c);
						 *[fs:0x0] =  *((intOrPtr*)(_t164 - 0xc));
						return _t162;
					}
				}
				L21:
			}

0x010dcadc
0x010dcae9
0x010dcaed
0x010dcaf0
0x010dcb09
0x010dcb0e
0x010dcaf2
0x010dcaf6
0x010dcaf7
0x010dcb00
0x010dcaf9
0x010dcaf9
0x010dcaf9
0x010dcaf7
0x010dcb0f
0x010dcb15
0x010dcb1a
0x010dcb1e
0x010dcb29
0x010dcb2e
0x010dcb38
0x010dcb3f
0x010dcb42
0x010dcb46
0x010dcb51
0x010dcb52
0x010dcb59
0x010dcb5e
0x010dcb61
0x010dcb6a
0x010dcb6f
0x010dcb75
0x010dcb78
0x010dcb78
0x010dcb7d
0x010dcb86
0x010dcb8e
0x010dcb94
0x010dcbaa
0x010dcb96
0x010dcb9c
0x010dcb9c
0x010dcb94
0x010dcbb1
0x010dcbb9
0x010dcbbf
0x010dcbd1
0x010dcbd1
0x010dcbd6
0x010dcbdf
0x010dcc26
0x010dcc2c
0x010dcc3e
0x010dcc4a
0x010dcc52
0x010dcbe1
0x010dcbe1
0x010dcbe9
0x00000000
0x010dcbeb
0x010dcbeb
0x010dcc18
0x010dcc1d
0x010dcc24
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010dcc24
0x010dcc5b
0x010dcc61
0x010dcc63
0x010dcc68
0x010dcc70
0x010dcc75
0x010dcc76
0x010dcc80
0x010dcc85
0x010dcc86
0x010dcc87
0x010dcc89
0x010dcc8c
0x010dcc91
0x010dcc98
0x010dcca0
0x010dcca4
0x010dccac
0x010dccb0
0x010dccb8
0x010dccbc
0x010dccc1
0x010dccc1
0x010dccc1
0x010dccc8
0x010dcccc
0x010dccd4
0x010dccd8
0x010dcce3
0x010dcceb
0x010dcceb
0x010dcbe9
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010DCADC
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DCC76
__EH_prolog.LIBCMT ref: 010DCC80

Strings

Incorrect volume size:, xrefs: 010DCC63

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrow
String ID: Incorrect volume size:
API String ID: 2366012087-1799541332
Opcode ID: 1a2f623e78cedc07f92d6d24d0ca6a0ae4f5bca06bc57ae302cbce599f58b7de
Instruction ID: fb1a14996ffa78346addd55d9f79bd734aefe848658eda81d3ffa6ea7dd61571
Opcode Fuzzy Hash: 1a2f623e78cedc07f92d6d24d0ca6a0ae4f5bca06bc57ae302cbce599f58b7de
Instruction Fuzzy Hash: 2C51A131904355DFEB15EFA8CA84BEDB7F4BF24304F04449DE5866B291DBB0AA08DB51

Uniqueness

Uniqueness Score: -1.00%

Function 010DC32D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E010DC32D(intOrPtr __ecx, signed int __edx) {
				signed int _t49;
				void* _t59;
				void* _t60;
				intOrPtr* _t62;
				short* _t72;
				intOrPtr* _t79;
				signed int _t83;
				signed int _t84;
				signed int _t87;
				void* _t89;

				_t49 = E011039E0(E011049E0, _t89);
				_t62 =  *((intOrPtr*)(_t89 + 0xc));
				_push(_t83);
				_t87 = __edx;
				 *((intOrPtr*)(_t89 - 0x10)) = __ecx;
				if(__ecx != 0 ||  *(_t62 + 4) == __edx) {
					if( *(_t89 + 0x1c) == 0) {
						_t59 = E010D296F(_t89 - 0x1c,  *0x1108660);
						 *(_t89 - 4) =  *(_t89 - 4) & 0x00000000;
						_t60 = E010DC2ED( *((intOrPtr*)(_t89 + 8)), _t59, 1,  *((intOrPtr*)(_t89 + 0x14)), 1);
						 *(_t89 - 4) =  *(_t89 - 4) | 0xffffffff;
						_t49 = E010D1ABD(_t60,  *(_t89 - 0x1c));
					}
				}
				_t84 = _t83 | 0xffffffff;
				if( *(_t89 + 0x10) < 0) {
					_t49 =  *(_t62 + 4);
					 *(_t89 + 0x10) = _t49;
				}
				 *(_t89 + 0x1c) = _t87;
				if(_t87 >=  *(_t62 + 4)) {
					L20:
					 *[fs:0x0] =  *((intOrPtr*)(_t89 - 0xc));
					return _t49;
				} else {
					while(1) {
						_t50 =  *_t62;
						_t79 =  *((intOrPtr*)( *_t62 +  *(_t89 + 0x1c) * 4));
						if( *((intOrPtr*)(_t79 + 4)) == 0) {
							break;
						}
						if( *(_t89 + 0x1c) >=  *(_t89 + 0x10)) {
							L11:
							_t69 =  *((intOrPtr*)(_t89 - 0x10));
							__eflags =  *((intOrPtr*)(_t89 - 0x10));
							if( *((intOrPtr*)(_t89 - 0x10)) == 0) {
								E010DC2ED( *((intOrPtr*)(_t89 + 8)), _t79, 1,  *((intOrPtr*)(_t89 + 0x14)),  *((intOrPtr*)(_t89 + 0x18)));
							} else {
								__eflags = _t84 - 0xffffffff;
								if(__eflags != 0) {
									_push( *((intOrPtr*)(_t89 + 0x18)));
									_push(2);
									_push(_t79);
									E010DC472(_t69,  *((intOrPtr*)(_t50 + _t84 * 4)), __eflags);
									_t84 = _t84 | 0xffffffff;
								} else {
									_t84 =  *(_t89 + 0x1c);
								}
							}
							L16:
							 *(_t89 + 0x1c) =  *(_t89 + 0x1c) + 1;
							_t49 =  *(_t89 + 0x1c);
							if(_t49 <  *(_t62 + 4)) {
								continue;
							}
							_t104 = _t84 - 0xffffffff;
							if(_t84 == 0xffffffff) {
								goto L20;
							}
							_push( *((intOrPtr*)( *((intOrPtr*)( *_t62 + _t84 * 4)))));
							_push("There is no second file name for rename pair:");
							E010E8A22(_t89 - 0x28, _t104);
							_push(0x110ded0);
							_push(_t89 - 0x28);
							L01103CAC();
							break;
						}
						_t72 =  *_t79;
						_t102 =  *_t72 - 0x40;
						if( *_t72 != 0x40) {
							goto L11;
						} else {
							E010DC531( *((intOrPtr*)(_t89 - 0x10)),  *((intOrPtr*)(_t89 + 8)), _t102, _t72 + 2, 1,  *((intOrPtr*)(_t89 + 0x14)),  *((intOrPtr*)(_t89 + 0x18)),  *((intOrPtr*)(_t89 + 0x20)));
							goto L16;
						}
					}
					_push(0);
					_push( *0x1108674);
					E010E8A22(_t89 - 0x1c, _t104);
					_t49 = _t89 - 0x1c;
					_push(0x110ded0);
					_push(_t49);
					L01103CAC();
					goto L20;
				}
			}

0x010dc332
0x010dc33b
0x010dc33f
0x010dc342
0x010dc344
0x010dc347
0x010dc352
0x010dc35d
0x010dc365
0x010dc372
0x010dc377
0x010dc37e
0x010dc383
0x010dc352
0x010dc384
0x010dc38b
0x010dc38d
0x010dc390
0x010dc390
0x010dc396
0x010dc399
0x010dc461
0x010dc467
0x010dc46f
0x010dc39f
0x010dc39f
0x010dc39f
0x010dc3a4
0x010dc3ab
0x00000000
0x00000000
0x010dc3b7
0x010dc3dd
0x010dc3dd
0x010dc3e0
0x010dc3e2
0x010dc40c
0x010dc3e4
0x010dc3e4
0x010dc3e7
0x010dc3ee
0x010dc3f1
0x010dc3f3
0x010dc3f7
0x010dc3fc
0x010dc3e9
0x010dc3e9
0x010dc3e9
0x010dc3e7
0x010dc411
0x010dc411
0x010dc414
0x010dc41a
0x00000000
0x00000000
0x010dc41c
0x010dc41f
0x00000000
0x00000000
0x010dc429
0x010dc42b
0x010dc430
0x010dc438
0x010dc43d
0x010dc43e
0x00000000
0x010dc43e
0x010dc3b9
0x010dc3bb
0x010dc3bf
0x00000000
0x010dc3c1
0x010dc3d6
0x00000000
0x010dc3d6
0x010dc3bf
0x010dc443
0x010dc448
0x010dc44e
0x010dc453
0x010dc456
0x010dc45b
0x010dc45c
0x00000000
0x010dc45c

APIs

__EH_prolog.LIBCMT ref: 010DC332
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DC43E
_CxxThrowException.MSVCRT(00000000,0110DED0), ref: 010DC45C

Part of subcall function 010DC472: __EH_prolog.LIBCMT ref: 010DC477
Part of subcall function 010DC472: _CxxThrowException.MSVCRT(00000000,0110DED0), ref: 010DC51B

Strings

There is no second file name for rename pair:, xrefs: 010DC42B

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog
String ID: There is no second file name for rename pair:
API String ID: 206451386-3412818124
Opcode ID: 6383b69cbe79cccbb96e01c4cd6a26f0717808675074e01911672b3e73b5b77d
Instruction ID: 89eb4b81cd11a40ea431c68e0aa34e5b5e1edbd33e63160fee53d051e7da4fea
Opcode Fuzzy Hash: 6383b69cbe79cccbb96e01c4cd6a26f0717808675074e01911672b3e73b5b77d
Instruction Fuzzy Hash: 69414C3190020ADFEF16DF98C981BEE7BB2BF44324F048259F965AB1D5CBB09951CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010FBB23 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FBB23(void* __ecx) {
				void* _t40;
				void* _t56;
				void* _t68;
				void* _t90;
				signed int _t98;
				intOrPtr _t99;
				char** _t101;
				void* _t103;

				E011039E0(E01107178, _t103);
				_t68 = __ecx;
				if( *((char*)(__ecx + 0x131)) != 0 &&  *((intOrPtr*)(__ecx + 0xb8)) != 0) {
					_t101 = __ecx + 0x124;
					_t101[1] = 0;
					 *( *(__ecx + 0x124)) =  *( *(__ecx + 0x124)) & 0x00000000;
					E010FBC65(__ecx + 8);
					 *(_t103 - 0x10) = 0;
					if( *((intOrPtr*)( *((intOrPtr*)(_t103 + 8)) + 8)) > 0) {
						do {
							_t98 =  *(_t103 - 0x10);
							_t111 = _t98;
							if(_t98 != 0) {
								E010D24BF();
							}
							_t99 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 + 8)) + 4)) + _t98 * 4));
							E010D251D(_t101, _t111, _t99 + 4);
							 *((intOrPtr*)(_t103 - 0x14)) =  *((intOrPtr*)(_t99 + 8));
							E010FBC7F(_t101, E010FBB17( *((intOrPtr*)(_t99 + 0x10))) -  *((intOrPtr*)(_t103 - 0x14)));
							 *(_t103 - 0x10) =  *(_t103 - 0x10) + 1;
						} while ( *(_t103 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t103 + 8)) + 8)));
					}
					_t113 =  *((char*)(_t68 + 0x132));
					if( *((char*)(_t68 + 0x132)) != 0) {
						E010D24BF();
						E010D2351(_t103 - 0x20, "Size");
						 *(_t103 - 4) =  *(_t103 - 4) & 0x00000000;
						_t90 = 0xd;
						E010FBC7F(_t101, _t90 -  *((intOrPtr*)(_t103 - 0x1c)));
						_t56 = E010D251D(_t101, _t113, _t103 - 0x20);
						 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
						E010D1ABD(_t56,  *((intOrPtr*)(_t103 - 0x20)));
					}
					if( *((char*)(_t68 + 0x133)) != 0) {
						E010D24BF();
						E010D24BF();
						E010D24DB(_t101, "Name");
					}
					fputs( *_t101,  *( *(_t68 + 0xb8)));
					E010D1CAE( *(_t68 + 0xb8));
					E010FBA4E(_t68,  *((intOrPtr*)(_t103 + 8)) + 4);
				}
				_t40 = E010FA3B2();
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t40;
			}

0x010fbb28
0x010fbb31
0x010fbb3b
0x010fbb56
0x010fbb5f
0x010fbb62
0x010fbb65
0x010fbb6d
0x010fbb73
0x010fbb75
0x010fbb75
0x010fbb78
0x010fbb7a
0x010fbb7e
0x010fbb7e
0x010fbb8b
0x010fbb92
0x010fbb9d
0x010fbbac
0x010fbbb1
0x010fbbba
0x010fbb75
0x010fbbbf
0x010fbbc6
0x010fbbca
0x010fbbd7
0x010fbbdc
0x010fbbe2
0x010fbbe8
0x010fbbf3
0x010fbbfb
0x010fbbff
0x010fbc04
0x010fbc0c
0x010fbc10
0x010fbc17
0x010fbc23
0x010fbc23
0x010fbc32
0x010fbc3c
0x010fbc4a
0x010fbc4f
0x010fbc50
0x010fbc5a
0x010fbc62

APIs

__EH_prolog.LIBCMT ref: 010FBB28
fputs.MSVCRT ref: 010FBC32

Strings

Name, xrefs: 010FBC1C
Size, xrefs: 010FBBCF

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfputs
String ID: Name$Size
API String ID: 1798449854-481755742
Opcode ID: a048a7fb7d59459087083b1698235bf9180c105ace6871f2a54c68074f989436
Instruction ID: 9bcca3e5a00d1e1f58f4cee95d4fb2d288baca7755c3aa598601165f755a18a8
Opcode Fuzzy Hash: a048a7fb7d59459087083b1698235bf9180c105ace6871f2a54c68074f989436
Instruction Fuzzy Hash: F231F431A002199BCB06EF64C885BED77B2BF94310F14406CE9D95B295CF74A941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01102459 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E01102459(void* __ecx, void* __edx, void* __ebp) {
				intOrPtr _v0;
				char* _t65;
				char** _t66;
				struct _IO_FILE** _t67;
				void* _t68;

				_t68 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc8)) <= 0 ||  *(__ecx + 0xb8) == 0) {
					L7:
					_t65 = _t68 + 0x129;
					if( *((intOrPtr*)(_t68 + 0x129)) != 0) {
						 *((intOrPtr*)(_t68 + 0x18)) =  *((intOrPtr*)(_t68 + 0x18)) + 1;
						asm("adc [esi+0x1c], ebx");
					} else {
						if( *((intOrPtr*)(_t68 + 0xac)) != 0) {
							E01101818(_t68 + 8);
						}
						 *_t65 = 1;
					}
					if( *((intOrPtr*)(_t68 + 0xac)) != 0) {
						E010D23B0(_t68 + 0x20, "Removing");
						E010D2A8C(_t68 + 0x2c, _v0);
						E0110196E(_t68 + 8);
					}
					return 0;
				} else {
					E010FBC65(__ecx + 8);
					if( *((intOrPtr*)(__ecx + 0x129)) == 0) {
						_t67 =  *(__ecx + 0xb8);
						if(_t67 != 0) {
							E010D1CAE(_t67);
							fputs(": Removing files after including to archive",  *_t67);
							E010D1CAE(_t67);
						}
					}
					_t66 = _t68 + 0xcc;
					E010D23B0(_t66, "Removing");
					E010D24BF();
					fputs( *_t66,  *( *(_t68 + 0xb8)));
					_t71 = _t68 + 0xd8;
					E010D2A8C(_t68 + 0xd8, _v0);
					E010D1DE0( *(_t68 + 0xb8), _t71);
					E010D1D87( *(_t68 + 0xb8), _t71, _t66);
					E010D1CAE( *(_t68 + 0xb8));
					if( *((intOrPtr*)(_t68 + 0xc1)) != 0) {
						E010D1C9F( *(_t68 + 0xb8));
					}
					goto L7;
				}
			}

0x0110245b
0x01102466
0x01102522
0x01102528
0x0110252e
0x01102545
0x01102549
0x01102530
0x01102536
0x0110253b
0x0110253b
0x01102540
0x01102540
0x01102552
0x0110255c
0x01102568
0x01102570
0x01102570
0x0110257a
0x01102478
0x0110247c
0x0110248d
0x0110248f
0x01102497
0x0110249b
0x011024a7
0x011024ad
0x011024ad
0x01102497
0x011024b2
0x011024bf
0x011024c6
0x011024d5
0x011024d8
0x011024e5
0x011024f1
0x011024fe
0x01102509
0x01102515
0x0110251d
0x0110251d
0x00000000
0x01102515

APIs

fputs.MSVCRT ref: 011024A7
fputs.MSVCRT ref: 011024D5

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Strings

Removing, xrefs: 011024B8, 01102554
: Removing files after including to archive, xrefs: 011024A2

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: : Removing files after including to archive$Removing
API String ID: 1185151155-1218467041
Opcode ID: 68062c31bdf95f4854a382f09f2fa37e4299a77b7aae23fa3026471f52eefb91
Instruction ID: b5f3f5dc4a051a251c62f92eed38954cea598c65d280b08c250f2cb57e652b8e
Opcode Fuzzy Hash: 68062c31bdf95f4854a382f09f2fa37e4299a77b7aae23fa3026471f52eefb91
Instruction Fuzzy Hash: 17316432A007469FD77AEB64C890BEAB7A6AF65200F04481ED5DB071A0DF717889CB55

Uniqueness

Uniqueness Score: -1.00%

Function 010FD1D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010FD1D4(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				void* __edi;
				void* _t24;
				void* _t25;
				struct _IO_FILE** _t60;
				void* _t66;

				E011039E0(E01107280, _t66);
				_t60 = __ecx;
				E010D28E9(_t66 - 0x24);
				 *((intOrPtr*)(_t66 - 4)) = 0;
				_t24 = E010F38F4(_t66 - 0x24,  *((intOrPtr*)(_t66 + 0xc)), __edx, 0);
				if( *((intOrPtr*)(_t66 - 0x20)) != 0) {
					E010D232F(_t66 - 0x18);
					 *((char*)(_t66 - 4)) = 1;
					E010D28E9(_t66 - 0x30);
					 *((char*)(_t66 - 4)) = 2;
					E010FC2DC(__edx,  *((intOrPtr*)(_t66 + 8)), _t66 - 0x18, _t66 - 0x30);
					_t73 =  *((intOrPtr*)(_t66 - 0x14));
					if( *((intOrPtr*)(_t66 - 0x14)) == 0) {
						_push( *((intOrPtr*)(_t66 - 0x30)));
						E010D1CC1(_t60);
					} else {
						fputs( *(_t66 - 0x18),  *_t60);
					}
					fputs(" = ",  *_t60);
					_t24 = E010D1ABD(E010D1ABD(E010FD0EC(_t60,  *((intOrPtr*)(_t66 - 0x24)), _t60, _t73),  *((intOrPtr*)(_t66 - 0x30))),  *(_t66 - 0x18));
				}
				_t25 = E010D1ABD(_t24,  *((intOrPtr*)(_t66 - 0x24)));
				 *[fs:0x0] =  *((intOrPtr*)(_t66 - 0xc));
				return _t25;
			}

0x010fd1d9
0x010fd1e4
0x010fd1eb
0x010fd1fa
0x010fd1fd
0x010fd205
0x010fd20a
0x010fd212
0x010fd216
0x010fd228
0x010fd22c
0x010fd231
0x010fd23a
0x010fd247
0x010fd24c
0x010fd23c
0x010fd241
0x010fd244
0x010fd258
0x010fd271
0x010fd277
0x010fd27b
0x010fd287
0x010fd28f

APIs

__EH_prolog.LIBCMT ref: 010FD1D9
fputs.MSVCRT ref: 010FD241
fputs.MSVCRT ref: 010FD258

Strings

= , xrefs: 010FD253

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: =
API String ID: 2614055831-2525689732
Opcode ID: db7ab193b4bc2d8415dba4295af67ed18bbdf0b29a7f2ec57d45b4447b2055a3
Instruction ID: a19710ad0e8c67378c3a44824ae5a6c63ffc15db5c0dbd8b735602434b08c93a
Opcode Fuzzy Hash: db7ab193b4bc2d8415dba4295af67ed18bbdf0b29a7f2ec57d45b4447b2055a3
Instruction Fuzzy Hash: 7B216D32904219EBCF0AEBD8D942DEEFBB5EF68210F10401AF54173190DF715A41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 010E5D3A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E010E5D3A(void* __ebx, intOrPtr* __ecx, void* __edx) {
				void* _t28;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				intOrPtr* _t60;
				void* _t62;
				void* _t64;
				intOrPtr* _t65;

				_t38 = __ebx;
				E011039E0(E011055A0, _t62);
				_t65 = _t64 - 0xc;
				_t60 = __ecx;
				_push("RAM ");
				 *((intOrPtr*)( *__ecx))();
				_push(__edx);
				 *((intOrPtr*)( *__ecx))();
				_t67 =  *((char*)(_t62 + 8));
				if( *((char*)(_t62 + 8)) == 0) {
					_push("      ?");
					 *((intOrPtr*)( *__ecx))();
				} else {
					_t54 =  *((intOrPtr*)(_t62 + 0x10));
					_t50 = 0x14;
					_t36 = E01103C70( *((intOrPtr*)(_t62 + 0xc)), _t50, _t54);
					_push(_t54);
					_push(_t36);
					_t55 = 6;
					E010E30BD(__ecx, _t55, _t67);
				}
				 *((intOrPtr*)( *_t60))(" MB");
				E010D232F(_t62 - 0x18);
				 *(_t62 - 4) =  *(_t62 - 4) & 0x00000000;
				E010E2E4D(_t38, _t62 - 0x18);
				_t28 =  *((intOrPtr*)( *_t60))( *((intOrPtr*)(_t62 - 0x18)));
				_t9 = _t62 - 4;
				 *(_t62 - 4) =  *(_t62 - 4) | 0xffffffff;
				E010D1ABD(_t28,  *((intOrPtr*)(_t62 - 0x18)));
				 *_t65 = 0x110972c;
				 *((intOrPtr*)( *_t60))();
				 *((intOrPtr*)( *_t60))( *((intOrPtr*)(_t62 + 0x14)));
				_t53 = 3;
				_t34 = E010E30BD(_t60, _t53,  *_t9,  *((intOrPtr*)(_t62 + 0x18)), 0);
				 *[fs:0x0] =  *((intOrPtr*)(_t62 - 0xc));
				return _t34;
			}

0x010e5d3a
0x010e5d3f
0x010e5d44
0x010e5d48
0x010e5d4f
0x010e5d54
0x010e5d5a
0x010e5d5b
0x010e5d5d
0x010e5d61
0x010e5d81
0x010e5d88
0x010e5d63
0x010e5d66
0x010e5d6b
0x010e5d6c
0x010e5d73
0x010e5d74
0x010e5d77
0x010e5d78
0x010e5d78
0x010e5d93
0x010e5d98
0x010e5d9d
0x010e5da4
0x010e5db0
0x010e5db2
0x010e5db2
0x010e5db9
0x010e5dc2
0x010e5dc9
0x010e5dd2
0x010e5dd8
0x010e5dde
0x010e5de8
0x010e5df0

APIs

__EH_prolog.LIBCMT ref: 010E5D3F

Part of subcall function 010E30BD: memset.MSVCRT ref: 010E30D5
Part of subcall function 010E30BD: strlen.MSVCRT ref: 010E30F3

Strings

RAM , xrefs: 010E5D4F
?, xrefs: 010E5D81
MB, xrefs: 010E5D8C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologmemsetstrlen
String ID: ?$ MB$RAM
API String ID: 2475707007-294454972
Opcode ID: c4440959bf8d8720480f3f9d544cdc8d40195cf6c06df71cb3759aea8e742684
Instruction ID: 52477ae7c78816b578565d139ac737cafa6a172d201c6c34779523b39b2b078e
Opcode Fuzzy Hash: c4440959bf8d8720480f3f9d544cdc8d40195cf6c06df71cb3759aea8e742684
Instruction Fuzzy Hash: C9218B357006059FCB2AAF19C859AADBFB1EF59710F104009F6929B3E0CBB05801DF81

Uniqueness

Uniqueness Score: -1.00%

Function 010DC472 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E010DC472(void* __ecx, void* __edx, void* __eflags) {
				void* _t25;
				intOrPtr _t34;
				void* _t54;
				void* _t56;

				E011039E0(E011049F4, _t56);
				_t54 = E010DD360(__ecx);
				E010D2A8C(_t54, __edx);
				_t1 = _t54 + 0xc; // 0xc
				_t51 = _t1;
				E010D2A8C(_t1,  *((intOrPtr*)(_t56 + 8)));
				_t34 =  *((intOrPtr*)(_t56 + 0xc));
				 *((intOrPtr*)(_t54 + 0x1c)) = _t34;
				 *((char*)(_t54 + 0x18)) =  *((intOrPtr*)(_t56 + 0x10));
				_t25 = E010F4B08(_t54);
				_t62 = _t25;
				if(_t25 == 0) {
					E010D28E9(_t56 - 0x18);
					 *(_t56 - 4) =  *(_t56 - 4) & 0x00000000;
					E010D2C71(_t56 - 0x18, _t62, _t54);
					E010D2BFE(_t56 - 0x18);
					E010D2C71(_t56 - 0x18, _t62, _t51);
					E010D2BFE(_t56 - 0x18);
					_t63 = _t34;
					if(_t34 != 0) {
						__eflags = _t34 - 1;
						if(__eflags == 0) {
							_push("-r0");
							goto L5;
						}
					} else {
						_push("-r");
						L5:
						E010D2CAD(_t56 - 0x18);
					}
					_push( *((intOrPtr*)(_t56 - 0x18)));
					_push("Unsupported rename command:");
					E010E8A22(_t56 - 0x24, _t63);
					_t25 = _t56 - 0x24;
					_push(0x110ded0);
					_push(_t25);
					L01103CAC();
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t56 - 0xc));
				return _t25;
			}

0x010dc477
0x010dc489
0x010dc48e
0x010dc493
0x010dc493
0x010dc49b
0x010dc4a0
0x010dc4a8
0x010dc4ab
0x010dc4ae
0x010dc4b3
0x010dc4b5
0x010dc4ba
0x010dc4bf
0x010dc4c7
0x010dc4cf
0x010dc4d8
0x010dc4e0
0x010dc4e5
0x010dc4e7
0x010dc4f0
0x010dc4f3
0x010dc4f5
0x00000000
0x010dc4f5
0x010dc4e9
0x010dc4e9
0x010dc4fa
0x010dc4fd
0x010dc4fd
0x010dc502
0x010dc508
0x010dc50d
0x010dc512
0x010dc515
0x010dc51a
0x010dc51b
0x010dc51b
0x010dc526
0x010dc52e

APIs

__EH_prolog.LIBCMT ref: 010DC477

Part of subcall function 010DD360: __EH_prolog.LIBCMT ref: 010DD365

_CxxThrowException.MSVCRT(00000000,0110DED0), ref: 010DC51B

Strings

-r0, xrefs: 010DC4F5
Unsupported rename command:, xrefs: 010DC508

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrow
String ID: -r0$Unsupported rename command:
API String ID: 2366012087-1002762148
Opcode ID: be747a2011c06cbf79628930055329fb73e800888cdbe6977e0bbac836fedcdc
Instruction ID: e02d161caa3f599bed0fe89b3ce06fb6502b2ea10cf17668b9ba6083df7c19e3
Opcode Fuzzy Hash: be747a2011c06cbf79628930055329fb73e800888cdbe6977e0bbac836fedcdc
Instruction Fuzzy Hash: B211903190030A9ACB1AFFA5C991AFEF7B4EFA4200F40405DD98263180DFB15A06DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01102A02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01102A02(void* __ecx) {
				void* __edi;
				void* _t40;
				struct _IO_FILE** _t54;
				void* _t57;
				void* _t59;

				E011039E0(E01107B34, _t59);
				_t57 = __ecx;
				if( *((intOrPtr*)(_t59 + 8)) != 0) {
					_t40 = __ecx + 8;
					if( *((intOrPtr*)(__ecx + 0xac)) != 0) {
						E0110183F(_t40, 0, 1);
					}
					if( *(_t57 + 0xbc) != 0) {
						_t41 =  *((intOrPtr*)(_t57 + 0xb8));
						if( *((intOrPtr*)(_t57 + 0xb8)) != 0) {
							E010D1C9F(_t41);
						}
						E010D232F(_t59 - 0x18);
						 *((intOrPtr*)(_t59 - 4)) = 0;
						E010FAD37( *((intOrPtr*)(_t59 + 8)),  *((intOrPtr*)(_t59 + 0xc)), _t59 - 0x18);
						_t54 =  *(_t57 + 0xbc);
						fputs( *(_t59 - 0x18),  *_t54);
						fputs(" : ",  *_t54);
						E010D1CAE(_t54);
						_push( *((intOrPtr*)(_t59 + 0x10)));
						E010D1E60( *(_t57 + 0xbc),  *((intOrPtr*)(_t59 + 0xc)));
						E010D1CAE( *(_t57 + 0xbc));
						E010D1CAE( *(_t57 + 0xbc));
						E010D1ABD(E010D1C9F( *(_t57 + 0xbc)),  *(_t59 - 0x18));
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return 0;
			}

0x01102a07
0x01102a13
0x01102a18
0x01102a24
0x01102a27
0x01102a2b
0x01102a2b
0x01102a36
0x01102a3c
0x01102a44
0x01102a46
0x01102a46
0x01102a4f
0x01102a5d
0x01102a61
0x01102a66
0x01102a77
0x01102a80
0x01102a87
0x01102a8c
0x01102a95
0x01102aa2
0x01102aa9
0x01102abc
0x01102ac2
0x01102a36
0x01102aca
0x01102ad2

APIs

__EH_prolog.LIBCMT ref: 01102A07
fputs.MSVCRT ref: 01102A77
fputs.MSVCRT ref: 01102A80

Part of subcall function 0110183F: fputs.MSVCRT ref: 011018A8

Strings

: , xrefs: 01102A7B

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: :
API String ID: 2614055831-3653984579
Opcode ID: 42818cf992444138de3f68c0ee0e6fb1f38750ecabf5f3406a9189ed235b1395
Instruction ID: bb3b77611c97efda5c810361a02629f11057b77a27c594a3a6461190e079366d
Opcode Fuzzy Hash: 42818cf992444138de3f68c0ee0e6fb1f38750ecabf5f3406a9189ed235b1395
Instruction Fuzzy Hash: C7115131E0070ADFDB2AEB65C891EEEBB63EF94310F14841ED95613690DF716981CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010FEE7F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FEE7F(void* __ebx, intOrPtr __esi) {
				intOrPtr* _t26;
				intOrPtr _t27;
				intOrPtr _t35;
				struct _IO_FILE** _t38;
				void* _t40;
				intOrPtr _t56;
				void* _t58;

				_t56 = __esi;
				_t40 = __ebx;
				_t26 =  *0x11146fc; // 0x1114440
				if(_t26 == __esi) {
					_t26 = 0x1114440;
				}
				_t27 = E010FA29C(_t58 - 0xf0, _t58 - 0x2c0,  *((intOrPtr*)(_t58 - 0x130)),  *_t26);
				 *((intOrPtr*)(_t58 - 0x20)) = _t27;
				if(_t27 == 1) {
					_t38 =  *0x1114700; // 0x1114438
					if(_t38 != _t56) {
						fputs("\nDecoding ERROR\n",  *_t38);
					}
					 *((intOrPtr*)(_t58 - 0x3c)) = 2;
					 *((intOrPtr*)(_t58 - 0x20)) = _t56;
				}
				if( *((char*)(_t58 - 0x2f7)) != 0 &&  *0x11146fc != 0) {
					E01100A10();
				}
				E010D1ABD(E011009F5( *((intOrPtr*)(_t58 - 0x20))),  *((intOrPtr*)(_t58 - 0xd0)));
				 *(_t58 - 4) = 6;
				E010E9E21(_t58 - 0xc4);
				_t46 =  *((intOrPtr*)(_t58 - 0x1c));
				 *(_t58 - 4) = 5;
				_t66 =  *((intOrPtr*)(_t58 - 0x1c));
				if( *((intOrPtr*)(_t58 - 0x1c)) != 0) {
					E010EBD18(_t46);
				}
				 *(_t58 - 4) = 3;
				E010FFCF6(_t58 - 0xf0);
				 *(_t58 - 4) = 2;
				E010D11BB(_t58 - 0x448);
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				E01100E30(_t40, _t58 - 0x33c, _t66);
				 *(_t58 - 4) =  *(_t58 - 4) | 0xffffffff;
				E010E8B2E(_t40, _t58 - 0x7c);
				_t35 =  *((intOrPtr*)(_t58 - 0x3c));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0xc));
				return _t35;
			}

0x010fee7f
0x010fee7f
0x010fee7f
0x010fee86
0x010fee88
0x010fee88
0x010feea1
0x010feea9
0x010feeac
0x010feeb2
0x010feeb9
0x010feec2
0x010feec9
0x010feeca
0x010feed1
0x010feed1
0x010ffad7
0x010ffae2
0x010ffae2
0x010ffaf5
0x010ffafb
0x010ffb05
0x010ffb0a
0x010ffb0d
0x010ffb11
0x010ffb13
0x010ffb15
0x010ffb15
0x010ffb20
0x010ffb24
0x010ffb2f
0x010ffb33
0x010ffb38
0x010ffb42
0x010ffb47
0x010ffb4e
0x010ffb53
0x010ffb5c
0x010ffb64

APIs

fputs.MSVCRT ref: 010FEEC2

Strings

F}w, xrefs: 010FEE88, 010FEE8D
@F}w, xrefs: 010FEEBB
Decoding ERROR, xrefs: 010FEEBD

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: Decoding ERROR$ F}w$@F}w
API String ID: 1795875747-582513202
Opcode ID: a05323f18ce90023a8656641379339f109bd41ab4e5c50cfaa0b4fc60dd29a4b
Instruction ID: 42dac73d59e7ea45d406f627b91bd6290619b3e1dd4b559c185a3bdd2338c4ef
Opcode Fuzzy Hash: a05323f18ce90023a8656641379339f109bd41ab4e5c50cfaa0b4fc60dd29a4b
Instruction Fuzzy Hash: 5A21AC71D0415ACEDF2ADB98E854BECBBB1BF24304F1041EDD195A36A1DB701A88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011022E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011022E0(void* __ecx, void* __edi) {
				void* _t37;
				void* _t49;
				void* _t51;

				E011039E0(E01107ABC, _t51);
				_t49 = __ecx;
				_t37 = __ecx + 8;
				if( *((intOrPtr*)(__ecx + 0xac)) != 0) {
					E0110183F(_t37, __edi, 1);
				}
				if( *(_t49 + 0xb8) != 0) {
					E010D232F(_t51 - 0x18);
					 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
					E01102390(_t51 - 0x18, "Files read from disk",  *((intOrPtr*)(_t49 + 0x18)),  *((intOrPtr*)(_t49 + 0x1c)));
					E010D24D3();
					E010D24DB(_t51 - 0x18, "Archive size: ");
					E010FA4C9(_t51 - 0x18,  *((intOrPtr*)( *((intOrPtr*)(_t51 + 8)))),  *((intOrPtr*)( *((intOrPtr*)(_t51 + 8)) + 4)));
					E010D24D3();
					E010D1CAE( *(_t49 + 0xb8));
					E010D1ABD(fputs( *(_t51 - 0x18),  *( *(_t49 + 0xb8))),  *(_t51 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return 0;
			}

0x011022e5
0x011022ee
0x011022f7
0x011022fa
0x011022fe
0x011022fe
0x0110230a
0x0110230f
0x01102317
0x01102326
0x0110232e
0x0110233b
0x0110234b
0x01102353
0x0110235e
0x01102377
0x0110237c
0x01102385
0x0110238d

APIs

__EH_prolog.LIBCMT ref: 011022E5
fputs.MSVCRT ref: 0110236E

Part of subcall function 0110183F: fputs.MSVCRT ref: 011018A8

Strings

Archive size: , xrefs: 01102333
Files read from disk, xrefs: 0110231B

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: Archive size: $Files read from disk
API String ID: 2614055831-3736835528
Opcode ID: 0ce6733c7fce5f287449fee4f49ecc9e63e6f41992d7402852b4e59b27c16d4f
Instruction ID: 8cc2d962c48a8c08642808006addcee26b54c9e024315d78522dee99aebd666c
Opcode Fuzzy Hash: 0ce6733c7fce5f287449fee4f49ecc9e63e6f41992d7402852b4e59b27c16d4f
Instruction Fuzzy Hash: 32113031D10606DFCB1AEBA4C855BEEBBB5FF24304F008468D246564E0DFB16699CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010FD06E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E010FD06E(struct _IO_FILE** __ecx, char* __edx) {
				void* __edi;
				void* _t20;
				struct _IO_FILE** _t35;
				void* _t37;

				E011039E0(E01107248, _t37);
				_t35 = __ecx;
				fputs(__edx,  *__ecx);
				fputs(" = ",  *_t35);
				_t43 =  *((char*)(_t37 + 0xc));
				if( *((char*)(_t37 + 0xc)) == 0) {
					E010D292C(_t37 - 0x18,  *((intOrPtr*)(_t37 + 8)));
					_t5 = _t37 - 4;
					 *_t5 =  *(_t37 - 4) & 0x00000000;
					__eflags =  *_t5;
					E010D1DE0(_t35, _t37 - 0x18);
					_push( *((intOrPtr*)(_t37 - 0x18)));
					E010D1CC1(_t35);
					_t20 = E010D1ABD(E010D1CAE(_t35),  *((intOrPtr*)(_t37 - 0x18)));
				} else {
					_t20 = E010FD0EC(_t35,  *((intOrPtr*)(_t37 + 8)), fputs, _t43);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t37 - 0xc));
				return _t20;
			}

0x010fd073
0x010fd07c
0x010fd088
0x010fd091
0x010fd096
0x010fd09a
0x010fd0ae
0x010fd0b3
0x010fd0b3
0x010fd0b3
0x010fd0bd
0x010fd0c4
0x010fd0c7
0x010fd0d6
0x010fd09c
0x010fd0a1
0x010fd0a1
0x010fd0e1
0x010fd0e9

APIs

__EH_prolog.LIBCMT ref: 010FD073
fputs.MSVCRT ref: 010FD088
fputs.MSVCRT ref: 010FD091

Part of subcall function 010FD0EC: __EH_prolog.LIBCMT ref: 010FD0F1
Part of subcall function 010FD0EC: fputs.MSVCRT ref: 010FD12E
Part of subcall function 010FD0EC: fputs.MSVCRT ref: 010FD164

Strings

= , xrefs: 010FD08C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: =
API String ID: 2614055831-2525689732
Opcode ID: acf9b2721185f9f67b07a9c2eabeadc1757ebb95c7b88c84df10639047ec1a71
Instruction ID: 93596fc01233e0190a564236e76f504df06830db7103e1845173931c65a156c2
Opcode Fuzzy Hash: acf9b2721185f9f67b07a9c2eabeadc1757ebb95c7b88c84df10639047ec1a71
Instruction Fuzzy Hash: 79018631A00109EBCB16BBA9C801AEEBF76EF94654F00801EF58162690CF754946DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 010FC015 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FC015(void* __ecx, void* __eflags, char* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v34;
				char _v35;
				char _v36;
				struct _IO_FILE** _t19;

				_v36 = 0x3a;
				_v35 = 0x20;
				E010D15CA( &_v34, _a8, _a12);
				_t19 =  *(__ecx + 0xb8);
				fputs(_a4,  *_t19);
				fputs( &_v36,  *_t19);
				return E010D1CAE(_t19);
			}

0x010fc025
0x010fc02c
0x010fc030
0x010fc035
0x010fc046
0x010fc04e
0x010fc05d

APIs

fputs.MSVCRT ref: 010FC046
fputs.MSVCRT ref: 010FC04E

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Strings

:, xrefs: 010FC025
, xrefs: 010FC02C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: $:
API String ID: 1185151155-4041779174
Opcode ID: e04e2424560e77a409fb343022dc86b66bde21d4081628a0c80e84157740fa06
Instruction ID: e9b31f9df16c2bbd652182f3d4e425f003bccb008e68168b2d753d6ed7dcd33b
Opcode Fuzzy Hash: e04e2424560e77a409fb343022dc86b66bde21d4081628a0c80e84157740fa06
Instruction Fuzzy Hash: C1F08C32900258ABCF226FA5CC04DDEBF69EFA8214F054419E89123250DB75A524CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010FE2A2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FE2A2(struct _IO_FILE** __ecx, char* __edx, intOrPtr _a4, intOrPtr _a8) {
				struct _IO_FILE** _t12;

				_t12 = __ecx;
				fputs(__edx,  *__ecx);
				fputs(0x110b77c,  *_t12);
				return E010D1CAE(E010D1F47(_t12, _a4, _a8));
			}

0x010fe2a3
0x010fe2af
0x010fe2b8
0x010fe2d5

APIs

fputs.MSVCRT ref: 010FE2AF
fputs.MSVCRT ref: 010FE2B8

Part of subcall function 010D1F47: fputs.MSVCRT ref: 010D1F64

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Strings

F}w, xrefs: 010FE2A2, 010FE2A5, 010FE2AC, 010FE2B1
Archives, xrefs: 010FE2AE

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: F}w$Archives
API String ID: 1185151155-3814464731
Opcode ID: 7002e63affce13d860dd9d0e6bad8538a8c33ac5633ee4b1aac832596780f45a
Instruction ID: 5ff65324c7276eacc8e47463c253b6e97fd136bf0ccd5f0052bc9398d7ae7c15
Opcode Fuzzy Hash: 7002e63affce13d860dd9d0e6bad8538a8c33ac5633ee4b1aac832596780f45a
Instruction Fuzzy Hash: CBD01232A442556BCB167A659C04C6FBBA6FFE86107060C5EF4D043150CBB148549B91

Uniqueness

Uniqueness Score: -1.00%

Function 010D92F1 Relevance: 6.3, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E010D92F1(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t12;
				signed int _t13;
				signed int _t16;
				signed int _t19;
				intOrPtr _t20;
				signed int* _t21;

				_t21 = _a12;
				_t20 = _a8;
				 *_t21 =  *_t21 & 0x00000000;
				_push(0x10);
				_push(0x110cdf8);
				_push(_t20);
				L01103D72();
				if(_t12 != 0) {
					_push(0x10);
					_push(0x110c548);
					_push(_t20);
					L01103D72();
					if(_t12 == 0) {
						goto L1;
					}
					_push(0x10);
					_push(0x110c528);
					_push(_t20);
					L01103D72();
					if(_t12 != 0) {
						_push(0x10);
						_push(0x110c518);
						_push(_t20);
						L01103D72();
						if(_t12 != 0) {
							_push(0x10);
							_push(0x110c508);
							_push(_t20);
							L01103D72();
							if(_t12 != 0) {
								return 0x80004002;
							}
							_t13 = _a4;
							_t16 = _t13;
							_t19 = _t13 + 0xc;
							L9:
							asm("sbb ecx, ecx");
							 *_t21 =  ~_t16 & _t19;
							L10:
							 *((intOrPtr*)(_t13 + 0x10)) =  *((intOrPtr*)(_t13 + 0x10)) + 1;
							return 0;
						}
						_t13 = _a4;
						_t16 = _t13;
						_t19 = _t13 + 8;
						goto L9;
					}
					_t13 = _a4;
					_t16 = _t13;
					_t19 = _t13 + 4;
					goto L9;
				}
				L1:
				_t13 = _a4;
				 *_t21 = _t13;
				goto L10;
			}

0x010d92f5
0x010d92f9
0x010d92fc
0x010d92ff
0x010d9301
0x010d9306
0x010d9307
0x010d9311
0x010d931a
0x010d931c
0x010d9321
0x010d9322
0x010d932c
0x00000000
0x00000000
0x010d932e
0x010d9330
0x010d9335
0x010d9336
0x010d9340
0x010d934c
0x010d934e
0x010d9353
0x010d9354
0x010d935e
0x010d936a
0x010d936c
0x010d9371
0x010d9372
0x010d937c
0x00000000
0x010d9395
0x010d937e
0x010d9381
0x010d9383
0x010d9386
0x010d9388
0x010d938c
0x010d938e
0x010d938e
0x00000000
0x010d9391
0x010d9360
0x010d9363
0x010d9365
0x00000000
0x010d9365
0x010d9342
0x010d9345
0x010d9347
0x00000000
0x010d9347
0x010d9313
0x010d9313
0x010d9316
0x00000000

APIs

memcmp.MSVCRT ref: 010D9307
memcmp.MSVCRT ref: 010D9322
memcmp.MSVCRT ref: 010D9336

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 4c0b9c143dd4c73004a89f4619b530b89a81325312b2dfa2a015b67c61f3f6b6
Instruction ID: 8f7718bb14dfc2ab91486b452daeef3f0402899b4dbddfeda81af38cb9d2c740
Opcode Fuzzy Hash: 4c0b9c143dd4c73004a89f4619b530b89a81325312b2dfa2a015b67c61f3f6b6
Instruction Fuzzy Hash: 5C11E231B403457BC72B4E15CC02FAD33E4ABA5748F008A68FC85EA2C2FBE5E5508B80

Uniqueness

Uniqueness Score: -1.00%

Function 010D3087 Relevance: 6.3, APIs: 5, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E010D3087(short** __ecx, char** __edx, int _a4) {
				int _v8;
				long _t18;
				int _t19;
				int _t31;
				short** _t34;
				char** _t37;

				_push(__ecx);
				_t34 = __ecx;
				_t18 = 0;
				_t37 = __edx;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((short*)( *((intOrPtr*)(__ecx)))) = 0;
				_t31 = __edx[1];
				if(_t31 != 0) {
					_t19 = MultiByteToWideChar(_a4, 0,  *__edx, _t31, 0, 0);
					_v8 = _t19;
					if(_t19 != 0) {
						L4:
						if(_t19 > _t34[2]) {
							E010D26A3(_t34, _t19);
							_t19 = _v8;
						}
						_t18 = MultiByteToWideChar(_a4, 0,  *_t37, _t37[1],  *_t34, _t19);
						if(_t18 == 0) {
							_t18 =  &_a4;
							_push(0x110d0e8);
							_push(_t18);
							_a4 = 0x44e74;
							L01103CAC();
						}
						_t28 =  *_t34;
						_t34[1] = _t18;
						_t28[_t18] = ( *_t34)[_t18] & 0x00000000;
					} else {
						_t18 = GetLastError();
						if(0 != 0) {
							_t19 =  &_a4;
							_push(0x110d0e8);
							_push(_t19);
							_a4 = 0x44e74;
							L01103CAC();
							goto L4;
						}
					}
				}
				return _t18;
			}

0x010d308a
0x010d308e
0x010d3090
0x010d3092
0x010d3096
0x010d3099
0x010d309c
0x010d30a1
0x010d30b3
0x010d30b7
0x010d30ba
0x010d30db
0x010d30de
0x010d30e3
0x010d30e8
0x010d30e8
0x010d30fb
0x010d30ff
0x010d3101
0x010d3104
0x010d3109
0x010d310a
0x010d3111
0x010d3111
0x010d3116
0x010d3118
0x010d311b
0x010d30bc
0x010d30bc
0x010d30c4
0x010d30c6
0x010d30c9
0x010d30ce
0x010d30cf
0x010d30d6
0x00000000
0x010d30d6
0x010d30c4
0x010d30ba
0x010d3124

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,000004B0,?,?,?,?,010D18A8,0000FDE9,?,7FFFFFE0,?), ref: 010D30B3
GetLastError.KERNEL32(?,?,?,010D18A8,0000FDE9,?,7FFFFFE0,?,00000000,?,00000001,00000000), ref: 010D30BC
_CxxThrowException.MSVCRT(00000000,0110D0E8), ref: 010D30D6
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,010D18A8,0000FDE9,?,7FFFFFE0,?,00000000), ref: 010D30FB
_CxxThrowException.MSVCRT(00000000,0110D0E8), ref: 010D3111

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: 42008ff72978fbe93c7c11d47358c06978ef0e4a1d4ec9367a4343301c8689a0
Instruction ID: 3b423ed2ed338b006cdf1dc48dcd0656302d6d61e85e98341fb81231a82dbc0d
Opcode Fuzzy Hash: 42008ff72978fbe93c7c11d47358c06978ef0e4a1d4ec9367a4343301c8689a0
Instruction Fuzzy Hash: 41114CB5600606BFD725CF69CC81E6BBBEDFF882847108129E958D7240D7B0ED418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 010EA2E2 Relevance: 6.3, APIs: 4, Instructions: 300
stringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E010EA2E2(intOrPtr __ecx) {
				void* __ebx;
				void* _t156;
				intOrPtr* _t162;
				intOrPtr* _t167;
				intOrPtr* _t170;
				intOrPtr* _t171;
				int _t172;
				intOrPtr* _t174;
				void* _t182;
				signed int _t194;
				char _t196;
				void* _t198;
				void* _t208;
				signed int _t216;
				void* _t218;
				signed int _t284;
				void* _t286;
				intOrPtr _t287;
				void* _t288;
				void* _t289;
				signed int _t290;
				void* _t291;
				void* _t293;
				void* _t294;

				E011039E0(E01105C64, _t291);
				_t294 = _t293 - 0x6c;
				 *((intOrPtr*)(_t291 - 0x24)) = __ecx;
				_push( *((intOrPtr*)(_t291 + 0xc)));
				E010D4398(_t291 - 0x48);
				 *(_t291 - 4) = 0;
				if( *((intOrPtr*)(_t291 - 0x44)) == 0) {
					_push(E010D296F(_t291 - 0x54,  *0x1109828));
					 *(_t291 - 4) = 1;
					E010D1ABD(E010D150C(_t291 - 0x48),  *((intOrPtr*)(_t291 - 0x54)));
				}
				 *((intOrPtr*)(_t291 - 0x30)) = 0;
				 *((intOrPtr*)(_t291 - 0x2c)) = 0;
				 *((intOrPtr*)(_t291 - 0x28)) = 0;
				 *(_t291 - 4) = 2;
				E010F801B(_t291 - 0x3c);
				_t284 = 0;
				_t297 =  *((intOrPtr*)(_t291 - 0x44));
				 *(_t291 - 4) = 3;
				if( *((intOrPtr*)(_t291 - 0x44)) <= 0) {
					L11:
					_t216 = 0;
					if( *((intOrPtr*)(_t291 - 0x2c)) <= 0) {
						L40:
						 *(_t291 - 4) = 2;
						E010D1ABD(E010EB037(_t216, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
						 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
						E010E8B2E(_t216, _t291 - 0x48);
						_t156 = 0;
						L41:
						 *[fs:0x0] =  *((intOrPtr*)(_t291 - 0xc));
						return _t156;
					} else {
						goto L12;
					}
					while(1) {
						L12:
						 *((intOrPtr*)(_t291 + 0xc)) = 0;
						 *(_t291 - 4) = 6;
						E010D232F(_t291 - 0x54);
						 *(_t291 - 4) = 7;
						_t286 = E010D8F8D( *((intOrPtr*)(_t291 + 8)), _t291 - 0x54,  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x30)) + _t216 * 8)),  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x30)) + 4 + _t216 * 8)), _t291 + 0xc);
						if(_t286 != 0) {
							break;
						}
						_t167 =  *((intOrPtr*)(_t291 + 0xc));
						if(_t167 == 0) {
							_push(0x110d248);
							_push(_t291 + 8);
							 *((intOrPtr*)(_t291 + 8)) = "Can\'t create hasher";
							L01103CAC();
							L34:
							_t160 =  *((intOrPtr*)(_t291 - 0x10));
							 *(_t291 - 4) = 7;
							__eflags = _t160;
							if(_t160 != 0) {
								_t160 =  *((intOrPtr*)( *_t160 + 8))(_t160);
							}
							break;
						}
						 *((intOrPtr*)(_t291 - 0x10)) = 0;
						_t287 =  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x3c)) + _t216 * 4));
						 *(_t291 - 4) = 8;
						 *((intOrPtr*)( *_t167))(_t167, 0x110c3b8, _t291 - 0x10);
						_t170 =  *((intOrPtr*)(_t291 - 0x10));
						if(_t170 == 0) {
							L17:
							 *(_t291 - 4) = 7;
							if(_t170 != 0) {
								 *((intOrPtr*)( *_t170 + 8))(_t170);
							}
							_t171 =  *((intOrPtr*)(_t291 + 0xc));
							_t172 =  *((intOrPtr*)( *_t171 + 0x18))(_t171);
							 *(_t291 - 0x14) = _t172;
							if(_t172 > 0x40) {
								E010D1ABD(_t172,  *((intOrPtr*)(_t291 - 0x54)));
								_t174 =  *((intOrPtr*)(_t291 + 0xc));
								__eflags = _t174;
								 *(_t291 - 4) = 3;
								if(_t174 != 0) {
									 *((intOrPtr*)( *_t174 + 8))(_t174);
								}
								_t286 = 0x80004001;
								L39:
								 *(_t291 - 4) = 2;
								E010D1ABD(E010EB037(_t216, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
								 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
								E010E8B2E(_t216, _t291 - 0x48);
								_t156 = _t286;
								goto L41;
							} else {
								_t288 = E010EAEEC( *((intOrPtr*)(_t291 - 0x24)) + 4);
								E010E0E48(_t288,  *((intOrPtr*)(_t291 + 0xc)));
								_t72 = _t288 + 4; // 0x4
								E010D240D(_t72, _t291 - 0x54);
								 *((intOrPtr*)(_t291 - 0x18)) = 4;
								 *(_t288 + 0x10) =  *(_t291 - 0x14);
								_t289 = _t288 + 0x14;
								do {
									_t182 = memset(_t289, 0,  *(_t291 - 0x14));
									_t294 = _t294 + 0xc;
									_t289 = _t289 + 0x40;
									_t77 = _t291 - 0x18;
									 *_t77 =  *((intOrPtr*)(_t291 - 0x18)) - 1;
								} while ( *_t77 != 0);
								E010D1ABD(_t182,  *((intOrPtr*)(_t291 - 0x54)));
								 *(_t291 - 4) = 3;
								E010D9116(_t291 + 0xc);
								_t216 = _t216 + 1;
								if(_t216 <  *((intOrPtr*)(_t291 - 0x2c))) {
									continue;
								}
								goto L40;
							}
						}
						_push(0);
						_push(_t170);
						_t286 = E010DA275(_t287);
						if(_t286 != 0) {
							goto L34;
						}
						_t170 =  *((intOrPtr*)(_t291 - 0x10));
						goto L17;
					}
					E010D1ABD(_t160,  *((intOrPtr*)(_t291 - 0x54)));
					_t162 =  *((intOrPtr*)(_t291 + 0xc));
					__eflags = _t162;
					 *(_t291 - 4) = 3;
					if(_t162 != 0) {
						 *((intOrPtr*)( *_t162 + 8))(_t162);
					}
					goto L39;
				} else {
					goto L3;
				}
				while(1) {
					L3:
					E010E5016(_t291 - 0x78);
					 *(_t291 - 4) = 4;
					_push( *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x48)) + _t284 * 4)));
					_t218 = E010DAA62(_t291 - 0x78, _t297);
					if(_t218 != 0) {
						break;
					}
					if( *((intOrPtr*)(_t291 - 0x68)) == 0) {
						E010D23B0(_t291 - 0x6c,  *0x1109828);
					}
					_t194 = strcmp( *(_t291 - 0x6c), "*");
					asm("sbb al, al");
					_t196 =  ~_t194 + 1;
					 *((char*)(_t291 + 0xf)) = _t196;
					if(_t196 != 0) {
						 *((intOrPtr*)(_t291 - 0x20)) = 0;
						 *((intOrPtr*)(_t291 - 0x1c)) = 0;
						 *((intOrPtr*)(_t291 - 0x18)) = 0;
						 *(_t291 - 4) = 5;
						E010D8CC0( *((intOrPtr*)(_t291 + 8)), _t291 - 0x20, __eflags);
						_t198 = E010EB088(_t291 - 0x3c);
						_t290 = 0;
						__eflags =  *((intOrPtr*)(_t291 - 0x1c));
						 *((intOrPtr*)(_t291 - 0x2c)) = 0;
						if( *((intOrPtr*)(_t291 - 0x1c)) <= 0) {
							L29:
							E010D1ABD(_t198,  *((intOrPtr*)(_t291 - 0x20)));
							 *(_t291 - 4) = 3;
							E010E2A6A(_t291 - 0x78);
							goto L11;
						} else {
							goto L26;
						}
						do {
							L26:
							_t198 = E010EAF93(_t291 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x20)) + _t290 * 8)),  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x20)) + 4 + _t290 * 8)));
							__eflags =  *((intOrPtr*)(_t291 - 0x2c)) -  *((intOrPtr*)(_t291 - 0x38));
							if( *((intOrPtr*)(_t291 - 0x2c)) !=  *((intOrPtr*)(_t291 - 0x38))) {
								_push(_t291 - 0x78);
								_push(_t198);
								_t198 = E010EAFED(_t291 - 0x3c);
							}
							_t290 = _t290 + 1;
							__eflags = _t290 -  *((intOrPtr*)(_t291 - 0x1c));
						} while (_t290 <  *((intOrPtr*)(_t291 - 0x1c)));
						goto L29;
					} else {
						if(E010D8C2C( *((intOrPtr*)(_t291 + 8)), _t291 - 0x6c, _t291 - 0x1c) == 0) {
							 *(_t291 - 4) = 3;
							E010E2A6A(_t291 - 0x78);
							 *(_t291 - 4) = 2;
							E010D1ABD(E010EB037(_t218, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
							 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
							E010E8B2E(_t218, _t291 - 0x48);
							_t156 = 0x80004001;
							goto L41;
						}
						_t208 = E010EAF93(_t291 - 0x30,  *((intOrPtr*)(_t291 - 0x1c)),  *((intOrPtr*)(_t291 - 0x18)));
						if( *((intOrPtr*)(_t291 - 0x2c)) !=  *((intOrPtr*)(_t291 - 0x38))) {
							_push(_t291 - 0x78);
							_push(_t208);
							E010EAFED(_t291 - 0x3c);
						}
						 *(_t291 - 4) = 3;
						E010E2A6A(_t291 - 0x78);
						_t284 = _t284 + 1;
						if(_t284 <  *((intOrPtr*)(_t291 - 0x44))) {
							continue;
						} else {
							goto L11;
						}
					}
				}
				 *(_t291 - 4) = 3;
				E010E2A6A(_t291 - 0x78);
				 *(_t291 - 4) = 2;
				E010D1ABD(E010EB037(_t218, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
				 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
				E010E8B2E(_t218, _t291 - 0x48);
				_t156 = _t218;
				goto L41;
			}

0x010ea2e7
0x010ea2ec
0x010ea2f2
0x010ea2f5
0x010ea2fb
0x010ea305
0x010ea308
0x010ea318
0x010ea31c
0x010ea328
0x010ea32d
0x010ea32e
0x010ea331
0x010ea334
0x010ea33a
0x010ea33e
0x010ea343
0x010ea345
0x010ea348
0x010ea34c
0x010ea3f7
0x010ea3f7
0x010ea3fc
0x010ea66e
0x010ea671
0x010ea67d
0x010ea682
0x010ea68a
0x010ea68f
0x010ea691
0x010ea697
0x010ea69f
0x00000000
0x00000000
0x00000000
0x010ea402
0x010ea402
0x010ea402
0x010ea408
0x010ea40c
0x010ea41e
0x010ea42e
0x010ea432
0x00000000
0x00000000
0x010ea438
0x010ea43d
0x010ea605
0x010ea60a
0x010ea60b
0x010ea612
0x010ea617
0x010ea617
0x010ea61a
0x010ea61e
0x010ea620
0x010ea625
0x010ea625
0x00000000
0x010ea620
0x010ea446
0x010ea449
0x010ea458
0x010ea45c
0x010ea45e
0x010ea463
0x010ea47b
0x010ea47d
0x010ea481
0x010ea486
0x010ea486
0x010ea489
0x010ea48f
0x010ea495
0x010ea498
0x010ea62d
0x010ea632
0x010ea636
0x010ea638
0x010ea63c
0x010ea641
0x010ea641
0x010ea644
0x010ea649
0x010ea64c
0x010ea658
0x010ea65d
0x010ea665
0x010ea66a
0x00000000
0x010ea49e
0x010ea4ac
0x010ea4b0
0x010ea4b8
0x010ea4bc
0x010ea4c4
0x010ea4cb
0x010ea4ce
0x010ea4d1
0x010ea4d6
0x010ea4db
0x010ea4de
0x010ea4e1
0x010ea4e1
0x010ea4e1
0x010ea4e9
0x010ea4ef
0x010ea4f6
0x010ea4fb
0x010ea4ff
0x00000000
0x00000000
0x00000000
0x010ea505
0x010ea498
0x010ea465
0x010ea466
0x010ea46e
0x010ea472
0x00000000
0x00000000
0x010ea478
0x00000000
0x010ea478
0x010ea5e9
0x010ea5ee
0x010ea5f2
0x010ea5f4
0x010ea5f8
0x010ea5fd
0x010ea5fd
0x00000000
0x00000000
0x00000000
0x00000000
0x010ea352
0x010ea352
0x010ea355
0x010ea360
0x010ea364
0x010ea36c
0x010ea370
0x00000000
0x00000000
0x010ea379
0x010ea384
0x010ea384
0x010ea391
0x010ea398
0x010ea39b
0x010ea39e
0x010ea3a1
0x010ea53e
0x010ea541
0x010ea544
0x010ea54d
0x010ea551
0x010ea559
0x010ea55e
0x010ea560
0x010ea563
0x010ea566
0x010ea595
0x010ea598
0x010ea59e
0x010ea5a5
0x00000000
0x00000000
0x00000000
0x00000000
0x010ea568
0x010ea568
0x010ea575
0x010ea57d
0x010ea580
0x010ea585
0x010ea586
0x010ea58a
0x010ea58a
0x010ea58f
0x010ea590
0x010ea590
0x00000000
0x010ea3a7
0x010ea3b8
0x010ea5b2
0x010ea5b6
0x010ea5be
0x010ea5ca
0x010ea5cf
0x010ea5d7
0x010ea5dc
0x00000000
0x010ea5dc
0x010ea3c7
0x010ea3d2
0x010ea3d7
0x010ea3d8
0x010ea3dc
0x010ea3dc
0x010ea3e4
0x010ea3e8
0x010ea3ed
0x010ea3f1
0x00000000
0x00000000
0x00000000
0x00000000
0x010ea3f1
0x010ea3a1
0x010ea50d
0x010ea511
0x010ea519
0x010ea525
0x010ea52a
0x010ea532
0x010ea537
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010EA2E7

Part of subcall function 010D4398: __EH_prolog.LIBCMT ref: 010D439D

strcmp.MSVCRT ref: 010EA391

Part of subcall function 010D150C: __EH_prolog.LIBCMT ref: 010D1511

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

memset.MSVCRT ref: 010EA4D6

Part of subcall function 010EB037: __EH_prolog.LIBCMT ref: 010EB03C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$freememsetstrcmp
String ID:
API String ID: 149676679-0
Opcode ID: 829b856860c6ec5b3cfb6392e1de7dc3deb85d6a95ace4c1e2f17d58e5690b1c
Instruction ID: d0dd77112e6c16d9a0ac9cb1538ee45c706125e672840744341cd1a072925d01
Opcode Fuzzy Hash: 829b856860c6ec5b3cfb6392e1de7dc3deb85d6a95ace4c1e2f17d58e5690b1c
Instruction Fuzzy Hash: FCC1AF31D00249EFCF16EFE9C8489ECFBF4AF68304F248159E496A72A1DB705A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011027ED Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E011027ED(void* __ecx, void* __edx) {
				void* _t38;
				intOrPtr* _t63;
				char** _t79;
				void* _t82;
				void* _t85;

				E011039E0(E01107B20, _t85);
				_push(__ecx);
				_t82 = __ecx;
				 *(_t85 - 0x10) = 0x1114708;
				EnterCriticalSection(0x1114708);
				 *((intOrPtr*)(_t85 - 4)) = 0;
				if( *((intOrPtr*)(_t85 + 0x10)) == 0 ||  *(_t82 + 0xb0) == 0) {
					 *((char*)(_t85 + 0x13)) = 0;
				} else {
					 *((char*)(_t85 + 0x13)) = 1;
					E010FBC65(_t82);
					_t79 = _t82 + 0xc4;
					E010D23B0(_t79,  *((intOrPtr*)(_t85 + 0xc)));
					if( *((intOrPtr*)(_t85 + 8)) != 0) {
						E010D24BF();
					}
					fputs( *_t79,  *( *(_t82 + 0xb0)));
					_t80 = _t82 + 0xd0;
					 *((intOrPtr*)(_t82 + 0xd4)) = 0;
					 *((short*)( *((intOrPtr*)(_t82 + 0xd0)))) = 0;
					if( *((intOrPtr*)(_t85 + 8)) != 0) {
						E010D2A28(_t80,  *((intOrPtr*)(_t85 + 8)));
						E010D1DE0( *(_t82 + 0xb0), _t80);
					}
					E010D1D87( *(_t82 + 0xb0), _t80, _t82 + 0xc4);
					E010D1CAE( *(_t82 + 0xb0));
					if( *((intOrPtr*)(_t82 + 0xb9)) != 0) {
						E010D1C9F( *(_t82 + 0xb0));
					}
				}
				if( *((intOrPtr*)(_t82 + 0xa4)) != 0) {
					if( *((intOrPtr*)(_t82 + 0xbc)) >= 1) {
						_t78 = _t82 + 0x24;
						_t63 = _t82 + 0x18;
						 *((intOrPtr*)(_t82 + 0x28)) = 0;
						 *((short*)( *((intOrPtr*)(_t82 + 0x24)))) = 0;
						 *((intOrPtr*)(_t63 + 4)) = 0;
						 *((char*)( *_t63)) = 0;
						if( *((intOrPtr*)(_t82 + 0xbc)) > 1 ||  *((intOrPtr*)(_t85 + 0x13)) == 0) {
							E010D23B0(_t63,  *((intOrPtr*)(_t85 + 0xc)));
							if( *((intOrPtr*)(_t85 + 8)) != 0) {
								E010D2A28(_t78,  *((intOrPtr*)(_t85 + 8)));
							}
						}
					}
					E0110196E(_t82);
				}
				_t38 = E010FA3B2();
				LeaveCriticalSection(0x1114708);
				 *[fs:0x0] =  *((intOrPtr*)(_t85 - 0xc));
				return _t38;
			}

0x011027f2
0x011027f7
0x01102800
0x01102803
0x01102806
0x01102811
0x01102814
0x01102935
0x01102826
0x01102828
0x0110282c
0x01102834
0x0110283c
0x01102844
0x01102848
0x01102848
0x01102857
0x01102866
0x0110286e
0x01102871
0x01102874
0x0110287b
0x01102887
0x01102887
0x0110289a
0x011028a5
0x011028b0
0x011028b8
0x011028b8
0x011028b0
0x011028c3
0x011028cc
0x011028d1
0x011028d4
0x011028d7
0x011028da
0x011028df
0x011028e2
0x011028eb
0x011028f5
0x011028fd
0x01102904
0x01102904
0x011028fd
0x011028eb
0x0110290b
0x0110290b
0x01102910
0x0110291c
0x0110292a
0x01102932

APIs

__EH_prolog.LIBCMT ref: 011027F2
EnterCriticalSection.KERNEL32(01114708,?,00000001,?,?,01102B5D,?,0000006F,?,?,00000000), ref: 01102806
fputs.MSVCRT ref: 01102857
LeaveCriticalSection.KERNEL32(01114708,?,00000001,?,?,01102B5D,?,0000006F,?,?,00000000), ref: 0110291C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSection$EnterH_prologLeavefputs
String ID:
API String ID: 2174113412-0
Opcode ID: 631319178e59dd9581aee19acfb8ef6b91937a21a39bd616b79b1edd2f7064dd
Instruction ID: 300297825002820de6c28b5cb4df79ce7ceab5339fe8649ad63b94875a5d69de
Opcode Fuzzy Hash: 631319178e59dd9581aee19acfb8ef6b91937a21a39bd616b79b1edd2f7064dd
Instruction Fuzzy Hash: D631B635A00745EFDB2AAF64C494BEEBBE2FF55300F04842EE59A57250DBB06944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 010E7202 Relevance: 6.1, APIs: 4, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010E7202(void* __ecx, WCHAR** _a4, signed int* _a8) {
				long _v8;
				long _v12;
				long _v16;
				WCHAR* _v20;
				int _t40;
				long _t41;
				void* _t42;
				int _t46;
				long _t50;
				struct _SECURITY_DESCRIPTOR** _t66;
				void* _t69;

				_t69 = __ecx;
				 *_a8 =  *_a8 | 0xffffffff;
				_v16 = 7;
				if( *((char*)(__ecx + 0x94)) != 0) {
					_v16 = 0xf;
				}
				_t8 = _t69 + 0x8c; // 0x8c
				_t66 = _t8;
				_v8 = _v8 & 0x00000000;
				_t40 = GetFileSecurityW( *_a4, _v16,  *(_t69 + 0x8c),  *(_t69 + 0x90),  &_v12);
				_v20 = _t40;
				if(_t40 == 0) {
					_t41 = GetLastError();
					_v8 = _t41;
					if(_t41 != 0x7a) {
						goto L15;
					} else {
						_t43 = _v12;
						if(_v12 <=  *(_t69 + 0x90)) {
							goto L16;
						} else {
							E010D705A(_t66, _t43);
							_v20 =  *_a4;
							_t46 = GetFileSecurityW(_v20, _v16,  *_t66,  *(_t69 + 0x90),  &_v12);
							_v20 = _t46;
							if(_t46 == 0) {
								_v8 = GetLastError();
							} else {
								if(_v12 !=  *(_t69 + 0x90)) {
									goto L5;
								}
							}
							goto L12;
						}
					}
				} else {
					_t50 = _v12;
					if(_t50 == 0) {
						L14:
						_t42 = 0;
					} else {
						if(_t50 >  *(_t69 + 0x90)) {
							L5:
							_v8 = 1;
						}
						L12:
						if(_v20 == 0) {
							L15:
							if(_v8 == 0) {
								L16:
								_v8 = 1;
							}
							_t42 = E010E6F2A(_t69, _a4, _v8);
						} else {
							_t32 = _t69 + 0x68; // 0x68
							 *_a8 = E010DAFC2(_t32,  *_t66, _v12);
							goto L14;
						}
					}
				}
				return _t42;
			}

0x010e720d
0x010e720f
0x010e721a
0x010e7221
0x010e7223
0x010e7223
0x010e7239
0x010e7239
0x010e7242
0x010e7255
0x010e7259
0x010e725c
0x010e727a
0x010e7283
0x010e7286
0x00000000
0x010e7288
0x010e7288
0x010e7291
0x00000000
0x010e7293
0x010e7296
0x010e72a8
0x010e72b7
0x010e72bb
0x010e72be
0x010e72d3
0x010e72c0
0x010e72c9
0x00000000
0x010e72cb
0x010e72c9
0x00000000
0x010e72be
0x010e7291
0x010e725e
0x010e725e
0x010e7263
0x010e72ef
0x010e72ef
0x010e7269
0x010e726f
0x010e7271
0x010e7271
0x010e7271
0x010e72d6
0x010e72da
0x010e72f3
0x010e72f7
0x010e72f9
0x010e72f9
0x010e72f9
0x010e7308
0x010e72dc
0x010e72e1
0x010e72ed
0x00000000
0x010e72ed
0x010e72da
0x010e7263
0x010e7311

APIs

GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,00000000,?,00000000,?), ref: 010E7255
GetLastError.KERNEL32(?,00000000,?), ref: 010E727A
GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,?,?,00000000,?), ref: 010E72B7
GetLastError.KERNEL32(?,?,?,?,?,00000000,?), ref: 010E72CD

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFileLastSecurity
String ID:
API String ID: 555121230-0
Opcode ID: f9cb2e000004682ec43fea53e1f93a4372a2537620ee95b39900ac92b34a987a
Instruction ID: cfa6b55a73ce54186ba8e3a44be2bfa62fcd4df8712f7380b1e9ff8e6991f30d
Opcode Fuzzy Hash: f9cb2e000004682ec43fea53e1f93a4372a2537620ee95b39900ac92b34a987a
Instruction Fuzzy Hash: EC318274900209EFDB55CFA9C884BEEBBF5FF44304F108499E5A5A7250D770AA41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010D6E1F Relevance: 6.1, APIs: 4, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E010D6E1F(void* __ecx, void** __edx) {
				intOrPtr _t21;
				void* _t25;
				void* _t31;
				void* _t44;
				int _t47;
				void** _t49;
				void* _t51;

				E011039E0(E011046A8, _t51);
				_t49 = __edx;
				_t31 = 0;
				_t44 = __ecx;
				_t21 =  *((intOrPtr*)(__edx));
				_t57 = _t21;
				if(_t21 != 0) {
					E010D1ABD(_t21, _t21);
					 *((intOrPtr*)(__edx)) = 0;
				}
				 *(_t51 - 0x24) =  *(_t51 - 0x24) | 0xffffffff;
				_t49[1] = _t31;
				_push(0x2200000);
				_push(3);
				_push(1);
				_push(_t31);
				_push(_t44);
				 *(_t51 - 4) = _t31;
				if(E010D63E5(_t51 - 0x24, _t57) != 0) {
					if( *(_t51 + 8) != _t31) {
						GetFileInformationByHandle( *(_t51 - 0x24),  *(_t51 + 8));
					}
					_push(0x4000);
					_t25 = E010D1A96();
					 *(_t51 + 8) = _t25;
					 *(_t51 - 0x14) = _t25;
					 *(_t51 - 4) = 1;
					if(DeviceIoControl( *(_t51 - 0x24), 0x900a8, _t31, _t31, _t25, 0x4000, _t51 - 0x10, _t31) != 0) {
						_t47 =  *(_t51 - 0x10);
						_t26 = E010D705A(_t49, _t47);
						if(_t47 != _t31) {
							_t26 = memcpy( *_t49,  *(_t51 + 8), _t47);
						}
						_t31 = 1;
					}
					E010D1ABD(_t26,  *(_t51 + 8));
				}
				E010D6497(_t51 - 0x24);
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return _t31;
			}

0x010d6e24
0x010d6e2e
0x010d6e30
0x010d6e33
0x010d6e35
0x010d6e37
0x010d6e39
0x010d6e3c
0x010d6e42
0x010d6e42
0x010d6e44
0x010d6e48
0x010d6e4b
0x010d6e50
0x010d6e52
0x010d6e54
0x010d6e55
0x010d6e59
0x010d6e63
0x010d6e68
0x010d6e70
0x010d6e70
0x010d6e7b
0x010d6e7c
0x010d6e82
0x010d6e85
0x010d6e99
0x010d6ea5
0x010d6ea7
0x010d6ead
0x010d6eb4
0x010d6ebc
0x010d6ec1
0x010d6ec4
0x010d6ec4
0x010d6ec9
0x010d6ece
0x010d6ed2
0x010d6edf
0x010d6ee7

APIs

__EH_prolog.LIBCMT ref: 010D6E24
GetFileInformationByHandle.KERNEL32(000000FF,?,?,00000000,00000001,00000003,02200000,?,?,00000000), ref: 010D6E70
DeviceIoControl.KERNEL32 ref: 010D6E9D
memcpy.MSVCRT ref: 010D6EBC

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ControlDeviceFileH_prologHandleInformationfreememcpy
String ID:
API String ID: 1689166341-0
Opcode ID: a150b8c42ed8a2165cc6d37bcccba81ec1002467b60c775c5344e7e96247d274
Instruction ID: 8891285febfcb712a1f98a28afc26596edbefeb5f90e6113ccf666401c958a1d
Opcode Fuzzy Hash: a150b8c42ed8a2165cc6d37bcccba81ec1002467b60c775c5344e7e96247d274
Instruction Fuzzy Hash: F1219272900245AFDB25DF98DD80EEEBBF9EF54354F20416DF55566280CB724E44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010D5008 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D5008(WCHAR* __ecx) {
				signed int _t16;
				signed int _t17;
				int _t21;
				void* _t26;
				WCHAR* _t36;
				void* _t42;

				E011039E0(E011044B0, _t42);
				_t36 = __ecx;
				_t26 = E010D7553(__ecx);
				if(_t26 == 1) {
					L4:
					if(_t26 == 0) {
						goto L8;
					} else {
						_t17 = E010D28E9(_t42 - 0x18);
						 *(_t42 - 4) =  *(_t42 - 4) & 0x00000000;
						if(E010D765C(_t36, _t42 - 0x18, _t42, _t17 & 0xffffff00 | _t26 != 0x00000001) == 0) {
							E010D1ABD(_t19,  *(_t42 - 0x18));
							goto L8;
						} else {
							_t21 = CreateDirectoryW( *(_t42 - 0x18), 0);
							_t16 = E010D1ABD(_t21,  *(_t42 - 0x18)) & 0xffffff00 | _t21 != 0x00000000;
						}
					}
				} else {
					if(CreateDirectoryW(__ecx, 0) == 0) {
						if(GetLastError() == 0xb7) {
							L8:
							_t16 = 0;
						} else {
							goto L4;
						}
					} else {
						_t16 = 1;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t42 - 0xc));
				return _t16;
			}

0x010d500d
0x010d5018
0x010d5025
0x010d502a
0x010d5046
0x010d5048
0x00000000
0x010d504a
0x010d504d
0x010d5052
0x010d5069
0x010d5087
0x00000000
0x010d506b
0x010d5070
0x010d507f
0x010d507f
0x010d5069
0x010d502c
0x010d5033
0x010d5044
0x010d508d
0x010d508d
0x00000000
0x00000000
0x00000000
0x010d5035
0x010d5035
0x010d5035
0x010d5033
0x010d5095
0x010d509d

APIs

__EH_prolog.LIBCMT ref: 010D500D
CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000001), ref: 010D502F
GetLastError.KERNEL32(?,00000000,?,00000000,00000001), ref: 010D5039
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000,00000001), ref: 010D5070

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CreateDirectory$ErrorH_prologLast
String ID:
API String ID: 1817354178-0
Opcode ID: 6f0c56600576c5e12777e03716b562c6090913dccd69252b7f1df40f4bc234bc
Instruction ID: 82955865b23bac2da68ff9687c1fec1efa60db845671aca693a4634e1c3809de
Opcode Fuzzy Hash: 6f0c56600576c5e12777e03716b562c6090913dccd69252b7f1df40f4bc234bc
Instruction Fuzzy Hash: 8D01F532D043029BDB257F689C81BFE7FB5AF54254F040166FE42A2290CBB54C419AD1

Uniqueness

Uniqueness Score: -1.00%

Function 010F9716 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E010F9716(void* __ecx) {
				signed int _t16;
				signed int _t17;
				signed int _t21;
				intOrPtr _t27;
				intOrPtr* _t30;
				void* _t36;
				signed int _t38;
				void* _t39;

				E011039E0(E01106FE0, _t39);
				_push(__ecx);
				_t21 =  *(_t39 + 0xc);
				_t36 = __ecx;
				if(_t21 != 0x21) {
					L7:
					if(_t21 > 0) {
						_t21 = _t21 & 0x0000ffff | 0x80070000;
					}
					_t16 = _t21;
				} else {
					 *(_t39 - 0x10) = 0x11146c0;
					EnterCriticalSection(0x11146c0);
					_t27 =  *((intOrPtr*)(_t36 + 0x24));
					_t17 = 0;
					 *((intOrPtr*)(_t39 - 4)) = 0;
					if(_t27 <= 0) {
						L6:
						LeaveCriticalSection(0x11146c0);
						goto L7;
					} else {
						_t30 =  *((intOrPtr*)(_t36 + 0x20));
						while( *_t30 !=  *((intOrPtr*)(_t39 + 8))) {
							_t17 = _t17 + 1;
							_t30 = _t30 + 4;
							if(_t17 < _t27) {
								continue;
							} else {
								L5:
								_t21 =  *(_t39 + 0xc);
								goto L6;
							}
							goto L10;
						}
						_t38 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t36 + 0x5c)))) + 0x20))( *((intOrPtr*)( *((intOrPtr*)(_t36 + 0x2c)) + _t17 * 4)), 0x21);
						if(_t38 == 0) {
							goto L5;
						} else {
							LeaveCriticalSection(0x11146c0);
							_t16 = _t38;
						}
					}
				}
				L10:
				 *[fs:0x0] =  *((intOrPtr*)(_t39 - 0xc));
				return _t16;
			}

0x010f971b
0x010f9720
0x010f9722
0x010f972a
0x010f972c
0x010f9765
0x010f9767
0x010f976f
0x010f976f
0x010f9775
0x010f972e
0x010f9734
0x010f9737
0x010f973d
0x010f9740
0x010f9744
0x010f9747
0x010f975e
0x010f975f
0x00000000
0x010f9749
0x010f9749
0x010f974c
0x010f9753
0x010f9754
0x010f9759
0x00000000
0x010f975b
0x010f975b
0x010f975b
0x00000000
0x010f975b
0x00000000
0x010f9759
0x010f9799
0x010f979d
0x00000000
0x010f979f
0x010f97a0
0x010f97a6
0x010f97a6
0x010f979d
0x010f9747
0x010f9777
0x010f977d
0x010f9785

APIs

__EH_prolog.LIBCMT ref: 010F971B
EnterCriticalSection.KERNEL32(011146C0), ref: 010F9737
LeaveCriticalSection.KERNEL32(011146C0), ref: 010F975F
LeaveCriticalSection.KERNEL32(011146C0), ref: 010F97A0

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSection$Leave$EnterH_prolog
String ID:
API String ID: 2532973370-0
Opcode ID: 87e0af2362bacd947a2d09aeb080b90503c7dea24e635a11fd4a47c06f0a67e8
Instruction ID: 8944c7da77e34049eb7bc49e315d4211667de94a7606e4f917a3638106392c7a
Opcode Fuzzy Hash: 87e0af2362bacd947a2d09aeb080b90503c7dea24e635a11fd4a47c06f0a67e8
Instruction Fuzzy Hash: CE11AC35A00301ABC725CF98C8C1A6EB7E4BF4C714B14856DF65AD7B04C7B5A8418B60

Uniqueness

Uniqueness Score: -1.00%

Function 010FAC8B Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E010FAC8B(void* __ecx) {
				void* _t16;
				struct _IO_FILE** _t39;
				intOrPtr _t43;
				void* _t44;

				E011039E0(E011070DC, _t44);
				_push(__ecx);
				 *(_t44 - 0x10) = 0x11146e0;
				EnterCriticalSection(0x11146e0);
				 *((intOrPtr*)(_t44 - 4)) = 0;
				_t16 = E010FA3B2();
				if(_t16 == 0) {
					_t43 =  *((intOrPtr*)(_t44 + 8));
					 *((intOrPtr*)(_t43 + 0x160)) =  *((intOrPtr*)(_t43 + 0x160)) + 1;
					asm("adc [eax+0x4], edi");
					 *((intOrPtr*)(_t43 + 0x158)) =  *((intOrPtr*)(_t43 + 0x158)) + 1;
					asm("adc [eax+0x4], edi");
					E010FA997(_t43);
					_t39 =  *(_t43 + 0xcc);
					if(_t39 != 0) {
						fputs( *0x110aa1c,  *_t39);
						_push( *((intOrPtr*)(_t44 + 0xc)));
						E010D1CAE(E010D1CC1(_t39));
						E010D1C9F( *(_t43 + 0xcc));
					}
					_t16 = E010FA3B2();
				}
				LeaveCriticalSection(0x11146e0);
				 *[fs:0x0] =  *((intOrPtr*)(_t44 - 0xc));
				return _t16;
			}

0x010fac90
0x010fac95
0x010fac9f
0x010faca2
0x010facaa
0x010facad
0x010facb4
0x010facb6
0x010facbb
0x010facc8
0x010faccb
0x010facd8
0x010facdb
0x010face0
0x010face8
0x010facf2
0x010facfa
0x010fad06
0x010fad11
0x010fad11
0x010fad16
0x010fad16
0x010fad1e
0x010fad2c
0x010fad34

APIs

__EH_prolog.LIBCMT ref: 010FAC90
EnterCriticalSection.KERNEL32(011146E0), ref: 010FACA2
fputs.MSVCRT ref: 010FACF2

Part of subcall function 010D1CC1: __EH_prolog.LIBCMT ref: 010D1CC6
Part of subcall function 010D1CC1: fputs.MSVCRT ref: 010D1D39

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Part of subcall function 010D1C9F: fflush.MSVCRT ref: 010D1CA1

LeaveCriticalSection.KERNEL32(011146E0), ref: 010FAD1E

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalH_prologSectionfputs$EnterLeavefflushfputc
String ID:
API String ID: 84800229-0
Opcode ID: 36dbb5d5dbba5db6cbc5cbb2446b09cab1a722d50aca5da57995ff77636ddba7
Instruction ID: 7a08222f060a2b8c94d15756bbde316d857cfebdce089748a78e2edcf1ccf1a8
Opcode Fuzzy Hash: 36dbb5d5dbba5db6cbc5cbb2446b09cab1a722d50aca5da57995ff77636ddba7
Instruction Fuzzy Hash: B7118E31A00705DFD72AEF64D8859EFB7E5FF84354B14842EE8AAA3640DB70AC40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010F97B3 Relevance: 6.0, APIs: 4, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E010F97B3(void* __ecx) {
				void* _t23;
				intOrPtr* _t24;
				intOrPtr _t31;
				void* _t33;
				void* _t38;

				_t28 = __ecx;
				E011039E0(E01106FF4, _t38);
				_push(__ecx);
				_push(__ecx);
				_t33 = __ecx;
				 *(_t38 - 0x14) = 0x11146c0;
				EnterCriticalSection(0x11146c0);
				_t31 =  *((intOrPtr*)(_t33 + 0x24));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *(_t38 - 0x10) =  *(_t38 - 0x10) & 0x00000000;
				if(_t31 <= 0) {
					L4:
					_push(0x110d0e8);
					_push(_t38 + 8);
					 *((intOrPtr*)(_t38 + 8)) = 0x1335445;
					L01103CAC();
				} else {
					_t24 =  *((intOrPtr*)(_t33 + 0x20));
					_t28 = _t33 + 0x20;
					while( *_t24 !=  *((intOrPtr*)(_t38 + 8))) {
						 *(_t38 - 0x10) =  *(_t38 - 0x10) + 1;
						_t24 = _t24 + 4;
						if( *(_t38 - 0x10) < _t31) {
							continue;
						} else {
							goto L4;
						}
						goto L5;
					}
				}
				L5:
				E010D48A2(_t28,  *(_t38 - 0x10));
				_t23 = E010D4522(_t33 + 0x2c,  *(_t38 - 0x10));
				LeaveCriticalSection(0x11146c0);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t23;
			}

0x010f97b3
0x010f97b8
0x010f97bd
0x010f97be
0x010f97c7
0x010f97ca
0x010f97cd
0x010f97d3
0x010f97d6
0x010f97da
0x010f97e0
0x010f97fa
0x010f97fd
0x010f9802
0x010f9803
0x010f980a
0x010f97e2
0x010f97e2
0x010f97e5
0x010f97e8
0x010f97ef
0x010f97f2
0x010f97f8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010f97f8
0x010f97e8
0x010f980f
0x010f9812
0x010f981d
0x010f9823
0x010f982f
0x010f9837

APIs

__EH_prolog.LIBCMT ref: 010F97B8
EnterCriticalSection.KERNEL32(011146C0), ref: 010F97CD
_CxxThrowException.MSVCRT(?,0110D0E8), ref: 010F980A
LeaveCriticalSection.KERNEL32(011146C0,00000000,00000000,?,0110D0E8), ref: 010F9823

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSection$EnterExceptionH_prologLeaveThrow
String ID:
API String ID: 4150843469-0
Opcode ID: b0f4b413ed2038583cfaae9239c80b5240cfea16cccd029e240978042d8e2d19
Instruction ID: 7e7ea59d4e51a4d1956185bbb99dff20164ddae70cbe80b34e92d393f96c76d8
Opcode Fuzzy Hash: b0f4b413ed2038583cfaae9239c80b5240cfea16cccd029e240978042d8e2d19
Instruction Fuzzy Hash: D4019275D0061AEFDB09DF54C881AEEB7B8FF54309F10852AE515A2A40D7B0A905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 011026C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011026C0(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				void* _t17;
				struct _IO_FILE** _t27;
				void* _t33;

				E011039E0(E01107AE4, _t33);
				_t27 = __ecx;
				E010D232F(_t33 - 0x18);
				 *(_t33 - 4) =  *(_t33 - 4) & 0x00000000;
				E010FA63A(_t33 - 0x18, __edx);
				fputs( *(_t33 + 8),  *_t27);
				fputs(0x110b77c,  *_t27);
				fputs( *(_t33 - 0x18),  *_t27);
				_t17 = E010D1ABD(E010D1CAE(_t27),  *(_t33 - 0x18));
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t17;
			}

0x011026c5
0x011026cf
0x011026d6
0x011026db
0x011026e4
0x011026f4
0x011026fd
0x01102704
0x01102713
0x0110271e
0x01102726

APIs

__EH_prolog.LIBCMT ref: 011026C5
fputs.MSVCRT ref: 011026F4
fputs.MSVCRT ref: 011026FD
fputs.MSVCRT ref: 01102704

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfputcfree
String ID:
API String ID: 3247574066-0
Opcode ID: f8dc0dcaef680ae4e1efca672f4fd7427562865b68ccb9afdf23bbc7cf640589
Instruction ID: d675bc9d2180d2d9f51c4385322fefdff7cff42e00eae904591e000e8395673d
Opcode Fuzzy Hash: f8dc0dcaef680ae4e1efca672f4fd7427562865b68ccb9afdf23bbc7cf640589
Instruction Fuzzy Hash: B8F06D32D0011AEBCB0AABA9DC019EEBF76FF68250F14402AE505232A0DFB11961DAC0

Uniqueness

Uniqueness Score: -1.00%

Function 010EA895 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 394
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E010EA895(signed int __ecx, void* __edx, void* __eflags) {
				signed int _t194;
				void* _t196;
				signed int _t197;
				signed int _t201;
				signed int _t203;
				void* _t206;
				signed int _t208;
				signed int _t211;
				signed int _t215;
				intOrPtr _t218;
				void* _t221;
				void* _t222;
				signed int _t227;
				signed int _t233;
				signed int _t240;
				intOrPtr _t242;
				signed int _t248;
				signed int _t252;
				signed int _t255;
				signed int _t262;
				signed int _t265;
				signed int _t275;
				signed int _t277;
				signed char _t278;
				signed int _t295;
				signed int _t315;
				intOrPtr _t357;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t365;
				void* _t367;

				E011039E0(E01105CCE, _t367);
				 *(_t367 - 0x18) = __ecx;
				E010E711F(_t367 - 0x1a8);
				_t357 =  *((intOrPtr*)(_t367 + 8));
				 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
				_t364 =  *(_t367 + 0x10);
				_t373 =  *(_t357 + 0xd);
				 *(_t367 - 0x110) = _t364;
				if( *(_t357 + 0xd) == 0) {
					_t194 =  *((intOrPtr*)( *_t364 + 8))();
					__eflags = _t194;
					if(_t194 == 0) {
						 *((char*)(_t367 - 0x177)) =  *((intOrPtr*)(_t357 + 0xe));
						_t196 = E010D28E9(_t367 - 0x48);
						_push(_t367 - 0x1a8);
						_push(_t196);
						 *(_t367 - 4) = 2;
						_t197 = E010E7410(__edx,  *((intOrPtr*)(_t357 + 0x10)));
						 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
						_t275 = _t197;
						E010D1ABD(_t197,  *((intOrPtr*)(_t367 - 0x48)));
						__eflags = _t275;
						if(_t275 == 0) {
							_t194 =  *((intOrPtr*)( *_t364 + 0xc))(_t367 - 0x170);
							__eflags = _t194;
							if(_t194 != 0) {
								goto L3;
							}
							_t277 = 0;
							__eflags = 0;
							L10:
							E010EADD3(_t367 - 0xac);
							 *(_t367 - 4) = 3;
							_t203 = E010EA2E2(_t367 - 0xac,  *(_t367 - 0x18), _t357);
							if(_t203 == _t277) {
								__eflags =  *(_t357 + 0xd);
								 *((intOrPtr*)(_t367 - 0x74)) =  *((intOrPtr*)(_t367 - 0x148));
								 *((intOrPtr*)(_t367 - 0x70)) =  *((intOrPtr*)(_t367 - 0x144));
								_t206 =  *_t364;
								if( *(_t357 + 0xd) == 0) {
									_t295 =  *((intOrPtr*)(_t367 - 0x158)) +  *((intOrPtr*)(_t367 - 0x150));
									__eflags = _t295;
									asm("adc edx, [ebp-0x14c]");
									_t203 =  *((intOrPtr*)(_t206 + 0x14))(_t295,  *((intOrPtr*)(_t367 - 0x154)));
								} else {
									_t203 =  *((intOrPtr*)(_t206 + 0x10))(1, _t277);
								}
								__eflags = _t203 - _t277;
								if(_t203 != _t277) {
									goto L11;
								} else {
									 *(_t367 - 4) = 4;
									_t208 = E01103390(0x8000);
									__eflags = _t208 - _t277;
									 *(_t367 + 0xc) = _t208;
									__eflags = _t208 & 0xffffff00 | _t208 != _t277;
									if((_t208 & 0xffffff00 | _t208 != _t277) != 0) {
										 *(_t367 - 0x30) = _t277;
										 *(_t367 - 0x2c) = _t277;
										_t211 =  *((intOrPtr*)( *_t364 + 0x20))(_t367 - 0xac);
										__eflags = _t211 - _t277;
										if(_t211 != _t277) {
											L49:
											_t365 = _t211;
											L50:
											E011033B0( *(_t367 + 0xc));
											L51:
											 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
											E010EAE4E(_t367 - 0xac);
											L52:
											 *(_t367 - 4) =  *(_t367 - 4) | 0xffffffff;
											E010E8784(_t367 - 0x1a8);
											_t201 = _t365;
											L53:
											 *[fs:0x0] =  *((intOrPtr*)(_t367 - 0xc));
											return _t201;
										}
										__eflags =  *((intOrPtr*)(_t367 - 0x180)) - _t277;
										 *(_t367 - 0x10) = _t277;
										if( *((intOrPtr*)(_t367 - 0x180)) <= _t277) {
											L48:
											_t211 =  *((intOrPtr*)( *_t364 + 0x30))(_t367 - 0xac);
											goto L49;
										}
										while(1) {
											 *(_t367 + 0x10) = _t277;
											 *(_t367 - 4) = 5;
											E010D28E9(_t367 - 0x3c);
											_t278 = 0;
											 *(_t367 - 4) = 6;
											 *(_t367 - 0x18) =  *(_t367 - 0x18) & 0;
											__eflags =  *(_t357 + 0xd);
											 *(_t367 - 0x24) = 0;
											if( *(_t357 + 0xd) == 0) {
												goto L27;
											}
											_push(8);
											_t265 = E010D1A96();
											__eflags = _t265;
											if(_t265 == 0) {
												_t265 = 0;
												__eflags = 0;
											} else {
												 *(_t265 + 4) =  *(_t265 + 4) & 0x00000000;
												 *_t265 = 0x1109848;
											}
											E010E0E48(_t367 + 0x10, _t265);
											L36:
											_t225 =  *((intOrPtr*)( *_t364 + 0x24))( *((intOrPtr*)(_t367 - 0x3c)),  *(_t367 - 0x24));
											_t360 = _t225;
											__eflags = _t360;
											if(_t360 != 0) {
												L57:
												E010D1ABD(_t225,  *((intOrPtr*)(_t367 - 0x3c)));
												_t227 =  *(_t367 + 0x10);
												__eflags = _t227;
												 *(_t367 - 4) = 4;
												if(_t227 != 0) {
													 *((intOrPtr*)( *_t227 + 8))(_t227);
												}
												_t365 = _t360;
												goto L50;
											}
											 *(_t367 - 0x20) =  *(_t367 - 0x20) & _t225;
											 *(_t367 - 0x1c) =  *(_t367 - 0x1c) & _t225;
											E010EA6A2(_t367 - 0xac);
											__eflags = _t278;
											if(_t278 != 0) {
												L44:
												_t315 = _t367 - 0xac;
												E010EA726(_t315,  *(_t367 - 0x24),  *(_t367 - 0x18), _t367 - 0x3c);
												__eflags = _t278;
												_t233 =  *((intOrPtr*)( *_t364 + 0x2c))( *(_t367 - 0x20),  *(_t367 - 0x1c), _t367 - 0xac, _t315 & 0xffffff00 | _t278 == 0x00000000);
												__eflags = _t233;
												if(_t233 != 0) {
													L60:
													_t365 = _t233;
													E010D1ABD(_t233,  *((intOrPtr*)(_t367 - 0x3c)));
													 *(_t367 - 4) = 4;
													E010D9116(_t367 + 0x10);
													goto L50;
												}
												_t233 =  *((intOrPtr*)( *_t364 + 0x18))(_t367 - 0x30);
												__eflags = _t233;
												if(_t233 != 0) {
													goto L60;
												}
												E010D1ABD(_t233,  *((intOrPtr*)(_t367 - 0x3c)));
												 *(_t367 - 4) = 4;
												E010D9116(_t367 + 0x10);
												L47:
												 *(_t367 - 0x10) =  *(_t367 - 0x10) + 1;
												__eflags =  *(_t367 - 0x10) -  *((intOrPtr*)(_t367 - 0x180));
												if( *(_t367 - 0x10) <  *((intOrPtr*)(_t367 - 0x180))) {
													_t357 =  *((intOrPtr*)(_t367 + 8));
													_t277 = 0;
													__eflags = 0;
													continue;
												}
												goto L48;
											}
											_t123 = _t367 - 0x14;
											 *_t123 =  *(_t367 - 0x14) & 0x00000000;
											__eflags =  *_t123;
											while(1) {
												__eflags =  *(_t367 - 0x14);
												if( *(_t367 - 0x14) != 0) {
													goto L41;
												}
												L40:
												_t360 =  *((intOrPtr*)( *_t364 + 0x18))(_t367 - 0x30);
												__eflags = _t360;
												if(_t360 != 0) {
													goto L57;
												}
												L41:
												_t240 =  *(_t367 + 0x10);
												_t225 =  *((intOrPtr*)( *_t240 + 0xc))(_t240,  *(_t367 + 0xc), 0x8000, _t367 - 0x28);
												_t360 = _t225;
												__eflags = _t360;
												if(_t360 != 0) {
													goto L57;
												}
												__eflags =  *((intOrPtr*)(_t367 - 0x28)) - _t225;
												if( *((intOrPtr*)(_t367 - 0x28)) == _t225) {
													goto L44;
												}
												E010EA6DF(_t367 - 0xac,  *(_t367 + 0xc),  *((intOrPtr*)(_t367 - 0x28)));
												_t242 =  *((intOrPtr*)(_t367 - 0x28));
												 *(_t367 - 0x20) =  *(_t367 - 0x20) + _t242;
												asm("adc [ebp-0x1c], ecx");
												 *(_t367 - 0x30) =  *(_t367 - 0x30) + _t242;
												asm("adc [ebp-0x2c], ecx");
												 *(_t367 - 0x14) =  *(_t367 - 0x14) + 1;
												__eflags =  *(_t367 - 0x14);
												if( *(_t367 - 0x14) != 0) {
													goto L41;
												}
												goto L40;
											}
											L27:
											_push(0x58);
											_t215 = E010D1A96();
											 *(_t367 - 0x14) = _t215;
											__eflags = _t215;
											 *(_t367 - 4) = 7;
											if(_t215 == 0) {
												_t359 = 0;
												__eflags = 0;
											} else {
												_t359 = E010D929A(_t215);
											}
											 *(_t367 - 4) = 6;
											E010E0E48(_t367 + 0x10, _t359);
											_t218 =  *((intOrPtr*)( *((intOrPtr*)(_t367 - 0x184)) +  *(_t367 - 0x10) * 4));
											 *(_t367 - 0x18) =  *((intOrPtr*)(_t218 + 0x4c));
											_t278 =  *(_t218 + 0x3c) >> 0x00000004 & 0x00000001;
											 *(_t367 - 0x24) = _t278;
											_t221 = E010E709D(_t367 - 0x1a8, _t367 - 0xb8,  *(_t367 - 0x10));
											 *(_t367 - 4) = 8;
											_t222 = E010D2A8C(_t367 - 0x3c, _t221);
											 *(_t367 - 4) = 6;
											E010D1ABD(_t222,  *((intOrPtr*)(_t367 - 0xb8)));
											__eflags = _t278;
											if(_t278 != 0) {
												goto L36;
											} else {
												E010E7072(_t367 - 0x1a8, _t367 - 0x48,  *(_t367 - 0x10));
												 *(_t367 - 4) = 9;
												 *((char*)(_t367 - 0x4c)) =  *((intOrPtr*)( *((intOrPtr*)(_t367 + 8)) + 0xc));
												_t248 = E010D68A5( *((intOrPtr*)(_t367 - 0x48)),  *((intOrPtr*)(_t367 - 0x4c)));
												__eflags = _t248;
												if(_t248 != 0) {
													 *(_t367 - 4) = 6;
													E010D1ABD(_t248,  *((intOrPtr*)(_t367 - 0x48)));
													goto L36;
												}
												_t252 =  *((intOrPtr*)( *_t364 + 0x28))(_t367 - 0x48, GetLastError());
												 *((intOrPtr*)(_t367 - 0x74)) =  *((intOrPtr*)(_t367 - 0x74)) + 1;
												_t362 = _t252;
												_push( *((intOrPtr*)(_t367 - 0x48)));
												asm("adc dword [ebp-0x70], 0x0");
												__eflags = _t362 - 1;
												if(_t362 != 1) {
													E010D1ABD(E010D1ABD(_t252),  *((intOrPtr*)(_t367 - 0x3c)));
													_t255 =  *(_t367 + 0x10);
													__eflags = _t255;
													 *(_t367 - 4) = 4;
													if(_t255 != 0) {
														 *((intOrPtr*)( *_t255 + 8))(_t255);
													}
													E011033B0( *(_t367 + 0xc));
													 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
													E010EAE4E(_t367 - 0xac);
													 *(_t367 - 4) =  *(_t367 - 4) | 0xffffffff;
													E010E8784(_t367 - 0x1a8);
													_t201 = _t362;
													goto L53;
												}
												E010D1ABD(E010D1ABD(_t252),  *((intOrPtr*)(_t367 - 0x3c)));
												_t262 =  *(_t367 + 0x10);
												__eflags = _t262;
												 *(_t367 - 4) = 4;
												if(_t262 != 0) {
													 *((intOrPtr*)( *_t262 + 8))(_t262);
												}
												goto L47;
											}
										}
									}
									_t365 = 0x8007000e;
									goto L50;
								}
							}
							L11:
							_t365 = _t203;
							goto L51;
						}
						__eflags = _t275 - 0x80004004;
						if(_t275 != 0x80004004) {
							E010D23B0( *(_t367 + 0xc), "Scanning error");
						}
						_t365 = _t275;
						goto L52;
					}
					L3:
					_t365 = _t194;
					goto L52;
				}
				E010E6EDE(_t367 - 0x108, _t373);
				 *(_t367 - 0x108) =  *(_t367 - 0x108) | 0xffffffff;
				 *(_t367 - 0x104) =  *(_t367 - 0x104) | 0xffffffff;
				 *((intOrPtr*)(_t367 - 0xf0)) = 0;
				 *((intOrPtr*)(_t367 - 0xf8)) = 0;
				 *((intOrPtr*)(_t367 - 0x100)) = 0;
				_t277 = 0;
				 *((intOrPtr*)(_t367 - 0xec)) = 0;
				 *((intOrPtr*)(_t367 - 0xf4)) = 0;
				 *((intOrPtr*)(_t367 - 0xfc)) = 0;
				_push(_t367 - 0x108);
				 *(_t367 - 4) = 1;
				 *((intOrPtr*)(_t367 - 0xcc)) = 0;
				E010E8BD5(_t367 - 0x184);
				 *(_t367 - 4) =  *(_t367 - 4) & 0;
				E010E6F0A(_t367 - 0x108);
				goto L10;
			}

0x010ea89a
0x010ea8a6
0x010ea8b3
0x010ea8b8
0x010ea8bb
0x010ea8bf
0x010ea8c2
0x010ea8c6
0x010ea8cc
0x010ea941
0x010ea944
0x010ea946
0x010ea955
0x010ea95b
0x010ea969
0x010ea96a
0x010ea96d
0x010ea971
0x010ea976
0x010ea97a
0x010ea97f
0x010ea984
0x010ea987
0x010ea9b0
0x010ea9b3
0x010ea9b5
0x00000000
0x00000000
0x010ea9b7
0x010ea9b7
0x010ea9b9
0x010ea9bf
0x010ea9ce
0x010ea9d2
0x010ea9d9
0x010ea9e8
0x010ea9ec
0x010ea9f5
0x010ea9f8
0x010ea9fa
0x010eaa12
0x010eaa12
0x010eaa18
0x010eaa22
0x010ea9fc
0x010eaa01
0x010eaa01
0x010eaa25
0x010eaa27
0x00000000
0x010eaa29
0x010eaa2e
0x010eaa32
0x010eaa37
0x010eaa39
0x010eaa3f
0x010eaa41
0x010eaa58
0x010eaa5b
0x010eaa5e
0x010eaa61
0x010eaa63
0x010eacee
0x010eacee
0x010eacf0
0x010eacf3
0x010eacf8
0x010eacf8
0x010ead02
0x010ead07
0x010ead07
0x010ead11
0x010ead16
0x010ead18
0x010ead1e
0x010ead26
0x010ead26
0x010eaa69
0x010eaa6f
0x010eaa72
0x010eace0
0x010eaceb
0x00000000
0x010eaceb
0x010eaa7f
0x010eaa7f
0x010eaa85
0x010eaa89
0x010eaa8e
0x010eaa90
0x010eaa94
0x010eaa97
0x010eaa9a
0x010eaa9d
0x00000000
0x00000000
0x010eaa9f
0x010eaaa1
0x010eaaa6
0x010eaaa9
0x010eaab7
0x010eaab7
0x010eaaab
0x010eaaab
0x010eaaaf
0x010eaaaf
0x010eaabd
0x010eabd9
0x010eabe3
0x010eabe6
0x010eabe8
0x010eabea
0x010ead73
0x010ead76
0x010ead7b
0x010ead7f
0x010ead81
0x010ead85
0x010ead8a
0x010ead8a
0x010ead8d
0x00000000
0x010ead8d
0x010eabf0
0x010eabf3
0x010eabfc
0x010eac01
0x010eac03
0x010eac6f
0x010eac72
0x010eac7f
0x010eac84
0x010eac9b
0x010eac9e
0x010eaca0
0x010ead94
0x010ead97
0x010ead99
0x010ead9f
0x010eada6
0x00000000
0x010eada6
0x010eacae
0x010eacb1
0x010eacb3
0x00000000
0x00000000
0x010eacbc
0x010eacc2
0x010eacc9
0x010eacce
0x010eacce
0x010eacd4
0x010eacda
0x010eaa7a
0x010eaa7d
0x010eaa7d
0x00000000
0x010eaa7d
0x00000000
0x010eacda
0x010eac05
0x010eac05
0x010eac05
0x010eac09
0x010eac09
0x010eac0d
0x00000000
0x00000000
0x010eac0f
0x010eac1a
0x010eac1c
0x010eac1e
0x00000000
0x00000000
0x010eac24
0x010eac24
0x010eac36
0x010eac39
0x010eac3b
0x010eac3d
0x00000000
0x00000000
0x010eac43
0x010eac46
0x00000000
0x00000000
0x010eac54
0x010eac59
0x010eac5e
0x010eac61
0x010eac64
0x010eac67
0x010eac6a
0x010eac09
0x010eac0d
0x00000000
0x00000000
0x00000000
0x010eac0d
0x010eaac7
0x010eaac7
0x010eaac9
0x010eaacf
0x010eaad2
0x010eaad4
0x010eaad8
0x010eaae5
0x010eaae5
0x010eaada
0x010eaae1
0x010eaae1
0x010eaaeb
0x010eaaef
0x010eaafe
0x010eab10
0x010eab19
0x010eab1d
0x010eab20
0x010eab29
0x010eab2d
0x010eab32
0x010eab3c
0x010eab41
0x010eab44
0x00000000
0x010eab4a
0x010eab57
0x010eab62
0x010eab69
0x010eab72
0x010eab77
0x010eab79
0x010eabcf
0x010eabd3
0x00000000
0x010eabd8
0x010eab8a
0x010eab8d
0x010eab91
0x010eab93
0x010eab96
0x010eab9a
0x010eab9d
0x010ead31
0x010ead36
0x010ead3a
0x010ead3d
0x010ead41
0x010ead46
0x010ead46
0x010ead4c
0x010ead51
0x010ead5b
0x010ead60
0x010ead6a
0x010ead6f
0x00000000
0x010ead6f
0x010eabab
0x010eabb0
0x010eabb4
0x010eabb7
0x010eabbb
0x010eabc4
0x010eabc4
0x00000000
0x010eabbb
0x010eab44
0x010eaa7f
0x010eaa43
0x00000000
0x010eaa43
0x010eaa27
0x010ea9db
0x010ea9db
0x00000000
0x010ea9db
0x010ea989
0x010ea98f
0x010ea999
0x010ea999
0x010ea99e
0x00000000
0x010ea99e
0x010ea948
0x010ea948
0x00000000
0x010ea948
0x010ea8d4
0x010ea8d9
0x010ea8e0
0x010ea8eb
0x010ea8f1
0x010ea8f7
0x010ea903
0x010ea905
0x010ea90b
0x010ea911
0x010ea917
0x010ea91e
0x010ea922
0x010ea928
0x010ea92d
0x010ea936
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010EA89A

Part of subcall function 010E711F: __EH_prolog.LIBCMT ref: 010E7124

Part of subcall function 010E8BD5: __EH_prolog.LIBCMT ref: 010E8BDA

Part of subcall function 010EADD3: __EH_prolog.LIBCMT ref: 010EADD8

Part of subcall function 010EA2E2: __EH_prolog.LIBCMT ref: 010EA2E7
Part of subcall function 010EA2E2: strcmp.MSVCRT ref: 010EA391

Strings

Scanning error, xrefs: 010EA994

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$strcmp
String ID: Scanning error
API String ID: 828347417-2691707340
Opcode ID: 855eb42dacfb51dc83a990ac1ce437f53beba5c93c9a7d790a05fd114d4794df
Instruction ID: 44992e4fb23a52ca0e98e8751a6d1087ce80ea58674e45627bbb57c5d607271f
Opcode Fuzzy Hash: 855eb42dacfb51dc83a990ac1ce437f53beba5c93c9a7d790a05fd114d4794df
Instruction Fuzzy Hash: ABF1D030A0424AEFDF15DFA9C848BEDBBF1BF18314F148099E496A7291DB309A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010EE40F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E010EE40F(void* __ecx, void* __eflags) {
				intOrPtr* _t106;
				intOrPtr* _t110;
				signed int _t111;
				intOrPtr* _t114;
				signed int _t115;
				intOrPtr* _t118;
				signed int _t119;
				intOrPtr* _t121;
				signed int _t122;
				signed int _t126;
				signed int _t129;
				char* _t130;
				char* _t133;
				void* _t138;
				intOrPtr _t141;
				intOrPtr _t161;
				void* _t175;
				void* _t176;
				signed int _t180;
				void* _t181;
				intOrPtr* _t182;
				void* _t186;
				void* _t187;
				void* _t188;
				void* _t190;

				E011039E0(E0110625C, _t190);
				_t188 = __ecx;
				_t106 = __ecx + 0xb0;
				_t182 = __ecx + 0xa8;
				 *((char*)(__ecx + 0xb8)) = 0;
				 *_t106 = 0;
				 *((intOrPtr*)(_t106 + 4)) = 0;
				 *_t182 = 0;
				 *((intOrPtr*)(_t182 + 4)) = 0;
				asm("sbb ecx, [ebp+0x10]");
				 *((intOrPtr*)(__ecx + 0xc8)) =  *((intOrPtr*)(__ecx + 0xc0)) -  *((intOrPtr*)(_t190 + 0xc));
				 *((intOrPtr*)(__ecx + 0xcc)) =  *((intOrPtr*)(__ecx + 0xc4));
				E010EE3E3(__ecx + 0x10);
				 *(_t190 - 0x24) = 0;
				 *((short*)(_t190 - 0x22)) = 0;
				 *(_t190 - 0x1c) = 0;
				_t110 =  *((intOrPtr*)(_t190 + 8));
				 *(_t190 - 4) = 0;
				_t111 =  *((intOrPtr*)( *_t110 + 0x20))(_t110, 0x47, _t190 - 0x24, _t181, _t187, _t138);
				 *(_t190 - 0x10) = _t111;
				if(_t111 == 0) {
					 *((intOrPtr*)(__ecx + 0x14)) = E010EE3A2(_t190 - 0x24, __ecx + 0x13);
					E010D8173(_t190 - 0x24);
					 *(_t190 - 0x24) = 0;
					 *((short*)(_t190 - 0x22)) = 0;
					 *(_t190 - 0x1c) = 0;
					_t114 =  *((intOrPtr*)(_t190 + 8));
					 *(_t190 - 4) = 1;
					_t115 =  *((intOrPtr*)( *_t114 + 0x20))(_t114, 0x48, _t190 - 0x24);
					__eflags = _t115;
					 *(_t190 - 0x10) = _t115;
					if(_t115 == 0) {
						 *((intOrPtr*)(__ecx + 0x18)) = E010EE3A2(_t190 - 0x24, 0);
						E010D8173(_t190 - 0x24);
						 *(_t190 - 0x24) = 0;
						 *((short*)(_t190 - 0x22)) = 0;
						 *(_t190 - 0x1c) = 0;
						_t118 =  *((intOrPtr*)(_t190 + 8));
						 *(_t190 - 4) = 2;
						_t119 =  *((intOrPtr*)( *_t118 + 0x20))(_t118, 0x37, _t190 - 0x24);
						__eflags = _t119;
						 *(_t190 - 0x10) = _t119;
						if(_t119 == 0) {
							__eflags =  *(_t190 - 0x24);
							if( *(_t190 - 0x24) != 0) {
								__eflags =  *(_t190 - 0x24) - 8;
								_t133 =  *(_t190 - 0x1c);
								if( *(_t190 - 0x24) != 8) {
									_t133 = L"Unknown error";
								}
								E010D2A28(_t188 + 0x28, _t133);
							}
							E010D8173(_t190 - 0x24);
							 *(_t190 - 0x24) = 0;
							 *((short*)(_t190 - 0x22)) = 0;
							 *(_t190 - 0x1c) = 0;
							_t121 =  *((intOrPtr*)(_t190 + 8));
							 *(_t190 - 4) = 3;
							_t122 =  *((intOrPtr*)( *_t121 + 0x20))(_t121, 0x49, _t190 - 0x24);
							__eflags = _t122;
							 *(_t190 - 0x10) = _t122;
							if(_t122 == 0) {
								__eflags =  *(_t190 - 0x24);
								if( *(_t190 - 0x24) != 0) {
									__eflags =  *(_t190 - 0x24) - 8;
									_t130 =  *(_t190 - 0x1c);
									if( *(_t190 - 0x24) != 8) {
										_t130 = L"Unknown warning";
									}
									E010D2A28(_t188 + 0x34, _t130);
								}
								 *(_t190 - 4) =  *(_t190 - 4) | 0xffffffff;
								E010D8173(_t190 - 0x24);
								__eflags =  *(_t190 + 0x14);
								if( *(_t190 + 0x14) == 0) {
									L19:
									_push(_t188 + 0xb8);
									_push(_t188 + 0xb0);
									_t175 = 0x2c;
									_t126 = E010EE6AC( *((intOrPtr*)(_t190 + 8)), _t175);
									__eflags = _t126;
									if(_t126 == 0) {
										_push(_t190 + 0x17);
										_push(_t182);
										_t176 = 0x24;
										_t126 = E010EE74A( *((intOrPtr*)(_t190 + 8)), _t176);
										__eflags = _t126;
										if(_t126 == 0) {
											asm("adc eax, [edi+0x4]");
											 *((intOrPtr*)(_t190 + 0xc)) =  *((intOrPtr*)(_t190 + 0xc)) +  *_t182;
											_t161 =  *((intOrPtr*)(_t188 + 0xc0));
											_t129 =  *(_t188 + 0xc4);
											asm("sbb edi, [ebp+0x10]");
											__eflags =  *(_t188 + 0xb8);
											 *((intOrPtr*)(_t188 + 0xc8)) = _t161 -  *((intOrPtr*)(_t190 + 0xc));
											 *(_t188 + 0xcc) = _t129;
											if( *(_t188 + 0xb8) != 0) {
												_t141 =  *((intOrPtr*)(_t188 + 0xb0));
												_t180 =  *(_t188 + 0xb4);
												_t186 = _t141 +  *((intOrPtr*)(_t190 + 0xc));
												 *(_t190 - 0x10) = _t180;
												asm("adc edx, [ebp+0x10]");
												__eflags = _t180 - _t129;
												if(__eflags > 0) {
													L29:
													 *((char*)(_t188 + 0x11)) = 1;
												} else {
													if(__eflags < 0) {
														L25:
														 *((intOrPtr*)(_t188 + 0xc8)) = _t141;
														 *((intOrPtr*)(_t188 + 0x20)) = _t161 - _t186;
														asm("sbb eax, edx");
														 *(_t188 + 0xcc) =  *(_t190 - 0x10);
														 *((char*)(_t188 + 0x10)) = 1;
														 *(_t188 + 0x24) = _t129;
													} else {
														__eflags = _t186 - _t161;
														if(_t186 >= _t161) {
															__eflags = _t180 - _t129;
															if(__eflags >= 0) {
																if(__eflags > 0) {
																	goto L29;
																} else {
																	__eflags = _t186 - _t161;
																	if(_t186 > _t161) {
																		goto L29;
																	}
																}
															}
														} else {
															goto L25;
														}
													}
												}
											}
											goto L30;
										}
									}
								} else {
									__eflags =  *(_t188 + 0x13);
									if( *(_t188 + 0x13) == 0) {
										L30:
										_t126 = 0;
										__eflags = 0;
									} else {
										__eflags =  *(_t188 + 0x14) & 0x00000001;
										if(( *(_t188 + 0x14) & 0x00000001) != 0) {
											goto L30;
										} else {
											goto L19;
										}
									}
								}
							} else {
								E010D8173(_t190 - 0x24);
								_t126 =  *(_t190 - 0x10);
							}
						} else {
							E010D8173(_t190 - 0x24);
							_t126 =  *(_t190 - 0x10);
						}
					} else {
						E010D8173(_t190 - 0x24);
						_t126 =  *(_t190 - 0x10);
					}
				} else {
					E010D8173(_t190 - 0x24);
					_t126 =  *(_t190 - 0x10);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t190 - 0xc));
				return _t126;
			}

0x010ee414
0x010ee41e
0x010ee423
0x010ee42f
0x010ee435
0x010ee43b
0x010ee43d
0x010ee446
0x010ee44b
0x010ee44e
0x010ee451
0x010ee457
0x010ee460
0x010ee465
0x010ee469
0x010ee46d
0x010ee470
0x010ee47c
0x010ee47f
0x010ee484
0x010ee487
0x010ee4a7
0x010ee4aa
0x010ee4af
0x010ee4b3
0x010ee4b7
0x010ee4ba
0x010ee4c6
0x010ee4cd
0x010ee4d0
0x010ee4d2
0x010ee4d5
0x010ee4f4
0x010ee4f7
0x010ee4fc
0x010ee500
0x010ee504
0x010ee507
0x010ee513
0x010ee51a
0x010ee51d
0x010ee51f
0x010ee522
0x010ee534
0x010ee538
0x010ee53a
0x010ee53f
0x010ee542
0x010ee544
0x010ee544
0x010ee54d
0x010ee54d
0x010ee555
0x010ee55a
0x010ee55e
0x010ee562
0x010ee565
0x010ee571
0x010ee578
0x010ee57b
0x010ee57d
0x010ee580
0x010ee592
0x010ee596
0x010ee598
0x010ee59d
0x010ee5a0
0x010ee5a2
0x010ee5a2
0x010ee5ab
0x010ee5ab
0x010ee5b0
0x010ee5b7
0x010ee5bc
0x010ee5bf
0x010ee5d4
0x010ee5dd
0x010ee5e4
0x010ee5e7
0x010ee5e8
0x010ee5ed
0x010ee5ef
0x010ee5fb
0x010ee5fc
0x010ee5ff
0x010ee600
0x010ee605
0x010ee607
0x010ee615
0x010ee618
0x010ee61b
0x010ee624
0x010ee631
0x010ee634
0x010ee63a
0x010ee640
0x010ee646
0x010ee648
0x010ee656
0x010ee659
0x010ee65c
0x010ee65f
0x010ee662
0x010ee664
0x010ee695
0x010ee695
0x010ee666
0x010ee666
0x010ee66c
0x010ee66e
0x010ee677
0x010ee67a
0x010ee67c
0x010ee682
0x010ee686
0x010ee668
0x010ee668
0x010ee66a
0x010ee68b
0x010ee68d
0x010ee68f
0x00000000
0x010ee691
0x010ee691
0x010ee693
0x00000000
0x00000000
0x010ee693
0x010ee68f
0x00000000
0x00000000
0x00000000
0x010ee66a
0x010ee666
0x010ee664
0x00000000
0x010ee646
0x010ee607
0x010ee5c1
0x010ee5c1
0x010ee5c4
0x010ee699
0x010ee699
0x010ee699
0x010ee5ca
0x010ee5ca
0x010ee5ce
0x00000000
0x00000000
0x00000000
0x00000000
0x010ee5ce
0x010ee5c4
0x010ee582
0x010ee585
0x010ee58a
0x010ee58a
0x010ee524
0x010ee527
0x010ee52c
0x010ee52c
0x010ee4d7
0x010ee4da
0x010ee4df
0x010ee4df
0x010ee489
0x010ee48c
0x010ee491
0x010ee491
0x010ee6a1
0x010ee6a9

APIs

__EH_prolog.LIBCMT ref: 010EE414

Strings

Unknown error, xrefs: 010EE544, 010EE549
Unknown warning, xrefs: 010EE5A2, 010EE5A7

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: Unknown error$Unknown warning
API String ID: 3519838083-4291957651
Opcode ID: 643d8d8d905dc60c73198c7a4029dd7e1f45a6b92695de985caec6584ee17123
Instruction ID: 0fe378de884af845158e70a4bc72c9f6a424cf9b9b2b60725b222fff9070bfbf
Opcode Fuzzy Hash: 643d8d8d905dc60c73198c7a4029dd7e1f45a6b92695de985caec6584ee17123
Instruction Fuzzy Hash: 7D91507190030ACFDB24DF69C984AEEBBF5BF58340F50855DE49AA7290E771AA08CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0110196E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110196E(intOrPtr* __ecx) {
				signed int _v5;
				unsigned int _v12;
				long _v16;
				unsigned int _v20;
				char _v52;
				void* __edi;
				intOrPtr _t84;
				intOrPtr _t85;
				unsigned int _t101;
				signed char* _t102;
				unsigned int _t104;
				char** _t130;
				char* _t172;
				intOrPtr* _t173;
				intOrPtr* _t175;
				signed char _t200;

				_t175 = __ecx;
				_t172 = 0;
				_v16 = 0;
				if( *((intOrPtr*)(__ecx + 0x30)) != 0) {
					_v16 = GetTickCount();
				}
				_v5 = _v5 & 0x00000000;
				if( *((intOrPtr*)(_t175 + 0x48)) == _t172) {
					L14:
					_t130 = _t175 + 0x38;
					_t130[1] = _t172;
					 *( *(_t175 + 0x38)) =  *( *(_t175 + 0x38)) & 0x00000000;
					E011018D2(_t175);
					if(_v5 == 0) {
						L16:
						E010D240D(_t175 + 0x98, _t130);
						_t82 =  *(_t175 + 0x10);
						_t165 =  *(_t175 + 0x14);
						if(( *(_t175 + 0x10) |  *(_t175 + 0x14)) != 0) {
							E010D15CA( &_v52, _t82, _t165);
							E010D1B5E(_t130, 0x20);
							E010D24DB(_t130,  &_v52);
						}
						_t191 =  *((intOrPtr*)(_t175 + 0x1c)) - _t172;
						if( *((intOrPtr*)(_t175 + 0x1c)) != _t172) {
							E010D1B5E(_t130, 0x20);
							E010D251D(_t130, _t191, _t175 + 0x18);
						}
						if( *((intOrPtr*)(_t175 + 0x28)) != _t172 &&  *((intOrPtr*)(_t175 + 0x3c)) <  *((intOrPtr*)(_t175 + 0xac))) {
							E010D1B5E(_t130, 0x20);
							_t174 = _t175 + 0x5c;
							E010D2A8C(_t175 + 0x5c, _t175 + 0x24);
							E010D1DE0( *(_t175 + 0xa4), _t175 + 0x5c);
							E010D1D5C(_t175 + 0x5c, _t175 + 0x50);
							if( *(_t175 + 0x54) +  *((intOrPtr*)(_t175 + 0x3c)) >  *((intOrPtr*)(_t175 + 0xac))) {
								_t101 =  *((intOrPtr*)(_t175 + 0x28));
								_v12 = _t101;
								if(_t101 == 0) {
									L29:
									_t102 =  *(_t175 + 0x50);
									 *(_t175 + 0x54) =  *(_t175 + 0x54) & 0x00000000;
									 *_t102 =  *_t102 & 0x00000000;
									_t200 =  *_t102;
								} else {
									do {
										_t104 = _v12 >> 3;
										if(_t104 == 0) {
											_t104 = 1;
										}
										_v12 = _v12 - _t104;
										E010D2A8C(_t174, _t175 + 0x24);
										_v20 = _v12 >> 1;
										E010D3005(_t174, _v12 >> 1,  *((intOrPtr*)(_t175 + 0x60)) - _v12);
										E010D2E6E(_t174, _v20, L" . ");
										E010D1DE0( *(_t175 + 0xa4), _t174);
										E010D1D5C(_t174, _t175 + 0x50);
									} while ( *(_t175 + 0x54) +  *((intOrPtr*)(_t175 + 0x3c)) >  *((intOrPtr*)(_t175 + 0xac)) && _v12 != 0);
									if(_v12 == 0) {
										goto L29;
									}
								}
							}
							E010D251D(_t130, _t200, _t175 + 0x50);
							_t172 = 0;
						}
						if(E01101BCB(_t175 + 0x44, _t130) != 0) {
							E0110183F(_t175, _t172, _t172);
							_t173 = _t175 + 0xa4;
							fputs( *_t130,  *( *(_t175 + 0xa4)));
							if( *((char*)(_t175 + 0xa8)) != 0) {
								E010D1C9F( *_t173);
							}
							E010D240D(_t175 + 0x44, _t130);
							_t172 = 0;
						}
						_t84 = E01101BE9(_t175 + 0x68, _t175);
						if( *((intOrPtr*)(_t175 + 0x30)) != _t172) {
							_t85 = _v16;
							 *((intOrPtr*)(_t175 + 0x34)) = _t85;
							return _t85;
						}
					} else {
						_t84 = E010D25DD(_t130, _t175 + 0x98);
						if(_t84 == 0) {
							goto L16;
						}
					}
				} else {
					_t84 =  *((intOrPtr*)(_t175 + 0x30));
					if(_t84 == _t172 || _v16 -  *((intOrPtr*)(_t175 + 0x34)) >= _t84) {
						if(E010D25DD(_t175 + 0x80, _t175 + 0x18) == 0 || E010D2FAE(_t175 + 0x8c, _t175 + 0x24) == 0 ||  *((intOrPtr*)(_t175 + 0x78)) !=  *(_t175 + 0x10) ||  *((intOrPtr*)(_t175 + 0x7c)) !=  *(_t175 + 0x14)) {
							goto L14;
						} else {
							if( *((intOrPtr*)(_t175 + 0x70)) !=  *((intOrPtr*)(_t175 + 8)) ||  *((intOrPtr*)(_t175 + 0x74)) !=  *((intOrPtr*)(_t175 + 0xc)) ||  *((intOrPtr*)(_t175 + 0x68)) !=  *_t175) {
								L13:
								_v5 = 1;
								goto L14;
							} else {
								_t84 =  *((intOrPtr*)(_t175 + 0x6c));
								if(_t84 !=  *((intOrPtr*)(_t175 + 4))) {
									goto L13;
								}
							}
						}
					}
				}
				return _t84;
			}

0x01101977
0x01101979
0x0110197e
0x01101981
0x01101989
0x01101989
0x0110198c
0x01101993
0x01101a05
0x01101a08
0x01101a0d
0x01101a10
0x01101a13
0x01101a1c
0x01101a33
0x01101a3a
0x01101a3f
0x01101a42
0x01101a49
0x01101a50
0x01101a59
0x01101a64
0x01101a64
0x01101a69
0x01101a6c
0x01101a72
0x01101a7d
0x01101a7d
0x01101a85
0x01101a9e
0x01101aa6
0x01101aac
0x01101ab8
0x01101ac2
0x01101ad3
0x01101ad9
0x01101ade
0x01101ae1
0x01101b52
0x01101b52
0x01101b55
0x01101b59
0x01101b59
0x01101ae3
0x01101ae3
0x01101ae6
0x01101ae9
0x01101aed
0x01101aed
0x01101aee
0x01101af7
0x01101b0b
0x01101b0e
0x01101b1d
0x01101b29
0x01101b33
0x01101b3e
0x01101b50
0x00000000
0x00000000
0x01101b50
0x01101ae1
0x01101b62
0x01101b67
0x01101b67
0x01101b75
0x01101b7a
0x01101b85
0x01101b8f
0x01101b9e
0x01101ba2
0x01101ba2
0x01101bab
0x01101bb0
0x01101bb0
0x01101bb6
0x01101bbe
0x01101bc0
0x01101bc3
0x00000000
0x01101bc3
0x01101a1e
0x01101a26
0x01101a2d
0x00000000
0x00000000
0x01101a2d
0x01101995
0x01101995
0x0110199a
0x011019ba
0x00000000
0x011019de
0x011019e4
0x01101a01
0x01101a01
0x00000000
0x011019f5
0x011019f5
0x011019fb
0x00000000
0x00000000
0x011019fb
0x011019e4
0x011019ba
0x0110199a
0x01101bca

APIs

GetTickCount.KERNEL32 ref: 01101983
fputs.MSVCRT ref: 01101B8F

Strings

. , xrefs: 01101B13

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CountTickfputs
String ID: .
API String ID: 290905099-4150638102
Opcode ID: 4875c9d8110698fedf2d9e9f1d21d10380687b87e96b906afe0800277b919f8f
Instruction ID: 90512e747f02241b73c00b1be56e81e9fb51b8f1f1480f517ce48a5d3b2c2621
Opcode Fuzzy Hash: 4875c9d8110698fedf2d9e9f1d21d10380687b87e96b906afe0800277b919f8f
Instruction Fuzzy Hash: 37715F30A00B45AFDB2AEF68C590AAAB7F6BF50304F40485DD49787680DBB5F984CB10

Uniqueness

Uniqueness Score: -1.00%

Function 010DCD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E010DCD40(void* __ecx, intOrPtr* __edx) {
				void* __edi;
				void* __esi;
				signed int _t77;
				void* _t91;
				void* _t94;
				void* _t100;
				void* _t104;
				signed int _t119;
				signed int _t131;
				signed int _t138;
				intOrPtr _t142;
				void* _t145;
				intOrPtr* _t157;
				void* _t163;
				void* _t165;
				void* _t166;

				E011039E0(E01104B0A, _t163);
				_t166 = _t165 - 0xc0;
				 *(_t163 - 0x10) =  *(_t163 - 0x10) & 0x00000000;
				_t157 = __edx;
				_t145 = __ecx;
				 *((intOrPtr*)(_t163 - 0x14)) = __edx;
				 *(_t163 - 0x18) = __ecx;
				if( *((intOrPtr*)(__edx + 4)) <= 0) {
					L19:
					_t77 =  *(_t163 - 0x10);
					_t172 = _t77 -  *((intOrPtr*)(_t157 + 4));
					if(_t77 !=  *((intOrPtr*)(_t157 + 4))) {
						_push( *((intOrPtr*)( *((intOrPtr*)( *_t157 + _t77 * 4)))));
						_push("incorrect update switch command");
						E010E8A22(_t163 - 0x30, _t172);
						_t77 = _t163 - 0x30;
						_push(0x110ded0);
						_push(_t77);
						L01103CAC();
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t163 - 0xc));
					return _t77;
				} else {
					goto L1;
				}
				do {
					L1:
					_t142 =  *0x110869c; // 0x11086f0
					_t112 =  *((intOrPtr*)( *_t157 +  *(_t163 - 0x10) * 4));
					if(E010D2075( *((intOrPtr*)( *((intOrPtr*)( *_t157 +  *(_t163 - 0x10) * 4)))), _t142) == 0) {
						_t119 = 7;
						memcpy(_t163 - 0x4c,  *(_t163 + 8), _t119 << 2);
						_t166 = _t166 + 0xc;
						E010D28E9(_t163 - 0x24);
						 *(_t163 - 4) = 0;
						__eflags = E010DCF2D(_t112, _t163 - 0x4c, _t163 - 0x24);
						if(__eflags == 0) {
							 *(_t163 - 4) =  *(_t163 - 4) | 0xffffffff;
							_push( *((intOrPtr*)(_t163 - 0x24)));
							L16:
							E010D1ABD(_t85);
							L18:
							_t157 =  *((intOrPtr*)(_t163 - 0x14));
							goto L19;
						}
						__eflags =  *(_t163 - 0x20);
						if( *(_t163 - 0x20) != 0) {
							_t85 =  *((intOrPtr*)(_t163 - 0x24));
							__eflags =  *_t85 - 0x21;
							if( *_t85 != 0x21) {
								_t59 = _t163 - 4;
								 *_t59 =  *(_t163 - 4) | 0xffffffff;
								__eflags =  *_t59;
								_push(_t85);
								goto L16;
							}
							E010D28E9(_t163 - 0xcc);
							 *(_t163 - 4) = 1;
							E010DCC7B(_t163 - 0xc0);
							 *(_t163 - 4) = 2;
							_t91 = E010D292C(_t163 - 0x30,  *((intOrPtr*)(_t163 - 0x24)) + 2);
							__eflags =  *(_t163 - 0x2c);
							 *(_t163 - 4) = 3;
							if( *(_t163 - 0x2c) == 0) {
								E010D1ABD(_t91,  *(_t163 - 0x30));
								_t94 = E010D1ABD(E010DCCEC(_t163 - 0xc0),  *((intOrPtr*)(_t163 - 0xcc)));
								_t65 = _t163 - 4;
								 *_t65 =  *(_t163 - 4) | 0xffffffff;
								__eflags =  *_t65;
								E010D1ABD(_t94,  *((intOrPtr*)(_t163 - 0x24)));
								goto L18;
							}
							E010D2A8C(_t163 - 0xcc, _t163 - 0x30);
							_t161 = _t163 - 0x4c;
							_t131 = 7;
							_push(_t163 - 0xcc);
							_t100 = memcpy(_t163 - 0x68, _t163 - 0x4c, _t131 << 2);
							_t166 = _t166 + 0xc;
							E010D1ABD(E010DD290(_t100 + 0x38, _t163 - 0x4c + _t131 + _t131, _t161),  *(_t163 - 0x30));
							_t104 = E010D1ABD(E010DCCEC(_t163 - 0xc0),  *((intOrPtr*)(_t163 - 0xcc)));
							L11:
							_t48 = _t163 - 4;
							 *_t48 =  *(_t163 - 4) | 0xffffffff;
							__eflags =  *_t48;
							E010D1ABD(_t104,  *((intOrPtr*)(_t163 - 0x24)));
							_t157 =  *((intOrPtr*)(_t163 - 0x14));
							_t145 =  *(_t163 - 0x18);
							goto L12;
						}
						_t104 =  *(_t163 - 0x18);
						__eflags =  *((char*)(_t104 + 0x44));
						if( *((char*)(_t104 + 0x44)) != 0) {
							_t138 = 7;
							_t104 = memcpy( *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x38)))) + 0x64, _t163 - 0x4c, _t138 << 2);
							_t166 = _t166 + 0xc;
						}
						goto L11;
					} else {
						if( *(_t145 + 0x44) != 0) {
							 *(_t145 + 0x44) =  *(_t145 + 0x44) & 0x00000000;
							E010DD332(_t145 + 0x38, 0);
						}
					}
					L12:
					 *(_t163 - 0x10) =  *(_t163 - 0x10) + 1;
				} while ( *(_t163 - 0x10) <  *((intOrPtr*)(_t157 + 4)));
				goto L19;
			}

0x010dcd45
0x010dcd4a
0x010dcd50
0x010dcd56
0x010dcd59
0x010dcd5f
0x010dcd62
0x010dcd65
0x010dcef2
0x010dcef2
0x010dcef5
0x010dcef8
0x010dcf02
0x010dcf04
0x010dcf09
0x010dcf0e
0x010dcf11
0x010dcf16
0x010dcf17
0x010dcf17
0x010dcf22
0x010dcf2a
0x00000000
0x00000000
0x00000000
0x010dcd6b
0x010dcd6b
0x010dcd70
0x010dcd76
0x010dcd82
0x010dcda6
0x010dcdaa
0x010dcdaa
0x010dcdaf
0x010dcdbf
0x010dcdc7
0x010dcdc9
0x010dcead
0x010dceb1
0x010dcebb
0x010dcebb
0x010dceee
0x010dceee
0x00000000
0x010dcef1
0x010dcdcf
0x010dcdd2
0x010dcdf6
0x010dcdf9
0x010dcdfd
0x010dceb6
0x010dceb6
0x010dceb6
0x010dceba
0x00000000
0x010dceba
0x010dce09
0x010dce14
0x010dce18
0x010dce26
0x010dce2b
0x010dce30
0x010dce33
0x010dce37
0x010dcec5
0x010dcedc
0x010dcee4
0x010dcee4
0x010dcee4
0x010dcee8
0x00000000
0x010dceed
0x010dce47
0x010dce52
0x010dce5a
0x010dce5b
0x010dce5f
0x010dce5f
0x010dce6c
0x010dce83
0x010dce89
0x010dce8c
0x010dce8c
0x010dce8c
0x010dce90
0x010dce95
0x010dce98
0x00000000
0x010dce9b
0x010dcdd4
0x010dcdd7
0x010dcddb
0x010dcde6
0x010dcdef
0x010dcdef
0x010dcdef
0x00000000
0x010dcd84
0x010dcd88
0x010dcd8e
0x010dcd97
0x010dcd97
0x010dcd88
0x010dce9c
0x010dce9c
0x010dcea2
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010DCD45
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DCF17

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Strings

incorrect update switch command, xrefs: 010DCF04

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionH_prologThrowfree
String ID: incorrect update switch command
API String ID: 2564996034-2497410926
Opcode ID: 6e424531d1b36aa954a3fe381aca526beaa1bd1c6c1f9c85fd868f5d770f0b6b
Instruction ID: ce5661a0ffa33f8997533dc9df5704c2cc9b5542ec0ada63080ddd4414db617b
Opcode Fuzzy Hash: 6e424531d1b36aa954a3fe381aca526beaa1bd1c6c1f9c85fd868f5d770f0b6b
Instruction Fuzzy Hash: 08514872C0025ADFEF25EB98CA40BEDBBB5BF14314F104189E5A5B7290CB706E45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010D41F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E010D41F4(intOrPtr* __ecx) {
				intOrPtr* _t16;
				void* _t17;
				intOrPtr _t26;
				void* _t33;
				intOrPtr _t37;
				intOrPtr* _t48;

				_t48 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					L4:
					return 0;
				}
				if(E010D3E8C( *((intOrPtr*)( *((intOrPtr*)( *__ecx))))) != 0) {
					L2:
					_push(1);
					L15:
					_pop(_t17);
					return _t17;
				}
				_t16 =  *__ecx;
				if( *((intOrPtr*)( *_t16 + 4)) != 0) {
					goto L4;
				}
				_t37 =  *((intOrPtr*)(__ecx + 4));
				if(_t37 == 1 ||  *((intOrPtr*)( *((intOrPtr*)(_t16 + 4)) + 4)) != 0) {
					goto L2;
				}
				_t33 = 2;
				if(_t37 == _t33) {
					L18:
					return _t33;
				}
				if(wcscmp( *( *(_t16 + 8)), ".") == 0) {
					L14:
					_push(3);
					goto L15;
				}
				if(wcscmp( *( *( *_t48 + 8)), "?") == 0) {
					if( *((intOrPtr*)(_t48 + 4)) == 3) {
						goto L14;
					}
					if(E010D3E8C( *((intOrPtr*)( *((intOrPtr*)( *_t48 + 0xc))))) != 0) {
						_push(4);
						goto L15;
					}
					if(E010D20D0( *((intOrPtr*)( *((intOrPtr*)( *_t48 + 0xc)))), "UNC") == 0) {
						goto L14;
					}
					_t33 = 4;
				}
				_t26 =  *((intOrPtr*)(_t48 + 4));
				_t33 = _t33 + 1;
				if(_t26 > _t33) {
					goto L18;
				}
				return _t26;
			}

0x010d41f7
0x010d41fe
0x010d421f
0x00000000
0x010d421f
0x010d420d
0x010d420f
0x010d420f
0x010d429c
0x010d429c
0x00000000
0x010d429c
0x010d4216
0x010d421d
0x00000000
0x00000000
0x010d4226
0x010d422c
0x00000000
0x00000000
0x010d4238
0x010d423b
0x010d42aa
0x00000000
0x010d42aa
0x010d4254
0x010d429a
0x010d429a
0x00000000
0x010d429a
0x010d4269
0x010d426f
0x00000000
0x00000000
0x010d427f
0x010d4281
0x00000000
0x010d4281
0x010d4298
0x00000000
0x00000000
0x010d42a1
0x010d42a1
0x010d42a2
0x010d42a5
0x010d42a8
0x00000000
0x00000000
0x010d42af

APIs

wcscmp.MSVCRT ref: 010D424E
wcscmp.MSVCRT ref: 010D4263

Strings

UNC, xrefs: 010D4287

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wcscmp
String ID: UNC
API String ID: 3392835482-337201128
Opcode ID: f54882064999d2881947ffa6d152c1ceccdb8ae3f1c025f1e7e2b7edeeea988e
Instruction ID: efd65f6d2f357b055d9972c8551113521d81b5c20e3cee6cb7245b8dba5603db
Opcode Fuzzy Hash: f54882064999d2881947ffa6d152c1ceccdb8ae3f1c025f1e7e2b7edeeea988e
Instruction Fuzzy Hash: 98218B357407018FE665CF9DC890E35B3E1EF89620B6888AAEAC5CFB91C771E841CB00

Uniqueness

Uniqueness Score: -1.00%

Function 011018D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011018D2(intOrPtr* __ecx) {
				char _v5;
				char _v40;
				intOrPtr _t19;
				void* _t23;
				signed int _t29;
				void* _t30;
				void* _t41;
				signed int _t43;
				void* _t44;
				void* _t45;
				intOrPtr* _t46;
				void* _t47;

				_t46 = __ecx;
				_t19 = 0;
				_t42 = 0;
				_t43 =  *(__ecx + 8);
				_t29 =  *(__ecx + 0xc);
				_v5 = 0x25;
				if((_t43 & _t29) != 0xffffffff) {
					if((_t43 | _t29) != 0) {
						_t19 = E01103B80(E01103D00( *__ecx,  *((intOrPtr*)(__ecx + 4)), 0x64, 0), 0, _t43, _t29);
					}
				} else {
					_t42 =  *((intOrPtr*)(__ecx + 4));
					_t41 = 0x14;
					_t19 = E01103C70( *__ecx, _t41,  *((intOrPtr*)(__ecx + 4)));
					_v5 = 0x4d;
				}
				E010D15CA( &_v40, _t19, _t42);
				_t23 = strlen( &_v40) + 1;
				 *((char*)(_t47 + _t23 - 0x25)) = _v5;
				 *(_t47 + _t23 - 0x24) =  *(_t47 + _t23 - 0x24) & 0x00000000;
				_t44 = 4;
				if(_t23 >= _t44) {
					L7:
					return E010D24DB(_t46 + 0x38,  &_v40);
				} else {
					_t30 = _t46 + 0x38;
					_t45 = _t44 - _t23;
					do {
						E010D1B5E(_t30, 0x20);
						_t45 = _t45 - 1;
					} while (_t45 != 0);
					goto L7;
				}
			}

0x011018da
0x011018dd
0x011018df
0x011018e1
0x011018e4
0x011018e9
0x011018f2
0x0110190b
0x0110191f
0x0110191f
0x011018f4
0x011018f6
0x011018fb
0x011018fc
0x01101901
0x01101901
0x01101929
0x01101938
0x0110193e
0x01101942
0x01101947
0x0110194a
0x0110195d
0x0110196d
0x0110194c
0x0110194c
0x0110194f
0x01101951
0x01101955
0x0110195a
0x0110195a
0x00000000
0x01101951

APIs

__aulldiv.LIBCMT ref: 0110191F
strlen.MSVCRT ref: 01101932

Strings

M, xrefs: 01101901

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: __aulldivstrlen
String ID: M
API String ID: 1892184250-3664761504
Opcode ID: df11962cb6fbe8ebe1ad44703ea8e2feb80c3c52f9ce9c4929b45e0229628e53
Instruction ID: 23f1f51c8212ea9e9944301667ec13bf1b73a7ff392a8bcbe7e80d8ae5985621
Opcode Fuzzy Hash: df11962cb6fbe8ebe1ad44703ea8e2feb80c3c52f9ce9c4929b45e0229628e53
Instruction Fuzzy Hash: 44110B32A043447EDB1BDAB8CC50FEE77E9DB98714F14442DE392971C0DAB5E8058320

Uniqueness

Uniqueness Score: -1.00%

Function 010DD09F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E010DD09F(intOrPtr* __ecx, signed int __edx) {
				signed int _t29;
				void* _t30;
				intOrPtr _t37;
				void* _t42;
				intOrPtr _t45;
				intOrPtr _t58;
				intOrPtr* _t60;
				intOrPtr _t61;
				void* _t63;

				E011039E0(E01104B38, _t63);
				_t45 =  *__ecx;
				_t29 = __edx + __edx * 4;
				_push(_t60);
				_t30 = _t45 + _t29 * 4;
				if( *((char*)(_t45 + _t29 * 4)) != 0) {
					E010D29BC(_t63 - 0x18, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t30 + 8)) +  *(_t30 + 0xc) * 4 - 4)));
					_t58 = 0;
					 *((intOrPtr*)(_t63 - 4)) = 0;
					_t33 = E010DB942( *((intOrPtr*)(_t63 - 0x18)), _t63 + 0xc);
					__eflags = _t33;
					if(_t33 == 0) {
						L4:
						E010D1FB5( *((intOrPtr*)(_t63 - 0x18)));
						asm("sbb ebx, ebx");
						_t42 = ( ~( *(_t63 + 8)) & 0xfffffffe) + 5;
						__eflags = _t42;
						if(__eflags == 0) {
							L8:
							_push( *((intOrPtr*)(_t63 - 0x18)));
							_push("Unsupported charset:");
							E010E8A22(_t63 - 0x24, __eflags);
							_t33 = _t63 - 0x24;
							_push(0x110ded0);
							_push(_t63 - 0x24);
							L01103CAC();
						} else {
							_t60 = 0x11086a0;
							while(1) {
								_t33 = E010D2075( *((intOrPtr*)(_t63 - 0x18)),  *_t60);
								__eflags = _t33;
								if(_t33 != 0) {
									goto L9;
								}
								_t58 = _t58 + 1;
								_t60 = _t60 + 8;
								__eflags = _t58 - _t42;
								if(__eflags != 0) {
									continue;
								} else {
									goto L8;
								}
								goto L9;
							}
						}
						L9:
						_t24 = _t60 + 4; // 0x11086f0
						_t61 =  *_t24;
					} else {
						_t61 =  *((intOrPtr*)(_t63 + 0xc));
						__eflags = _t61 - 0x10000;
						if(_t61 >= 0x10000) {
							goto L4;
						}
					}
					E010D1ABD(_t33,  *((intOrPtr*)(_t63 - 0x18)));
					_t37 = _t61;
				} else {
					_t37 =  *((intOrPtr*)(_t63 + 0xc));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t37;
			}

0x010dd0a4
0x010dd0ac
0x010dd0ae
0x010dd0b2
0x010dd0b7
0x010dd0bb
0x010dd0d2
0x010dd0da
0x010dd0df
0x010dd0e2
0x010dd0e7
0x010dd0e9
0x010dd0f6
0x010dd0f9
0x010dd103
0x010dd108
0x010dd108
0x010dd10b
0x010dd128
0x010dd128
0x010dd12e
0x010dd133
0x010dd138
0x010dd13b
0x010dd140
0x010dd141
0x010dd10d
0x010dd10d
0x010dd112
0x010dd117
0x010dd11c
0x010dd11e
0x00000000
0x00000000
0x010dd120
0x010dd121
0x010dd124
0x010dd126
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010dd126
0x010dd112
0x010dd146
0x010dd146
0x010dd146
0x010dd0eb
0x010dd0eb
0x010dd0ee
0x010dd0f4
0x00000000
0x00000000
0x010dd0f4
0x010dd14c
0x010dd152
0x010dd0bd
0x010dd0bd
0x010dd0bd
0x010dd15a
0x010dd162

APIs

__EH_prolog.LIBCMT ref: 010DD0A4
_CxxThrowException.MSVCRT(?,0110DED0), ref: 010DD141

Strings

Unsupported charset:, xrefs: 010DD12E

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionH_prologThrow
String ID: Unsupported charset:
API String ID: 461045715-616772432
Opcode ID: c2aee95e22016892f595489105536af225b6a0c729eecb1d1d0427743b573362
Instruction ID: 1ea7aa4cc6b032dbb9766a246e7848264ac186e85e575a0b014986b27bff9d9b
Opcode Fuzzy Hash: c2aee95e22016892f595489105536af225b6a0c729eecb1d1d0427743b573362
Instruction Fuzzy Hash: 7E21083190020A9FCF15EFECC980EEDBBB1EF95314F054199E9956B291CB316D46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 010FB0EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FB0EC(intOrPtr __ecx, signed int __edx) {
				intOrPtr* _t43;
				signed int _t59;
				signed int _t63;
				signed int _t64;
				void* _t67;

				E011039E0(E01107120, _t67);
				 *((intOrPtr*)(_t67 - 0x14)) = __ecx;
				_t59 = __edx;
				 *((intOrPtr*)(_t67 - 0x18)) = 0;
				E010D232F(_t67 - 0x24);
				 *((intOrPtr*)(_t67 - 4)) = 0;
				 *(_t67 - 0x10) = 0;
				_t43 = 0x110aa6c;
				do {
					_t63 = 1;
					_t64 = _t63 <<  *(_t67 - 0x10);
					if((_t59 & _t64) != 0) {
						 *((intOrPtr*)(_t67 - 0x18)) =  *_t43;
						if( *((intOrPtr*)(_t67 - 0x20)) != 0) {
							E010D24D3();
						}
						E010D24DB(_t67 - 0x24,  *((intOrPtr*)(_t67 - 0x18)));
						_t59 = _t59 &  !_t64;
					}
					 *(_t67 - 0x10) =  *(_t67 - 0x10) + 1;
					_t43 = _t43 + 4;
				} while (_t43 < 0x110aa98);
				if(_t59 != 0) {
					 *((char*)(_t67 - 0x34)) = 0x30;
					 *((char*)(_t67 - 0x33)) = 0x78;
					E010D1644(_t59, _t67 - 0x32);
					_t78 =  *((intOrPtr*)(_t67 - 0x20));
					if( *((intOrPtr*)(_t67 - 0x20)) != 0) {
						E010D24D3();
					}
					E010D24DB(_t67 - 0x24, _t67 - 0x34);
				}
				E010D1ABD(E010D238B( *((intOrPtr*)(_t67 - 0x14)), _t78, _t67 - 0x24),  *((intOrPtr*)(_t67 - 0x24)));
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return  *((intOrPtr*)(_t67 - 0x14));
			}

0x010fb0f1
0x010fb0fb
0x010fb101
0x010fb106
0x010fb109
0x010fb10e
0x010fb111
0x010fb114
0x010fb119
0x010fb11e
0x010fb11f
0x010fb123
0x010fb12b
0x010fb12e
0x010fb133
0x010fb133
0x010fb13e
0x010fb145
0x010fb145
0x010fb147
0x010fb14a
0x010fb14d
0x010fb157
0x010fb15e
0x010fb162
0x010fb166
0x010fb16b
0x010fb16f
0x010fb174
0x010fb174
0x010fb180
0x010fb180
0x010fb194
0x010fb1a3
0x010fb1ab

APIs

__EH_prolog.LIBCMT ref: 010FB0F1

Strings

x, xrefs: 010FB162
0, xrefs: 010FB15E

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: 0$x
API String ID: 3519838083-1948001322
Opcode ID: c40673198adf766561d9c7438faca8be277118782885af929184dfe5a6644143
Instruction ID: 8b7a22228e5024acb07769d41f2d4625fa4de06f7a108f4ac14e2737aa56926d
Opcode Fuzzy Hash: c40673198adf766561d9c7438faca8be277118782885af929184dfe5a6644143
Instruction Fuzzy Hash: 5E218E32D0021ADBCF05EB98DA91AEDBBB5FF58304F14005AE54177280DF755E44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010E2D87 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010E2D87(intOrPtr __ecx, intOrPtr* __edx, void* __edi, void* __eflags) {
				intOrPtr* _t53;
				void* _t55;

				E011039E0(E01105320, _t55);
				 *(_t55 - 0x14) =  *(_t55 - 0x14) & 0x00000000;
				 *((intOrPtr*)(_t55 - 0x10)) = __ecx;
				_t53 = __edx;
				E010D232F(_t55 - 0x20);
				 *(_t55 - 4) =  *(_t55 - 4) & 0x00000000;
				_t61 =  *__edx -  *((intOrPtr*)(__edx + 4));
				if( *__edx !=  *((intOrPtr*)(__edx + 4))) {
					E010D24DB(_t55 - 0x20, 0x1109580);
					E010D254B(_t55 - 0x20, E010D85F8( *((intOrPtr*)(_t53 + 4))));
					E010D24DB(_t55 - 0x20, " : ");
					E010E2E26(_t55 - 0x20,  *_t53, 0);
					E010D24DB(_t55 - 0x20, 0x1109580);
					E010E2E26(_t55 - 0x20,  *((intOrPtr*)(_t53 + 4)), 0);
				}
				E010D1ABD(E010D238B( *((intOrPtr*)(_t55 - 0x10)), _t61, _t55 - 0x20),  *((intOrPtr*)(_t55 - 0x20)));
				 *[fs:0x0] =  *((intOrPtr*)(_t55 - 0xc));
				return  *((intOrPtr*)(_t55 - 0x10));
			}

0x010e2d8c
0x010e2d94
0x010e2d98
0x010e2d9c
0x010e2da1
0x010e2da8
0x010e2dac
0x010e2daf
0x010e2dbb
0x010e2dcc
0x010e2dd9
0x010e2de5
0x010e2dee
0x010e2dfb
0x010e2e00
0x010e2e10
0x010e2e1d
0x010e2e25

APIs

__EH_prolog.LIBCMT ref: 010E2D8C

Strings

: , xrefs: 010E2DD4
/ , xrefs: 010E2DB2, 010E2DB7, 010E2DED

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: / $ :
API String ID: 3519838083-1815150141
Opcode ID: 4349b87bb34542cd336f91d73b8e6863f5f9ec1e1f49416d63cc30a9c559c912
Instruction ID: 8bcaad07ee3c37c7dcbe2f130a78acc0205371144d1f770b61ebf6397ed382c2
Opcode Fuzzy Hash: 4349b87bb34542cd336f91d73b8e6863f5f9ec1e1f49416d63cc30a9c559c912
Instruction Fuzzy Hash: FB111C32D0022ADBCF19EB98CC90EEDB3B9BF68700F44451DE19276190DFB4AA04CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010DE2D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010DE2D7(void* __ecx, void* __eflags) {
				intOrPtr* _t24;
				void* _t25;
				void* _t29;
				void* _t30;
				long _t45;
				void* _t48;
				void* _t51;

				E011039E0(E01104EF8, _t51);
				_t48 = __ecx;
				_t45 = GetLastError();
				E010D296F(_t51 - 0x18,  *((intOrPtr*)(_t51 + 8)));
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				_t57 = _t45;
				if(_t45 != 0) {
					E010D2CAD(_t51 - 0x18, " : ");
					_t29 = E010D4B4D(_t51 - 0x24, _t45, _t57);
					 *(_t51 - 4) = 1;
					_t30 = E010D2C71(_t51 - 0x18, _t57, _t29);
					 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
					E010D1ABD(_t30,  *((intOrPtr*)(_t51 - 0x24)));
				}
				E010DE2BC(_t51 - 0x18,  *((intOrPtr*)(_t51 + 0xc)));
				_t24 =  *((intOrPtr*)(_t48 + 0x28));
				_t25 =  *((intOrPtr*)( *_t24 + 0x1c))(_t24,  *((intOrPtr*)(_t51 - 0x18)));
				E010D1ABD(_t25,  *((intOrPtr*)(_t51 - 0x18)));
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return _t25;
			}

0x010de2dc
0x010de2e6
0x010de2f4
0x010de2f6
0x010de2fb
0x010de2ff
0x010de301
0x010de30b
0x010de315
0x010de31e
0x010de322
0x010de32a
0x010de32e
0x010de333
0x010de33a
0x010de33f
0x010de348
0x010de350
0x010de35d
0x010de365

APIs

__EH_prolog.LIBCMT ref: 010DE2DC
GetLastError.KERNEL32(?), ref: 010DE2E8

Part of subcall function 010D4B4D: __EH_prolog.LIBCMT ref: 010D4B52

Part of subcall function 010D1ABD: free.MSVCRT(00000000,010EC91D,00000001,00000001,?,?,010D10EB,?,00000000), ref: 010D1AC1

Strings

: , xrefs: 010DE303

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ErrorLastfree
String ID: :
API String ID: 683690243-3653984579
Opcode ID: 31c00f4297d08766281e7639547a033d13b6a9e19a223fdb336943010437c23a
Instruction ID: 56ac48088984e84798924c644c20f163f75f1ec3232d690df2d4f23e81016e77
Opcode Fuzzy Hash: 31c00f4297d08766281e7639547a033d13b6a9e19a223fdb336943010437c23a
Instruction Fuzzy Hash: F301D232D0034ADBCF05EBE8C905EEEBBB4AF64314F104058E941A7280DFB58E45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010FD3B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FD3B2(struct _IO_FILE** __ecx, void* __edx, void* __ebp, intOrPtr _a4) {
				struct _IO_FILE** _t35;
				intOrPtr _t36;

				_t36 = _a4;
				_t35 = __ecx;
				if( *((char*)(_t36 + 0x21)) == 0) {
					if( *(_t36 + 0x3c) < 0) {
						fputs("Can not open the file as archive",  *__ecx);
						goto L5;
					} else {
						_t4 = _t36 + 0x24; // 0x1101ef0
						E010D1E52(_t4);
						E010D1CAE(__ecx);
						_t5 = _t36 + 0x3c; // 0x10cc1868
						E010FD2F3(__ecx,  *((intOrPtr*)( *((intOrPtr*)(__edx + 0x28)) +  *_t5 * 4)) + 0xc, 0);
					}
				} else {
					fputs("Can not open encrypted archive. Wrong password?",  *__ecx);
					L5:
				}
				E010D1CAE(_t35);
				E010D1CAE(_t35);
				_t9 = _t36 + 0x30; // 0x1101efc
				E010FD34F(_t35, _t9);
				return 0;
			}

0x010fd3b4
0x010fd3bb
0x010fd3c1
0x010fd3d0
0x010fd402
0x00000000
0x010fd3d2
0x010fd3d2
0x010fd3d8
0x010fd3df
0x010fd3e4
0x010fd3f4
0x010fd3f4
0x010fd3c3
0x010fd402
0x010fd402
0x010fd409
0x010fd40c
0x010fd413
0x010fd418
0x010fd41d
0x010fd427

APIs

fputs.MSVCRT ref: 010FD402

Strings

Can not open encrypted archive. Wrong password?, xrefs: 010FD3C5
Can not open the file as archive, xrefs: 010FD3FD

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
API String ID: 1795875747-2399861261
Opcode ID: 7f588c14e03a6a92403b37c4289302155a1dd76421d121289890f46a8a2a7d57
Instruction ID: 33d85cd44bdcc859a0599bf0fb1cfbc4663f086e9f3cf362aa806163444f7a09
Opcode Fuzzy Hash: 7f588c14e03a6a92403b37c4289302155a1dd76421d121289890f46a8a2a7d57
Instruction Fuzzy Hash: 47018135B043059BD61AABA4C895AAEB7E7EFD8210F18941ED78247A80DFB0A8418B51

Uniqueness

Uniqueness Score: -1.00%

Function 010FD00A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FD00A(struct _IO_FILE** __ecx, signed int __edx) {
				char _v20;
				char* _t7;
				struct _IO_FILE** _t14;

				_t14 = __ecx;
				if(__edx >= 0x60) {
					E010D157E(__edx,  &_v20);
					_t7 =  &_v20;
				} else {
					_t7 =  *(0x110afe8 + __edx * 4);
				}
				fputs(_t7,  *_t14);
				return fputs(" = ",  *_t14);
			}

0x010fd017
0x010fd019
0x010fd029
0x010fd02e
0x010fd01b
0x010fd01b
0x010fd01b
0x010fd03a
0x010fd04b

APIs

fputs.MSVCRT ref: 010FD03A
fputs.MSVCRT ref: 010FD043

Strings

= , xrefs: 010FD03E

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: =
API String ID: 1795875747-2525689732
Opcode ID: febd3bf37b1fa38a9596751071e55ccee3274aa7cf65f7baced73c98ab589576
Instruction ID: 9d795d7a72e79156193d5550dfa6516ecb7e56b3f50894a5d2b5dcb5ac3dbb3e
Opcode Fuzzy Hash: febd3bf37b1fa38a9596751071e55ccee3274aa7cf65f7baced73c98ab589576
Instruction Fuzzy Hash: 76E0D871E002159BCF05E6D89C458BF3B79FF846907440839F65197244EB70D861CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 010DCA7B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E010DCA7B() {
				signed int _v8;
				void* __ecx;
				void* _t6;
				WCHAR** _t11;

				_push(_t11);
				_t16 = _t11;
				_v8 = _v8 & 0x00000000;
				_t6 = OpenEventW(2, 0,  *_t11);
				_v8 = _t6;
				if(_t6 != 0 || GetLastError() == 0) {
					E011037B0( &_v8);
				}
				return E010D1ABD(E01103730( &_v8),  *_t16);
			}

0x010dca7e
0x010dca80
0x010dca82
0x010dca8c
0x010dca94
0x010dca97
0x010dcaa6
0x010dcaa6
0x010dcabd

APIs

OpenEventW.KERNEL32(00000002,00000000,00000002,Unsupported Map data size,00000002,?,010DCA37,?,?,00000000,?), ref: 010DCA8C
GetLastError.KERNEL32(?,010DCA37,?,?,00000000,?), ref: 010DCA99

Strings

Unsupported Map data size, xrefs: 010DCA7F

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorEventLastOpen
String ID: Unsupported Map data size
API String ID: 330508107-1172413320
Opcode ID: 035e62a9177d1cd359c89cd4e9781e55b62432b6a945f389c6ead931f671f1d7
Instruction ID: 55f46070540307feeddd835edc9817a1078ab656374e9abc454074d2ee701cef
Opcode Fuzzy Hash: 035e62a9177d1cd359c89cd4e9781e55b62432b6a945f389c6ead931f671f1d7
Instruction Fuzzy Hash: 40E09270A14305EFEB29EF98DE06B9D77FCEF14248F2000ADE541E20C4EBB06A00DA55

Uniqueness

Uniqueness Score: -1.00%

Function 01101609 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01101609(char* __ecx) {
				void* _t1;
				char* _t5;
				struct _IO_FILE** _t11;

				_t5 = __ecx;
				_t1 = E011015F9();
				_t11 =  *0x1114700; // 0x1114438
				if(_t11 != 0) {
					fputs("\n\n",  *_t11);
					fputs(_t5,  *_t11);
					return E010D1CAE(_t11);
				}
				return _t1;
			}

0x0110160b
0x0110160d
0x01101612
0x0110161a
0x0110162a
0x0110162f
0x00000000
0x0110163b
0x0110163e

APIs

fputs.MSVCRT ref: 0110162A
fputs.MSVCRT ref: 0110162F

Part of subcall function 010D1CAE: fputc.MSVCRT ref: 010D1CB5

Strings

@F}w, xrefs: 01101623, 0110162C

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: @F}w
API String ID: 1185151155-2595722615
Opcode ID: 9155bcc983fc4125a33abf14ea5b81df22e0fe8ef90ffe51024f2ed61d72ac05
Instruction ID: ab711930312ac49b7a41d560fdd9ebfe301d424a841399dba001d859c0f6b491
Opcode Fuzzy Hash: 9155bcc983fc4125a33abf14ea5b81df22e0fe8ef90ffe51024f2ed61d72ac05
Instruction Fuzzy Hash: D5D0C272F0155467C62B3A996C0095AA718EFD5A1030A041EFA8067141C7A688404BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0110131F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110131F() {
				struct _IO_FILE** _t2;
				void* _t4;
				void* _t11;

				_t2 =  *0x11146fc; // 0x1114440
				fputs("Unsupported Windows version",  *_t2);
				_t4 = 2;
				 *[fs:0x0] =  *((intOrPtr*)(_t11 - 0xc));
				return _t4;
			}

0x0110131f
0x0110132b
0x01101335
0x011015b9
0x011015c2

APIs

fputs.MSVCRT ref: 0110132B

Strings

F}w, xrefs: 01101324
Unsupported Windows version, xrefs: 01101326

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: F}w$Unsupported Windows version
API String ID: 1795875747-110344309
Opcode ID: 91848c8a820a0b881634932b3309faa61310628792b331ae2030161a241d53bd
Instruction ID: 6c0d7fe725a7adefe4460af398745f79f4f16ff6f8cbc55d96f6c80e486113b2
Opcode Fuzzy Hash: 91848c8a820a0b881634932b3309faa61310628792b331ae2030161a241d53bd
Instruction Fuzzy Hash: FAD05233A08640EFDB2E8B88F046B8477A0F788A20F10496AE0038A180D7B2A0008B40

Uniqueness

Uniqueness Score: -1.00%

Function 010F2A4C Relevance: 5.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E010F2A4C(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t11;
				signed int _t12;
				signed int _t15;
				signed int _t18;
				intOrPtr _t19;
				signed int* _t20;

				_t20 = _a12;
				_t19 = _a8;
				 *_t20 =  *_t20 & 0x00000000;
				_push(0x10);
				_push(0x110cdf8);
				_push(_t19);
				L01103D72();
				if(_t11 == 0) {
					L2:
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 4;
					L7:
					asm("sbb ecx, ecx");
					 *_t20 =  ~_t15 & _t18;
					 *((intOrPtr*)(_t12 + 0x10)) =  *((intOrPtr*)(_t12 + 0x10)) + 1;
					return 0;
				}
				_push(0x10);
				_push(0x110c4c8);
				_push(_t19);
				L01103D72();
				if(_t11 != 0) {
					_push(0x10);
					_push(0x110c4a8);
					_push(_t19);
					L01103D72();
					if(_t11 != 0) {
						_push(0x10);
						_push(0x110c408);
						_push(_t19);
						L01103D72();
						if(_t11 != 0) {
							return 0x80004002;
						}
						_t12 = _a4;
						_t15 = _t12;
						_t18 = _t12 + 0xc;
						goto L7;
					}
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 8;
					goto L7;
				}
				goto L2;
			}

0x010f2a50
0x010f2a54
0x010f2a57
0x010f2a5a
0x010f2a5c
0x010f2a61
0x010f2a62
0x010f2a6c
0x010f2a82
0x010f2a82
0x010f2a85
0x010f2a87
0x010f2ac6
0x010f2ac8
0x010f2acc
0x010f2ace
0x00000000
0x010f2ad1
0x010f2a6e
0x010f2a70
0x010f2a75
0x010f2a76
0x010f2a80
0x010f2a8c
0x010f2a8e
0x010f2a93
0x010f2a94
0x010f2a9e
0x010f2aaa
0x010f2aac
0x010f2ab1
0x010f2ab2
0x010f2abc
0x00000000
0x010f2ad5
0x010f2abe
0x010f2ac1
0x010f2ac3
0x00000000
0x010f2ac3
0x010f2aa0
0x010f2aa3
0x010f2aa5
0x00000000
0x010f2aa5
0x00000000

APIs

memcmp.MSVCRT ref: 010F2A62
memcmp.MSVCRT ref: 010F2A76
memcmp.MSVCRT ref: 010F2A94
memcmp.MSVCRT ref: 010F2AB2

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a5f9a4d34482ff53ac906bac670b123a8070012ad3dc9554900a59d63cff7487
Instruction ID: aeab65b0b7216cda6f7182ae960c5511047202aa13d02968125b4159b4860736
Opcode Fuzzy Hash: a5f9a4d34482ff53ac906bac670b123a8070012ad3dc9554900a59d63cff7487
Instruction Fuzzy Hash: D511C231B802056BC72B9E158C02FBD33E4ABA5710F04856CEE85DA2C2F7A4E5448790

Uniqueness

Uniqueness Score: -1.00%

Function 010DDADE Relevance: 5.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E010DDADE(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t11;
				signed int _t12;
				signed int _t15;
				signed int _t18;
				intOrPtr _t19;
				signed int* _t20;

				_t20 = _a12;
				_t19 = _a8;
				 *_t20 =  *_t20 & 0x00000000;
				_push(0x10);
				_push(0x110cdf8);
				_push(_t19);
				L01103D72();
				if(_t11 == 0) {
					L2:
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 4;
					L7:
					asm("sbb ecx, ecx");
					 *_t20 =  ~_t15 & _t18;
					 *((intOrPtr*)(_t12 + 0x10)) =  *((intOrPtr*)(_t12 + 0x10)) + 1;
					return 0;
				}
				_push(0x10);
				_push(0x110c4d8);
				_push(_t19);
				L01103D72();
				if(_t11 != 0) {
					_push(0x10);
					_push(0x110c408);
					_push(_t19);
					L01103D72();
					if(_t11 != 0) {
						_push(0x10);
						_push(0x110c3e8);
						_push(_t19);
						L01103D72();
						if(_t11 != 0) {
							return 0x80004002;
						}
						_t12 = _a4;
						_t15 = _t12;
						_t18 = _t12 + 0xc;
						goto L7;
					}
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 8;
					goto L7;
				}
				goto L2;
			}

0x010ddae2
0x010ddae6
0x010ddae9
0x010ddaec
0x010ddaee
0x010ddaf3
0x010ddaf4
0x010ddafe
0x010ddb14
0x010ddb14
0x010ddb17
0x010ddb19
0x010ddb58
0x010ddb5a
0x010ddb5e
0x010ddb60
0x00000000
0x010ddb63
0x010ddb00
0x010ddb02
0x010ddb07
0x010ddb08
0x010ddb12
0x010ddb1e
0x010ddb20
0x010ddb25
0x010ddb26
0x010ddb30
0x010ddb3c
0x010ddb3e
0x010ddb43
0x010ddb44
0x010ddb4e
0x00000000
0x010ddb67
0x010ddb50
0x010ddb53
0x010ddb55
0x00000000
0x010ddb55
0x010ddb32
0x010ddb35
0x010ddb37
0x00000000
0x010ddb37
0x00000000

APIs

memcmp.MSVCRT ref: 010DDAF4
memcmp.MSVCRT ref: 010DDB08
memcmp.MSVCRT ref: 010DDB26
memcmp.MSVCRT ref: 010DDB44

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: dd8174043d86f55af1eb932c4d3d8dd0a50d3cf97799a49d5681cf082f8f6663
Instruction ID: 0fd11836b4c4842db1729b7c517fa149dfc3db9269daeca231818e8693933ba3
Opcode Fuzzy Hash: dd8174043d86f55af1eb932c4d3d8dd0a50d3cf97799a49d5681cf082f8f6663
Instruction Fuzzy Hash: 9911E131B80341ABC71B5E558C02FBD33E8AB65729F048668ED85DB2C2F7E0E5008794

Uniqueness

Uniqueness Score: -1.00%

Function 01100201 Relevance: 5.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E01100201(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t10;
				signed int _t11;
				signed int _t14;
				signed int _t17;
				intOrPtr _t18;
				signed int* _t19;

				_t19 = _a12;
				_t18 = _a8;
				 *_t19 =  *_t19 & 0x00000000;
				_push(0x10);
				_push(0x110cdf8);
				_push(_t18);
				L01103D72();
				if(_t10 != 0) {
					_push(0x10);
					_push(0x110c2e8);
					_push(_t18);
					L01103D72();
					if(_t10 == 0) {
						goto L1;
					}
					_push(0x10);
					_push(0x110c2d8);
					_push(_t18);
					L01103D72();
					if(_t10 != 0) {
						_push(0x10);
						_push(0x110c408);
						_push(_t18);
						L01103D72();
						if(_t10 != 0) {
							return 0x80004002;
						}
						_t11 = _a4;
						_t14 = _t11;
						_t17 = _t11 + 8;
						L7:
						asm("sbb ecx, ecx");
						 *_t19 =  ~_t14 & _t17;
						L8:
						 *((intOrPtr*)(_t11 + 0xf0)) =  *((intOrPtr*)(_t11 + 0xf0)) + 1;
						return 0;
					}
					_t11 = _a4;
					_t14 = _t11;
					_t17 = _t11 + 4;
					goto L7;
				}
				L1:
				_t11 = _a4;
				 *_t19 = _t11;
				goto L8;
			}

0x01100205
0x01100209
0x0110020c
0x0110020f
0x01100211
0x01100216
0x01100217
0x01100221
0x0110022a
0x0110022c
0x01100231
0x01100232
0x0110023c
0x00000000
0x00000000
0x0110023e
0x01100240
0x01100245
0x01100246
0x01100250
0x0110025c
0x0110025e
0x01100263
0x01100264
0x0110026e
0x00000000
0x0110028a
0x01100270
0x01100273
0x01100275
0x01100278
0x0110027a
0x0110027e
0x01100280
0x01100280
0x00000000
0x01100286
0x01100252
0x01100255
0x01100257
0x00000000
0x01100257
0x01100223
0x01100223
0x01100226
0x00000000

APIs

memcmp.MSVCRT ref: 01100217
memcmp.MSVCRT ref: 01100232
memcmp.MSVCRT ref: 01100246

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 2a592959b1de073c864fed8a67973a59f3124993c94781948fd0618c81316ca1
Instruction ID: cc4ca1d29eb7635b6c1173739f38826d1e93d742aaafe3eec93213cd73423a6d
Opcode Fuzzy Hash: 2a592959b1de073c864fed8a67973a59f3124993c94781948fd0618c81316ca1
Instruction Fuzzy Hash: D201E131B802027BD72F5E158C02FB933A4AB69781F044628FD49EA2C1F7E4E5008BD5

Uniqueness

Uniqueness Score: -1.00%

Function 010F1CBD Relevance: 5.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E010F1CBD(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t10;
				signed int _t11;
				signed int _t14;
				signed int _t17;
				intOrPtr _t18;
				signed int* _t19;

				_t19 = _a12;
				_t18 = _a8;
				 *_t19 =  *_t19 & 0x00000000;
				_push(0x10);
				_push(0x110cdf8);
				_push(_t18);
				L01103D72();
				if(_t10 != 0) {
					_push(0x10);
					_push(0x110c4f8);
					_push(_t18);
					L01103D72();
					if(_t10 == 0) {
						goto L1;
					}
					_push(0x10);
					_push(0x110c4c8);
					_push(_t18);
					L01103D72();
					if(_t10 != 0) {
						_push(0x10);
						_push(0x110c408);
						_push(_t18);
						L01103D72();
						if(_t10 != 0) {
							return 0x80004002;
						}
						_t11 = _a4;
						_t14 = _t11;
						_t17 = _t11 + 8;
						L7:
						asm("sbb ecx, ecx");
						 *_t19 =  ~_t14 & _t17;
						L8:
						 *((intOrPtr*)(_t11 + 0xc)) =  *((intOrPtr*)(_t11 + 0xc)) + 1;
						return 0;
					}
					_t11 = _a4;
					_t14 = _t11;
					_t17 = _t11 + 4;
					goto L7;
				}
				L1:
				_t11 = _a4;
				 *_t19 = _t11;
				goto L8;
			}

0x010f1cc1
0x010f1cc5
0x010f1cc8
0x010f1ccb
0x010f1ccd
0x010f1cd2
0x010f1cd3
0x010f1cdd
0x010f1ce6
0x010f1ce8
0x010f1ced
0x010f1cee
0x010f1cf8
0x00000000
0x00000000
0x010f1cfa
0x010f1cfc
0x010f1d01
0x010f1d02
0x010f1d0c
0x010f1d18
0x010f1d1a
0x010f1d1f
0x010f1d20
0x010f1d2a
0x00000000
0x010f1d43
0x010f1d2c
0x010f1d2f
0x010f1d31
0x010f1d34
0x010f1d36
0x010f1d3a
0x010f1d3c
0x010f1d3c
0x00000000
0x010f1d3f
0x010f1d0e
0x010f1d11
0x010f1d13
0x00000000
0x010f1d13
0x010f1cdf
0x010f1cdf
0x010f1ce2
0x00000000

APIs

memcmp.MSVCRT ref: 010F1CD3
memcmp.MSVCRT ref: 010F1CEE
memcmp.MSVCRT ref: 010F1D02

Memory Dump Source

Source File: 00000008.00000002.479266797.00000000010D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000008.00000002.479259028.00000000010D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479301891.0000000001108000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479315398.0000000001114000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.479327529.0000000001118000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: bacf5cf6e9172a6b928eef80f4d6284ac28c0c3c1b541bca565f19d602f04c5d
Instruction ID: fa6b571a73d9ebf6e9a2838246f8de32a5245964fcbfacc3497e7a9ed4205f16
Opcode Fuzzy Hash: bacf5cf6e9172a6b928eef80f4d6284ac28c0c3c1b541bca565f19d602f04c5d
Instruction Fuzzy Hash: 0F01A131B50206BBD71BAE198C02FBD73E4AB65750F04896CEE85EA2C2F7F4E5508791

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dcinst.exePID: 5216, Parent PID: 7108COMMON

Executed Functions

Function 00007FF7BB95178C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF7BB951797

Memory Dump Source

Source File: 0000000B.00000002.480722668.00007FF7BB951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7BB950000, based on PE: true

Associated: 0000000B.00000002.480716078.00007FF7BB950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480729448.00007FF7BB952000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480736639.00007FF7BB953000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 43e33c125a3c8228278e703230b8202cb01cfa5b73ebf8838dc6b54c4d14e989
Instruction ID: e97edb50b9d84ffe0f7236e99196f63599f654601267e0465dced10f454153f7
Opcode Fuzzy Hash: 43e33c125a3c8228278e703230b8202cb01cfa5b73ebf8838dc6b54c4d14e989
Instruction Fuzzy Hash: 86B09210E96903C1D708BB6D9CD506562A0BB6A300FC00430C60D80134EE5C919B8720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7BB951000 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 125COMMON

Download Yara Rule

APIs

dc_is_old_runned.DCAPI ref: 00007FF7BB951036
dc_open_device.DCAPI ref: 00007FF7BB95104C
_wcsicmp.MSVCRT ref: 00007FF7BB95105C
dc_is_driver_installed.DCAPI ref: 00007FF7BB951066
dc_update_boot.DCAPI ref: 00007FF7BB951073

Strings

-unins, xrefs: 00007FF7BB95109C
-setup, xrefs: 00007FF7BB951052
-isenc, xrefs: 00007FF7BB95111D
-isboot, xrefs: 00007FF7BB9510EF
-unldr, xrefs: 00007FF7BB9510CC

Memory Dump Source

Source File: 0000000B.00000002.480722668.00007FF7BB951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7BB950000, based on PE: true

Associated: 0000000B.00000002.480716078.00007FF7BB950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480729448.00007FF7BB952000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480736639.00007FF7BB953000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: _wcsicmpdc_is_driver_installeddc_is_old_runneddc_open_devicedc_update_boot
String ID: -isboot$-isenc$-setup$-unins$-unldr
API String ID: 1863842065-2825037726
Opcode ID: 08165641a467146d9f58a98be15a2dbb4946945580ad9d72de36a5c40ad714af
Instruction ID: a1b7545ae08418405085cd78492e25726b18d5a3e9fe15f7588546a19aef46bc
Opcode Fuzzy Hash: 08165641a467146d9f58a98be15a2dbb4946945580ad9d72de36a5c40ad714af
Instruction Fuzzy Hash: 8A513E11A89B93C1E6606B3D98D427AB395BF67B84FC48135CF0E426B8DF2CE444C631

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7BB9512FC Relevance: 9.1, APIs: 6, Instructions: 133sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF7BB95131E
Sleep.KERNEL32 ref: 00007FF7BB951354
_amsg_exit.MSVCRT ref: 00007FF7BB95136A
_initterm.MSVCRT ref: 00007FF7BB9513F1
exit.KERNELBASE ref: 00007FF7BB9514B6
_cexit.MSVCRT ref: 00007FF7BB9514C4

Memory Dump Source

Source File: 0000000B.00000002.480722668.00007FF7BB951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7BB950000, based on PE: true

Associated: 0000000B.00000002.480716078.00007FF7BB950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480729448.00007FF7BB952000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480736639.00007FF7BB953000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: InfoSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 2456207614-0
Opcode ID: 05207090eec1ca913629afba813957c211e5b73bbb799b49574875545f8807e8
Instruction ID: b53d9b4e4a09dfb45b0c70a594eae3a6378305c4adefd3ea5edde6bdf8ccb021
Opcode Fuzzy Hash: 05207090eec1ca913629afba813957c211e5b73bbb799b49574875545f8807e8
Instruction Fuzzy Hash: 85510831A8D753C6EB20BF1DA4E0279A3A1BB66744F944435DB4E426B8DF7CE4848720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7BB9512B0 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__wgetmainargs.KERNELBASE ref: 00007FF7BB9512E8

Memory Dump Source

Source File: 0000000B.00000002.480722668.00007FF7BB951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7BB950000, based on PE: true

Associated: 0000000B.00000002.480716078.00007FF7BB950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480729448.00007FF7BB952000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480736639.00007FF7BB953000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: a85eaaa03e987c289de7677a108681475fc302380e0be413145242a90740eb0c
Instruction ID: 5e424e14ce1e85867154fb00cf309afb1db0c8d3d1333fb7f29c6d50f253f706
Opcode Fuzzy Hash: a85eaaa03e987c289de7677a108681475fc302380e0be413145242a90740eb0c
Instruction Fuzzy Hash: D0E05274E8DB47D7EA11AB1CA8844A0B7A0BB26754BC04176DE4E57238EE3CA159CB20

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7BB951290 Relevance: 10.6, APIs: 7, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF77FF7BB951290(void* __eax, signed int __ecx, void* __rcx) {
				void* _t4;

				_t4 = __rcx -  *0xbb953000; // 0x9af0b07ac493
				if (_t4 != 0) goto 0xbb9512ab;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xbb9512a7;
				return __eax;
			}

0x7ff7bb951290
0x7ff7bb951297
0x7ff7bb951299
0x7ff7bb9512a2
0x7ff7bb9512a4

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7BB951633
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7BB951652
RtlVirtualUnwind.KERNEL32 ref: 00007FF7BB95169E
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7BB951712
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7BB95171F
GetCurrentProcess.KERNEL32 ref: 00007FF7BB951725
TerminateProcess.KERNEL32 ref: 00007FF7BB951733

Memory Dump Source

Source File: 0000000B.00000002.480722668.00007FF7BB951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7BB950000, based on PE: true

Associated: 0000000B.00000002.480716078.00007FF7BB950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480729448.00007FF7BB952000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480736639.00007FF7BB953000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: 12ea769f34f527f12297de04386c162131157b894df67d2b653d6fa4f13d2ac8
Instruction ID: f3f06d26ca34ebf8cdc83bcf4e2d7dfd5827a5190d658dcc94feab3195e7021e
Opcode Fuzzy Hash: 12ea769f34f527f12297de04386c162131157b894df67d2b653d6fa4f13d2ac8
Instruction Fuzzy Hash: F531B13594DB46C1EA10AB1DF89036AB3A0FBA6794F904036DA8E43B78DF7CE054C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD19AF8260 Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00007FFD7FFD19AF8260(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx) {
				signed int _v28;
				char _v40;
				intOrPtr* _t14;

				_t14 =  &_v40;
				asm("cpuid");
				 *_t14 = 1;
				 *((intOrPtr*)(_t14 + 4)) = __ebx;
				 *((intOrPtr*)(_t14 + 8)) = __ecx;
				 *((intOrPtr*)(_t14 + 0xc)) = __edx;
				return (_v28 & 0x04000000) >> 0x1a;
			}

0x7ffd19af826b
0x7ffd19af8270
0x7ffd19af8272
0x7ffd19af8274
0x7ffd19af8277
0x7ffd19af827a
0x7ffd19af828f

Memory Dump Source

Source File: 0000000B.00000002.480767421.00007FFD19AF1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFD19AF0000, based on PE: true

Associated: 0000000B.00000002.480757917.00007FFD19AF0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480795762.00007FFD19B10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480810275.00007FFD19B19000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480820428.00007FFD19B1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480828119.00007FFD19B1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f9ac9c730b3139acf02d60763c7b3ff6e1294a7e8ae7245ea572cc760c8104
Instruction ID: b7f92014f20b6e4cc698a25b9afd95afd2a8df9c6c330bb748dfc7fde3ff73c2
Opcode Fuzzy Hash: b0f9ac9c730b3139acf02d60763c7b3ff6e1294a7e8ae7245ea572cc760c8104
Instruction Fuzzy Hash: 1BD0E2B39185548BD3299F19F84168ABBA0E358314F84C225EBD892B10D23CEA82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7BB95191C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7BB951953
GetCurrentProcessId.KERNEL32 ref: 00007FF7BB95195E
GetCurrentThreadId.KERNEL32 ref: 00007FF7BB95196A
GetTickCount.KERNEL32 ref: 00007FF7BB951976
QueryPerformanceCounter.KERNEL32 ref: 00007FF7BB951987

Memory Dump Source

Source File: 0000000B.00000002.480722668.00007FF7BB951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7BB950000, based on PE: true

Associated: 0000000B.00000002.480716078.00007FF7BB950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480729448.00007FF7BB952000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480736639.00007FF7BB953000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.480742163.00007FF7BB954000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 1dce962ad3c2a63dfd42b8a2254170d9176563c7fee761932e8a0dc58e47b0a9
Instruction ID: e985ba6df4e18fc6679ecb41b65a38be9f3a7944279414aa576ac787b6272dca
Opcode Fuzzy Hash: 1dce962ad3c2a63dfd42b8a2254170d9176563c7fee761932e8a0dc58e47b0a9
Instruction Fuzzy Hash: E7012A21699B02C1E6409F3DF890266B360BB5BB90F846630DF5E476A8DE3CD8898320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD19AFF488 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD19AFF4BF
GetCurrentProcessId.KERNEL32 ref: 00007FFD19AFF4CA
GetCurrentThreadId.KERNEL32 ref: 00007FFD19AFF4D6
GetTickCount.KERNEL32 ref: 00007FFD19AFF4E2
QueryPerformanceCounter.KERNEL32 ref: 00007FFD19AFF4F3

Memory Dump Source

Source File: 0000000B.00000002.480767421.00007FFD19AF1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFD19AF0000, based on PE: true

Associated: 0000000B.00000002.480757917.00007FFD19AF0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480795762.00007FFD19B10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480810275.00007FFD19B19000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480820428.00007FFD19B1B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.480828119.00007FFD19B1C000.00000002.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: dfa2e914579514696e3e31d6105436410edf8a279778afcced3e3b06aeb5d09f
Instruction ID: 41ff201260e3696ad351ca56d7e14a33da235dbb10556c43db7c0f51606cc953
Opcode Fuzzy Hash: dfa2e914579514696e3e31d6105436410edf8a279778afcced3e3b06aeb5d09f
Instruction Fuzzy Hash: 3D017061729F0982FB608F31F5A42656360FB09FACF446130EE5E07764DE3CD9988301

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 09490699.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Disgusting\13.exe

C:\Disgusting\50

C:\Disgusting\7z.dll

C:\Disgusting\dcapi.dll

C:\Disgusting\dccon.exe

C:\Disgusting\dcinst.exe

C:\Disgusting\dcrypt.sys

C:\Windows\System32\drivers\dcrypt.sys

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

Windows Analysis Report
09490699.exe

Function 00401770 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 226
serviceCOMMON

Function 00401000 Relevance: 13.6, APIs: 9, Instructions: 63
COMMON

Function 00437960 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 367
COMMON

Function 00436440 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 87
COMMON

Function 0042CA80 Relevance: .1, Instructions: 118
COMMONCrypto